CopyCited 4 times | Published | Court of Appeals for the Eleventh Circuit | 2014 U.S. App. LEXIS 19311, 2014 WL 5072710
...requiring presuit actions by an individual plaintiff before he may bring a medical
Case: 13-14637 Date Filed: 10/10/2014 Page: 2 of 36
negligence claim in Florida state court. The district court held that one of those
presuit requirements in Florida Statute § 766.1065—that the plaintiff execute a
written authorization form for release of protected health information—is
preempted by a federal statute, the Health Insurance Portability and Accountability
Act (“HIPAA”), and its accompanying regulations, see 45 C.F.R. §§ 164.508,
164.512. That authorization form—required by § 766.1065 as a pre-condition to
filing a medical negligence claim—allows the prospective defendant to obtain
documents and conduct ex parte interviews of the prospective plaintiff’s medical
providers on matters pertinent to the medical negligence claim. Fla. Stat.
§ 766.1065.
After oral argument and careful review of the record and the parties’
submissions, we conclude that the written authorization form, required by Florida
statute § 766.1065, is fully compliant with the HIPAA statute and its regulations
and the state and federal law are not in conflict. Accordingly, there is no federal
preemption of § 766.1065, and the district court’s entry of judgment in favor of the
plaintiff is reversed.
I....
...Stat. §
766.203(2).
Murphy was ready to file his lawsuit but first had to comply with Florida’s
numerous presuit requirements. We review the presuit requirements in §
766.106
not challenged here in order to place the challenged statute, §
766.1065, in context.
II....
...Id. §
766.106(4). No statements,
discussions, documents, or reports generated in this presuit-screening process are
discoverable or admissible in any civil action. Id. §
766.106(5). We now examine
the Florida statute challenged here, which is §
766.1065.
4
Case: 13-14637 Date Filed: 10/10/2014 Page: 5 of 36
III. FLA. STAT. §
766.1065
Section
766.1065 took effect on July 1, 2013. See 2013 Fla. Sess. Law Serv.
Ch. 2013-108, § 7 (S.B. 1792) (West). Section
766.1065 governs all causes of
action accruing before, on, or after that date. Id. § 6(1).
Section
766.1065 requires that an “authorization for release of protected
health information” accompany the 90-day presuit notice required by §
766.106(2),
and the authorization must be in the written form specified by §
766.1065. Fla.
Stat. §
766.1065(1)....
...The form authorizes “the disclosure of protected health
information that is potentially relevant to the claim of personal injury or wrongful
death.” Id. The presuit notice is void if the plaintiff does not provide the
authorization form. 1 Id.
Section 766.1065(3) includes the precise language that a valid, written
authorization must contain. The Florida legislature expressed its intent to make the
presuit authorization form consistent with HIPAA. Specifically, § 766.1065(3)
mandates that the authorization “shall be construed in accordance with the
‘Standards for Privacy of Individually Identifiable Health Information’ in
45 C.F.R. parts 160 and 164”—HIPAA’s Privacy Rule. Id. § 766.1065(3)....
...In
addition, the authorization must inform the plaintiff that signing the form “is not a
1
If, after giving the authorization, a plaintiff revokes the authorization, the presuit notice
“is deemed retroactively void from the date of issuance.” Id. § 766.1065(2).
5
Case: 13-14637 Date Filed: 10/10/2014 Page: 6 of 36
condition for continued treatment, payment, enrollment, or eligibility for health
plan benefits.” Id. § 766.1065(3)(H).
On the statutorily prescribed form, the plaintiff must include a list of all the
names and addresses of “all health care providers” known who either:
(1) “examined, evaluated, or treated the Patient in connection with injuries
complained of after the alleged act of negligence,” or (2) “examined, evaluated, or
treated the Patient during a period commencing 2 years before the incident” giving
rise to the claim. Id. § 766.1065(3)(B). This authorization, however, does not
apply to health care providers or information that the plaintiff certifies “is not
potentially relevant” to the injury “that is the basis of the accompanying presuit
notice.” Id. § 766.1065(3)(C)....
...arte interviews, stating:
“This authorization expressly allows the persons or class of persons
listed . . . above to interview the health care providers listed . . . above, without the
presence of the Patient or the Patient’s attorney.” Id. § 766.1065(3)(E)....
...Those
“persons or class of persons” include the doctor defendant, his insurer, adjuster,
6
Case: 13-14637 Date Filed: 10/10/2014 Page: 7 of 36
experts or attorneys. Id. § 766.1065(3)(D)-(E)....
...or an interview.”).
The authorization form must provide that the authorization “expires upon
resolution of the claim or at the conclusion of any litigation instituted in connection
with the matter . . . , whichever occurs first.” Id. § 766.1065(3)(F)....
...authorization” but doing so renders the presuit notice retroactively void, and (2) the
plaintiff “understands that signing this authorization is not a condition for
continued treatment, payment, enrollment, or eligibility for health plan benefits.”
Id. §
766.1065(3)(G)-(H).
Importantly, the last paragraph in the authorization form must warn the
plaintiff “that information used or disclosed under this authorization may be
2
Section
766.106(6)(b)(5) provides that when the...
...7
Case: 13-14637 Date Filed: 10/10/2014 Page: 8 of 36
subject to additional disclosure by the recipient and may not be protected by
federal HIPAA privacy regulations.” Id. § 766.1065(3)(I)....
...release . . . violates his
federal rights under [HIPAA].” 3 Murphy’s complaint contended that: (1) HIPAA’s
Privacy Rule protects “personal health and medical information from uses not
related to medical and health care”; (2) Florida’s § 766.1065 “authorizes
3
The complaint also named as a defendant “Adolfo C....
...procedures at variance from, and in derogation of, what is authorized by federal
law” under the Supremacy Clause; and (3) therefore, “HIPAA expressly preempts
these contrary procedures.”
The complaint requested: (1) a declaratory judgment that HIPAA preempted
§ 766.1065’s presuit authorization requirement and (2) an injunction against forced
compliance with § 766.1065 in the event Murphy sued Dr....
...The district court found that Murphy had retained experts already and his
decision to give presuit notice depended on whether he had to authorize ex parte
interviews. The district court also found that Dr. Dulay and his representatives
wanted to conduct the ex parte interviews allowed by § 766.1065.
The district court held that “consent given only in an authorization that is
required by Florida law as a presuit condition is not voluntary.” Because the
§ 766.1065 authorization form was not voluntary, the district court concluded that
§ 766.1065 would result in disclosure of Murphy’s HIPAA-protected health
information without his consent and without other safeguards in HIPAA and its
regulations. Thus, § 766.1065 was contrary to the HIPAA provisions and
9
Case: 13-14637 Date Filed: 10/10/2014 Page: 10 of 36
preempted....
...relevant to this case—the privacy and disclosure regulations in parts 160 and
164—exceed the scope of the Secretary’s delegated authority, or (2) that the
Florida legislature could permissibly enact a statute contrary to those HIPAA
regulations. Rather, they argue that § 766.1065 is consistent with both the HIPAA
statute and the HIPAA regulations. Thus, we outline the relevant HIPAA
regulations and then analyze whether § 766.1065 is contrary to them.
5
HIPAA, however, does not preempt state laws that provide “more stringent” privacy
protections....
...and no longer be protected by [HIPAA].” Id. § 164.508(c)(2), (b)(4).
In short, the HIPAA regulations mandate that an authorization contain many
different elements in order to be a valid authorization. The authorization form
required by § 766.1065 must have those same HIPAA elements to be valid too.
The HIPAA regulations also set forth circumstances when a written
authorization is invalid, specifically: (1) “[t]he expiration date has passed or the
expiration event is kno...
...or benefits on an
individual’s signing an authorization if the disclosure of protected health
information is necessary to determine payment. See id.
X. PREEMPTION ANALYSIS
With this background, we examine whether § 766.1065 is contrary to
HIPAA and its regulations.
A. § 766.1065 Authorizations Meet HIPAA’s Requirements
The HIPAA regulations expressly allow the release of protected health
information upon the signing of a valid authorization. Our first task is to determine
whether the presuit authorization form required by § 766.1065 meets the HIPAA
requirements for a valid, written authorization.
As outlined above, the HIPAA regulations include explicit details about
what an authorization must contain to be valid under HIPAA. In turn, the Florida
statute, in § 766.1065, provides the precise form that a presuit authorization must
23
Case: 13-14637 Date Filed: 10/10/2014 Page: 24 of 36
take, ensuring that the form meets each of the required elements set forth in the
HIPAA regulations. To the extent that there remains any ambiguity, § 766.1065
explicitly states that presuit authorizations “shall be construed in accordance with
the [HIPAA requirements].” Fla. Stat. § 766.1065(3). Thus, the plain text of
§ 766.1065 makes clear that it requires presuit authorizations to meet HIPAA’s
requirements.
Murphy argues that the § 766.1065 authorization fails to satisfy HIPAA’s
required elements for four reasons, each of which lacks merit.
First, Murphy views the authorizations required by § 766.1065 as
irrevocable and, therefore, in conflict with the HIPAA regulations’ requirement
that an authorization be revocable. See 45 C.F.R. § 164.508(b)(5). This is not so.
Subsection (2) of § 766.1065 plainly contemplates a plaintiff’s ability to revoke the
required authorization. See Fla. Stat. § 766.1065(2) (“If the authorization required
by this section is revoked . . . .”). Further, subsection (3) explicitly requires that
the authorization include the phrase “the Patient has the right to revoke this
authorization in writing.” Id. § 766.1065(G). There is a consequence for
revocation, though—that the presuit notice is deemed retroactively void. As a
result, and if too much time passes, a plaintiff’s medical negligence claim may be
barred by the statute of limitations. See id. § 766.1065(2)....
...24
Case: 13-14637 Date Filed: 10/10/2014 Page: 25 of 36
any consequences; they just require that an authorization be revocable. The
Florida statute requires the same.
Second, Murphy argues that § 766.1065 authorizations are non-HIPAA
compliant because they require a plaintiff to list health care providers to whom the
presuit authorization does not apply, as well as those to whom it applies....
...medical history for any purpose. It is no defect, therefore, that the Florida presuit
authorization permits disclosure of some information that may be irrelevant to the
plaintiff’s medical negligence claim.
Third, Murphy contends that the authorizations required by § 766.1065 do
not meet the HIPAA regulations’ specificity requirement....
...at 82,517. Importantly, “[t]here are no limitations on
the information that can be authorized for disclosure,” and an individual may
authorize a health care provider to release all of his medical records. Id. Here, the
authorization form in § 766.1065 specifically authorizes the release of health
information held by health care providers that the plaintiff identifies, including
those who have examined, evaluated, or treated him (or who will do so) in
connection with the complained-of injury; and those who have examined,
evaluated, or treated him two years prior to the injury. Fla. Stat. § 766.1065(3)(B).
Murphy may not like the breadth of the authorization required by § 766.1065, but
the HIPAA regulations do not require that authorizations be narrow, simply that
they be specific.
And in accordance with HIPAA’s requirement that a valid authorization
form include “[a] description of each purpose of the requested use or disclosure,”
45 C.F.R. § 164.508(c)(1)(iv), § 766.1065’s authorization form states that
disclosure is authorized for the following “specific purposes”: (1) “[f]acilitating the
investigation and evaluation” of the claim; (2) “[d]efending against any litigation
arising out of” the claim; or (3) “[o]btaining legal advice or representation arising
out of” the claim. Fla. Stat. § 766.1065(3)(A).
26
Case: 13-14637 Date Filed: 10/10/2014 Page: 27 of 36
The form’s limitation on how disclosed information may be used, however,
does not alter the form’s clear description of which information may be turned
over. Section 766.1065’s authorization form is clear that all information in the
listed doctors’ possession, both verbal and written, is subject to disclosure....
...The
form is also clear that disclosed information may be used only to investigate and
defend the medical negligence claim. Doctors will have no difficulty discerning
the obvious purpose of a defendant’s request when presented with a signed
authorization. Therefore, § 766.1065’s authorization form fully satisfies HIPAA’s
requirement that the information permitted for disclosure be identified “in a
specific and meaningful fashion.” 45 C.F.R. § 164.508(c)(1)(i).
Fourth, Murphy argues that § 766.1065 requires a prohibited compound
authorization. See 45 C.F.R. § 164.508(b)(3). He reasons that a compound
authorization is an authorization combined “with any other document” and that
§ 766.1065 requires an authorization combined with a 90-day presuit notice.
However, as explained above, a compound authorization is created when “an
authorization for the use and disclosure of protected health information is
combined with any other legal permission.” 78 Fed....
...Accordingly, the fact that the authorization must be sent out with the
presuit notice does not create an impermissible compound authorization.
In summary, after reviewing the HIPAA regulations, we conclude that the
authorization form required in § 766.1065 complies with HIPAA. Indeed,
§ 766.1065 expressly requires that an individual execute a HIPAA-compliant
authorization before bringing a medical negligence claim....
...romulgated the
regulations, before filing a medical negligence complaint in state court.
Conditioning the use of the state courts on compliance with a federal provision
(HIPAA) does not conflict with that federal provision (HIPAA).
Because § 766.1065 is consistent with HIPAA’s requirements for disclosure
by written authorization, it is also irrelevant whether § 766.1065 calls for
procedures that satisfy the requirements of another HIPAA disclosure exception—
including the exception for disclosure by judicial process. See 45 C.F.R.
§ 164.512(e)(1)(i)-(ii). Clearly, § 766.1065 does not provide the same privacy
safeguards as those called for in the judicial-process exception....
...disclose protected health information without the written authorization of the
individual” (emphasis added)). Accordingly, no other HIPAA exception for
disclosure needs to be satisfied once an individual signs a valid written
authorization.
B. Mandatory Nature of § 766.1065
Because § 766.1065’s authorization form meets HIPAA’s required elements
to be a valid authorization, Murphy is left to focus on the mandatory nature of
§ 766.1065. Because § 766.1065 requires HIPAA authorizations as a mandatory
pre-condition to filing a medical negligence claim in Florida court, Murphy argues
individuals are being coerced by the State of Florida to sign them. Murphy
contends that HIPAA requires all authorizations be signed voluntarily to be valid,
and thus § 766.1065 violates HIPAA....
...§ 164.508(b)(4).
30
Case: 13-14637 Date Filed: 10/10/2014 Page: 31 of 36
Second, Murphy, and others like him, voluntarily choose to seek redress for
grievances through Florida’s judicial system. By enacting § 766.1065, the State
conditioned an individual’s ability to use a state-provided resource to advance
medical negligence claims—the state judicial system—upon that individual’s
executing a limited HIPAA authorization in a form that complies with HIPAA’s
requirements....
...Rejecting the plaintiffs’ argument that the
presuit authorization they signed was invalid because it was involuntary, the court
held “while it is true that the [plaintiffs] could not have proceeded with their suit if
10
Both Texas and Tennessee have enacted statutes similar to § 766.1065....
...32
Case: 13-14637 Date Filed: 10/10/2014 Page: 33 of 36
filing suit, a plaintiff’s decision whether to file suit is still a voluntary one.” Id.
at 557. 11
Fourth, Florida’s § 766.1065 statute is not preempted even if we accept
Murphy’s argument that HIPAA contains an implicit requirement of voluntariness.
As outlined above, the HIPAA regulations set forth numerous core elements that
must be in an authorization form in order for that authorization to be valid....
...In Allen, the Georgia statute did not
“expressly provide[] that the requisite authorization comply with the provisions of HIPAA” and
did not require that the authorization give notice of a plaintiff’s right to revoke. 644 S.E.2d at
816. Unlike the Georgia statute, Florida’s § 766.1065 requires that authorizations conform to
HIPAA’s requirements. See Fla. Stat. § 766.1065(3). Moreover, the Georgia Supreme Court’s
analysis suggests that, had the Georgia statute contained a provision like the § 766.1065(3)—
requiring that authorizations meet HIPAA’s requirements—the court would have upheld it. See
Allen, 644 S.E.2d at 816.
Recently, a Florida circuit court in Escambia County ruled that HIPAA does not preempt
the presuit authorization requirement in § 766.1065....
...At the same time, the Secretary acknowledges that some coercion is allowed
by expressly permitting Medicaid benefits, financial incentives, and even
employment to be conditioned on the execution of a HIPAA authorization. We do
not find the condition imposed by § 766.1065 to be categorically different from the
other conditions and incentives permitted under HIPAA....
...on in areas
traditionally regulated by the states. See Medtronic, Inc.,
518 U.S. at 485, 116 S.
Ct. at 2250.
34
Case: 13-14637 Date Filed: 10/10/2014 Page: 35 of 36
C. §
766.1065 is “Not Contrary” to HIPAA
In light of our above analysis, we conclude that Murphy has not shown
§
766.1065 is contrary to HIPAA. 12
First, it is patently clear that §
766.1065 does not make it “impossible” for a
covered entity, as defined by the HIPAA regulations, “to comply” with both
HIPAA and state law. See 45 C.F.R. § 160.202(1). Section
766.1065 requires the
authorization form to comply with HIPAA’s requirements....
...Once a plaintiff
executes a valid HIPAA authorization as part of his presuit obligations, his
physician can, consistent with HIPAA, convey relevant health information about
the plaintiff to the defendant. A medical provider can simultaneously comply with
state and federal requirements.
Second, § 766.1065 does not stand “as an obstacle” to fulfilling “the full
purposes and objectives” of HIPAA. See 45 C.F.R. § 160.202(2). One of
HIPAA’s stated objectives is “reducing the administrative costs of providing and
paying for health care.” 42 U.S.C. § 1320d-1(b). Likewise, § 766.1065, by
allowing health care providers to investigate and potentially settle claims before
litigation commences, serves to reduce the overall cost that medical negligence
litigation places on Florida’s health care system. The Florida law, like HIPAA,
12
As Murphy’s counsel noted at oral argument, whether § 766.1065 violates the Florida
Constitution is a state law issue that is not before us....
...XI. CONCLUSION
For the foregoing reasons, we vacate the district court’s declaratory
judgment order in favor of plaintiff Murphy, as well as the district court’s
injunction against the enforcement of Fla. Stat. § 766.1065....
CopyCited 3 times | Published | Supreme Court of Florida
LEWIS, J. This case involves a Florida constitutional challenge to the 2013 amendments to sections
766.106 and
766.1065 of the Florida Statutes....
...In .addition, the presuit notice must include an executed authorization form that is provided in section 7661065 of the Florida Statutes. Id. That executed authorization form is titled “Authorization for Release of Protected Health Information.” § 766.1065, Fla....
...the claimant is required to authorize the release of protected verbal and written health- information that is potentially relevant to the claim of medical negligence in the- possession óf the' health care providers listed in the notice disclosures. § 766.1065(3)B.1.-2., Fla. Stat. However, this authorization is not a blanket authorization—it excludes health care providers who do not possess information that is potentially relevant to the ' claim. § 766.1065(3)0....
...This authorization expressly allows the persons or class of persons listed in subsections D.2.-4. above to interview ■ the health care providers listed in subsections B.1.-2. above, without the presence of the Patient or the Patient’s attorney. § 766.1065(3)E., Fla....
...er to whom presuit notice was given) or employed by or on behalf of any health care provider(s) listed in subsections B.1.-2. above, regarding the matter of the presuit notice accompanying this authorization dr the care and treatment of the Patient. § 766.1065(3)D.2.-4., Fla....
...Specifically, in 2013, the Legislature added a third express purpose for the release of the protected health information: “Obtaining legal advice or representation arising out of the medical negligence claim described in the accompanying presuit notice.” § 766.1065(3)A.3., Fla....
...-Stat.; Ch. 2013-108, § 4", at 6, Laws of Fla. Before the amendments, the stated purpose of the mandatory authorization was twofold—to facilitate the investigation and evaluation of the claim, or to defend against any litigation arising out of the claim. § 766.1065(3)A.l.-2., Fla....
...Specifically, “If the authorization required by this section is revoked, the presuit notice under s.
766.106(2) is deemed retroactively void from the date of issuance, and any tolling effect that the.presuit notice may have had on any applicable statute-of-limitations period is retroactively rendered void.” §
766.1065(2), Fla....
...vant matters and privacy rights related thereto. Therefore, the district court upheld the constitutionality of the statutes. This review follows. ANALYSIS Weaver contends that the Legislature’s passage of certain amendments to sections
766.106 and
766.1065 of the Florida Statutes are unconstitutional for several reasons....
...’s constitutional right to privacy. Requiring claimants to authorize clandestine, ex parte secret interviews is far from the least intrusive means to accomplish those stated goals. 5 The ex parte secret interview provisions of sections
766.106 and
766.1065 fail to protect Florida citizens from even accidental disclosures of confidential medical information- that falls outsidé the scope of the claim because there would be no one present on the claimant’s behalf to ensure that the potential d...
...s doctrine forbids burdening the Constitution’s enumerated rights by coercively withholding benefits from those who exercise them.”). However, such' unconstitutional conditioning and coercion is exactly what the amendments to section
766.106 and
766.1065 have done here....
...ovisions are stricken. Id. at 493 (citing Moreau v. Lewis,
648 So.2d 124, 128 (Fla. 1995)). Noting the limited nature of our holding today and our severance principles, we make two strikes from the amended statutes. First, wé strike in its entirety section
766.1065(3)E., Florida Statutes (2013), which contains the constitutionally infirm language: “This authorization expressly allows the persons or class of persons listed in subsections D.2.-4. above to interview the health, care providers listed in subsections B.1.-2. above, without the presence of the Patient or the Patient’s attorney.” §
766.1065(3)E., Fla....
...ild that was authorized pursuant to statute). . Further, although not at issue here, requiring potential claimants to list by name health care providers who do not have information potentially relevant to the claim, and provide dates of service, see § 766.1065(3)C., in and of itself reveals irrelevant private medical information....
