Opis Management Resources, Inc., together with four other nursing home providers, requested the Federal Court nearly two years ago to determine if Florida’s §400.145, which provides broad and easy access to patient records of deceased nursing home residents, was preempted by HIPAA’s stricter access requirements. The federal trial court ruled in December 2011 that HIPAA preempted Florida’s less stringent law. The decision was appealed and, on April 9th, the appellate court affirmed the trial court’s decision. Simply put, Florida §400.145 requires nursing homes to “furnish to the spouse, guardian, surrogate, proxy, or attorney in fact of a former resident … a copy of that resident’s records which are in the possession of the facility.” Also, “Copies of such records . . . may be made available prior to the administration of an estate, upon request, to the spouse, guardian, surrogate, proxy, or attorney in fact.” HIPAA allows nursing homes to release medical records only to a patient or his/her personal representative. When a patient is deceased, “personal representative” means an “executor, administrator, or other person [who] has authority to act on behalf of a deceased individual or of the individual’s estate.” Thus, a person authorized under §400.145 can be – but is not always – the same as the personal representative under HIPAA. As a result, Florida law requires nursing homes to release medical records is less stringent than Federal law. The Florida Agency for Health Care Administration (AHCA) cited several Florida nursing homes for refusing to provide records in accordance with the Florida law even though they were complying with the federal law. The court’s decision reaffirmed what has long been the relationship between HIPAA and state privacy laws: HIPAA provides a threshold level of confidentiality protection. States are free to impose even greater protection. Conversely, as in this case, if state privacy laws do not provide a minimum “HIPAA” standard of protection, they are preempted by the federal law. The Appellate Court noted that Florida law authorizes sweeping disclosures, “making a deceased resident’s protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident’s stead.” Under HIPAA, a personal representative may only access the decedent’s confidential information that is relevant to the personal representation. The court found that less stringent protection of confidential information frustrated HIPAA’ s purpose and was, therefore, invalid. Because of this decision, §400.145 is invalid and AHCA cannot currently sanction nursing homes for failing to abide by it. Nursing homes in Florida should release a deceased resident’s medical records in accordance with HIPAA, i.e. to a personal representative of the estate, executor, administrator, or other person authorized to act on behalf of the deceased patient or the deceased patient’s estate. If no such person exists, the nursing home should wait for a court to appoint an appropriate person. While the District Court’s decision is limited to §400.145, similar laws may also be preempted. One example is Florida Statutes §766.104, which states, “subsequent to the death of a person and prior to the administration of such person’s estate, copies of all medical reports and records . . . that are in the possession of a healthcare practitioner” shall be made available to the deceased person’s spouse, parent, adult child, guardian, surrogate, proxy, or attorney. Given the parallel between §400.145 and §766.104, it’s probable that HIPAA preempts §766.104 too. Florida Statutes §395.3025 allowing parents of a minor or next of kin of a deceased person access to hospital patient records is probably preempted. Only future litigation will determine the true scope of HIPAA preemption.
