Medical Association Challenges Legality of Medical-Privacy Rule

President George W. Bush may be satisfied with the federal government’s recently approved medical privacy rules, but the members of one state medical organization are so dissatisfied that they have turned to the courts for relief.

The South Carolina Medical Association (SCMA) announced in July that it was filing a lawsuit to challenge the constitutionality of the new privacy regulations.

The development of regulations to govern the circumstances under which patients’ medical-record data could be released and who would be eligible to receive that information was mandated by a 1996 law known as the Health Insurance Portability and Accountability Act (HIPAA). That health-reform legislation instructed the Secretary of Health and Human Services to draft regulations that would comply with the privacy objectives described in the law if Congress did not do so on its own within three years.

The SCMA’s court challenge questions the legality of a section of the law, Section 264, which allowed the HHS Secretary “to create patient-privacy regulations with virtually no congressional guidance, not even the legislative establishment of a federal patient-privacy program,” according to an SCMA statement. The medical association emphasizes that its members are particularly concerned because federal law requires administrative agencies such as HHS “to exercise no more power or authority than that authorized by Congress,” and thus the agency exceeded its constitutional mandate by acting as federal legislators and violating the separation-of-powers requirement.

The SCMA, whose legal challenge has been joined by several individual South Carolina physicians and the Louisiana Medical Association, does not, according to the suit, “dispute the benefits of protecting the privacy of individually identifiable health information.” What it does object to is that in the absence of guidance from Congress, HHS took it upon itself to promulgate complex regulations that go well beyond the initial goal of regulating electronic communication of patients’ medical information and in fact include “all forms of speech involving individually identifiable health information.”

In addition the SCMA is challenging the scope of the regulations’ reach, which, the suit notes, “go beyond HIPAA’s regulation of health care providers, health plans, and health care clearinghouses to regulate all persons doing business with such entities who would receive either electronic or non-electronic communications” of these medical records.

The medical association suit maintains that if allowed to stand, the privacy regulations HHS developed will have serious consequences for physicians and patients. The regulations “ignore the realities of current medical practices and will delay and impede critical health care operations,” the suit says, through “increased costs of health care, massive new paperwork requirements for all involved in the field of health care, and serious inconvenience to all patients.”

“The HIPAA regulations will add huge bureaucratic costs to the health care system, whatever its aims may be. It seems like overkill,” James Scully, M.D., told Psychiatric News. Scully is chair of the department of neuropsychiatry and behavioral science at the University of South Carolina School of Medicine and immediate past-president of the South Carolina Psychiatric Association.

The SCMA suit indicates that the medical association is troubled by the fact that HHS acted without congressional guidance, because HHS, the agency that drafted the privacy regulations, turns out to be “the only entity that can enforce the privacy provisions,” a situation that “empowers the HHS bureaucracy instead of the aggrieved individual. Fines imposed for the improper release of individually identifiable health information are paid to the federal government,” the SCMA points out, “and the individual actually harmed by the disclosure is not provided any personal relief by the HHS privacy regulations.” It labels this regulatory scheme “self-serving” on HHS’s part.

The SCMA also maintains that the HIPAA regulations are “flawed” because they allow states with laws that mandate stricter privacy and disclosure requirements than the new federal rules to preempt the federal rules. “The determination of whether state laws are more stringent is no easy task,” the SCMA states, and thus the HIPAA regulations are “too vague to be enforced, especially through criminal penalties.”

The preemption wording is so vague, the suit states, that no “person of ordinary intelligence” would be able to determine whether state medical-privacy rules are actually more or less strict than the new federal ones, leaving physicians and others covered by the rules at risk of being charged with violating whichever set of rules did in fact hold sway.

The SCMA is hoping that a federal court—the suit was filed in the Columbia Division of the U.S. District Court for South Carolina—will nullify the privacy regulations for being unconstitutional and send the issue back to Congress, where elected representatives who are more accessible to constituents’ concerns will be forced to grapple with the development of medical-record rules.

HHS officials had 60 days from the July 16 filing to respond to the SCMA lawsuit.

The SCMA’s suit does not reflect any formal input from the South Carolina Psychiatric Association, whose president, J.T. Thornhill, M.D., said he was “disappointed” that the SCMA did not consult with or seek input from the state’s primary psychiatric organization.

[South Carolina Medical Association, et al. v. U.S. Department of Health and Human Services and Tommy G. Thompson, Secretary, U.S. District Court for the District of South Carolina, Columbia Division] ▪