Opinion ID: 2570110
Heading Depth: 1
Heading Rank: 4

Heading: The Health Department Complied with HIPAA Standards for Privacy of Individually Identifiable Health Information

Text: Mubita also argues the records should be suppressed on the ground that the Health Department's release of his medical records violated the HIPAA Standards. Mubita cites 45 C.F.R. § 164.512 to support his argument that the disclosure violated those standards. Under section 164.512(e), disclosure requires either a court order, or a subpoena or discovery request, along with notice to Mubita to allow him to object. In addition, Mubita points to section 164.512(f) governing disclosure for law enforcement purposes. Under this section, Mubita again argues there was no court order or subpoena, nor any administrative request that would allow the Health Department to disclose his information. Mubita argues section 164.512(f)(1)(ii)(C) requires that the information requested be specific and limited in scope. Since the prosecutor here requested whatever information your agency may possess in regard to an adult male resident of Latah County who has tested positive for the HIV virus, he argues the request was not specific. Lastly, Mubita points to section 164.512(f)(2), which covers disclosures for identification and location purposes. Again, Mubita argues the prosecutor's request was too broad. The State claims its actions were consistent with the HIPAA Standards. In the alternative, the State contends that the exclusionary rule does not apply to a statutory violation. [11] Under 45 C.F.R. § 164.502, the general rule is that a covered entity may not use or disclose protected health information, except as specifically permitted. Section 164.512 sets forth specific instances where a covered entity may disclose protected health information without the written consent, authorization or notice to the individual. Section 164.512(f) sets forth the standard for disclosures to law enforcement officials for law enforcement purposes. [12] Subsection (f)(1)(ii)(C) permits such disclosures in compliance with an authorized investigative demand, or similar process authorized by law, provided that: (1) the information sought is relevant and material to a legitimate law enforcement inquiry; (2) the request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and (3) deidentified information could not reasonably be used. The prosecutor explicitly requested the documents pursuant to 45 C.F.R. § 164.512(f)(1)(ii)(C). The State met the requirements of this section in making its request for disclosure. The request was an authorized investigative demand made by the county prosecutor, which demand was material to a law enforcement inquiry. The request was specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information was sought. Finally, de-identified information was not a possibility because the identification and confirmation of Mubita's HIV status was necessary to preclude any additional victims. Based on these factors, enumerated in section 164.512(f)(1)(ii)(C), the State complied with HIPAA Standards. [13] Furthermore, it should be noted that, even if the State had violated HIPAA Standards, suppression of the evidence is not the proper remedy for a HIPAA violation. See, e.g., Sanchez-Llamas v. Oregon, 548 U.S. 331, 126 S.Ct. 2669, 165 L.Ed.2d 557 (2006) (suppression is not a proper remedy for violation of the Vienna Convention, art. 36); United States v. Frazin, 780 F.2d 1461, 1466 (9th Cir.1986) (no suppression for violation of Right to Financial Privacy Act) (Because the statute, when properly construed, excludes a suppression remedy, it would not be appropriate for us to provide one in the exercise of our supervisory, powers over the administration of justice. Where Congress has both established a right and provided exclusive remedies for its violation, we would `encroach upon the prerogatives' of Congress were we to authorize a remedy not provided for by statute.). HIPAA expressly provides for monetary fines in the event of a violation. See 42 U.S.C.A. §§ 1320d-5, 1320d-6. Thus, the proper remedy for a HIPAA violation is a monetary fine, consistent with the express provisions of the statute. [14] The district court did not err when it denied Mubita's motion to suppress the documents based on the alleged HIPAA violation. C.