As we first reported in December 2011, it's a common scenario: A Florida nursing home resident dies, and his or her spouse, surrogate, proxy, or attorney requests the resident's medical records. However, if the nursing home releases the records, it might be violating federal law. If it doesn't, it violates Florida law. A federal trial court then noted this "Catch-22" and declared the Florida law invalid. The decision was appealed and now the U.S. Court of Appeals has affirmed the decision in a decision rendered April 9, 2013. The impact of this decision on nursing homes and other providers is outlined below.
Conflicting Laws
Florida Statutes Section 400.145 provides that nursing homes "shall furnish to the spouse, guardian, surrogate, proxy, or attorney in fact . . . of a former resident . . . a copy of that resident's records which are in the possession of the facility." Also, "Copies of such records . . . may be made available prior to the administration of an estate, upon request, to the spouse, guardian, surrogate, proxy, or attorney in fact."
However, the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA") provides that nursing homes may only release medical records to a patient or his/her personal representative. 45 C.F.R. 164.502(a)(1), (g)(1). When a patient is deceased, "personal representative" means an "executor, administrator, or other person [who] has authority to act on behalf of a deceased individual or of the individual's estate." 45 C.F.R. 164.502(g)(4).
Thus, a person authorized under Section 400.145 can be–but is not always–the same as the personal representative under HIPAA. As a result, Florida law requires nursing homes to release medical records even though doing so might violate federal law.
The Federal Court's Decision
Opis Management Resources, Inc., together with four other nursing home providers were cited by the Florida Agency for Health Care Administration ("AHCA") for failing to provide records to spouses or "attorneys in fact" of deceased residents because they were not authorized to receive the records pursuant to HIPAA. Their position was also upheld by the U.S. Department of Health and Human Services Office for Civil Rights when the requestors complained about the nursing homes' actions. They then sought declaratory relief from federal court based on the conflict between state and federal law.
On December 2, 2011, the United States District Court for the Northern District of Florida concluded that Section 400.145 is contrary to HIPAA and, therefore, invalid. Opis Management Resources, LLC v. Dudek, No. 11-400 (N.D. Fla. Dec. 2, 2011). The Court described the following scenarios:
A decedent's spouse, for example, could seek [protected health information] for any number of reasons . . . . A spouse could be trying to establish paternity, or her rights to life insurance. These goals do not conform to HIPAA' s purpose to protect privacy and act in the interest of the patient.
Id (internal citations omitted). States are generally free to pass their own privacy laws, but "provisions of state law which are contrary to HIPAA are preempted unless that state law is 'more stringent.'" Opis Management, No. 11-400 slip op. at 3 (citing 45 C.F.R. § 160.203). Because the Court found section 400.145 provides less protection than HIPAA, not more, it concluded that the state law is preempted.
The Appellate Court's Decision
AHCA appealed the trial decision and argued against preemption on the basis that HIPAA provides that any person who has authority to act on behalf of a deceased individual under state law can be treated as a personal representative. According to AHCA, the state statute identifies groups of people who may have access to a deceased resident's medical records "on behalf of" the resident, meaning they should be treated as personal representatives. Since personal representatives under HIPAA enjoy the same access to confidential information as the deceased individual, AHCA argued the two laws complement each other rather than conflict.
The court rejected this argument and noted that the Florida law authorizes sweeping disclosures, "making a deceased resident's protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident's stead." Under HIPAA, a personal representative may only access the decedent's confidential information that is relevant to the personal representation. The court agreed with the trial court's view that Florida's less stringent protection of confidential information frustrated HIPAA' s purpose and was, therefore, invalid. Interestingly, because AHCA did not raise the issue in the lower court of whether the state law was allowed by HIPAA Rule 164.512(a)(1) which allows for the release of PHI "as required by law," the appellate court did not address whether this would have saved the constitutionality of the state law.
What This Means for Nursing Homes
Because of the Court's ruling, section 400.145 is invalid and AHCA cannot currently sanction nursing homes for failing to abide by it. Therefore, nursing homes in Florida should only release a deceased resident's medical records to a personal representative of the estate, executor, administrator, or other person authorized to act on behalf of the deceased patient or the deceased patient's estate. If no such person exists, the nursing home should wait for a court to appoint an appropriate person.
Broader Implications to All Florida Healthcare Providers
Family requests for medical records of deceased patients often occur outside of the nursing home context. The healthcare provider is in a difficult position – while providers would often want to help out the grieving family and provide the requested records, HIPAA is clear that this should not be done until a personal representative has been appointed by the probate court. Providers now have a Florida case supporting their refusal to provide the records before a personal representative is appointed.
While the District Court's decision is limited to §400.145, similar laws may also be preempted. One example is Florida Statutes §766.104, which states, "subsequent to the death of a person and prior to the administration of such person's estate, copies of all medical reports and records . . . that are in the possession of a healthcare practitioner" shall be made available to the deceased person's spouse, parent, adult child, guardian, surrogate, proxy, or attorney. Given the parallel between §400.145 and §766.104, it's probable that HIPAA preempts §766.104 too.
Florida Statutes §395.3025 allowing parents of a minor or next of kin of a deceased person access to hospital patient records is probably preempted. Only future litigation will determine the true scope of HIPAA preemption.
