Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

On September 25, 2013, the Northern District Court of Florida, Tallahassee Division, ruled that Florida Statute § 766.1065 violated the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) by requiring a plaintiff in a medical malpractice action to deliver a presuit authorization which allows the defending medical professionals to conduct ex parte interviews of the plaintiff’s other healthcare providers.  Finding that HIPAA does not “otherwise permit or require disclosures in an ex parte interview of the kind at issue,” and that the plaintiff’s presuit authorization under applicable Florida law was invalid under federal rules, the Court enjoined the defendants from interviewing plaintiff’s other health care providers ex parte (i) absent voluntary consent of the plaintiff, or (ii) in accordance with the provisions of HIPAA.

As background, claimants pursuing medical negligence suits in Florida must meet specific presuit requirements pursuant to Fla. Stat. § 766.106.  These presuit requirements are intended to put the defendant on notice of the individual’s intent to sue and thus must be completed before the claimant files his or her complaint for medical negligence.  Among other things, the presuit requirements specify that the claimant must provide to the prospective defendant a list of all known health care providers who, during the two-year period prior to the alleged act of negligence, treated or evaluated the claimant, along with copies of all medical records.

Under § 766.1065, which became effective July 1, 2013, the plaintiff must also submit a signed authorization allowing the defendant, the defendant’s attorney, insurer and/or adjuster, to interview the plaintiff’s other health care providers ex parte.  The authorization permits disclosure of protected health information that is potentially relevant to the claim of personal injury or wrongful death and must be in the form specified pursuant to the statute.  Please note that the authorization does not give the defendant permission to inquire about all matters of the plaintiff’s health, only those relevant to the plaintiff’s cause of action.

In the instant case, the Court based its ruling on two key premises: 1) that HIPAA expressly preempts any conflicting state law, except those state laws that are more stringent than HIPAA, i.e., a state law that would prohibit a disclosure otherwise permitted under the federal rules; and 2) that disclosures made in connection with judicial or administrative proceedings do not supersede the need for a valid authorization under HIPAA if other requirements are not met.

In addition to the above two premises, the Court also observed that under HIPAA, valid authorizations must meet specific content requirements.  While the Court acknowledged that the authorization mandated under the Florida statute generally met the specified content requirements of HIPAA, the authorization failed to show the individual’s consent.  Rather, the authorization evidenced only the individual’s mandated compliance with state law.  

In light of the foregoing, the Court concluded that the defendants were not permitted to conduct interviews or other communications with plaintiff’s other health care providers and enjoined the defendants from doing so.  This decision, however, is unlikely to be the last word, as the defendants will likely appeal the ruling, and the ultimate resolution of this case remains unclear. For example, other courts have reached the opposite conclusion on a similar question of law as demonstrated in In re Collins, M.D., 286 S.W.3d 911 (Tex. 2009).  These rulings show the continuing tension regarding HIPAA preemption.

Court Overturns Presuit Patient Authorization Requirement Under Florida Medical Malpractice Statute