We use cookies to better understand how you use our site and to improve your experience by personalizing content. Please review our updated Privacy Policy and Terms of Use. If you accept the use of cookies, please click the "I accept" button.I acceptI declineX
Skip navigational links

U.S. Court In Pennsylvania Upholds Amended HIPAA Privacy Rule


HLD, v. 32, n. 5 (May 2004)

U.S. Court In Pennsylvania Upholds Amended HIPAA Privacy Rule

The amendment to the Health Insurance Portability and Accountability Act (HIPAA) privacy rule to remove the consent requirement for health information used for routine purposes did not violate the Administrative Procedure Act (APA) or constitutional rights, a federal district court in Pennsylvania held April 2.

A group of nine individuals and ten organizations (plaintiffs), including various healthcare consumer and advocacy organizations, challenged the HIPAA privacy rule as amended to remove the requirement included in the original rule that covered entities obtain patient consent before using their protected healthcare information for treatment, payment, and healthcare operations.

According to plaintiffs, the rule change was arbitrary and capricious, exceeded the Department of Health and Human Services Secretary's statutory authority, and violated various constitutional rights. Plaintiffs also contended that the Secretary failed to give adequate public notice of his intent to rescind the consent requirement, provided an insufficient comment period, and impermissibly made the rule retroactive to records created before the rule's compliance date.

The U.S. District Court for the Eastern District of Pennsylvania found that at least one of the plaintiffs, Dr. Deborah Peel, had standing to challenge the HIPAA rule. The court concluded that Peel suffered an injury in fact, pointing to the many notices she had received from healthcare providers indicating their use of her health information for routine purposes.

The court also found that Peel's injury in fact was causally connected and traceable to the amended rule. Although the amended rule permits providers to continue to obtain consent for routine purposes if they chose to do so, the amended rule "changed the landscape established by the Original Rule in which decisions will be made by providers as to whether they will seek consent or agree to patients' demands for consent." Finally, the court concluded that Peel had demonstrated that reinstating the original rule would redress her alleged injury.

Turning to the merits, the court held that the amended rule did not run afoul of the APA. In so holding, the court found a "reasoned analysis" behind the rule change. Specifically, the court noted the Secretary's explanation that the change was made in light of numerous comments that the consent requirement would impede the efficient delivery of healthcare. According to the Secretary, targeted fixes would have added more complexity to the rule without solving all of the problems. "He determined that the rescission was the most efficient means to achieving the purposes set forth in HIPAA" and also "explained why the alternative solutions would not be effective," the court noted.

The court rejected plaintiffs' argument that the Secretary had failed to respond adequately to comments on the amended rule. In the court's view, the Secretary showed he considered the two factors mandated by Subtitle F of HIPAA: efficiency and effectiveness of the healthcare system and the privacy of health information. "He just balanced the factors in a way with which the plaintiffs disagree," the court said. The court also held that the notice of proposed rulemaking for the amended rule adequately informed the public of the intent to rescind the consent requirement.

The court held that the rule change fell within the Secretary's authority under HIPAA to balance privacy protection and the efficiency of the healthcare system. "Although HIPAA also required the Secretary to protect the privacy of health information, the Court finds nothing in the statute requiring the Secretary to maximize privacy interests over efficiency interests," the court wrote.

The court also rejected plaintiffs' argument that the rule was retroactive. Covered entities were never under any legal obligation to comply with the original rule, the court observed. Thus, the original rule did not create rights for the amended rule to subsequently eliminate.

The court found no basis for plaintiffs' contention that the amended rule violated their due process rights to medical privacy and their First Amendment rights to private physician-patient communications. The amended rule is wholly permissive; it does not prohibit covered entities from obtaining consent for routine purposes if they chose to do so. "Because the Amended Rule is not compulsory in nature, it does not affirmatively interfere with any right," the court said.

Citizens for Health v. Thompson, No. 03-2267 (E.D. Pa. April 2, 2004).

© 2018 American Health Lawyers Association. All rights reserved. 1620 Eye Street NW, 6th Floor, Washington, DC 20006-4010 P. 202-833-1100 F. 202-833-1105