Opinion ID: 2741507
Heading Depth: 1
Heading Rank: 8

Heading: disclosure permitted under regulations

Text: The HIPAA regulations generally prohibit covered entities from using or disclosing “protected health information.” 45 C.F.R. § 164.508(a)(1); see id. § 164.502(a) (“A covered entity . . . may not use or disclose protected health information, except as permitted or required by [these regulations].”); id. § 164.512 (enumerating exceptions). Only health plans, health care clearinghouses, and certain health care providers are “covered entities” under the HIPAA regulations. Id. § 160.102(a). The regulations, however, permit covered entities to disclose protected health information when certain requirements are met, two of which are pertinent here.6 First, disclosure may be made through the judicial process. Id. § 164.512(e). Second, disclosure is permitted if an individual expressly authorizes release of his or her medical information in a valid authorization form. See id. § 164.502(a)(1)(iv) (allowing covered entities to disclose protected health information “pursuant to and in compliance with a valid authorization”); id. § 164.508 (“Except as otherwise permitted . . . by [HIPAA], a covered entity may not use or disclose protected health information without an authorization that is valid . . . .”). We discuss each permitted disclosure avenue in turn. 6 There are numerous categories of permissive uses and disclosures in the HIPAA regulations, only two of which we discuss here. 15 Case: 13-14637 Date Filed: 10/10/2014 Page: 16 of 36
Section 164.512 provides that “[a] covered entity may use or disclose protected health information without the written authorization of the individual, as described in § 164.508 . . . in the situations covered by this section . . . .” Id. § 164.512. One of the twelve situations covered in § 164.512 are “[d]isclosures for judicial and administrative proceedings.” Id. § 164.512(e).7 More precisely, even without a written authorization, “[a] covered entity may disclose protected health information in the course of any judicial or administrative proceeding.” Id. § 164.512(e)(1). But certain procedures must be followed. Information may be released only in response to: (1) an “order of a court or administrative tribunal,” or (2) a “subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal,” when certain conditions are met. Id. § 164.512(e)(1)(i)-(ii). For the latter, information may be disclosed only if the covered entity receives satisfactory assurance from the party seeking the information that reasonable efforts have been made to either (1) ensure that the individual whose 7 Section 164.512 also covers standards in these other situations involving disclosure without a written authorization: (1) when required by law, (2) for public health activities, (3) about victims of abuse, neglect, or domestic violence, (4) for health oversight activities, (5) for law enforcement purposes, (6) about decedents, (7) for cadaveric organ, eye, or tissue donation purposes, (8) for research purposes, (9) to avert a serious threat to health or safety, (10) for specialized government functions, (11) for workers’ compensation. Id. § 164.512(a)-(l). The provisions governing disclosure by judicial process “do not supersede other provisions of [§ 164.512] that otherwise permit or restrict uses or disclosures of protected health information.” Id. § 164.512(e)(2). 16 Case: 13-14637 Date Filed: 10/10/2014 Page: 17 of 36 information is to be shared has been given notice of the request, or (2) secure a qualified protective order. Id. § 164.512(e)(1)(ii). The HIPAA regulations state additional requirements for each of these processes to be valid. For example, to establish that reasonable efforts have been made to give notice, the party requesting information must show by written documentation that it has made a “good faith attempt to provide written notice,” that such notice included sufficient information about the litigation to permit the individual to raise an objection to the court, that the time for the individual to raise objections to the court has elapsed, and that either no objections were filed or all objections filed have been resolved by the court. Id. § 164.512(e)(1)(iii). If instead the party seeks to proceed by protective order, it must show that the parties to the dispute have agreed to a qualified protective order and presented it to the court, or that the party seeking the protected health information has requested a qualified protective order from the court. Id. § 164.512(e)(1)(iv). 8 Importantly for this case, § 164.512(e) provides an alternative avenue for disclosure without a written authorization and does not replace or narrow the provisions permitting disclosure by written authorization alone, which are discussed below. 8 A qualified protective order means an order that prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation for which it was requested and requires that the protected health information, at the end of the litigation, be returned to the covered entity or destroyed. Id. § 164.512(e)(1)(v). 17 Case: 13-14637 Date Filed: 10/10/2014 Page: 18 of 36
Disclosure of protected health information is also permissible when a person signs a valid written authorization. Id. § 164.508. A valid authorization, alone, is sufficient to permit disclosure in compliance with HIPAA, so long as “such use or disclosure [is] consistent with such authorization.” Id. The HIPAA regulations specify that, to be valid, an authorization must contain these elements: (1) “[a] description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion”; (2) “[t]he name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure”; (3) “[t]he name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure”; (4) “[a] description of each purpose of the requested use or disclosure”; (5) “[a]n expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure”; and (6) the “[s]ignature of the individual and date.” Id. § 164.508(c)(1)(i)-(vi). Further, “the authorization must contain statements adequate to place the individual on notice of all of the following:” (1) the individual’s “right to revoke,” the exceptions to the right to revoke, and “a description of how the individual may revoke”; (2) that a covered entity “may not condition treatment, payment, 18 Case: 13-14637 Date Filed: 10/10/2014 Page: 19 of 36 enrollment or eligibility for benefits on whether the individual signs the authorization,” subject to narrow exceptions; and (3) “the potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by [HIPAA].” Id. § 164.508(c)(2), (b)(4). In short, the HIPAA regulations mandate that an authorization contain many different elements in order to be a valid authorization. The authorization form required by § 766.1065 must have those same HIPAA elements to be valid too. The HIPAA regulations also set forth circumstances when a written authorization is invalid, specifically: (1) “[t]he expiration date has passed or the expiration event is known by the covered entity to have occurred”; (2) “[t]he authorization has not been filled out completely, with respect to [each element required]”; (3) “[t]he authorization is known by the covered entity to have been revoked”; (4) the authorization is a compound authorization or is a condition for receiving treatment (and neither exception is applicable); or (5) “[a]ny material information in the authorization is known . . . to be false.” Id. § 164.508(b)(2). The HIPAA regulations explain that a “compound authorization,” subject to exceptions not at issue here, is an authorization for the disclosure of protected health information that is “combined with any other document to create a compound authorization.” Id. § 164.508(b)(3). The Secretary gave this example of a compound authorization: an authorization for the use or disclosure of 19 Case: 13-14637 Date Filed: 10/10/2014 Page: 20 of 36 protected health information “may be combined with an informed consent to receive treatment, [or] a consent to assign payment of benefits to a provider.” Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,511 (Dec. 28, 2000). Further, as part of a larger modification of the HIPAA regulations, the Secretary stated that a compound authorization is created when “an authorization for the use and disclosure of protected health information is combined with any other legal permission.” Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, 78 Fed. Reg. 5565, 5609 (Jan. 25, 2013). Citing the fact that the use of multiple authorization forms has confused patients, the Secretary permitted the use of compound authorization forms under certain circumstances. Id. at 5609-11. The Secretary’s statements elucidate the HIPAA regulations’ circular definition of “compound authorization,” clarifying that the regulation prohibits the combination of an authorization with another “legal permission”—such as a consent to treatment or consent to assign payment— not its combination with literally “any other document.” The exceptions to the compound authorization prohibition also inform this conclusion. See 45 C.F.R. § 164.508(b)(3)(i)-(iii). The first exception permits an authorization for disclosure of health information for a research study to be combined with another authorization for the same or another study. Id. 20 Case: 13-14637 Date Filed: 10/10/2014 Page: 21 of 36 § 164.508(b)(3)(i). The second exception authorizes a compound authorization for the use or disclosure of psychotherapy notes. Id. § 164.508(b)(3)(ii). The third exception allows an authorization—other than an authorization for use or disclosure of psychotherapy notes—to be combined with any other such authorization, unless the covered entity has conditioned treatment or enrollment in a health care plan on the provision of an authorization. Id. § 164.508(b)(3)(iii). Notably, each exception discusses an authorization combined with another authorization—not an authorization combined with a wholly different type of document, such as a presuit notice.