HIPAA "Routine Use" Exception Held Constitutional

Professor Scott is Research Professor at the Health Law and Policy Institute, University of Houston Law Center, Tex.

Citizens for Health v. Leavitt

In a case closely followed by healthcare lawyers, the US Supreme Court on October 2, 2006, in , declined to review a Third Circuit Court of Appeals decision from last year, upholding the Health Insurance Portability and Accountability Act's (HIPAA) "routine use" exception.

HIPAA provides that "covered entities" (health plans, healthcare clearinghouses, and healthcare providers) who transmit any health information in electronic form may not disclose individually identifiable "protected health information," except as permitted or required by the HIPAA Privacy Rule. As originally drafted, the Privacy Rule would have required a patient's written consent for most disclosures.

However, in its final form, HIPAA contains a "routine use" exception that allows disclosure of protected health information for "treatment, payment, and healthcare operations." Therefore, most legitimate disclosures of health information do not require a patient's consent.

In the Third Circuit case, Citizens for Health claimed that the routine use exception violated their constitutional rights. They argued that by promulgating the Privacy Rule, the Secretary of the Department of Health and Human Services (1) unlawfully infringed citizens' fundamental rights to privacy in personal health information under due process principles of the Constitution; (2) unlawfully infringed citizens' rights to communicate privately with their medical practitioners under the First Amendment of the Constitution; and (3) contravened Congress's intent in enacting HIPAA, by eliminating citizens' reasonable expectations of medical privacy.

Plaintiffs had one huge problem with their argument. As I constantly remind beginning law students, the Constitution is designed the protect citizens from an overzealous government?not from each other. Except for the Thirteenth Amendment (prohibiting slavery), only a state or federal official, not a private citizen, can violate another person's constitutional rights.

The law recognizes limited exceptions to this principle, when private citizens act in concert with government officials. For example, a private citizen acting on his/her own initiative could break into a house and seize stolen goods or other evidence of a crime without violating the homeowners' constitutional rights, while police would usually be required to obtain a search warrant to seize the goods. However, if police encouraged a private citizen to break into the house, the law would treat the private citizen's action as "state action" and find the seizure of the goods unconstitutional.

Under the state action principle, a violation of a citizen's right to medical privacy can only be unconstitutional when the violation can properly be ascribed to the government. An act may be ascribed to the government when the government has commanded a private citizen to act inappropriately. A law requiring violation of individual rights, and enforcement of such a law, could establish the requisite state action.

HIPAA's "routine use" exception does not, however, order the release of protected health information by private parties. In fact, HIPAA expressly provides that physicians and other covered entities are free to obtain a patient's consent before disclosure of any protected health information.

Therefore, the Third Circuit court held that the Privacy Rule does not make healthcare entities "state actors." Citizens for Health v. Leavitt is binding precedent only in the Third Circuit (Delaware, New Jersey, Pennsylvania, and the Virgin Islands), but the reasoning of the decision is likely to be followed in other jurisdictions, particularly since the Supreme Court refused to hear the case.