Opinion ID: 2741507
Heading Depth: 1
Heading Rank: 7

Heading: hipaa statute and regulations

Text: Both the HIPAA statute and its regulations contain express preemption provisions. The HIPAA statute itself provides that HIPAA requirements “shall supersede any contrary provision of State law.” 42 U.S.C. § 1320d-7(a)(1). More fully, the HIPAA statute provides that, subject to exceptions not at issue here, “a provision or requirement under [HIPAA], or a standard or implementation specification adopted or established under sections 1320d-1 through 1320d-3 of [HIPAA], shall supersede any contrary provision of State law.” Id. The HIPAA statute also allows the Secretary of Health and Human Services to “promulgate such regulations as may be necessary or appropriate to carry out the provisions of [HIPAA].” Id. § 300gg-92; see id. §§ 1320d-1, 1320d-2 & 1320d-3 (setting forth requirements governing the Secretary’s adoption of standards under HIPAA). “One of Congress’s objectives in enacting HIPAA was to address concerns about the confidentiality of patients’ individually identifiable health information.” OPIS Mgmt., 713 F.3d at 1294. Accordingly, Congress specifically authorized the Secretary “to promulgate privacy regulations addressing individuals’ rights to individually identifiable health information, procedures for 13 Case: 13-14637 Date Filed: 10/10/2014 Page: 14 of 36 exercising such rights, and the uses and disclosures of such information.” Id. at 1295. In turn, the Secretary promulgated comprehensive privacy and disclosure regulations spanning hundreds of pages. See 45 C.F.R. pts. 160 & 164. Echoing the HIPAA statute, the HIPAA regulations also state that a HIPAA requirement “that is contrary to a provision of state law preempts the provision of state law,” subject to exceptions not at issue here. 45 C.F.R. § 160.203.5 The Secretary also enacted a regulation to define further what is meant by “contrary” to state law. The Secretary’s regulation states that a state law is contrary to HIPAA if: (1) “[a] covered entity . . . would find it impossible to comply with both the State and Federal requirements”; or (2) “[t]he provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of [HIPAA], as applicable.” 45 C.F.R. § 160.202(1)-(2) (emphasis added). Dr. Dulay and the State do not contend (1) that the HIPAA regulations relevant to this case—the privacy and disclosure regulations in parts 160 and 164—exceed the scope of the Secretary’s delegated authority, or (2) that the Florida legislature could permissibly enact a statute contrary to those HIPAA regulations. Rather, they argue that § 766.1065 is consistent with both the HIPAA statute and the HIPAA regulations. Thus, we outline the relevant HIPAA regulations and then analyze whether § 766.1065 is contrary to them. 5 HIPAA, however, does not preempt state laws that provide “more stringent” privacy protections. See 45 C.F.R. § 160.203(b); see also Opis Mgmt., 713 F.3d at 1294. 14 Case: 13-14637 Date Filed: 10/10/2014 Page: 15 of 36