Opinion ID: 3014940
Heading Depth: 2
Heading Rank: 1

Heading: Fifth Amendment Substantive Due Process Claim

Text: In discussing Citizens’ Fifth Amendment claim, the District Court noted that substantive due process bars the government from depriving individuals of life, liberty, or property without due process of law, but it does not “‘impose an affirmative obligation on the State to ensure that those interests do not come to harm through other means.’” Citizens for Health, 2004 U.S. Dist. LEXIS 5745, at -47 (quoting DeShaney v. Winnebago County Soc. Servs. Dep’t, 489 U.S. 189, 195 (1989)). Applying this principle to the case at hand, the Court reasoned that, even assuming that individuals have a constitutional right to medical privacy, the Amended Rule is “wholly permissive with respect to whether a covered entity should seek consent from a patient before using his or her information for routine purposes. The Amended Rule neither requires nor prohibits that practice.” Id. at -48. In short, “[b]ecause the Amended Rule is not compulsory in nature, it does not affirmatively interfere with any right.” Id. We agree with the District Court that Citizens’ constitutional claims the Privacy Rule and that rescission of the Rule is likely to redress plaintiffs’ alleged injuries in no way amounts to a determination that the decisions of private entities to disclose or use plaintiffs’ health care information without their consent are legally attributable to the federal government in such a way as to constitute state action. See id. at 361 n.4. In fact, we reach the opposite conclusion below. 20 should ultimately be resolved based on the nature of the state’s involvement in light of the Amended Rule’s permissive character. However, we think that the District Court’s analysis does not go far enough, and that its reliance on DeShaney does not fully explain why Citizens cannot succeed here. We begin our analysis with the premise that the right to medical privacy asserted by Citizens is legally cognizable under the Due Process Clause of the Fifth Amendment, although, as Citizens themselves concede, its “boundaries . . . have not been exhaustively delineated.” (Appellants’ Br. at 12.) 10 Whatever 10 We express no opinion here on the scope of the federal constitutional right to medical privacy, or on whether the injury asserted by Citizens, if it were directly attributable to a state actor, would amount to a constitutional violation. Citizens assert in their brief that “the right . . . to not have [ones’] personal and identifiable health information made public or disclosed to numerous government employees in routine situations is a fundamental right implicit in the concept of ordered liberty and deeply rooted in the Nation’s history.” (Appellants’ Br. at 20.) But the question of the scope of the constitutional right to privacy in one’s medical information is largely unresolved. See, e.g., Whalen v. Roe, 429 U.S. 589, 602 (1977) (recognizing that, despite constitutionally protected interest in avoiding disclosure of personal matters, “disclosures of private medical information to doctors, to hospital personnel, to insurance companies, and to public health agencies are often an essential part of modern medical practice even when the disclosure may reflect unfavorably on the character of the 21 those boundaries may be, it is undisputed that a violation of a citizen’s right to medical privacy rises to the level of a constitutional claim only when that violation can properly be ascribed to the government. The Constitution protects against state interference with fundamental rights. It only applies to restrict private behavior in limited circumstances. Because such circumstances are not present in this case, and because the “violations” of the right to medical privacy that Citizens have asserted, if they amount to violations of that right at all, occurred at the hands of private entities, the protections of the Due Process Clause of the Fifth Amendment are not implicated in this case. We will accordingly affirm the District Court’s finding that the Secretary did not violate Citizens’ constitutional rights when he promulgated the Amended Rule. patient”); United States v. Westinghouse Elec. Corp., 638 F.2d 570, 578 (3d Cir. 1980) (“[T]he right of an individual to control access to his or her medical history is not absolute.”). And, although Citizens contend that “governmental intrusions” on the right to privacy are subject to “heightened scrutiny,” the standard of review we would apply would depend on the specific nature of the asserted violation. See Fraternal Order of Police v. City of Philadelphia, 812 F.2d 105, 110 (3d Cir. 1987) (“Most circuits appear to apply an ‘intermediate standard of review’ for the majority of confidentiality violations, . . . with a compelling interest analysis reserved for ‘severe intrusions’ on confidentiality.” (citations omitted)). Because we conclude that Citizens’ claims are more appropriately resolved through application of the state action doctrine, we do not decide these difficult questions now. 22 “The Constitution structures the National Government, confines its actions, and, in regard to certain individual liberties and other specified matters, confines the actions of the States. With a few exceptions, . . . constitutional guarantees of individual liberty and equal protection do not apply to the actions of private entities.” Edmonson, 500 U.S. at 619. Indeed, it is well established that the substantive component of due process, embodied in both the Fifth and Fourteenth Amendments,11 “‘provides heightened protection against government interference with certain fundamental rights and liberty interests.’” Troxel v. Granville, 530 U.S. 57, 65 (2000) (quoting Washington v. Glucksberg, 521 U.S. 702, 720 (1997)) (emphasis added); see also Reno v. Flores, 507 U.S. 292, 301 (1993). As explained in DeShaney, the Due Process Clauses of the Fifth and Fourteenth Amendments were intended to prevent federal and state governments “‘from abusing [their] power, or employing it as an instrument of oppression.’” 489 U.S. at 196 (quoting Davidson v. Cannon, 474 U.S. 344, 348 (1986)). Their “purpose was to protect the people from the State, not to ensure that the State protected them from each other.” Id. 11 In a due process claim brought under the Fifth Amendment, the “State” in the state action analysis is the federal government. See Malloy v. Hogan, 378 U.S. 1, 26 (1964) (“‘Due process of law is secured against invasion by the federal Government by the Fifth Amendment, and is safeguarded against state action in identical words by the Fourteenth.’”) (quoting Betts v. Brady, 316 U.S. 455, 462 (1942)); see also Public Utilities Comm’n v. Pollak, 343 U.S. 451, 461-62 (1952). 23 At first glance, the posture of this case seems different from that of most state action cases. The issue of state action usually arises where plaintiffs assert that their rights have been violated by private parties who, they claim, are acting on behalf of the state. E.g., Jackson v. Metro. Edison Co., 419 U.S. 345 (1974) (customer suing private utility company for violation of procedural due process on the theory that the utility was a “state actor” by virtue of a state-granted monopoly and extensive state regulation). In this case, by contrast, the action that Citizens challenge–the promulgation of the Amended Rule by the Secretary–is clearly government conduct. As noted above, however, the injury that Citizens allege is that their “personal health information” is being “used and disclosed, without their permission and against their will” by third parties. (Appellants’ Br. at 2.) To support their claims, Citizens point to privacy notices that they received from private health care providers and pharmacies. See Citizens for Health, 2004 U.S. Dist. LEXIS 5745, at -28. Citizens did not challenge any use or disclosure by the Secretary himself, or urge that the third parties were somehow acting on the Secretary’s behalf, before the District Court.12 The relevant question, then, is whether the 12 To be sure, Citizens and amici curiae have referred to other actions on the part of the federal government besides the promulgation of the Amended Rule that they believe violate the Fifth Amendment in their arguments before this court. For instance, they argue in their briefs that, as the supervisor of a number of federal programs that qualify as “health plans” under HIPAA–including Medicare, Medicaid, and the Indian Health Services Programs–under the Amended Rule, HHS could make 24 Secretary, as a state actor, was sufficiently involved in producing the harm Citizens assert to satisfy the Constitution’s state action requirement. As noted above, the District Court touched on the state action issue when it applied DeShaney’s holding that due process does not impose an affirmative obligation on the State to protect individuals’ interests in life, liberty, or property from harm inflicted by private actors. See 489 U.S. at 195. But the District Court’s analysis in this respect was incomplete. Although the fundamental principle that due process protections apply only to prevent injury attributable to conduct of the State underlies the discussion in DeShaney, the Supreme Court’s analysis in that case did not focus on “state action” as such. There, the Court was presented with a claim against a local government for its failure to prevent a father from physically abusing his son to the point of permanent injury where the local social services agency knew of the abuse but failed to remove the child from the father’s custody. Id. at 191. Plaintiffs argued that the State was “categorically obligated” to protect the child from abuse and that, given this obligation, the State’s failure to act was a proper basis for a due process challenge. Id. at 195. disclosures of protected health information as a covered entity. (Amici Supp. Br. at 6.) However, Citizens here challenge the Secretary’s promulgation of the Privacy Rule, not specific disclosures by HHS or any of the federal agency “health plans” that it supervises. Whether a challenge to such specific disclosures would satisfy the Constitution’s state action requirement thus remains outside the scope of this appeal. 25 The Court’s analysis thus sought to determine whether due process imposed a “duty” or “obligation” on the State to protect individuals from private harm, not “whether the State was sufficiently involved [in the privately caused harm] to treat that decisive conduct as state action.” Tarkanian, 488 U.S. at 192. In this case, DeShaney helps resolve a preliminary question: Was the Secretary obliged to prohibit any and all disclosures without consent in order to protect privacy rights across the board? We think the District Court appropriately relied on DeShaney to answer that question in the negative. But DeShaney does not reach the specific question before us: Is the nonconsensual use or disclosure of individual health information by private parties, as permitted by the Amended Rule, legally attributable to the Secretary? We conclude that it is not. To answer this question, we must determine “whether there is a sufficiently close nexus between the State and the challenged action of the regulated entity [–the private party–] so that the action of the latter may fairly be treated as that of the State itself.” Jackson, 419 U.S. at 351. Where, as here, plaintiff argues that the State has “authorized” or “empowered” a private entity to act in a way that directly brings about the alleged injury, our inquiry focuses on “whether the State provided a mantle of authority that enhanced the power of the harm-causing individual actor.” Tarkanian, 488 U.S. at 192. Unfortunately, there is no “infallible test” to employ in this analysis. Reitman v. Mulkey, 387 U.S. 369, 378 (1967). Rather, it is “‘[o]nly by sifting facts and weighing circumstances’ on a case-by-case basis [that] a ‘nonobvious involvement of the State in private conduct [can] be attributed its true significance.’” Id. (quoting 26 Burton v. Wilmington Parking Auth., 365 U.S. 715, 722 (1961)). The Supreme Court provided guidance as to what satisfies the Constitution’s state action requirement in Adickes v. S.H. Kress & Co., 398 U.S. 144 (1970). In that case, the Court explained that actions challenged on constitutional grounds fall somewhere along a continuum, with direct action by the State on one side and action by a “private party not acting against a backdrop of state compulsion or involvement” on the other. Id. at 168. Whereas the former meets the state action requirement for constitutional claims, the latter does not (although it could form the basis for a claim on statutory or common law grounds, depending on the alleged violation). The Court further elaborated that, along this continuum, the enactment of a state law “requiring” violation of individual rights, and “enforcement” of such a law establish the requisite state action. Id. at 170. “[A] State is responsible for the discriminatory act of a private party when the State, by its law, has compelled the act” or when the State has “commanded” a particular result. Id. (emphasis added) (citing Peterson v. City of Greenville, 373 U.S. 244, 248 (1963); Robinson v. Florida, 378 U.S. 153 (1964); Lombard v. Louisiana, 373 U.S. 267 (1963); Shuttlesworth v. Birmingham, 373 U.S. 262 (1963)). The first inquiry, then, is whether the Amended Rule can fairly be read to “require,” “compel,” or “command” routine use disclosures without consent. We conclude that it cannot. The fact that subsection (b) of the Rule expressly permits covered entities to obtain consent belies such an interpretation. See 45 C.F.R. § 164.506(b)(1) (“A covered entity may obtain consent 27 of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations.”) (emphasis added). Thus, the Amended Rule does not directly “provide a mantle of authority that enhance[s] the power of” health care providers and other entities, Tarkanian, 488 U.S. at 192. Citizens argue that the Amended Rule’s grant of “regulatory permission” to make the challenged uses and disclosures, see, e.g., 67 Fed. Reg. at 53,209, 53,211, 53,212 (discussing Amended Rule), indirectly provides the requisite “mantle of authority”. To demonstrate a link between the Amended Rule and private parties’ use and disclosure of Citizens’ health information without their consent, Citizens point to two sources: (1) changes in the privacy policies of covered entities, and (2) evidence that some entities have begun ignoring applicable state privacy laws. On the first point, Citizens have identified at least one covered entity that has adopted a blanket policy of refusing all requests for restrictions on uses and disclosures of health information since the promulgation of the Amended Rule.13 They further assert that 13 (See Appellants’ Br. at 26 (quoting Kaiser Permanente’s Notice of Privacy Practices (“You may request that we limit our uses and disclosures of your [personal health information] for treatment, payment, and health care operations purposes. However, by law, we do not have to agree to your request. Because we strongly believe that this information is needed to appropriately manage the care of our members/patients, it is our policy to not agree to requests for restrictions.”)).) 28 some covered entities have simply ignored applicable, more restrictive, state laws in making such uses and disclosures.14 Our reading of the case law discussed below, however, leads us to the conclusion that the fact that a private party changed its behavior in response to a law does not give the law the coercive quality upon which the state action inquiry depends unless the law itself suddenly authorized something that was previously prohibited. Citizens’ argument assumes (1) that 14 Citizens noted in their Reply Brief: As Plaintiffs noted at oral argument before the District Court, covered entities in Pennsylvania and Delaware are using and disclosing Plaintiffs’ health information without consent under the authority granted by the Amended Rule despite a Delaware law that prohibits such disclosures without “informed consent of the individual” and a Pennsylvania law that deems it “unprofessional conduct” and a licensure violation for a licensed health professional to “depart from or fail[] to conform to an ethical or quality standard of the profession.” (Appellants’ Reply Br. at 6 n.7 (citations omitted).) We note that, to the extent that these contentions are accurate, Citizens are free to pursue these covered entities directly under state law. That private entities are violating Citizens’ state statutory rights does not in any way imply that the Secretary has violated Citizens’ constitutional rights. 29 covered entities were previously prohibited from making nonconsensual uses or disclosures for routine uses and (2) that the Amended Rule’s “authorization” somehow permits uses or disclosures that were previously “unauthorized”. But there is no authority for either proposition. Citizens have not shown that federal law prohibited nonconsensual uses or disclosures of health information before the Rule was promulgated.15 And the preemption provisions of HIPAA and the Amended Rule expressly provide that any state statutes that prohibited such uses and disclosures before the Amended Rule was promulgated remain in effect.16 Because there is no indication that the 15 Citizens rely on Federal Rule of Evidence 501 and the recognition of common law evidentiary privileges establishing special treatment for such information to establish that the uses and disclosures “authorized” by the Rule were prohibited before its promulgation. (Appellants’ Reply Br. at 15.) But the Rule of Evidence and the common law of privilege are just evidentiary rules. They are not Acts of Congress or regulations that prohibit disclosure outside of court proceedings or otherwise provide Citizens with some affirmative “right” against disclosure of their information by private parties without their consent. 16 Citizens contend that a number of otherwise “more stringent” state laws provide exceptions for disclosures that are “authorized” or “permitted” by federal law. (See Appellants’ Reply Br. at 13-14 & n.9.) Whether or not that is the case, the fact remains that the Secretary has repeatedly emphasized that the Privacy Rule defers to states that impose stringent consent 30 nonconsensual uses and disclosures permitted by the Amended requirements. See, e.g., Standards for Privacy of Individually Identifiable Health Information, 67 Fed. Reg. 53,182, 53,212 (Aug. 14, 2002) (“The Privacy Rule provides a federal floor of privacy protection. State laws that are more stringent remain in force.”); Notice of Proposed Rulemaking, Standards for Privacy of Individually Identifiable Health Information, 64 Fed. Reg. 59,918, 59,997 (Nov. 3, 1999) (“We recognize that many State laws require patients to authorize or consent to disclosures of their health information for treatment and/or payment purposes. We consider individual authorization generally to be more protective of privacy interests than the lack of such authorization, so such State requirements would generally stand . . . .”). We take the Secretary’s assurances that the Privacy Rule leaves pre-existing state law privacy rights in place at face value, particularly in light of the express non-preemption provisions for “more stringent” state laws in HIPAA and the Privacy Rule. As such, we do not read the Rule to “authorize” or “permit” disclosures that state laws would otherwise prohibit. Cf. Fidelity Fed. Sav. & Loan Ass’n v. de la Cuesta, 458 U.S. 141, 154 (1982) (“When the administrator promulgates regulations intended to pre-empt state law, the court’s inquiry is . . . limited: ‘If [h]is choice represents a reasonable accommodation of conflicting policies that were committed to the agency’s care by the statute, we should not disturb it unless it appears from the statute or its legislative history that the accommodation is not one that Congress would have sanctioned.’” (quoting United States v. Shimer, 367 U.S. 374, 383 (1961)). 31 Rule were prohibited before the Rule went into effect, we have difficulty understanding how the Amended Rule “authorizes” covered entities to take action that they could not have otherwise taken. In the words of the Tarkanian test, Citizens have not shown how, by promulgating the Amended Rule, the Secretary “enhanced the power” of the covered entities to use or disclose health information without patients’ consent; covered entities had this power already. By way of analogy, assume that Congress were to pass legislation permitting private cinema operators, at their discretion, to search all moviegoers for any reason, without any showing of probable cause or reasonable suspicion. Although the Fourth Amendment would preclude the federal government from conducting such a search, private cinema operators are not bound by the Fourth Amendment, and absent any other law prohibiting it, private cinema operators were already “permitted” to conduct such a search before the new legislation took effect. To the extent that this new legislation changes the legal landscape at all, then, it only codifies a power that cinema operators had already. The codification does not transform the private exercise of the codified power into “state action.” Similarly, although the codification itself is clearly government action, it seems insufficient to endow a moviegoer’s challenge to a search by a cinema operator with constitutional significance given that the codification has neither enhanced nor diminished the individual moviegoer’s rights. None of the cases that Citizens or amici cite supports the view that a government authorization of conduct that was already legally permissible satisfies the constitutional state 32 action requirement. It is true that these cases find state action based on the enactment of statutes that permit private parties to infringe the constitutional rights of others.17 But the laws that the Supreme Court has struck down in these cases allowed private parties to take some action (usually discrimination based on race) where they would otherwise have been prohibited from doing so. In other words, the Court found that the state, by enacting these laws, had “empowered” private parties to act in ways that would have been prohibited but for the enactment of the law. As we explained above, that is not the case here. The Supreme Court’s decision in Reitman v. Mulkey, 387 U.S. 369 (1967), illustrates this point. That case involved a constitutional challenge to an amendment to the California Constitution that allowed private persons absolute discretion to refuse to sell, lease, or rent property to another. The amendment 17 (Amicus Br. of Texas Civil Rights Project at 11-14 (citing Reitman v. Mulkey, 387 U.S. 369 (1967) (California Constitution could not provide that all persons have the absolute discretion to refuse to sell, lease, or rent property to another); Gilmore v. City of Montgomery, 417 U.S. 556 (1974) (city could not allow private groups to use and control city facilities where those private groups could deny access to the facility on the basis of race); Nixon v. Condon, 286 U.S. 73 (1932) (state statute could not permit political parties to deny party membership on the basis of race); McCabe v. Atchison, Topeka, & Santa Fe Railway Co., 235 U.S. 151 (1914) (state statute could not permit railway to provide accommodations for Caucasian patrons, but not African American patrons)).) 33 effectively nullified California statutes that prohibited racial discrimination in private housing transactions. Id. at 374. The California Supreme Court reasoned that, because the State had taken affirmative action designed to make private discrimination legally possible–changing the situation from one in which private discrimination was restricted by statute to one in which it was encouraged–the State was at least a partner in the challenged discrimination. Id. at 375. The Court noted that the State could maintain a neutral position regarding private discrimination and was not bound by the Federal Constitution to forbid it. But once the State acted in a way that encouraged private discrimination, even if it stopped short of mandating such action, it crossed the constitutional line. Id. The United States Supreme Court affirmed the judgment of the California Supreme Court. The Court rejected petitioners’ argument that the state court’s reasoning was flawed because it meant that the mere repeal of a statute that prohibited private racial discrimination could be said to “authorize” or “encourage” discrimination simply because it permitted that which was formerly proscribed, pointing out that the challenged state action in case was not “the mere repeal” of prior antidiscrimination laws. Id. at 376. Rather, the offensive action was the state’s authorization and “constitutionalization” (under the state constitution) of the previously forbidden private right to discriminate. Id. Consequently, the amendment had a much broader impact than the mere repeal of existing statutes: Private discriminations in housing were now not only free from [the previously enacted anti- discrimination statutes] but they also enjoyed a far 34 different status than was true before the passage of those statutes. The right to discriminate, including the right to discriminate on racial grounds, was now embodied in the State’s basic charter, immune from legislative, executive, or judicial regulation at any level of the state government. Those practicing racial discriminations need no longer rely solely on their personal choice. They could now invoke express [state] constitutional authority, free from censure or interference of any kind from official sources. Id. at 380-81 (emphasis added).18 In other words, the amendment was constitutionally offensive not only because it 18 The Court reiterated this reasoning at the conclusion of the majority opinion: Here we are dealing with a provision which does not just repeal an existing law forbidding private racial discriminations. [The amendment] was intended to authorize, and does authorize, racial discrimination in the housing market. The right to discriminate is now one of the basic policies of the State. The California Supreme Court believes that the [amendment] will significantly encourage and involve the State in private discriminations. We have been presented with no persuasive considerations indicating that these judgments should be overturned. Reitman, 387 U.S. at 380-81. 35 now permitted conduct that was previously prohibited, but also because it affirmatively protected such conduct under the state constitution. The Reitman Court elaborated on this principle by referring to its ruling in Nixon v. Condon, 286 U.S. 73 (1932). It noted that, in Nixon, the Court was faced with a statute empowering the executive committee of a political party to prescribe the qualifications of its members for voting or for other participation, but containing no directions with respect to the exercise of that power. This was authority which the committee otherwise might not have had and which was used by the committee to bar Negroes from voting in primary elections. Reposing this power in the executive committee was said to insinuate the State into the self-regulatory, decision-making scheme of the voluntary association; the exercise of the power was viewed as an expression of state authority contrary to the Fourteenth Amendment. Reitman, 387 U.S. at 379 (discussing Nixon) (emphasis added). As in Reitman, then, the Nixon Court found that the enactment of the statute satisfied the state action requirement because the challenged law provided the committee with a power that it “otherwise might not have had.” Id. Because the Amended Rule does not endow covered entities with any power that they did not have otherwise, the action of the Secretary that Citizens challenge does not fit the Reitman / Nixon mold. 36 The Amended Rule has not enhanced covered entities’ power, under federal or state law, to use or disclose confidential health information without patients’ consent. The Rule does not “compel” or “command” or “require” that private entities use information without patients’ consent. See Adickes, 398 U.S. at 170. Nor has the Rule changed the situation from one in which nonconsensual routine uses and disclosures were prohibited to one in which they are now encouraged, see Reitman, 387 U.S. 369, or conferred authority on health care providers that they might not have had otherwise. See Nixon, 286 U.S. 73. Accordingly, we conclude that the Secretary’s promulgation of the Amended Rule does not satisfy the Constitution’s state action requirement. The fact that covered entities are construing the “may use” language as constituting a new federal seal of approval, and may be ignoring state laws regarding protections to be afforded to such information, is regrettable and disquieting. That routine requests for privacy are apparently being ignored by covered entities is even more unfortunate. But our task here is to determine the constitutionality of the Amended Rule, not the propriety of covered entities’ actions under state or common law. Because, for all of the reasons stated above, the covered entities’ actions that Citizens challenge do not implicate the federal government, we reject Citizens’ Fifth Amendment claim.