Opinion ID: 3014940
Heading Depth: 2
Heading Rank: 3

Heading: Claims Alleging Violations of HIPAA

Text: In claims based on HIPAA’s statutory language, Citizens argue (1) that the Secretary exceeded the regulatory authority delegated by HIPAA because the Act only authorizes the Secretary to promulgate regulations that enhance privacy and (2) that the Amended Rule impermissibly retroactively rescinded individual rights created by the Original Rule and disturbed Citizens’ “settled expectations” in the privacy of their health information. We find the District Court’s analysis of these statutory claims to be cogent. Citizens argue that the Secretary has eliminated their reasonable expectations of medical privacy retroactively and prospectively and that such action is inconsistent with Congress’s intent in enacting HIPAA. However, Citizens’ argument that the controlling policy underlying HIPAA is medical privacy and that the Amended Rule wholly sacrifices this interest to covered entities’ interests in efficiency and flexibility ignores the Act’s stated goals of “simplify[ing] the administration of health insurance,” HIPAA pmbl., 110 Stat. at 1936, and “improv[ing] the efficiency and 39 effectiveness of the health care system,” HIPAA § 261 (stating purpose of Subtitle F). As the District Court aptly explained, HIPAA requires the Secretary to “balance privacy protection and the efficiency of the health care system–not simply to enhance privacy.” Citizens for Health, 2004 U.S. Dist. LEXIS 5745, at . We thus conclude that Citizens’ first HIPAA claim lacks merit. We also agree with the District Court’s finding that the Amended Rule does not retroactively eliminate rights that Citizens enjoyed under the Original Rule or under various laws or standards of practice that existed before the Amended Rule went into effect. Because the Original Rule was amended before its compliance date, “[c]overed entities were never under a legal obligation to comply with the Original Rule’s consent requirement.” Id. at -46. Citizens, therefore, never enjoyed any rights under the Original Rule at all. Nor does the Amended Rule retroactively eliminate Citizens’ reasonable expectations based on state law, standards of medical ethics and established standards of practice because the Amended Rule does not disturb any preexisting, “more stringent” state law privacy rights. See id. at -46. See also Standards for Privacy of Individually Identifiable Health Information, 67 Fed. Reg. 53,182, 53,212 (Aug. 14, 2002) (“State laws that are more stringent [than the Privacy Rule] remain in place. In order not to interfere with such laws and ethical standards, this Rule permits covered entities to obtain consent. Nor is the Privacy Rule intended to serve as a ‘best practices’ standard. Thus, professional standards that are more protective of privacy retain their vitality.” (emphasis added)). Accordingly, we reject Citizens’ second HIPPA claim as well, and will affirm the grant 40 of summary judgment to the Secretary on these claims.