Court Holds Florida Statute Preempted by HIPAA
A federal court in Florida recently held that a state statute requiring nursing homes to furnish patient information to an individual’s “representative” was overly broad and pre-empted by the federal Health Insurance Portability and Accountability Act (“HIPAA”). The case is notable because it demonstrates the importance of strict compliance with HIPAA wherever patient information is concerned – even if a state law provides otherwise.
In Opis Management Resources, LLC, et al. v. Dudek, Plaintiff operated several nursing home facilities. Under Florida state statute, nursing homes are required to “furnish to the spouse, guardian, surrogate, proxy, or attorney in fact… for a former resident… a copy of that resident’s records which are in possession of the facility.” Fla. Stat. §400.145. After Plaintiff refused to provide healthcare records of deceased residents, the Florida Agency for Health Care Administration cited Plaintiff for violation of the statute. In response, Plaintiff claimed that the statute was preempted by HIPAA and therefore they could not comply without violating the federal law, and sought declaratory judgment with the U.S. District Court for the Northern District of Florida.
On review, the Court noted that HIPAA provides that a “covered entity” (such as the nursing home in this case) may not disclose patient information except to the patient, or to the patient’s “personal representative.” Pursuant to HIPAA, a “personal representative” includes an executor, administrator, or other person who has authority under state law to act on behalf of a deceased individual or of the individual’s estate.
After a detailed analysis of the variations between “personal representative” as defined in the HIPAA statute and Florida state law, the Court concluded that the Florida state statute requiring the nursing home to turn over records was overly broad and therefore preempted by HIPAA. Cases like Opis Management highlight the need for health care providers to be well-acquainted with HIPAA and be able to recognize when a seemingly innocuous state or municipal law may run afoul of the federal Act. Providers with questions about HIPAA should contact Mercedes Varasteh Dordeski at (248) 952-0400.
The case is Opis Management Resources, LLC v. Dudek, Case No. 4:11-cv-00400 (N.D. Fla. December 2, 2011).
