National Coalition of Mental Health Professionals and Consumers, Inc.

an educational foundation and advocacy organization serving mental health consumers and professionals

JIM PYLES FINAL UPDATE AS OF 10/06

From: Jim.Pyles  04 Oct 2006

Dear all, 

Although we have not been notified, the Associated Press is reporting that the Supreme Court has denied the petition for certiorari in the case of Citizens for Health, et al. v. Leavitt. The attention this case has received in the media and from constitutional and health lawyers around the country illustrates its significance. 

This case was filed on April 10, 2003, on behalf of ten national and state practitioner and consumer associations representing over 600,000 individuals, four days before the final implementation date of the Amended Health Information Privacy Rule issued under the Health Insurance Portability and Accountability Act (HIPAA). It challenged the constitutionality of an amendment to that rule that reversed the traditional privacy right recognized in the Original Privacy Rule for patients to have their identifiable health information used or disclosed in routine situations only with their consent. (The complaint also included certain statutory and procedural rulemaking challenges but the constitutional claims formed the core of the suit.) 

The Supreme Court's denial of the petition for certiorari lets stand a decision by the United States Court of Appeals for the Third Circuit that refused to address the constitutional claim on the grounds that there was no "state action", that is, that the damage suffered by the plaintiffs in the case occurred at the hands of private entities rather than the federal government, and therefore, there can be no constitutional violation because the Constitution protects citizens from the government rather than from each other. That decision leaves open the question of whether the HIPAA privacy rule, or any health information privacy legislation or rule, would be constitutional if it were proven that the federal government used such authority to directly to deprive individuals of their health information privacy.  

Factual and legal issues that were established in the case include the following: 

1.  The plaintiffs alleged that the amendment to the Original Privacy Rule, violated their right to privacy under the First, Fourth, Fifth and Ninth Amendments by eliminating the right of consent and granting "regulatory permission" for covered entities routinely to use and disclose the identifiable health information of the plaintiffs and their patients without notice or consent and over their objection.    

2. The District Court and Court of Appeals agreed that the right to medical privacy asserted by the plaintiffs "is legally cognizable under the Due Process Clause of the Fifth Amendment".  

3. The right of consent was eliminated from the Health Information Privacy Rule despite the fact that the overwhelming majority of comments from consumers and practitioners opposed eliminating the right. Elimination of the right of consent was supported principally by health insurers. 

4. The District Court and Court of Appeals decisions found that the health information privacy of the plaintiffs in the case was, in fact, violated by hundreds of private entities invoking the Amended Health Information Privacy Rule on and after its implementation date of April 14, 2003. 

5. Although the Rule allowed individuals to seek a right of consent by requesting restrictions on the use and disclosure of their identifiable health information, all such requests filed by the plaintiffs were summarily denied by covered entities. Some covered entities had policies of never granting any such requests. 

6. Prior to the April 14, 2003 implementation date of the Amended Privacy Rule, all health providers and physicians had provided a right of consent for routine uses and disclosures of identifiable health information, but after that date, that right was no longer afforded. 

7. Accordingly, the District Court and the Court of Appeals both found that the plaintiffs had suffered "injury in fact" that was caused directly by the Amended Rule and that this injury would be redressed by invalidating the amendment to the rule that eliminated the individual's right of consent and granted federal authority for the use and disclosure of identifiable health information.  

8. The District Court avoided addressing the constitutional claims on the grounds that the plaintiffs were merely seeking to obtain a privacy protection--the right of consent--that the constitution did not require the federal government to provide.

9. The Court of Appeals agreed that the District Court misperceived the plaintiffs' claim in that they were not seeking a new privacy protection but rather seeking relief from federal "regulatory permission" granted to covered entities to deprive plaintiffs of their health information privacy. The Court of Appeals, however, avoided addressing the constitutional claims on the grounds that, even though the plaintiffs' health information privacy was eliminated by covered entities exercising authority granted by the Amended Rule, covered entities had the discretion under the rule to elect to not eliminate the plaintiffs' health information privacy, therefore the federal government had not "compelled" or "commanded" the result. In other words, covered entities theoretically could have elected to not deprive the plaintiffs of their health information privacy, even though none had.

10. The Court of Appeals stated that it was expressing no opinion on the scope of the federal constitutional right to privacy or whether the injuries suffered by the plaintiffs would amount to a constitutional violation if they were directly attributable to a state actor. The Court also stated that it was expressing no opinion on whether routine disclosures by the federal government acting as a covered entity administering the Medicare, Medicaid and Indian Health Services programs would amount to a violation of the constitutional right to privacy.  The Court found that even though the federal government is a "covered entity" when it administers these programs, there was no evidence in this case of specific disclosures by the federal government, so whether such a disclosure would satisfy the "state action" requirement for a constitutional claim was outside of the scope of the appeal. 

If anyone is wondering why evidence of direct federal violations of patient privacy were not cited, it actually was in that we cited in the petition for certiorari that the HHS is actually using notices of privacy practices in Medicare and the Indian Health Services program stating that they are routinely disclosing identifiable health information under the authority granted by the Amended Rule. Also, remember that the state action issue was first raised by the Court of Appeals in its decision. The issue had not be raised or addressed by the parties, the District Court, or the Court of Appeals at oral argument or in the issues on which it requested post-hearing briefs. 

I would be glad to provide further information. 

Jim   

James C. Pyles
Powers, Pyles, Sutter and Verville, P.C.
1875 Eye Street, NW
Washington, D.C. 20006
e-mail: jim.pyles@ppsv.com
Telephone (202) 466-6550
Fax       (202) 785-1756 

Citizens for Health v. Michael O. Leavitt can be found at:
Page 74 of the Denied Certiore Petitions:

http://www.supremecourtus.gov/orders/courtorders/100206pzor.pdf