[ Tuesday, March 21, 2006 ]
Ohio Preemption Case:[Oops, I drafted this Monday, 3/21, but forgot to post it. Sorry for the delay]As I
previously noted, there has been a case on appeal to the Ohio Supreme Court that drills into the disconnect (which I've noted before, although not necessarily in this blog) between the preemption requirement of HIPAA (HIPAA supercedes any state laws that are "less stringent" in protecting privacy) and the "required by law" exception to HIPAA.
In the case, the Cincinnati, Ohio Health Department issued citations to building owners when lead paint was discovered in their buildings. The citations note the building owner, the location of the building, and the date the presence of the lead paint was discovered. In theory, the presence of lead contamination could come from any type of source, but in reality, the only way the Health Department knows to go looking for lead is when a child is diagnosed with lead poisoning; once that happens, the Health Department investigates the child's residence, usually finds the source of the lead, and The Cincinnati Enquirer newspaper tried to obtain copies of the citations under the Ohio Public Records Law, but the Health Department refused, due to the fact that anyone looking at the citation would know the date and location of the discovery of the lead, and could easily surmise that the discover was due to the diagnosis of lead poisoning of a child living at that location at that time. Therefore, simply by looking at the citation and asking a few questions, the newspaper reporter could easily determine who the child was with lead poisoning. So the newspaper sued, demanding disclosure under the open records law; the Health Department answered, that HIPAA prevented them from disclosing PHI, and disclosing the citations would be a release of PHI.
Over the weekend, it was
reported that the
Ohio Supreme Court ruled that the Ohio Public Records Law mandates the disclosure, and that the disclosure is permitted under HIPAA by the "required by law" exception. The court assumed that the Health Department was covered by HIPAA, but even with HIPAA's applicability assumed, the allowance under HIPAA for disclosures "required by law" would fit, rather than HIPAA's preemption of less-protective state laws. In other words, the Ohio Supreme Court determined that the "required by law" provision of HIPAA pretty much supersedes the "preemption of state laws" provision of HIPAA ("
the Ohio Public Records Law requires disclosure of these reports and the HIPAA does not supersede state disclosure requirements").
I doubt the city will appeal to the US Supreme Court, and even if they did, I don't know if the US Supreme Court would even take up the appeal. I suspect this is a "terminal" opinion. Given that, what should we take away from it?
The court does not draw the distinctions here that would be particularly helpful in determining when "required by law" applies and when "preemption" applies, but it might be useful to look at the specific language regarding preemption in the Privacy Rule, 45 CFR 160.203:
A standard, requriement, or implementation specification adopted under this
subchapter that is contrary to a provision of State law preempts the provision
of State law. This general rule applies, except if one or more of the following conditions are met:
(a) A determination is made by the Secretary [of HHS] that the provision of
State law . . . is necessary . . . to prevent fraud and abuse related to the provision of or payment for health care; to ensure appropriate State regulation of insurance . . . ; for State reporting on health care delivery or costs; or for purposes of serving a compelling need related to public health, safety, or welfare, and, if a standard, requirement or implementation specification under [the Privacy Rule or Security Rule] is at issue, the Secretary determines that the intrusion into privacy is waranted when balanced against the need to be served. . . .
(b) [the State law is more stringent];
(c) the provision of State law . . . provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention; or
(d) [related to health plan reporting and auditing].
Obviously, the Secretary of HHS hasn't made any determination, and the Ohio Supreme Court didn't address the "public health reporting" aspects of the lead paint citations, which would have answered the question regarding this conflict. Additionally, the Ohio Supreme Court could have noted that the preemption requirement should be read to relate only to state laws that are about medical record privacy (even though a reading of Section 160.203 does not really support that, since the text quoted above is really much broader), and that if the state law in question is about public records or public reporting, preemption isn't really the question. Unfortunately, this quandry is still unsolved.
Jeff [10:57 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
