Opinion ID: 844281
Heading Depth: 3
Heading Rank: 3

Heading: The Interplay Between the FCRA and HIPAA

Text: Recognizing the importance of protecting the privacy of health information in the midst of the rapid evolution of health information systems, Congress passed HIPAA in August 1996. ( South Carolina Medical Assn. v. Thompson (4th Cir. 2003) 327 F.3d 346, 348; see Pub.L. No. 104-191 (Aug. 21, 1996) 110 Stat. 1936.) Portions of HIPAA were intended to facilitate information exchange among participants in the health care system (42 U.S.C. §§ 1320d to 1320d-8 (HIPAA §§ 261-262, Pub.L. No. 104-191, §§ 261-262 (Aug. 21, 1996) 110 Stat. 2021-2031)), but Congress foresaw that with easier transmission of intimate medical details would come a heightened risk of privacy loss (65 Fed.Reg. 82469 (Dec. 28, 2000); see also Northwestern Memorial Hosp. v. Ashcroft (7th Cir. 2004) 362 F.3d 923, 928-929 [the sensitivity that lies behind HIPAA is concern for the natural sensitivity that people feel about the disclosure of their medical records]). Accordingly, Congress tasked the federal Department of Health and Human Services (Department) with recommending privacy standards for the handling of personal medical information (42 U.S.C. § 1320d-2 note (HIPAA, § 264(a), Pub.L. No. 104-191, § 264(a) (Aug. 21, 1996) 110 Stat. 2033)) and, if no legislation was forthcoming within a specified period, with promulgating regulations setting forth national medical information privacy standards ( id. (HIPAA, § 264(c)(1), Pub.L. No. 104-191, § 264(c)(1) (Aug. 21, 1996) 110 Stat. 2033)). When Congress failed to agree on legislation, the Department fulfilled its mandate and issued a wealth of detailed regulations, commonly known as the Privacy Rule. (Stds. for Privacy of Individually Identifiable Health Information, 65 Fed.Reg. 82462 (Dec. 28, 2000), codified at 45 C.F.R. §§ 160, 164 (2010) [original Privacy Rule]; Stds. for Privacy of Individually Identifiable Health Information, 67 Fed.Reg. 53182 (Aug. 14, 2002), codified at 45 C.F.R. §§ 160, 164 (2010) [final modifications to the Privacy Rule].) Three points about HIPAA and the Privacy Rule are germane here. First, at the time of HIPAA's passage it was expressly contemplated that Congress or the Department would closely regulate the obligations of health plans, medical providers, and their agents to maintain patient confidences. (42 U.S.C. § 1320d-2 note (HIPAA, § 264(b), (c)(1), Pub.L. No. 104-191, § 264(b), (c)(1) (Aug. 21, 1996) 110 Stat. 2033); see 42 U.S.C. § 1320d-1(a) [identifying entities to be covered by new standards].) The Privacy Rule does so, defining and restricting the ability of covered entities to divulge confidential medical information. (See 45 C.F.R. § 164.502(a) (2010) [prohibiting use or disclosure of personal health information except as provided under the Privacy Rule].) The Department's regulations expressly address such matters as the extent to which personal medical information may be disclosed when seeking payment, including to consumer reporting agencies. (See id., § 164.506 [permitting disclosure of personal health information for purposes of payment]; id., § 164.501 [defining payment to include certain limited disclosures of personal health information to consumer reporting agencies].) (9) Second, both HIPAA and the Privacy Rule's implementation of it expressly favor additional, more protective state legislation. Although HIPAA generally preempts state laws (42 U.S.C. § 1320d-7(a)(1); see 45 C.F.R. § 160.203 (2010)), Congress carved out a different rule for privacy regulation (42 U.S.C. § 1320d-7(a)(2)(B)), directing that only conflicting or less stringent state law be preempted, while more stringent state law be preserved ( id., § 1320d-2 note (HIPAA, § 264(c)(2), Pub.L. No. 104-191, § 264(c)(2) (Aug. 21, 1996) 110 Stat. 2033-2034); see 45 C.F.R. §§ 160.202, 160.203(b) (2010)). [10] As the Department explained when announcing the Privacy Rule: It is important to understand this regulation as a new federal floor of privacy protections that does not disturb more protective rules or practices. . . . The protections are a mandatory floor, which other governments and any covered entity may exceed. (65 Fed.Reg. 82471 (Dec. 28, 2000).) (10) Third, HIPAA was enacted just one month before the 1996 Reform Act. While in construing statutes we will always prefer interpretations that harmonize them with other legislation ( Lexin v. Superior Court (2010) 47 Cal.4th 1050, 1095 [103 Cal.Rptr.3d 767, 222 P.3d 214]), that canon is particularly appropriate here, where the very same Congress within a few weeks passed both HIPAA and the 1996 Reform Act. Given their contemporaneous nature and overlapping privacy concerns, we must when possible interpret HIPAA and the 1996 Reform Act as a coherent whole. The 104th Congress could have amended the FCRA to address the scope of a medical provider's duties when furnishing information to a consumer reporting agency, or it could have addressed it as part of HIPAA. It chose to address it as part of HIPAA, authorizing the Department to adopt regulations on the subject, while at the same time inviting the states to continue to regulate to the extent they desired to enact more stringent, privacy-favoring legislation. (See 42 U.S.C. § 1320d-2 note (HIPAA, § 264(c)(1), (2), Pub.L. No. 104-191, § 264(c)(1), (2) (Aug. 21, 1996) 110 Stat. 2033-2034).) We see no plausible basis for reading into sections 1681t(b)(1)(F) and 1681s-2, which are silent on the duties of a furnisher to preserve medical confidentiality, a clear and manifest congressional intent to preempt state legislation on that topic, when the same Congress in HIPAA had just authorized and encouraged further state regulation of such matters. Far more credible is to assume Congress intended preemption only with respect to the specific furnisher duties for which it adopted standards in section 1681s-2, while leaving to other laws and their preemption provisions or savings clauses the task of articulating additional, more general duties and identifying what the several states' roles might be in enacting supplemental legislation. [11]