Summary
In National Abortion Federation v. Ashcroft, No. 04 C 55 (N.D. Ill. February 6, 2004), the federal district court considered the interplay of HIPAA and Illinois law.
Summary of this case from Moss v. AmiraOpinion
04 C 55
February 5, 2004
MEMORANDUM OPINION
This matter comes before the court on Northwestern Memorial Hospital's ("Northwestern") motion to quash a subpoena pursuant to Federal Rule of Civil Procedure 45(c)(3)(A). For the reasons set forth below, the motion is granted.
BACKGROUND
In November 2003, the National Abortion Federation ("NAF"), a professional organization of abortion providers, and seven individual physicians commenced a civil action against the U.S. Attorney General in the Southern District of New York. National Abortion Federation et al. v. Ashcroft, Case No. 03 Civ. 8695 (RCC) (S.D.N.Y. 2003). This pending lawsuit challenges the constitutionality of the recently enacted Partial Birth Abortion Ban Act of 2003 ("PBABA"), 18 U.S.C. § 1531, which prohibits certain late-term abortion procedures. The NAF and the physician plaintiffs allege that the PBABA is unconstitutional under Supreme Court precedent because it contains no exception for preserving a woman's health. One of the plaintiffs is Dr. Cassing Hammond, an attending physician at Northwestern who performs abortions that would be banned under the PBABA. Northwestern is a large teaching hospital in Chicago which maintains no facilities in New York and is not a party to the lawsuit. Dr. Hammond has privileges to practice at Northwestern but he is not a Northwestern employee.
In support of the NAF plaintiffs' motion for a temporary restraining order, which was filed concurrently with the complaint, Dr. Hammond submitted a declaration in which he made assertions concerning his practice as an abortion provider. Dr. Hammond's declaration states that he provides PBABA-banned abortions to women with a variety of medical conditions for the protection of their health.
On November 21, 2003, government attorneys representing the Attorney General served Dr. Hammond with interrogatories and document requests. These requests asked Dr. Hammond to identify the patient medical record numbers for the medically necessary abortion procedures that Dr. Hammond described in his declaration. The government also requested Dr. Hammond to produce the medical records of the patients who received the above-described abortions. The government's document request asked only for the medical records of patients having abortions during the past two years. The requests appear to have been sought for the purpose of testing the assertions in Dr. Hammond's declarations. At best, the government is seeking possible impeachment material. Dr. Hammond responded to the government that he does not possess or control the medical records in question as they are the property and in the possession of Northwestern.
After learning that Northwestern possessed and controlled the medical records to be identified by Dr. Hammond., on December 18, 2003, the government served Northwestern with a subpoena pursuant to Federal Rule of Civil Procedure 45. The subpoena sought production of "[a]ll medical records associated with those medical record numbers to be identified by [Dr. Hammond] in response to the discovery demand served upon him" inNAF. Accompanying the subpoena was an Order signed by District Judge Richard Conway Casey, who is presiding over the litigation in New York. The Order authorizes Northwestern, as a non-party witness, to disclose to the government the medical records sought by the attached subpoena in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub.L. No. 104-191, §§ 261-264, 110 Stat. 1936 (Aug. 21, 1996), and 45 C.F.R. § 164.512(e)(1)(i). The government has agreed that if Northwestern is ordered by this court to produce the medical records in question, it may initially redact "all patient identifying information" from the records, except for the state of residence of the patient. However, the government has reserved the right to request or subpoena additional patient identifying information in the future. On January 23, 2004, Judge Casey issued an Agreed Protective Order holding that if Northwestern is compelled to disclose the records of Dr. Hammond's patients, it may redact such information as a patient's name, address, phone number, and the like, but the Order does not authorize redaction of a patient's medical history.
Northwestern now moves to quash the subpoena pursuant to Federal Rules of Civil Procedure 45(c)(3)(A)(iii) and (iv). Northwestern asserts that the medical records sought by the subpoena are privileged from disclosure under HIPAA as well as Illinois and federal statutory and common law. Northwestern also claims that production of the medical records in accordance with the subpoena would impose an undue burden on Northwestern and its patients.
DISCUSSION
A district court must quash or modify a subpoena if it "requires disclosure of privileged or otherwise protected matter and no exception or waiver applies." Fed.R.Civ.P. 45(c)(3)(A)(iii); Abbott v. Kidder. Peabody Co., 1997 WL 337228, *2 (N.D. Ill. 1997). Northwestern argues that the medical records sought by the government cannot be released under Illinois law, which provides for strict disclosure protections under the physician-patient privilege, and are therefore protected under HIPAA. The government counters that federal law governs this case and because federal common law does not recognize a physician-patient privilege, the medical records of Dr. Hammond's patients must be disclosed subject to the subpoena.
HIPAA
Recognizing "the importance of the privacy of medical records," U.S. v. Sutherland, 143 F. Supp.2d 609, 612 (W.D. Va. 2001), Congress addressed the issue when it enacted HIPAA in 1996. One provision of HIPAA directed the Secretary of Health and Human Services (the "Secretary") to promulgate final regulations setting standards "with respect to the privacy of individually identifiable health information" such as patient medical records. HIPAA, Pub.L. No. 104-191, § 264(a), 110 Stat. 1936 (1996); Sutherland at 612. The federal regulation covering the disclosure of protected patient medical records is 45 C.F.R. § 164.512. Sutherland at 612; U.S. ex rel. Stewart v. Louisiana Clinic, 2002 WL 31819130, *3 (E.D. La. 2002). This regulation allows for the disclosure of non-party medical information "in the course of any judicial or administrative proceeding . . . in response to an order of the court." 45 C.F.R. § 164.512(e)(1)(i). Judge Casey's December 18, 2003, Order thus granted Northwestern the authority to disclose to the government Dr. Hammond's patient's medical records pursuant to 45 C.F.R. § 164.512.(e)(1)(i). However, Judge Casey's authorization Order does not end our inquiry into whether the medical records at issue are privileged from disclosure under other aspects of HIPAA.
While HIPAA's regulations became effective on April 14, 2001,Sutherland at 612 (citing 66 Fed. Reg. 12,434 (Feb. 26, 2001)), compliance by hospitals was not required until April 14, 2003. 45 C.F.R. § 164.534(a).
HIPAA contains a preemption provision that the statute and the regulations promulgated by the Secretary thereunder expressly "supercede [sic] any contrary provision of State law," 42 U.S.C. § 1320d-7(a)(1) (implemented by 45 C.F.R. § 160.203). HIPAA's preemption over state medical privacy laws is not absolute, as HIPAA and its subsequent regulations do not preempt state law if the state law is "contrary" to HIPAA and "relates to the privacy of individually identifiable health information" such as patient medical records. Id. § 1320d7-(a)(2)(b) (implemented at 45 C.F.R. § 160.203(b)); Louisiana Clinic at *3. A state law is "contrary" to HIPAA and its regulations if a "covered entity would find it impossible to comply with both the State and federal requirements." 45 C.F.R. § 160.202. A contrary state health information privacy law will not be preempted by a HIPAA regulation if the state law is "more stringent" than HIPAA's requirements. 45 C.F.R. § 160, 203(b); Louisiana Clinic at *3. A state privacy law is "more stringent" than a HIPAA requirement if the state law "prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted" under HIPAA. 45 C.F.R. § 160, 202. We must then ask if Illinois medical information privacy laws are more stringent than HIPAA's requirements.
As mentioned above, HIPAA allows a hospital such as Northwestern to disclose patient medical records subject to a court order. 45 C.F.R. § 164.512(e)(1)(i). HIPAA does limit the authority of a court by requiring that the order:
[p]rohibit the parties from using or disclosing the protected health information for any purpose other than the litigation and proceeding for which such information was requested [and r]equires the return . . . or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.45 C.F.R. § 164.512(e)(1)(v).
In other words, HIPAA's regulations clearly allow a hospital to disclose patient medical records, when ordered in judicial proceedings, subject to the above limitations.
ILLINOIS MEDICAL PRIVACY LAW
Illinois law concerning when nonparty patient medical records may be disclosed by hospitals or doctors is far more restrictive. The Illinois Code of Civil Procedure states that "[n]o physician or surgeon shall be permitted to disclose any information he or she may have acquired in attending any patient in a professional character, necessary to enable him or her professionally to serve the patient" unless one of eleven enumerated conditions exist. 735 ILCS 5/8-802. This medical privacy protection extends to hospitals that possess nonparty patient medical records. Parkson v. Central DuPage Hospital, 435 N.E.2d 140, 142 (Ill.App.Ct. 1982). Unless one of these conditions is satisfied, absent the patient's consent, a hospital may not disclose a patient's medical records, even in response to a subpoena.Dep't of Professional Regulation v. Manos, 761 N.E.2d 208, 216-17 (Ill.App.Ct. 2001) (citing People v. Bickham, 89 Ill.2d 1, 6 (Ill. 1982)). Illinois courts have continued to hold that 735 ILCS 5/8-802's protection applies even if the patients' names and identification numbers are deleted or redacted from their medical records. See Manos at 216;Ekstrom v. Temple, 553 N.E.2d 424, 430 (Ill.App.Ct. 1990); Parkson at 143-44. These courts have reasoned that even if a patient's name and identification number are redacted from his or her file, because prior and present medical history would still be disclosed, the patient's right to confidentiality could potentially be compromised. Manos at 216.
While the government states that it would permit Northwestern to redact "all patient identifying information," its subpoena requests information concerning the medical necessity of abortions performed by Dr. Hammond. By demanding the rationale behind the abortions he performed, the subpoena would thereby require Northwestern to disclose medical history information of Dr. Hammond's patients. Further increasing the possibility that Dr. Hammond's patients could be identified despite the government's redaction proposal is the fact that it only seeks patient records from the past two years and requires that the patient's state of residence not be deleted. The proposal simply offers less security of confidentiality than other redaction plans that have been found to infringe on Illinois residents' right to privacy guaranteed by the state's Constitution. Manos at 217. While Illinois does not differentiate between the types of medical information that is subject to protection, it is only reasonable that the privilege should not be diluted in a case involving procedures as sensitive and personal as late-term abortions.
Neither Northwestern nor the government asserts that any of the conditions of 735 ILCS 5/8-802 have been met that would allow Northwestern to disclose Dr. Hammond's patients' records under the Illinois Code of Civil Procedure. The parties also do not dispute that disclosure of the medical records would violate other provisions of Illinois law such as the Medical Patients Rights Act, 410 ILCS 50/3a(a) and (d), and the Hospital Licensing Act, 210 ILCS 8576.17(d). Because we find that Illinois law is more stringent than HIPAA's disclosure requirements and that it would be impossible for Northwestern to comply with both Judge Casey's HIPAA-pursuant Order and various provisions of Illinois law, Illinois's nonparty patient privacy laws are not preempted by HIPAA and its subsequent regulations.
HIPAA, F.R.E. 501, and the SUPREMACY CLAUSE
The government argues that because NAF is a federal case that applies federal law, the Supremacy Clause, U.S. Const. Art. VI, cl. 2, and Federal Rule of Evidence 501 dictate that Illinois's strict privacy laws should be trumped by federal common law, which does not recognize a physician-patient privilege. The Supremacy Clause commands that state laws that "interfere with, or are contrary to the laws of Congress . . . must yield" to federal laws. Gibbons v. Ogden, 22 U.S. 1, 211 (1824). The Seventh Circuit has recently described the Supremacy Clause's application in the following manner: "A conflict between state and federal law, even if not over goals but merely over methods of achieving a common goal, is a clear case for invoking the [Supremacy Clause] to resolve the conflict in favor of federal law." Wisconsin Bell, Inc. v. Bie, 340 F.3d 441, 443 (7th Cir. 2003), cert. denied, 2004 WL 47558 (Jan. 12, 2004).
Neither the Supreme Court nor the Seventh Circuit has recognized a federal physician-patient privilege. See Whalen v. Roe, 429 U.S. 569, 602 n. 28 (1977); Patterson v. Caterpillar. Inc., 70 F.3d 503, 506-07 (7th Cir. 1995). See, however, the Supreme Court's recognition of a psychotherapist-patient privilege, upholding the Seventh Circuit's view, in Jaffee v. Redmond, 518 U.S. 1, 8 (1996).
According to the government, this is a clear case for applying the Supremacy Clause to invalidate Illinois' privacy laws by relying on Federal Rule of Evidence 501, which states:
Except as otherwise required by the Constitution of the United States or provided by Act of Congress or in rules prescribed by the Supreme Court . . . the privilege of a witness, person, government, State, or political subdivision thereof shall be governed by the principles of the common law as they may be interpreted by the courts of the United States in the light of reason and experience.
F.R.E. 501. As we have already stated, and the parties recognize, there has never been a federal common law physician-patient privilege. Under this proposition the government cites a litany of cases, beginning withMemorial Hospital for McHenry County v. Shadur, 664 F.2d 1058 (7th Cir. 1981), where federal courts have relied on the Supremacy Clause and Federal Rule of Evidence 501 to hold that state privilege laws cannot be used to hinder discovery in cases governed by federal law. However, it is important to note that all of the cases cited by the government either predate April 14, 2003, the date when HIPAA's regulations became effective, or deal with privileges that are outside of HIPAA's scope.
Because the authorities cited by the government do not contemplate HIPAA, they cannot be read in a vacuum. Federal Rule of Evidence 501 does state that evidentiary privileges should be governed by federal common law, but only "except as otherwise . . . provided by Act of Congress." For this reason, HIPAA and the regulations promulgated thereunder, not Federal Rule of Evidence 501, control the protections provided to patient medical records held by hospitals. If the case were otherwise, Congress' directive to the Secretary of Health and Human Services to set standards and regulations "with respect to the privacy of individually identifiable health information," HIPAA, Pub.L. No. 104-191, § 264(a), 110 Stat. 1936 (1996), would be rendered meaningless in a regime where Federal Rule of Evidence 501 recognizes no privilege as to such records.
The government contends that to quash its subpoena as a result of Illinois' privacy laws would violate the Supremacy Clause by a state law trumping federal law. However, because Illinois' privacy protections are activated only through HIPAA's anti-preemption provision, this not a case of Illinois law trumping federal law but instead a case of one federal law displacing another. It surely cannot be the case that the Supremacy Clause is violated when state law is followed pursuant to a federal statute that demands its application. As the government itself points out, state and federal laws are in conflict where state law "stands as an obstacle to the accomplishment and execution of the full purposes and objectives of Congress." Hines v. Davidowitz, 312 U.S. 52, 67 (1941). The application of Illinois' medical privacy laws is not an "obstacle" to achieving Congress' aims in enacting HIPAA, but rather appears to be Congress' desired outcome under a statute that contemplates that state medical privacy laws supersede less protective federal regulations. Because HIPAA, not Federal Rule of Evidence 501, governs how individually identifiable health information, such as medical records, should be kept private, Illinois law controls and the government's subpoena must be quashed.
F.R.E. 501 and the PHYSICIAN-PATIENT PRIVILEGE
The government contends that state privileges are honored in federal litigation only when state law supplies the rule of decision. It asserts that when federal law governs, as it does here, only privileges recognized by the national government matter. It argues that because no physician-patient privilege exists under federal common law, Northwestern must produce the records.
As pointed out above, HIPAA's preemption over state privacy laws must yield when state law is stricter than and contrary to HIPAA and the material sought relates to the privacy of individually identifiable health information. That is reason enough to quash the government's subpoena to Northwestern. Beyond that, however, the government's reliance on the absence of an express declaration that Federal Rule of Evidence 501 includes a physician-patient privilege is, in the context of this case, unsupportable.
Federal Rule of Evidence 501 speaks to privileges recognized under "principles of the common law as they may be interpreted by the courts of the United States in the light of reason and experience." The Court of Appeals for the Seventh Circuit concluded that "reason and experience," the touchstones for acceptance of a privilege under Rule 501, compelled recognition of a psychotherapist-patient privilege. Jaffee v. Redmond, 51 F.3d 1346, 1355 (7th Cir. 1995). Psychotherapists and patients share a unique relationship, in which the ability to communicate freely without the fear of public disclosure is the key to successful treatment. The Supreme Court agreed with that holding and the recognition of the privilege.
It can be no less when dealing with a woman, her doctor, and the necessity to make a decision on abortion, issues indisputably of the most sensitive stripe. American history discloses that the abortion decision is one of the most controversial decisions in modern life, with opprobrium ready to be visited by many upon the woman who so decides and the doctor who engages in the medical procedure. An emotionally charged decision will be rendered more so if the confidential medical records are released to the public, however redacted, for use in public litigation in which the patient is not even a party. Patients would rightly view such disclosure as a significant intrusion on their privacy.
That result is to be contrasted with the loss to the government if the physician-patient privilege were found to exist in these circumstances. The government seeks these records on the possibility that it may find something therein which would affect the testimony of Dr. Hammond adversely, that is, for its potential value in impeaching his credibility as a witness. What the government ignores in its argument is how little, if any, probative value lies within these patient records and the ready availability of information traditionally used to challenge the veracity of Dr. Hammond's scientific assertions and medical opinions. The presence or absence of medical risks, their likelihood and nature are undoubtably described and discussed in available medical literature. Challenges to Dr. Hammond's views would be readily available, as would the enlistment of experts supporting contrary opinions. The search for the truth that any hearing or trial seeks to produce would hardly be infringed by finding that a physician-patient privilege exists in these circumstances. When contrasted with the potential loss of privacy that would ensue were these medical records used in a case in which the patient was not a party, the balance of harms resulting from disclosure severely outweighs the loss to the government through non-disclosure. Reason and experience dictate that Federal Rule of Evidence 501 indeed recognizes a physician-patient privilege in the circumstances of this case, that is, matters relating to abortion. We so hold.