In the late 2000s, after several Florida nursing homes turned down requests from the family members of deceased patients seeking their medical records, the Florida Agency for Health Care Administration (AHCA) issued citations to the providers for not complying with a 1987 state law allowing such releases.
The nursing homes then sued the Florida AHCA when their refusals were deemed HIPAA-compliant by the Department of Health & Human Services, after the families appealed to the Office of Civil Rights, expecting the right to access their relatives’ records under HIPAA.
The dispute recently ended in a federal appeals court ruling affirming HIPAA preemption over state laws with less-stringent standards.
Even though certain family members of deceased relatives are able to access their records under state laws and under HIPAA’s “personal representatives” provisions, the Florida law “does not empower or require an individual to act on behalf of a deceased resident,” wrote judge Susan Black, on behalf of a three-judge panel of the 11th U.S. Circuit Court of Appeals in Atlanta, which upheld a district court’s ruling in favor of the nursing homes.
The Florida law, Black said, “authorizes sweeping disclosures, making a deceased resident’s protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident’s stead” — all in conflict with HIPAA.
HIPAA’s personal representative requirements extends to people who were given medical power of attorney or authority of the deceased patient’s estate, and to relatives or people identified by the patient involved in paying for their healthcare.
The AHCA argued the state law and HIPAA actually complemented each other, with the HIPAA Privacy Rule allowing any person with legal authority to act on behalf of a deceased individual under state law to also act as a personal representative.
“The fatal flaw in the state agency’s argument,” Black wrote, “is that the plain language of [the Florida law] does not empower or require an individual to act on behalf of a deceased resident.”
That Florida law, part of a body of nursing home statutes, “stands as an obstacle to the accomplishment and execution of the full purposes and objectives of HIPAA in keeping an individual’s protected health information strictly confidential.”
While HIPPA authorizes covered entities to release a deceased individual’s protected health information to certain family members or designated individuals, it permits the release of a deceased individual’s personal health information “in narrowly delineated circumstances,” Black said. HIPAA applies only to those involved in or paying for the deceased patient’s healthcare, and stipulates that “covered entities may release only protected health information that is relevant to such person’s involvement, i.e., information that is relevant to the care of the deceased individual or to the payment of the deceased individual’s healthcare.”
Florida’s 1987 law, though, “contains no such limitations or restrictions,” and it doesn’t require a HIPAA-compliant authorization in requests for deceased patients’ PHI.
“Given the opportunity,” Black wrote, “we are confident the Florida legislature could bring [the state statute] into compliance with federal law in any number of ways. Amending the statute, however, is a task for the state legislature, not a panel of federal judges.”
Florida’s AHCA said in a statement that it is immediately complying with the decision.