HLD, v. 32, n. 5 (May 2004)
U.S. Court In Pennsylvania Upholds Amended HIPAA Privacy Rule
The amendment to the Health Insurance Portability and Accountability
Act (HIPAA) privacy rule to remove the consent requirement for health information
used for routine purposes did not violate the Administrative Procedure Act (APA)
or constitutional rights, a federal district court in Pennsylvania held April
A group of nine individuals and ten organizations (plaintiffs),
including various healthcare consumer and advocacy organizations, challenged
the HIPAA privacy rule as amended to remove the requirement included in the
original rule that covered entities obtain patient consent before using their
protected healthcare information for treatment, payment, and healthcare operations.
According to plaintiffs, the rule change was arbitrary and capricious,
exceeded the Department of Health and Human Services Secretary's statutory authority,
and violated various constitutional rights. Plaintiffs also contended that the
Secretary failed to give adequate public notice of his intent to rescind the
consent requirement, provided an insufficient comment period, and impermissibly
made the rule retroactive to records created before the rule's compliance date.
The U.S. District Court for the Eastern District of Pennsylvania
found that at least one of the plaintiffs, Dr. Deborah Peel, had standing to
challenge the HIPAA rule. The court concluded that Peel suffered an injury in
fact, pointing to the many notices she had received from healthcare providers
indicating their use of her health information for routine purposes.
The court also found that Peel's injury in fact was causally connected
and traceable to the amended rule. Although the amended rule permits providers
to continue to obtain consent for routine purposes if they chose to do so, the
amended rule "changed the landscape established by the Original Rule in which
decisions will be made by providers as to whether they will seek consent or
agree to patients' demands for consent." Finally, the court concluded that Peel
had demonstrated that reinstating the original rule would redress her alleged
Turning to the merits, the court held that the amended rule did
not run afoul of the APA. In so holding, the court found a "reasoned analysis"
behind the rule change. Specifically, the court noted the Secretary's explanation
that the change was made in light of numerous comments that the consent requirement
would impede the efficient delivery of healthcare. According to the Secretary,
targeted fixes would have added more complexity to the rule without solving
all of the problems. "He determined that the rescission was the most efficient
means to achieving the purposes set forth in HIPAA" and also "explained why
the alternative solutions would not be effective," the court noted.
The court rejected plaintiffs' argument that the Secretary had
failed to respond adequately to comments on the amended rule. In the court's
view, the Secretary showed he considered the two factors mandated by Subtitle
F of HIPAA: efficiency and effectiveness of the healthcare system and the privacy
of health information. "He just balanced the factors in a way with which the
plaintiffs disagree," the court said. The court also held that the notice of
proposed rulemaking for the amended rule adequately informed the public of the
intent to rescind the consent requirement.
The court held that the rule change fell within the Secretary's
authority under HIPAA to balance privacy protection and the efficiency of the
healthcare system. "Although HIPAA also required the Secretary to protect the
privacy of health information, the Court finds nothing in the statute requiring
the Secretary to maximize privacy interests over efficiency interests," the
The court also rejected plaintiffs' argument that the rule was
retroactive. Covered entities were never under any legal obligation to comply
with the original rule, the court observed. Thus, the original rule did not
create rights for the amended rule to subsequently eliminate.
The court found no basis for plaintiffs' contention that the amended
rule violated their due process rights to medical privacy and their First Amendment
rights to private physician-patient communications. The amended rule is wholly
permissive; it does not prohibit covered entities from obtaining consent for
routine purposes if they chose to do so. "Because the Amended Rule is not compulsory
in nature, it does not affirmatively interfere with any right," the court said.
Citizens for Health v. Thompson, No. 03-2267 (E.D. Pa. April