National Coalition of Mental Health Professionals and Consumers, Inc.

an educational foundation and advocacy organization serving mental health consumers and professionals

ANALYSIS OF DECISION IN
CITIZENS FOR HEALTH v. LEAVITT
United State Court of Appeals No. 04-2550
November 2, 2005

            On November 1, 2005, the United States Court of Appeals for the Third Circuit issued its ruling in the above case after nearly nine months of deliberation.  Despite the fact that the Court seemed quite interested and receptive to Plaintiffs’ arguments at oral argument on March 9, the Court affirmed the decision of the District Court avoiding ruling on the constitutional claims and holding that the Amended HIPAA Privacy Rule is valid under the HIPAA statute and the Administrative Procedure Act.  The decision, however, is quite different in significant respects from the District Court decision, contains numerous rulings in favor of the Plaintiffs and also contains several significant errors.

Holdings and Findings in favor of Plaintiffs

            The Court agreed with Plaintiffs’ argument that it must assume that there are no material issues of fact in dispute and that all sworn allegations by the Plaintiffs in affidavits, exhibits and the verified amended complaint must be taken as true. Dec. at 17. Thus, all allegations of privacy violations described in nearly 30 affidavits and hundreds of exhibits are assumed to be true for the purposes of this case because none were disputed by the government.  Those affidavits and exhibits show that on April 14, 2003, the implementation date of the Amended Rule, covered entities and their business associates changed their past practices and began to routinely violate the medical privacy of the Plaintiffs.  The Court finds “the fact” that this is happening under the “federal seal of approval” provided by the Amended Rule “is regrettable and disquieting”, and the fact that disclosures are being made under the Rule over the Plaintiffs’ objections “is even more unfortunate”.  Dec. at 37.

            Based on those undisputed facts, the Court concluded that the Plaintiffs had demonstrated “standing” to bring their claims by showing the following.  The Plaintiffs have suffered “injury in fact” to their medical privacy. That injury “is causally connected and traceable” to the issuance of the Amended Privacy Rule. The injury that Plaintiffs are suffering can be redressed by enjoining the Rule.  Dec. at 18-19, n.9.  The Court thereby also ruled in the Plaintiffs’ favor on a question raised by the Chief Judge of the panel at the oral argument—that is, whether the Original Rule would be reinstated if the Amended Rule were declared invalid.  The Court appears to have adopted the Plaintiffs’ argument that the Original Rule, with the right of consent, would be reinstated.

            Also the Court appears to have ruled in Plaintiffs’ favor that the issues raised by the Plaintiffs are “justiciable” since the correct parties are before the Court.  This was an issue the parties were asked to address in post-hearing briefs.

            The Court acknowledges that the Amended Rule grants “regulatory permission” for covered entities and their business associates to disclose the Plaintiffs’ identifiable health information without their consent and against their will. Dec. at 28. 

            While the Court does not directly address the Constitutional claims, it acknowledges that the “strict scrutiny” test rather than a balancing test may be appropriate for “severe intrusions” on personal privacy. Dec. at 22, n. 10.

Errors in the Decision

            There are at least three errors in the decision that are puzzling.  First, the Court analyzes and rejects “Citizens’ argument” that the Secretary failed to provide adequate notice of the rescission of the consent requirement in the Original Rule.  Dec. at 41. The problem with this part of the decision is that Plaintiffs did not raise this issue on appeal nor did they present any arguments to the Court on this point. Thus, it appears that the Court simply took the District Court decision and tried to cure its shortcomings.

            Second, the Court rejects the First Amendment “chilling” of private speech argument by citing and comparing the decision in South Carolina Med. Ass’n v. Thompson, 327 F.3d 346, 355 (4^th Cir. 2003). However, this case did not involve the Amended Rule or the right of consent in any way.

            Third, the Court cited a line of cases relied on by the Plaintiffs and the Amici that stand for the opposite conclusion reached by the Court. Dec. at 33-36. (See below.)

The Constitutional Claims

            The Court avoids consideration of the Plaintiffs’ claims that the Amended Rule violates the Plaintiffs’ Fifth Amendment right to privacy and First Amendment right to private conversations with their physicians. The sole reason for refusing to consider the claims is that the Court cannot find any “state action” in the injury suffered by the Plaintiffs because the Amended Rule did not “enhance the power” of covered entities to use or disclose health information without consent because covered entities “had this power already”.  Dec. 32.  According to the Court: “Because there is no indication that the nonconsensual uses and disclosures permitted by the Amended Rule were prohibited [under federal law] before the Rule went into effect, we have difficulty understanding how the Amended Rule ‘authorizes’ covered entities covered entities to take action they could not otherwise have taken.” Dec. at 32. The Court relied heavily on the fact that the Amended Rule did not preempt State privacy laws that are more protective. Dec. at 30-31.

            The Court ignores a point made at considerable length in Plaintiffs’ briefs and discussed at length during the oral argument that more stringent state laws are in effect preempted by the Amended Rule because it authorizes the use and disclosure of individuals’ health information without notice, so it would be impossible for Plaintiffs to assert their privacy rights under state law. The Court merely concludes that it takes “at face value” the Secretary’s assurances that the Amended Rule leaves pre-existing state privacy rights in place. Dec. at 31, n.16. Further, the Court ignores the prior holdings of the Third Circuit that the right to health information privacy has become so well established in federal constitutional case law at least since 1977 that no reasonable government official could be unaware of it.  Gruenke v. Seip, 225 F.3d 290 (3^rd Cir. 2000); Sterling v. Borough of Minersville, 232 F.3d 190 (3^rd Cir. 2000).

            So the principle announced by this decision would permit the government to infringe any right that individuals would otherwise expect to have if the government merely “codifies” the private conduct in a governmental law. The Court cites the holding by the Supreme Court in Reitman v. Mulkey, 387 U.S. 369, 380-81 (1967) to the effect that state action exists where the government action was “intended” to damage the plaintiffs’ interest and it has that effect. Dec. at 35, n. 18.  As Plaintiffs showed, the Amended Privacy Rule was expressly intended to eliminate the right of consent in the interest of efficiency, and it is indisputably having that effect. Thus, the decision cited by the Court (and relied on by the Plaintiffs) seems to undermine its holding.

            The disturbing implication of the Court’s holding is illustrated by an example it gives.  According to the Court, there would be no state action and no constitutional violation if Congress enacted a law permitting cinema operators, at their discretion, to search all moviegoers without any showing of probable cause or reasonable suspicion because the law granting federal “regulatory permission” would be merely “codifying” power the cinema operators had already. Dec. at 32. Ironically, in the same week that we celebrate the life of Rosa Parks, it would appear that the Court’s rationale would permit the federal government to enact a law granting regulatory permission to bus companies to require minorities to ride in the back of a bus as long as the companies could have adopted such a requirement on their own. Thus, it would appear that the Court’s ruling could be an incentive for the federal “outsourcing” of the violation of fundamental rights.

            The Court’s ruling seems to rely heavily on the fact that the Amended Rule did not preempt stronger state health information privacy laws.

The Statutory Claims

            The Court also rejected the statutory claims with little analysis. Dec. 39-40.  The Court failed to address the legislative history of the statute and HHS’ analysis of that history cited by the Plaintiffs even though the statute is indisputably vague.

The Administrative Procedure Act Claims

             Not only did the Court address an argument that Plaintiffs did not make, the Court summarily rejected the arguments that Plaintiffs made without addressing significant points. For example, it is undisputed that the Secretary cited the same study to support recognizing and rescinding the right of consent.  It is further undisputed that the Secretary reversed the policy decision on consent based on precisely the same evidence that he relied on to adopt a right of consent in the Original Rule. It is difficult to imagine a clearer example of a rule that is arbitrary and capricious and invalid under the Administrative Procedure Act.

For more information, contact Jim Pyles, counsel for Plaintiffs, (202) 466-6550, jim.pyles@ppsv.com.