BRIEF OF APPELLANTS





Jurisdiction

    The District Court had subject matter jurisdiction
under 28 U.S.C.A. § 1331 (1993).  This Court has jurisdiction
under 28 U.S.C.A. § 1291 (1993).

Issues

1. Whether the Amended Privacy Rule issued by the Secretary violates
Appellants’ right to medical privacy under the Fifth Amendment by
granting “regulatory permission” for the use and disclosure of
Appellants’ personal health information to members of the public and
numerous government employees in routine situations without notice or
permission and against their will.

2. Whether the Secretary violated Appellants’ right to private
communications under the First Amendment by authorizing the use and
disclosure of Appellants’ confidential communications with their
medical practitioners in routine situations without notice or
permission and against their will.

3. Whether the Secretary’s elimination of Appellants’ reasonable
expectations of medical privacy in routine situations prospectively and
retrospectively is consistent with the intent of Congress.

4. Whether the Secretary acted arbitrarily and capriciously in
violation of the Administrative Procedure Act in reversing a settled
course of behavior and adopting a policy that he had previously
rejected.

Statement of the Case

    Appellants are 10 national and state associations,
and 9 individuals representing approximately 750,000 consumers, medical
practitioners and their patients whose medical privacy, and that of
their patients and members, began to be eliminated, prospectively and
retroactively, on April 14, 2003 by an Amended Privacy Rule issued by
the Secretary (“Amended Rule”).  Verified Amended Complaint, Joint
Appendix (“J.A.”) 45-332, 1,486-1,524.  That rule reversed and
eliminated medical privacy standards put into effect by the Secretary
on April 14, 2003 to implement § 264(c) of Title II, Subtitle F of
the Health Insurance Portability and Accountability Act of 1996
(HIPAA), Pub. L. 104-191.

Appellants and their members include individuals residing in every
state and the District of Columbia who are law abiding citizens posing
no threat to society who began having their personal health information
used and disclosed, without their permission and against their will, to
numerous other members of the public and government employees for
certain “routine” purposes by covered entities exercising federal
authority granted by the Amended Rule.  This health information is
being used and disclosed in identifiable form, is unlimited in scope,
and includes such highly personal information as genetic information,
the results of medical testing, diagnosis and treatment for
stigmatizing illnesses such as cancer, sexually transmitted diseases,
mental illness and AIDS, and information about abortion, contraception
and fertility as well as marriage and family relationships.  As a
result of these and other uses and disclosures, Appellants are avoiding
seeking medical care and are withholding information from their
clinicians.  Even these measures have not afforded privacy
protection against disclosures of information already in Appellants’
medical records since the Amended Rule applies retroactively. 
Appellants filed their complaint on April 10, 2003, as amended May 5,
2003, seeking to enjoin provisions of the Amended Rule that eliminated
their medical privacy and to reinstate provisions of the Original
Privacy Rule (“Original Rule”).  J.A. 1,486-1,524.

The Appellants and the Secretary filed cross motions for summary
judgment.  On April 2, 2004, the District Court issued an opinion
finding that the Amended Rule had caused redressable injury to
Appellants’ medical privacy but had not violated their rights under the
Constitution, HIPAA and the Administrative Procedure Act.  J.A.
1-15.  Appellants appealed on May 27, 2004.  J.A.
16-18. 

Statement of Facts

    On April 14, 2001, the Secretary put into effect
regulatory standards to protect the privacy of identifiable health
information as required under § 264(c) of HIPAA.  J.A. 39,
333, 364.  Section 264 required regulations to set forth medical
privacy rights that individuals “should have” with respect to
identifiable health information so that the efficiency and
effectiveness of the health delivery system could be improved through
the electronic storage and transmission of health information.  65
Fed. Reg. at 82,463/2, J.A. 334.  The Original Rule’s purpose was
“to protect and enhance the rights of consumers”, improve the quality
of health care by restoring trust in the health delivery system, and
create a national framework for health privacy building on the efforts
of states and others.  Id.  That rule had been published near
the end of the prior Administration.  65 Fed. Reg. 82,462
(December 28, 2000).  J.A. 333. 

    A core concept of the Original Rule was that consent
would be obtained by a health provider before using or disclosing an
individual’s identifiable health information for certain “routine”
purposes defined as treatment, payment or health care operations. 
45 C.F.R. § 164.506 (J.A. 42, 345).  Health information could
still be used by providers without consent if rendered
“de-identifiable” (45 C.F.R. § 164.514), if it was to be used for
any of 12 “non-routine” purposes (45 C.F.R. § 164.512(a)-(l)), if
the provider was in an indirect treatment relationship with the
individual or needed the information for treatment of a prison inmate
(45 C.F.R. § 164.506(a)(2)) or if the provider needed the
information in an emergency situation, was required by law to provide
treatment or was unable to obtain consent due to “substantial barriers”
(45 C.F.R. § 164.506(a)(3)).  J.A. 42.

    In recognizing a right of consent in the Original
Rule, the agency rejected a proposed provision permitting the use and
disclosure of identifiable health information for routine purposes
without the individual’s consent after providing a general
notice.  65 Fed. Reg. at 82,473/3, J.A. 344.  That approach
was rejected based on the agency’s findings that control over use and
disclosure of one’s identifiable health information is an essential
element of privacy, and privacy is necessary for high quality health
care as recognized in federal and state statutory and common law and
established standards of medical ethics.  J.A. 336, 338-40, 344-45.

    The current Secretary again rejected efforts to
eliminate the right of medical privacy and consent when he put the
Original Rule into effect on April 14, 2001 after conducting his own
rule making proceeding in February and March.  J.A. 365-66.

    The terms describing covered entities and health
information were broadly defined.  The Rule applied to “covered
entities” including health plans, health care clearinghouses and
providers.  Those terms were broadly defined to include both
private and governmental entities.  45 C.F.R. §
160.102.  The Rule also applied to “business associates” who might
handle health information on behalf of covered entities including
lawyers, consultants and financial advisors.  45 C.F.R. §
160.103.  The “routine” uses and disclosures subject to the Rule
were also broadly defined to include, but not be limited to, 7
“treatment” purposes and 22 “payment” purposes relating to providing
health care to the individual.  They also included 49 “health care
operations” purposes (expanded to 50 by the Amended Rule) related to
the operations of covered entities.  45 C.F.R. § 164.501.

    On August 14, 2002, the Secretary issued a final
Amended Rule reversing the policy put into effect on April 14, 2001 by
eliminating the individual’s right of privacy and consent in routine
situations, thereby adopting the approach that both his predecessor and
he had rejected.  67 Fed. Reg. at 53,182, J.A. 1376.  The
Amended Rule went further, however, and granted express federal
authority, in the form of “regulatory permission”, to all “covered
entities” and their “business associates” to use and disclose
individuals’ identifiable health information for routine purposes
without their permission and even over their objection.  67 Fed.
Reg. at 53,211/2, J.A. 1381.  The Secretary also indicated this
authority would apply to identifiable health information created for an
infinite period prior to the Amended Rule’s April 14, 2003 compliance
date.  67 Fed. Reg. at 53,211/3, J.A. 1381. 

By reversing its core concept while retaining its broad definitions,
the Secretary converted the Original “Privacy” Rule into a broad
“disclosure” rule.  The Amended Rule permits covered entities to
provide a consent process if individuals request “restrictions” on the
use and disclosure of their health information, but the Rule affords
complete discretion to covered entities to deny all such requests and
affords individuals no recourse.  45 C.F.R. §
164.522(a)(1)(i)(B). Appellants have shown by undisputed evidence that
all such requests are summarily denied or ignored.  There are over
600,000 covered entities and millions of business associates who have
been granted express federal authority by the Amended Rule to intrude
on Appellants’ medical privacy.  J.A. 366.

Related Cases and Proceedings

    None.

Standard or Scope of Review

    The District Court granted summary judgment in favor
of the Secretary.  Courts of Appeals review such orders de novo,
applying the same standard the District Court should have used. 
United States v. Tielsch, 89 Fed. Appx. 355, 356 (2004 WL 434146) (3d
Cir. 2004); Bartnicki v. Vopper, 200 F.3d 109, 114 (3d Cir. 1999),
aff’d, 532 U.S. 514, 524-25, 121 S.Ct. 1753, 1760 (2001); Gruenke v.
Seip, 225 F.3d 290, 298 (3d Cir. 2000); Nicini v. Morra, 212 F.3d 798,
805 (3d Cir. 2000).  The non-movant’s allegations are accepted as
true whenever they conflict with those of the movant and inferences
drawn from the underlying facts must be viewed in the light most
favorable to the non-movant.  Bartnicki, supra.  Questions of
law and constitutionality are subject to plenary review.  In re
Telegroup, 281 F.3d 133, 136 (3d Cir. 2002); Robeson Industries Corp.
v. Hartford Accident & Indemnity Company, 178 F.3d 160, 164 (3d
Cir. 1999).  The parties below cross-moved for summary judgment
based on an agreement that there are no material issues of fact in
dispute.  The Secretary did not contest any of Appellants’ 25
sworn affidavits and evidence verifying all facts alleged in the
Amended Complaint.

Summary of Argument

    The Amended Rule has eliminated the Appellants’
right to medical privacy—the right of law abiding citizens “to be let
alone.”  Appellants’ right to medical privacy is an unalienable
“fundamental” right deeply rooted in the Nation’s history and
traditional medical ethics and is implicit in the concept of ordered
liberty.  The Secretary has not demonstrated a “compelling
governmental interest” in infringing this right and admittedly has
failed to tailor the intrusion to preserve Appellants’ fundamental
liberty interest while addressing his objectives.  The Secretary
has also violated Appellants’ right to medical privacy by conditioning
Appellants’ ability to exercise that right on the unfettered discretion
of third parties.

    The Amended Rule is a “content-based” rule
restricting the Appellants’ ability to have private conversations with
their medical practitioners as protected by the First Amendment. 
The Amended Rule violates Appellants’ rights to private speech because
the Secretary did not use the “least restrictive alternative” available
to him in formulating the Rule.

    The Amended Rule also exceeds the authority granted
to the Secretary under HIPAA because the legislative history reflects a
Congressional intent to protect the ability of citizens to control the
use and disclosure of their identifiable health information in routine
situations and confers no authority to apply the Amended Rule
retroactively.  The Secretary’s predecessor confirmed this intent
in the Original Rule, and the Secretary failed to cite any evidence of
a contrary Congressional intent.

    The Amended Rule is also invalid under the
Administrative Procedure Act for being “arbitrary and capricious” in
that the Secretary failed to consider relevant factors and available
evidence, issued a basis for the Amended Rule that runs counter to the
evidence and is implausible, and failed to address significant comments
and alternatives.

    The undisputed affidavits and evidence submitted by
each of the Appellants show that the Amended Rule is violating their
medical privacy, impeding their access to quality health care and
disrupting private communications with medical practitioners.  The
Appellants seek an injunction restoring the status quo with respect to
the medical privacy which the Original Rule found was essential for
access to efficient and effective health care.  J.A. 345. 

Argument

I. The Amended Privacy Rule Deprives Appellants

of Their Right to Medical Privacy

A. The Right to Privacy

The makers of our Constitution . . . conferred, as against the
government, the right to be let alone—the most comprehensive of rights
and the right most valued by civilized men.  To protect that
right, every unjustifiable intrusion by the government upon the privacy
of the individual, whatever the means employed, must be deemed a
violation of the [Constitution].



Olmstead v. United States, 277 U.S. 438, 478, 48 S.Ct. 564, 572 (1928)
(Brandeis J., dissenting).

Whatever I see or hear, professionally or privately, which ought not to
be divulged, I will keep secret and tell no one.



The Hippocratic Oath, 5th Century B.C., J. Chadwick and W. Mann,
Hippocratic Writings, Penguin (1950).

The consent provisions in [the Original Privacy Rule] are replaced with
a new provision [in the Amended Rule] that provides regulatory
permission for covered entities to use and disclose protected health
information for [routine purposes].



Explanation of 45 C.F.R. § 164.506 (amended), 67 Fed. Reg. at
53,211/2, J.A. 1381 (emphasis supplied). 

As the Secretary’s explanation shows, the federal government has
substituted its decision making authority for that of the Appellants
concerning whether personal health information should be used and
disclosed in routine situations.  The undisputed evidence shows
that on and after April 14, 2003, covered entities have begun violating
Appellants’ medical privacy by exercising the “regulatory permission”
granted by the Amended Rule.  The Amended Rule thereby has
violated Appellants’ fundamental constitutional rights to medical
privacy and standards of medical ethics pre-dating the country’s
founding. 

    Justice Brandeis’ oft-cited definition of the right
to privacy in Olmstead was “validated” 40 years later in Griswold v.
Connecticut, 382 U.S. 479, 85 S.Ct. 1678 (1965).  See Sterling v.
Borough of Minersville, 232 F.3d 190, 193 (3d Cir. 2000).  
Both before and after Griswold, the Supreme Court recognized that the
right to “liberty” protected by the Due Process Clause includes certain
“zones of privacy” that are fundamental to the enjoyment of
liberty.  Lawrence v. Texas, 539 U.S. 558, 123 S.Ct. 2472, 2476
(2003); Troxel v. Granville, 530 U.S. 57, 65, 120 S.Ct. 2054, 2059
(2000); Planned Parenthood of Southeastern Pennsylvania v. Casey, 505
U.S. 833, 848-49, 112 S.Ct. 2791, 2805 (1992) (“Casey”); Thornburg v.
Amer. Coll. of Ost. and Gyn, 476 U.S. 747, 772, 106 S.Ct. 2169, 2184
(1986); Roe v. Wade, 410 U.S. 113, 152, 93 S.Ct. 705, 726-27 (1973).

    While the boundaries of privacy protected by the
right to liberty have not been exhaustively delineated, they include
protection against government intrusion with respect to certain types
of personal decisions as well as protection against the disclosure of
highly personal information, including medical information. 
Casey, 505 U.S. 849-53, 2806-08; Thornburg, 476 U.S. at 772, 106 S.Ct.
at 2184-85; Whalen v. Roe, 429 U.S. 589, 599, 97 S.Ct. 869, 876 (1977);
Sterling, 232 F.3d at 194; Gruenke, 225 F.3d 290, 302-03 (3d Cir.
2000).  See also Tucson Woman’s Clinic v. Eden, 371 F.3d 1173,
1193 (11th Cir. 2004). 

B. Privacy is a Fundamental Right

    Areas of personal decision making where freedom from
governmental interference has been found “fundamental” to liberty
protected by the Due Process Clause include parental decisions
concerning the care, custody, and control of children, Troxel v.
Granville, 530 U.S. at 72, 120 S.Ct. at 2063; relationships between
consenting adults, Lawrence v. Texas, 123 S.Ct. at 2478; abortion,
Casey, 505 U.S. at 852-53, 112 S.Ct. at 2807; advertising and
distribution of contraceptives, Carey v. Population Services Int’l, 431
U.S. 678, 684-86, 97 S.Ct. 2010, 2016-17 (1977); use of contraception
by unmarried individuals, Eisenstadt v. Baird, 405 U.S. 438, 92 S.Ct.
1029 (1972); use of contraception by married individuals, Griswold v.
Connecticut, supra; marriage, Loving v. Virginia, 388 U.S. 1, 12, 87
S.Ct. 1817, 1824 (1967); family relationships, Prince v. Massachusetts,
321 U.S. 158, 166, 64 S.Ct. 438 (1944); procreation, Skinner v.
Oklahoma, 316 U.S. 535, 541-42, 62 S.Ct. 1110 (1942); and child rearing
and education, Pierce v. Society of Sisters, 268 U.S. 510, 45 S.Ct. 571
(1925). 

    The types of personal information that are protected
from disclosure to the public and to government employees as a
“fundamental” liberty interest include personal information pertaining
to sexual orientation, Sterling, 232 F.3d at 195; and personal
communications, Bartnicki, 200 F.3d at 122; as well as identifiable
medical records and ultrasound prints, Tucson Woman’s Clinic, 371 F.3d
at 1194; information pertaining to a married woman’s reason for not
informing her husband of an abortion, Casey, 505 U.S. at 901;
information (even without the woman’s name) about the method of
payment, her personal history, and the bases for medical judgments
surrounding an abortion, Thornburg, 476 U.S. at 766, 106 S.Ct. at 2181;
copies of prescriptions for certain drugs, Whalen v. Roe, 429 U.S. at
605-06, 97 S.Ct. at 879-880; and results of pregnancy tests, Gruenke,
225 F.3d at 302-03.   All of the personal information found
protected by decisional or informational privacy under Due Process in
the foregoing decisions is usable and disclosable to an unlimited
number of private third parties and government employees under the
“regulatory permission” granted by the Amended Rule.

    In determining whether a case presents a fundamental
liberty interest, courts should arrive at a “careful description” of
the asserted right and examine whether the interest is “deeply rooted
in the Nation’s history and tradition” and is “implicit in the concept
of ordered liberty.”  Washington v. Glucksberg, 521 U.S. 702,
720-21, 117 S.Ct. 2258, 2268 (1997).  The so-called “Glucksburg
analysis”, however, is applicable only where a party seeks to establish
or extend Due Process protection to a previously unrecognized
fundamental liberty interest.  Williams v. Atty. Gen’l of Alabama,
2004 WL 1681149, *5 (11th Cir. July 28, 2004).  Compare, Troxel,
120 S.Ct. at 2060 (addressing a recognized liberty interest), with
Glucksberg and Reno v. Flores, 507 U.S. 292, 302, 113 S.Ct.. 1439, 1447
(1993) (addressing an alleged new liberty interest).

    The right to privacy for highly personal information
asserted by Appellants is so clearly established as a fundamental
liberty interest that no reasonable person could be expected to be
unaware of it.  Gruenke, 225 F.3d at 302-03.  See also,
Sterling, 232 F.3d at 192, 198.  HHS confirmed the correctness of
this Court’s conclusions in the Original Rule when it found that
“[p]rivacy is a fundamental right.”  65 Fed. Reg. at 82,464/1,
J.A. 335.

    The right asserted by Appellants is clearly
described, implicit in the concept of ordered liberty and deeply rooted
in the Nation’s history and tradition.  Appellants assert their
right, as law abiding citizens who pose no threat to society, to not
have the federal government use and disclose or authorize others to use
and disclose their identifiable health information to the public and to
government employees in routine situations without their consent and
against their will.

    In addition to the “right to be let alone”, this
Court has also defined privacy as “control over knowledge about one’s
self.”  U.S. v. Westinghouse, 638 F.2d at 577 n.5.  HHS noted
in issuing the Original Rule that “[t]he right of privacy is: ‘the
claim of individuals, groups, or institutions to determine for
themselves when, how, and to what extent information about them is
communicated.’”  65 Fed. Reg. at 82,465/1, J.A. 336.  HHS
also previously determined that “few experiences are as fundamental to
liberty and autonomy as maintaining control over when, how, to whom,
and where you disclose personal material.”  65 Fed. Reg. at
82,464/3, J.A. 335.  Thus, the ability to exert some control over
one’s health information is an essential element of the right to
privacy and is implicit in the concept of ordered liberty.  It is
precisely Appellants’ ability to have some control over the use and
disclosure of their health information in routine situations that the
Amended Rule has abrogated.

English common law pre-dating the American Constitution “secure[d] to
each individual the right of determining, ordinarily, to what extent
his thoughts, sentiments, and emotions shall be communicated to
others.” S. Warren and L. Brandeis, “The Right to Privacy”, IV. Harv.
L. Rev. at 198-99 (1890).   The law of France was also in
accord.  Id. at 214.

    The Declaration of Rights adopted by the first
Continental Congress in 1774 echoed the writings of John Locke that
individuals are entitled to life, liberty and property “and that they
cannot be deprived of these rights without their consent.” R. Rutland,
“The Birth of the Bill of Rights”, 26-27, Bicent. Ed.
(1991).  

The concept of liberty that cannot be abrogated without the
individual’s consent is reflected in the “unalienable rights” of the
Declaration of Independence and in Article I, Section 1 of the
Constitution that vests all legislative power in citizen
representatives.  The common purpose of these principles was “to
free citizens from the unlimited surveillance and control that had been
exercised over ‘subjects’ by the kings, lords, churches, guilds, and
municipalities of European society.  A. Westin, “Privacy and
Freedom”, 330 (1967) (footnote omitted). 

    The right to privacy subsequently became a
foundation principle of the Bill of Rights underlying the right of
citizens to speak or remain silent under the First Amendment; the right
to not have troops quartered in their homes under the Third Amendment;
the right of citizens to be secure in their “persons, houses, papers,
and effects” against unreasonable searches and seizures under the
Fourth Amendment; and the privilege against self incrimination and the
right to Due Process under the Fifth Amendment.  Westin at
330-333.  HHS recognized similar “historical sources” of the right
to liberty and privacy in the preamble to the Original Rule.  65
Fed. Reg. at 82,464/2, J.A. 335.

    Most state laws and established standards of ethical
and contemporary medical practice recognize the ability of patients to
have some control over the use and disclosure of their health
information in routine situations.  HHS found in issuing the
Original Rule that, while state laws (with some exceptions) do not
extend “comprehensive” protections to medical records, “[a]ll 50 states
today recognize in tort law a common law or statutory right to
privacy”, and some states, such as California and Tennessee, include a
right to privacy as a matter of state constitutional law.  65 Fed.
Reg. at 82,464/1, id.   About “half of the states” have a
general law that prohibits disclosure of health information without the
patient’s permission, although some have exceptions for “treatment and
related purposes.”  65 Fed. Reg. at 82,473/1, J.A. 344.  Most
state health care licensure laws have general prohibitions against
“breaches of confidentiality”, and others recognize invasion of privacy
and breaches of confidentiality under “various tort theories.”  65
Fed. Reg. at 82,473/2, id.  The Supreme Court has recognized that
all 50 states and the District of Columbia have enacted some form of
psychotherapist-patient privilege law protecting unauthorized
disclosures of mental health information.  Jaffee v. Redmond, 518
U.S. 1, 12, 116 S.Ct. 1923, 1929 (1996).

    Most traditional ethical standards for the practice
of medicine have incorporated the core element of the Hippocratic Oath
that patients’ health information generally should not be disclosed
without their permission or against their will.   For
example, the ethical standards of the American Medical Association
provide that

    The physician should not reveal confidential
communications or information without the express consent of the
patient, unless provided for by law or by the need to protect the
welfare of the individual or the public interest.



See R. Gorlin, “Codes of Professional Responsibility”(2000), at 342
(emphasis supplied.); see also, American College of Physicians at 312;
American Nurses Ass’n, 498; American Psychiatric Ass’n, 456; National
Ass’n of Social Workers, 535; American Dental Ass’n, 284; American
Chiropractic Ass’n, 275. 

Traditional ethical standards also state that “conflicts between a
patient’s right to privacy and a third party’s need to know should be
resolved in favor of the patient, except where that would result in
serious health hazard or harm to the patient or others.”  AMA
Policy No. 140.989, quoted at 65 Fed. Reg. 82,472/3, J.A. 343. 
Thus, traditional standards of ethical medical practice vest control of
personal health information in routine circumstances in the hands of
the patient rather than covered entities and their business associates.


HHS also found in issuing the Original Rule that “virtually all
hospitals” and “90% of non-hospital providers” obtain patient consent
for the use and disclosure of health information for routine
purposes.  65 Fed. Reg. at 82,771/2, J.A. 354.  

Citizens, therefore, reasonably have a “common belief” and “strong
expectations” that their identifiable health information will not be
used or disclosed without their knowledge and consent in routine
situations.  65 Fed. Reg. at 82,472/3-82,473/1, J.A. 343-44. 
See similar conclusion of the Massachusetts Medical Society, 65 Fed.
Reg. at 82,472/3, J.A. 343.  The Supreme Court reached similar
conclusions in Ferguson v. City of Charleston, 532 U.S. 67, 78, 121
S.Ct. 1281, 1288 (2001) (“The reasonable expectation of privacy enjoyed
by the typical patient undergoing diagnostic tests in a hospital is
that the results of those tests will not be shared with non-medical
personnel without her consent.”) and Jaffee v. Redmond, 518 U.S. at
13-15, 116 S.Ct. 1930-31.

    Thus, it is beyond dispute that the right asserted
by Appellants to not have their personal and identifiable health
information made public or disclosed to numerous government employees
in routine situations is a fundamental right implicit in the concept of
ordered liberty and deeply rooted in the Nation’s history.

C. Fundamental Rights Are Entitled to “Heightened Scrutiny”

    While protections afforded by Due Process to
established fundamental rights are not absolute, any governmental
intrusion on such rights is subject to “heightened scrutiny” which
“forbids the government to infringe . . . ’fundamental’ liberty
interests at all, no matter what process is provided, unless the
infringement is narrowly tailored to serve a compelling [governmental]
interest.”  (Emphasis original.)  Glucksberg, 521 U.S. at
721, 117 S.Ct. at 2267-68.  See also Troxel, 530 U.S. at 65, 120
S.Ct. at 2060; Casey, 505 U.S. at 872, 112 S.Ct. at 2817; Roe v. Wade,
410 U.S. at 155, 93 S.Ct. at 728; Doe v. Bolton, 410 U.S. 179, 219-20,
93 S.Ct. 739, 761-62, (Douglas, J., concurring) (1973) (“[F]undamental
rights and liberties . . . can be contained or controlled only by
discretely drawn legislation that preserves the ‘liberty’ interest and
regulates only those phases of the problem of compelling
concern.”)  See also, Lawrence v. Texas, (Scalia, J., dissenting),
123 S.Ct. at 2492.  Correlatively, Due Process does not permit the
imposition of “blanket” restrictions or requirements on fundamental
rights.  Carey v. Population Servs. Int’l, 431 U.S. at 693, 97
S.Ct. at 2020; Planned Parenthood of Cent. Missouri v. Danforth, 428
U.S. 52, 74, 96 S.Ct. 2831, 2843 (1976). 

    This Court has recognized that the strict
scrutiny/compelling interest test is used for “severe intrusions” on
the fundamental right to personal informational privacy. 
Fraternal Order of Police (“FOP”) v. City of Philadelphia, 812 F.2d
105, 110 (3d Cir. 1987).  Intrusions are severe if they seek
disclosure of highly personal information such as one’s sexual history
(Thorne v. City of El Segundo, 726 F.2d 459, 469 (9th Cir. 1983), cert.
denied, 469 U.S. 979, 105 S.Ct. 380 (1984)) or permit the disclosure of
such information to members of the public or numerous government
employees.  Whalen v. Roe, 429 U.S. at 606-07, 97 S.Ct. at 879-80
(Brennan, J., concurring).  See also Sterling, 232 F.3d at 195-96
(government’s interest in the disclosure of an individual’s sexual
orientation must be “genuine, legitimate and compelling”). 

The privacy intrusions authorized by the Amended Rule are clearly
“severe” since they encompass all of the highly personal information
found in prior decisions to be protected by the fundamental right to
liberty and they include disclosures of that information to an
unprecedented range of private and public individuals. 

Neither this Court nor the Supreme Court has been confronted with
personal privacy violations as “severe” as those authorized by the
Amended Rule.  The Supreme Court recently noted with respect to
the disclosure of a single type of medical test to a limited number of
government employees: “In none of our prior cases was there any
intrusion upon that kind of expectation.”  Ferguson, 532 U.S. at
78, 121 S.Ct. at 1288.

This Court has found the Due Process right to privacy of a young man
was violated by the threatened disclosure of his sexual orientation to
a single relative, (Sterling); privacy rights of a young woman swimmer
were violated when the results of her pregnancy tests were disclosed to
two of her team mates (Gruenke); disclosure of certain prescriptions
for the treatment of AIDS did not violate an employee’s right to
privacy because it was an inadvertent disclosure to a single supervisor
and adequate measures were adopted to prevent any recurrence (Doe v.
Southeastern Pa. Trans. Auth. (“SEPTA”), 72 F.3d 1133 (3d Cir. 1995));
privacy rights of applicants for a special police unit were violated by
the fact that access to limited medical information about them was not
restricted to specific members of the department (FOP); and privacy
rights of employees were not violated by the disclosure of
non-sensitive medical information to a federal agency investigating
workplace hazards because the employees were given notice of the
specific disclosures and an opportunity to decline, and no disclosures
were made to the public (Westinghouse).

    The approach adopted by the Secretary in the Amended
Rule fails to meet the strict scrutiny/compelling interest test in at
least three ways.  First, the Secretary never demonstrated a
“compelling governmental interest” in authorizing the routine use and
disclosure of Appellants’ most personal identifiable health information
to thousands of members of the public and government employees. 
The Secretary stated that he eliminated Appellants’ medical privacy in
routine situations because continuing to allow Appellants to have some
control over the use and disclosure of their health information “would
impede the provision of health care in many critical
circumstances.”  67 Fed. Reg. at 53,210/2, J.A. 1380.  The
Secretary, however, never explained why the delivery of health care had
not been impeded previously by the traditional right to medical privacy
which had concededly existed under federal common law, many state
statutes and common law, as well as established standards of medical
ethics and practice throughout the country’s history.

Second, any alleged impediment could only have been hypothetical since
the consent requirement in the Original Rule was eliminated before the
Rule’s compliance date.  Clearly the government’s interest in
removing a theoretical and unsubstantiated impediment to health care in
some situations does not rise to the level of governmental interest in
protecting existing and potential life that failed to override
fundamental liberty interests in Thornburg, Danforth, Wade, and Bolton.


    Third, the Secretary admittedly failed to take a
“tailored” approach.  The basis statement to the final Amended
Rule admits that the Secretary could have adopted more “targeted”
approaches that would have left the right to privacy and consent
intact.  67 Fed. Reg. at 53,210/3, J.A. 1380.  The Secretary
decided instead to adopt a “global fix” broadly eliminating Appellants’
medical privacy in routine situations.  67 Fed. Reg. at 53,210/3,
53,212/2, 53,213/1, J.A. 1,380, 1,382, 1,383.  Thus, the Amended
Rule does not pass the strict scrutiny/compelling interest test.

D. Fundamental Rights Cannot Be Subject to Conditions and Unfettered
Discretion

    It is also well-established that the exercise of
fundamental rights cannot be made conditional on the approval of a
third party.  See Casey, 505 U.S. at 897-98, 112 S.Ct. at 2831
(fundamental right to decide to have an abortion cannot be conditioned
on spousal notification); Carey v. Population Servs. Int’l, 431 U.S. at
693, 97 S.Ct. at 2020 (fundamental right of minors to use contraception
cannot be conditioned on approval by physician or government
officials); Danforth, 428 U.S. at 74, 96 S.Ct. at 2841 (fundamental
right to decide to have an abortion cannot be conditioned obtaining
spouse’s consent); and Doe v. Bolton, 410 U.S. 179, 93 S.Ct. at 749-50
(fundamental right to decide about abortion cannot be conditioned on
approval of hospital committee).

    It is even more clear that the exercise of
fundamental liberty rights cannot be conditioned on a grant by the
government of unfettered discretion to third parties to give or
withhold permission “for selfish reasons or arbitrarily.”  Tucson
Woman’s Clinic v. Eden, 371 F.3d at 1197, citing Wash. ex rel. Seattle
Title Trust Co. v. Roberge, 278 U.S. 116, 121-22, 49 S.Ct. 50, 52
(1928) (zoning measure violated landowner’s Due Process right to
legitimate use of property when it conferred complete discretion on
adjoining landowners to give or withhold permission for a particular
use); and Yick Yo v. Hopkins, 118 U.S. 355, 370, 6 S.Ct. 1064, 1071
(1886) (ordinance granting complete discretion to quasi-governmental
city supervisors to give or withhold consent for the operation of a
laundry violated Due Process).  See also Kent v. Dulles, 357 U.S.
116, 129, 78 S.Ct. 1113, 1119-20 (1953) (right to travel cannot be
limited by “unbridled discretion” to grant or withhold the
right).  The obvious reason is that the government does not have
the Constitutional power to act arbitrarily and may not delegate that
power to another.  Carey, 431 U.S. at 693, 97 S.Ct. at 2020,
Tucson Womans’ Clinic, 371 F.3d at 1198.    

Under the Amended Rule, Appellants cannot prevent their identifiable
health information from being used and disclosed to thousands of other
public and private individuals unless they file a “request for
restrictions” with all covered entities which may have contact with, or
custody over, that information.  67 Fed. Reg. at 53,211/1, J.A.
1,381.  Covered entities are free to deny those requests for any
reason and for no reason.  45 C.F.R. §
164.522(a)(1)(B).  There is no process for reviewing whether the
denials are related to some legitimate purpose, and all such decisions
are final.  It is undisputed in this case that all such requests
by Appellants have been summarily denied or ignored.  J.A. 305-06,
312-13, 1,480-82.  At least one national covered entity has
adopted a preemptive policy of never granting requests for
restrictions.  J.A. 315-16.  

As the Supreme Court observed over 100 years ago, “the very idea that
one man may be compelled to hold . . . any material right essential to
the enjoyment of life, at the mere will of another, seems intolerable
in any country where freedom prevails, as being the essence of slavery
itself.”  Yick Yo v. Hopkins, supra.  This is precisely the
condition imposed upon Appellants’ medical privacy by the Amended Rule.

II. The Amended Rule Violates Appellants’ Right to Private
Communications Protected by the First Amendment

A. Appellants’ Right to Confidential Communications

The right to privacy, “[a]s commonly understood”, encompasses both the
right to be free from unreasonable intrusions on one’s seclusion and
“the right to be free from ‘unreasonable publicity concerning [one’s]
private life.’”  Bartnicki v. Vopper, 200 F.3d at 122.  “Fear
or suspicion that one’s speech is being monitored by a stranger, even
without the reality of such activity, can have a seriously inhibiting
effect” on the willingness of citizens to speak freely.  Bartnicki
v. Vopper, 532 U.S. at 533, 543, 121 S.Ct. at 1764, 1769-70.  See
also, Jaffee v. Redmond, 518 U.S. at 11-12, 116 S.Ct. at 1929.

This chilling effect of inadequate privacy protections for
clinician-patient communications has been well-documented by HHS. 
Studies cited in support of the Original Rule showed that people who
believe their health information will not be protected are “much less
likely to participate fully in the diagnosis and treatment of [their]
medical condition” and take evasive action such as “withhold[ing]
information from their health care providers.”  65 Fed. Reg. at
82,468/1, J.A. 339.  Nearly 80% of the members of a national
professional medical association reportedly had withheld information
from their patients’ medical records due to privacy concerns, and
nearly 90% reportedly had a patient request that information be
withheld from their medical record.  Id.

A national survey of consumers found that 7% said they or an immediate
family member had chosen not to seek medical services due to fear of
harm to job prospects or other life opportunities.  65 Fed. Reg.
at 82,776/3, J.A. 355.  HHS estimated that nearly 600,000 people
failed to seek earlier treatment for cancer due to concerns that cancer
detection and treatment would make them “vulnerable to discrimination
by insurers and employers.”  65 Fed. Reg. at 82,777/3, J.A.
356.  While each state has enacted laws protecting the
confidentiality of an individual’s HIV status, that status can be
revealed indirectly through disclosure of HAART (Highly Active
Anti-retroviral Therapy) or similar HIV drug treatment, resulting in
patients delaying needed treatment.  65 Fed. Reg. at 82,778/1,
J.A. 357.  See SEPTA, 72 F.3d at 1135.  The agency found that
many more HIV positive patients would elect this treatment earlier if
privacy protections were strengthened.  HHS also estimated that
more than 2 million citizens currently do not seek treatment for mental
illness due to privacy fears.  65 Fed. Reg. at 82,778/1, J.A.
358.  HHS stated that these examples were illustrative of the
impediment to treatment for “any health condition” posed by fears of
inadequate privacy protections for health information. 

    A recent report on the effects of genetic
discrimination found 92% of Americans oppose providing their employers
access to their genetic information and 80% oppose providing their
health insurers access to this information.  “Faces of Genetic
Discrimination, National Partnership for Women and Families” at 7 (July
2004).   Among college educated respondents, 97% opposed
providing access to employers and health insurers.  A 2003 study
of 470 people with a family history of colorectal cancer showed that
50% had a high level of concern about discrimination and many of those
individuals indicated that they would be less likely to undergo genetic
testing, and if they did, they would be more likely to pay out of
pocket to protect their privacy.  Report at 8.  HHS found
that 63% of participants in one national survey said they would not
take genetic tests if insurers and employers could gain access to the
results, and the National Institutes for Health have reported that 32%
of women who were offered a test to measure breast cancer risk refused
to take it citing concerns about the potential for discrimination in
health insurance.  65 Fed. Reg. at 82,466/2, J.A. 337. 

The broad uses and disclosures authorized by the Amended Rule have had
the same kind of chilling effect among Appellants as documented by the
above examples.  See, e.g., Affidavits of Janis G. Chester, M.D.,
(“Based on my experience, the Amended Privacy Rule has resulted in both
me and my patients being reluctant to disclose personal health
information to medical practitioners that is necessary for high quality
health care”, J.A. 306); Sally Scofield, (stopped all health care, J.A.
328); California Consumer Health Care Council, (“avoiding disclosing
health information”, J.A. 315); Deborah Peel, M.D. (“will avoid medical
care except in dire situations”, J.A. 1482); Daniel S. Shrager, (“I am
likely to withhold information . . . to preserve my privacy”, J.A. 331).

The essential thrust of the First Amendment is to protect “voluntary”
expression of ideas which means that, in addition to the right to speak
publicly, “there is a concomitant freedom not to speak publicly, one
which serves the same ultimate end as freedom of speech in the
affirmative aspect.”  Bartnicki, 532 U.S. at 533 n.20, 121 S.Ct.
at 1764 (emphasis in original), citing, Harper & Row, Publishers,
Inc. v. Nation Enterprises, 471 U.S. 539, 559, 105 S.Ct. 2218, 2230
(1985).  As Warren and Brandeis observed:  “In every . . .
case the individual is entitled to decide whether that which is his
shall be given to the public…No other has the right to publish his
productions in any form, without his consent.”  “The Right to
Privacy”, at 199.  The Amended Rule expressly authorizes the
involuntary disclosure of Appellants’ communications with their
clinicians for routine purposes without their permission.

Under the First Amendment, content-based regulation of speech is
subject to “the most exacting scrutiny.”  Bartnicki v. Vopper, 200
F.3d at 121.  It cannot be upheld unless it is necessary to serve
a “compelling” governmental interest and “it is narrowly drawn to
achieve that end.”  Id.  Content-based regulations are
“presumed invalid” and will not be upheld unless the government can
show it used the “least restrictive alternative” in achieving its
goal.  Ashcroft v. ACLU, 124 S.Ct. 2783, 2791 (June 29,
2004).   The burden is on the government to prove that the
proposed alternatives will not be as effective as the challenged
regulation.  The purpose of this test is to ensure that speech is
not regulated more than is necessary to achieve a particular goal
because “it is important to assure that legitimate speech is not
chilled or punished.”  Id.

Whether a regulation is “content-based” is determined by whether it is
activated by reference to specific subject matter or whether that is
the government’s purpose or intent.  Bartnicki, 532 U.S. at 526,
121 S.Ct. at 1760-61; 200 F.3d at 122.  The Amended Rule is
clearly “content-based” because it applies to “health information . . .
whether oral or recorded in any form or medium . . .”.  45 C.F.R.
§ 160.103.  Further, the Secretary has acknowledged his
intent in issuing the Amended Rule was to authorize the use and
disclosure of this health information in routine situations “with
little or no” ability of the individual to restrict its
disclosure.  67 Fed. Reg. at 53,209/1, J.A. 1,379.

Where the government’s choice is between a “blanket” speech regulation
and “a more specific technological solution” that is less restrictive
of the right to protected speech, the blanket approach must be
invalidated absent a showing by the government that the less
restrictive alternative would not be as effective.  Ashcroft v.
ACLU, 124 S.Ct. at 2794.  The Secretary admittedly had a choice
between “two potential approaches”—retaining the right to privacy and
consent in routine situations as provided in the Original Rule, or
broadly eliminating the right to privacy and consent and providing
blanket “regulatory permission” for the use and disclosure of all of
Appellants’ health information without their permission.  67 Fed.
Reg. 53,210/3, J.A. 1380.  He also admittedly had a choice between
the “global fix” he selected or other global and targeted approaches
that would have preserved Appellants’ rights to keep communications
with their clinicians private.  Id.  While the Secretary
discussed some of these alternatives in a cursory fashion, he never
stated which of the alternatives had been used successfully in the past
and why they were no longer effective.  Nor did he address many of
the alternatives suggested in comments.  See infra. 

    Thus, the Secretary has not sustained his burden of
proving that he has a compelling interest in forcing Appellants to
disclose their personal health information involuntarily and that he
used the least restrictive alternative in regulating the disclosure of
private communications between Appellants and their clinicians. 
The Secretary’s action has undisputedly inhibited and “chilled”
Appellants’ private communications with their clinicians in violation
of their right to private communications under the First Amendment.

B. Coercion and the Relief Appellants Seek

The District Court avoided addressing Appellants’ constitutional
arguments by concluding that the Amended Rule does not compel anyone to
disclose Appellants’ health information for routine purposes without
their consent and that Appellants, in essence, challenge the Amended
Rule because it does not confer new protections for their right to
medical privacy.  J.A. 14-15, (citing, DeShaney v. Winnebago Cty.
Soc. Servs. Dep’t, 489 U.S. 189, 195 (1989); Regan v. Taxation with
Representation, 461 U.S. 540, 549-50 (1983) and Harris v. McRae, 448
U.S. 297, 316 (1980)).  The District Court’s ruling on the
constitutional claims is undermined by its ruling on standing and by
the undisputed facts in the case.  It is further undermined by its
finding that the use and disclosure of Appellants’ identifiable health
information without their consent and against their will is made
“wholly permissive” with respect to covered entities and their business
associates and has been placed beyond Appellants’ ability to
control.  J.A. 14. 

The District Court found with respect to Appellant Dr. Deborah Peel
that (a) the medical privacy of herself, her family, and her patients
has been compromised by covered entities exercising the “regulatory
permission” granted by the Amended Rule; (b) she has filed numerous
requests for a consent process with a variety of covered entities, and
all such requests have been denied or ignored; (c) this is a radical
change from the prevailing practice prior to the compliance date when
such information was not used and disclosed for routine purposes
without consent; (d) both she and her family are now avoiding obtaining
health care except in dire situations but that does not protect the
privacy of health information placed in their medical records in the
past; (e) her patients are now refusing to take their medications in an
effort to shield their identifiable health information from disclosure;
and (f) many more patients will now avoid psychiatric care as a result
of the Amended Rule.  J.A. 8-10.  Based on these findings,
the District Court held Dr. Peel had demonstrated “injury in fact”, the
injury was directly connected and traceable to the issuance of the
Amended Rule, and the injury was redressable by invalidating the
provisions in the Amended Rule authorizing the use and disclosure of
Appellants’ identifiable health information in routine situations
without their consent. 

In reaching this determination, the Court found that the injury
suffered by Dr. Peel, her family and her patients, is produced by the
“determinative or coercive effect” of the Amended Rule on the actions
of providers.  J.A. 10.  The other Appellants all made
similar uncontested assertions of injury, causation and redressability
with respect to the Amended Rule.  J.A. 46-332.  Accordingly,
all Appellants have shown that they, their members and their patients
are having their personal medical privacy violated under the coercive
authority of the Amended Rule. 

Further, the actions of third parties are sufficiently coerced where
their choices are “reasonably foreseeable” or are the “very goal” of
the governmental action.  The Pitt News v. Fisher, 215 F.3d 354,
361 (3d Cir. 2000).  The preamble to the Amended Rule clearly
shows the actions of covered entities in eliminating Appellants’
medical privacy were reasonably foreseeable, and that the Secretary’s
conceded goal was to allow Appellants’ identifiable health information
to be used and disclosed in routine situations “with little or no
restriction” regardless of their wishes.  67 Fed. Reg. at
53,209/1, J.A. 1,379.

Furthermore, Appellants do not seek Secretary’s protection or funding
of their medical privacy, so the decisions in DeShaney, Regan, and
Harris are inapposite.  To the contrary, Appellants assert their
constitutional right “to be let alone” by the Secretary in his official
capacity. 

The holding in DeShaney has no applicability since the decision stands
purely for the proposition that a state’s failure to protect an
individual against private violence does not violate Due Process. 
Nicini v. Morra, 212 F.3d at 806.  The Supreme Court’s analysis,
however, is useful in illustrating the effect of the Amended Rule.

The Court in DeShaney found the state of Wisconsin had no duty under
the Due Process Clause to protect a four year old child from being
beaten by his father.  The Court noted, however, such a duty would
have arisen under Due Process if the state had rendered the child more
vulnerable to the danger or had played a part in creating it. 
DeShaney, 489 U.S. at 201, 109 S.Ct. at 1006; Nicini, 212 F.3d at
808.  See also Horton v. Flenory, 889 F.2d 454, 457 (3d Cir. 1989)
(constitutional duty to protect imposed where individual was forcefully
detained and beaten by bar owner with police approval).  To make
the facts in DeShaney analogous to the facts in this case, the state of
Wisconsin would have had to issue a regulation eliminating the ability
of the child to protect himself and granting express authority to the
father to beat him.  Under such a rule, the father would have
“complete discretion” to not beat the child, but if he did, he would be
exercising the authority granted to him by the state.  The
DeShaney rationale clearly would have found a Due Process violation
under such facts.  A similar conclusion is appropriate in this
case because the Amended Rule has eliminated Appellants’ ability to
protect their medical privacy by withholding consent, and has conferred
authority on covered entities to violate their privacy at will.

It is well-established that courts look to the practical effect,
purpose and intent of laws to determine whether they are
unconstitutional.  See Lawrence v. Texas, 123 S.Ct. at 2478
(statutes purported to prohibit a particular sex act but their
“purposes” touched on the “most private human conduct” which is a
liberty interest protected by Due Process); Lawrence, 123 S.Ct. at 2495
(“A racially discriminatory purpose is always sufficient to subject a
law to strict scrutiny, even a facially neutral law that makes no
mention of race.”  (Scalia, J., dissenting,); Hunt v. Cromartie,
526 U.S. 541, 546, 119 S.Ct. 1545, 1549 (1999) (determining whether a
law has an unconstitutional effect involves “a sensitive inquiry into
such circumstantial and direct evidence of intent as may be
available”); M.L.B. v. S.L.J., 519 U.S. 102, 126-27, 117 S.Ct. 555, 569
(1996) (“a law [conditioning appeal on payment of a fee]
non-discriminatory on its face may be grossly discriminatory in
operation.”); Casey, 505 U.S. at 878, 112 S.Ct. at 2821 (“a provision
of law is invalid, if its purpose or effect is to place a substantial
obstacle in the path [of the exercise of a fundamental right].”);
F.E.C. v. Mass. Citizens for Life, Inc., 479 U.S. 238, 255, 107 S.Ct.
616, 626 (1986) (“The fact that the statute’s practical effect may be
to discourage protected speech is sufficient to characterize [it] as an
infringement on First Amendment activities”); Washington v. Davis, 426
U.S. 229, 241-42, 86 S.Ct. 2040, 2049 (1976) (“the necessary
[unconstitutional] . . . purpose” of a law need not be expressed on its
face, but “may often be inferred from the totality of the relevant
facts”); Loving v. Commonwealth of Virginia, 388 U.S. 1, 11, 87 S.Ct.
1817, 1823 (1967) (simply because a law barring interracial marriages
applies to whites and blacks alike does not obscure the fact it was
“designed to maintain White Supremacy”).

Further, the government may not insulate an unconstitutional intent
from constitutional scrutiny by conferring authority on third parties
to deprive others of constitutionally protected rights. 
Otherwise, the Secretary could lawfully issue a rule authorizing
hospitals to refuse to serve minorities.  For example, a city may
not eliminate minorities from parks and recreational areas by
authorizing segregated organizations to use those facilities. 
Gilmore v. City of Montgomery, 417 U.S. 556, 565, 94 S.Ct. 2416, 2422
(1974).  A state may not tacitly authorize “redlining” in real
estate by amending its constitution to confer “absolute discretion” on
private property owners to refuse to sell residential property to
certain individuals.  Reitman v. Mulkey, 387 U.S. 369, 371, 87
S.Ct. 1627, 1629 (1967) (courts “quite properly” examine the
constitutionality of a law “in terms of its ‘immediate objective’, its
‘ultimate effect’, and its ‘historical context and the conditions
existing prior to its enactment.’” (citations omitted)).

The Amended Rule admittedly has the intent and purpose of authorizing
covered entities and their business associates to use and disclose
Appellants’ identifiable health information for routine purposes
without their permission and even over their objection.  The
undisputed affidavits and evidence in this case demonstrate that the
Rule is having its intended unconstitutional effect.

III. The Court Should Enforce the Original Interpretation of The Statute

    In the Original Rule, the Secretary determined that
Congress intended for medical privacy to be “an integral part” of the
standards to improve the efficiency and effectiveness of the health
delivery system under the Administrative Simplification provisions of
HIPAA.  65 Fed. Reg. at 82,465/1, 82,469-474, J.A. 336,
340-45.  This intent is consistent with the statute’s legislative
history in which Senator Paul Simon (D-IL), one of the bill’s
cosponsors stated:

One important provision in this bill that has not received much
attention is administrative simplification.  It sounds innocuous
enough.  It aims to cut administrative costs by standardizing the
way medical information is electronically stored and transmitted. 
No one is against cutting health care costs.

This standardization, however, accelerates the creation of large data
bases containing personally identifiable information.  All this
information is transmitted over electronic networks.  We need to
be very careful about how safe and secure that information is from
prying eyes.  Some of it may be extremely sensitive and could be
used in a malicious or discriminatory manner.

Not only do we need to hold this information securely, we also need to
give individuals control over who actually has access to their medical
records...

142 Cong. Rec. S9515 (daily ed. August 2, 1996) (emphasis
supplied).  Senator Simon also had the following comments about
permitting identifiable health information to be stored and transmitted
before effective privacy and security measures are put into place:

Obviously, privacy should come first.  I don’t think there is one
Senator here who would like to have his or her own medical privacy play
second fiddle to business costs.

Id.  There is no evidence of Congressional intent to sacrifice the
public’s medical privacy to the interests of covered entities in
efficiency and “flexibility” as the Secretary has done in the Amended
Rule.  No such evidence has been cited by the Secretary.  67
Fed. Reg. at 53,210/3, 53,213/1, J.A. 1380, 1383.  Courts should
not defer to an agency’s position unless it is consistent with the
statute and Congressional intent on which it is based.  Adams
Fruit Co. v. Barrett, 494 U.S. 638, 649,110 S.Ct. 1384, 1390 (1990);
Thomas v. Commissioner of Social Security, 294 F.3d 568, 574 (3d Cir.
2002) (en banc); Natural Resources Defense Council v. EPA, 790 F.2d
289, 297 (3d Cir. 1986) (“NRDC”).

    Also, a statutory grant of rulemaking authority
“will not as a general matter, be understood to encompass the power to
promulgate retroactive rules unless that power is conveyed by Congress
in express terms.”  Bowen v. Georgetown Univers. Hosp., 488 S.Ct.
204, 208, 109 S.Ct. 468, 472 (1988).  See also, Eastern
Enterprises v. Apfel, 524 U.S. 498, 532 (1998).  Determining
whether a law operates retroactively “demands a commonsense, functional
judgment about ‘whether the new provision attaches new legal
consequences to events completed before its [promulgation].” 
Martin v. Hadix, 527 U.S. 343, 357, 119 S.Ct. 1998, 2006 (1999). 
This judgment should be guided by “familiar considerations of fair
notice, reasonable reliance, and settled expectations.”  Id. 


The Amended Rule attaches dramatically new legal consequences to
Appellants’ inclusion of identifiable health information in their
medical records in the past.  The Secretary states that the
Amended Rule expressly authorizes the use and disclosure of Appellants’
identifiable health information for routine purposes “prior to the
compliance date of the Privacy Rule.”  67 Fed. Reg. at 53,211/3,
J.A. 1381.  There is no language in the authorizing statute,
however, conferring power on the Secretary to act retroactively. 
See Pub. L. 104-191, §264(c), J.A. 39.

It is beyond dispute that Appellants have “settled expectations” that
information placed in their medical records prior to the compliance
date of the Amended Rule would not be used or disclosed in routine
situations without their consent.  65 Fed. Reg. at 82,473/1, J.A.
344; see also Ferguson, 532 U.S. at 78, 121 S.Ct. at 1288; Jaffee, 518
S.Ct. at 15, 116 S.Ct. at 1931.  Appellants have shown through
undisputed evidence that they had no notice or reasonable expectation
that the federal government would grant authority to thousands of
covered entities and their business associates to disclose their
personal health information to other members of the public and to
unspecified government employees without their knowledge or permission
and against their will.  See affidavits of Deborah Peel, M.D.,
J.A. 313, 1,481-82; California Consumer Health Care Council, J.A. 104,
315-16; Sally Scofield, J.A. 328-29; and Janis Chester, M.D., J.A.
305-06.  Appellant Jane Doe, for example, had no notice or
expectation prior to April 14, 2003 that her breast cancer pictures and
other medical records would be used or disclosed without her
permission.  J.A. 211.  It appears further that any
agreements that Appellants might have entered into in the past
protecting the privacy of their health information will be superseded
by the Amended Rule because requesting restrictions is the only process
even theoretically available to Appellants for keeping their health
information private.  The retroactivity of the Amended Rule,
therefore, changes the rights and settled expectations of Appellants
with respect to the privacy of their identifiable health
information. 

In addition, courts should avoid accepting an agency’s interpretation
of a statute where, as in this case, that interpretation would raise a
serious constitutional question.  DeBartolo Corp. v. Florida Gulf
Coast Building and Construction Trade Council, 485 U.S. 568, 575, 108
S.Ct. 1392, 1397 (1988).  See Solid Waste Agency v. Army Corps of
Engineers, 531 U.S. 159, 172, 121 S.Ct. 675, 683 (2001); U. S. v.
X-Citement Video, Inc., 513 U.S. 64, 78, 115 S.Ct. 464, 472
(1994).  See also, T. Merrill, “Judicial Deference to Executive
Precedent”, 101 Yale L.J. 969, 995-98 (1992) (“Unless there is actual
evidence that Congress was concerned with some specific constitutional
issue, it is unrealistic to assume the Congress gave much consideration
to the constitutional ramifications of the statute it
enacted.”   For this reason as well, the Court should restore
the right of privacy and consent in the Original Rule to avoid having
to confront whether Congress intended to authorize the Secretary to
eliminate the right to privacy, liberty and private speech. 

IV. The Amended Rule is Invalid Under the Administrative Procedure Act

A.    The Presumption in Favor of a Settled Course of
Action

An agency rule must be set aside under the Administrative Procedure
Act, if it is arbitrary, capricious, an abuse of discretion or
otherwise not in accordance with law.  5 U.S.C. § 706(2)(A);
Motor Vehicle Manufacturers Association v. State Farm Mutual, 463 U.S.
29, 41, 103 S.Ct. 2856, 2865 (1983).  Where, as here, an agency
reverses a “settled course of behavior” embodied in a prior regulation,
there is “at least a presumption” that the intent of Congress will be
best carried out by the original rule.  Motor Vehicle, 463 U.S. at
41-42, 103 S.Ct. at 2866; NRDC, 790 F.2d at 298. 

This presumption is especially strong where, as here, the position
adopted in the Amended Rule was specifically rejected when the Original
Rule was adopted and rejected again when the Original Rule was put into
effect.  65 Fed. Reg. at 82,473/3, J.A. 344, 831.  This
presumption is further strengthened because agency interpretations that
are more contemporaneous with the authorizing statute are entitled to
greater deference.  Madison v. Resources for Human Development,
Inc., 233 F.3d 175, 187 (3d Cir. 2000); Mazza v. Secretary of Health
and Human Srvs., 903 F.2d 953, 958 (3d Cir. 1990).  Shifting
agency positions are entitled to little deference.  Sierra v.
Romaine, 347 F.3d 559, 569 (3d Cir. 2003); NRDC, 790 F.2d at 298.

The validity of the Amended Rule can only be upheld, “if at all, on the
basis articulated by the agency itself.” Motor Vehicle, 463 U.S. at 50,
103 S.Ct. at 2870; W.R. Grace & Co. v. E.P.A., 261 F.3d 330, 338
(3d Cir. 2001); Funari v. Warden, Allentown Fed’l Correctional Inst.,
218 F.3d 250, 257 (3d Cir. 2000).  Accordingly, the Secretary’s
decision to eliminate medical privacy in routine situations can be
upheld, if at all, only for the reasons cited in the four-page basis he
provided for the final Amended Rule.  J.A. 1,380-84.

B.     The Failure to Consider Relevant Factors and
Evidence

The arbitrary and capricious standard requires an agency to demonstrate
in its basis statement that it has examined the relevant factors and
data, explained the “evidence which is available” and offered a
“rational connection between the facts found and the choice
made.”  Motor Vehicle, 463 U.S. at 43, 52, 103 S.Ct. at 2866,
2871. 

The basis for the Amended Rule does not address the impact it will have
on the three principal purposes of the Original Rule to enhance and
protect the privacy rights of consumers by giving them greater control
over their health information, to improve health quality by restoring
consumer trust, and to build a national framework for health privacy
based on the efforts of the states.  65 Fed. Reg. at 82,463/2,
J.A. 334.  It also failed to address the impact on factors that
were highly relevant to the right to privacy and consent in the
Original Rule such as (a) privacy means having some control over one’s
personal information; (b) privacy is a fundamental right; (c) privacy
is essential for effective, high quality health care; (d) threats to
privacy create barriers to health care; (e) most individuals have a
reasonable expectation of medical privacy and consent; and (f) privacy
and consent are an essential component of the ethical practice of
medicine and are “workable.”  J.A. 335-6, 338, 344-45, 351,
355-58.  

The basis also failed to consider data showing the (1) growing public
concern about the disclosure of genetic and other types of health
information to employers and insurers (J.A. 337-38); (2) number of
individuals and physicians already taking evasive actions to avoid the
unauthorized use of medical information (J.A. 339); (3) number of
federal and state statutes, common law and standards of medical ethics
that require the individual’s permission for the use and disclosure of
health information (J.A. 340, 343-434), or (4) savings in health care
and other costs that could be achieved by preserving medical privacy
(J.A. 355-58). 

The Secretary has tried to insulate himself from these factors and
evidence by refusing to include them in the administrative record he
certified for this case.  However, this evidence was before the
agency only 11 months before it issued the proposed Amended Rule and
was brought to the Secretary’s attention again in comments.  J.A.
927.  Comments of the Appellants American Psychoanalytic
Association and National Coalition of Mental Health Professionals and
Consumers.  J.A. 1312-29. 

An agency rule is arbitrary and capricious where it rescinds or
reverses a prior rule without addressing the effect on the original
rule’s purpose.  See Prometheus Radio Project v. F.C.C., 373 F.3d
372, 421 (3d Cir. 2004).  The Amended Rule clearly is such a rule.

    While agencies must be given ample latitude to
“adapt their rules and policies to the demands of changing
circumstances”, the basis to the final Amended Rule does not describe
any changed circumstances between the effective date of the Original
Rule and the issuance of the proposed Amended Rule.  Motor
Vehicle, 463 U.S. at 42, 103 S.Ct. at 2866.  The Secretary argued
for the first time before the District Court that “new” information was
brought to his attention requiring a reversal of position.  J.A.
11.  Agency action cannot be sustained based on counsel’s post hoc
rationalizations.  Burlington Truck Lines, Inc. v. United States,
371 U.S. 156, 246, 83 S.Ct. 239, 246 (1962).

In any event, the record shows that the concerns mentioned in the basis
for the final Amended Rule were actually brought to the Secretary’s
attention in the additional comment period he conducted prior to his
decision to put the Original Rule into effect on April 14, 2001. 
See 66 Fed. Reg. 12,738 (February 28, 2001) and comments filed, J.A.
365, 367-830.  In a press release announcing the Original Rule,
the Secretary noted, “[m]y staff has expedited the review of these
comments”, and that this review “pave[d] the way” for his decision to
put the Original Rule into effect.  J.A. 831-32.  He stated
the President believes putting the Original Rule into effect is “a
tremendous victory for American consumers” because it “giv[es] patients
peace of mind in knowing that their medical records are indeed
confidential and their privacy is not vulnerable to intrusion.” 
J.A. 831. Thus, the agency’s subsequent reversal is not supported by
changed circumstances or by “new” evidence contained in the Amended
Rule’s basis.

C. The Secretary’s Explanation  Runs Counter to the Evidence

Agency action also will be deemed arbitrary and capricious if it runs
counter to the evidence before the agency or is so implausible that it
cannot be ascribed to a difference in view or the product of agency
expertise.  Motor Vehicle, 463 U.S. at 43, 103 S.Ct. 2866-67;
NRDC, 790 F.2d at 297-98.  Many of the Secretary’s responses to
comments are inconsistent with the language and agency interpretations
of both rules.

The Secretary cited two principal factors in support of his decision to
eliminate medical privacy in routine situations: (a) the desire to
avoid compromising “timely access to quality health care” and (b) the
desire to simplify the requirements for covered entities.  67 Fed.
Reg. at 53,210, 53,212/3, J.A. 1,380, 1,382.  The Secretary cited
only one survey (which actually supported the Original Rule, infra at
55) and no other data supporting these factors.  He did not cite a
single example where access to quality health care actually had been
delayed due to obtaining patient permission for the use and disclosure
of health information despite extensive evidence that consent has been
required throughout the nation’s history by federal and state statutory
and common law and standards of ethical medical practice.  Agency
predictions must be supported by evidence of actual experience to
survive arbitrary and capricious review.  Prometheus Radio, 373
F.3d at 409, 434.  Nor did the Secretary address the increased
complexity caused by a federal policy that is inconsistent with federal
and state law and medical ethics.  J.A. 1,322.

Many comments raised the concern that disclosures of identifiable
health information without the patient’s consent would deprive patients
of control over the use and disclosure of their information and render
the notice of privacy practices “meaningless” since individuals would
have no negotiating power.  67 Fed. Reg. at 53,213/1, and
53,213/3, J.A. 1,383.  The Secretary disagreed, but conceded the
concern is valid and simply claimed that commenters did not understand
they had no negotiating power under the Original Rule either.  67
Fed. Reg. at 53,213/3, Id.  Under either rule, according to the
Secretary, individuals who disagreed with a provider’s information
practices could withhold consent and not receive treatment or give
consent and receive treatment thereby sacrificing their medical
privacy.   According to the Secretary, there could be no
negotiation under the Original Rule because it “did not allow separate
consents for use of protected health information for treatment, payment
and health care operations.”  Id.  The Secretary’s response
is not supported by either rule.

The plain language of the Original Rule does not prohibit a patient
from receiving health care if he does not sign a consent form. 
Rather, it requires consent for whatever health information is to be
used “or” disclosed for treatment, payment “or” health care
operations.  45 C.F.R. § 164.506(a)(1), J.A. 42.  The
preamble explains covered entities should determine which of the
routine uses to include in a consent:  “use and/or disclosure;
treatment, payment, and/or health care operations.”  65 Fed. Reg.
at 82,511/3, J.A. 348.  The consent requirement “only applies to
the extent the covered provider uses and discloses protected health
information.”  65 Fed. Reg. at 82,512/1, J.A. 349.  A
provider “may choose to obtain consent only for uses, not
disclosures.”  Id.  If an individual pays out of pocket, the
provider “may choose not to obtain the individual’s consent to disclose
information for payment purposes.”  Id.  Thus, the consent
document simply reflects the consent the patient is willing to give.

The preamble illustrates this flexibility noting that if a physician
receives a request for a patient’s medical record from a nursing home
and has obtained a consent to disclose information for treatment which
excludes genetic information, the physician may not disclose that
information without getting a new consent.  65 Fed. Reg. at
82,512/3, J.A. 349.  Thus, the explanation shows that the Original
Rule provides individuals with the flexibility to maintain control over
the disclosure of some particularly sensitive health information (such
as genetic information) for some purposes by withholding consent while
still being able to access needed health care. 

The Secretary’s description of the Amended Rule is also
inaccurate.  He states that an individual could protect his
medical privacy under the Amended Rule by choosing to not receive
treatment from a particular provider.  However, the Amended Rule
authorizes all covered entities and their business associates to use
and disclose the individual’s identifiable health information for
routine purposes regardless whether the individual receives
treatment.  45 C.F.R. § 164.506, J.A. 44.  Therefore,
covered entities may use and disclose existing health information about
an individual even if the individual seeks no further services from
that or any other covered entity.  67 Fed. Reg. at 53,211/3, J.A.
1,381.  Using the Original Rule’s example, the Amended Rule would
authorize the physician to disclose the patient’s genetic information
regardless of the patient’s wishes while the Original Rule would allow
that information to be disclosed only with the patient’s consent. 
The contrast could hardly be more stark or contrary to the Secretary’s
explanation.

Appellants’ affidavits also illustrate that the notices of privacy
practices required by the Amended Rule are “meaningless” because
virtually no covered entities are granting requests for a consent
process.  See, e.g., J.A. 315-6, 312-3, 1,480-82.

Other commenters asserted that authorizing the use and disclosure of
health information without the individual’s consent “would be a
departure from current medical ethical standards . . . and common law
and state law remedies for breach of confidentiality that generally
require or support patient consent prior to disclosing patient
information.”  67 Fed. Reg. at 53,212/3, J.A. 1382.  Another
commenter was concerned that disclosures without permission would
become the de facto industry standard supplanting ethical duties to
obtain consent.  Id.  The Secretary responded that the
Amended Rule merely establishes a “floor” of privacy protections and
that more stringent state laws remain in effect and professional
standards “retain their vitality” because covered entities can provide
a consent process.  Id.  This response is misleading, at best.

Eight months after the compliance date of the Amended Rule, the
Administration relied on the Amended Rule to override state laws in a
series of cases seeking to compel hospitals and physicians across the
country to disclose medical records of women who had received an
abortion in order to impeach the testimony of physicians challenging
the constitutionality of the Partial-Birth Abortion Act of 2003. 
Northwestern Memorial Hospital v. Ashcroft, 362 F.3d 923 (7th Cir.
2004); Nat’l Abortion Fed’n v. Ashcroft, 2004 WL 555701 (E.D.N.Y.
2004).  The Administration successfully argued that state statutes
and common laws which require consent or afford a physician-patient
privilege are overridden by the Amended Rule in federal question cases
and with respect to federal issues involving federal employment
discrimination, social security disability, ERISA , Medicare and
Medicaid, Food and Drug among others.  362 F.3d at 925-26. 
Because no physician-patient privilege is recognized by the Amended
Rule, the Administration argued it was entitled to all of the women’s
medical information even though the women were not parties to the
litigation and had no expectation their medical records could be
disclosed to the government.  The Administration ultimately
withdrew its subpoenas after one court held the demands for health
information under the Amended Rule violated the women’s Fifth Amendment
rights to medical privacy.  Planned Parenthood Fed’n of Am., Inc.
v. Ashcroft, 2004 WL 432222 (N.D. Cal. 2004).  Thus, the lower
“floor” of privacy protection in the Amended Rule is the only
protection available to citizens in many situations.

Further, the Amended Rule provides an effective incentive for providers
and other covered entities to abandon established standards of medical
ethics.  The Amended Rule compels covered entities to inform
patients of the uses and disclosures of their health information that
are authorized without consent by the Rule regardless of the privacy
practices they adopt.  45 C.F.R. § 164.520(b).  A
covered entity also may disclose a patient’s identifiable health
information as authorized by the Amended Rule with impunity because
standards of medical ethics do not have the force of law.  65 Fed.
Reg. at 82,472/3, J.A. 343.  If a covered entity, however, grants
a patient’s request for a consent process by entering into an agreement
for “restrictions”, it subjects itself to potential civil and criminal
liability because “[f]ailure of a covered entity to act in accordance
with an agreed-to restriction is a violation of the Rule.”  67
Fed. Reg. at 53,213/3, J.A. 1,383.  The inevitable consequence is
that the Amended Rule’s policy authorizing disclosures of identifiable
health information without permission has become the “de facto”
industry standard.  J.A. 305-06, 312-16, 1,480-82.

The Secretary stated he had “reviewed State laws” in adopting the
Amended Rule and relied on a California statute as a model for
eliminating privacy and consent in routine situations.  67 Fed.
Reg. at 53, 210/3, 53,211/1.  J.A. 1,380-81. The Secretary failed
to mention the laws of 49 other states and the District of Columbia,
summarized in at least two studies cited in the basis of the Original
Rule, many of which require the individual’s permission for the
disclosure of identifiable health information.  65 Fed. Reg. at
82,473.  J.A. 344.

The Secretary also failed to recognize that the California law cited as
a “model” actually resembles the Original Rule.  The California
statute establishes a general rule that no health provider, health
service plan, or contractor shall disclose medical information
regarding a patient or enrollee, “without first obtaining an
authorization, with certain exceptions” while the Amended Rule
establishes a general rule that all health information may be used and
disclosed without the individual’s permission for routine
purposes.  Compare Cal. Civ. Code, § 56.10(a) with 45 C.F.R.
§ 164.506(a), J.A. 44.

The uses and disclosures under the limited exceptions of the California
statute do not include the broad uses and disclosures permitted for
“health care operations” under the Amended Rule, such as business
planning and development, business management and general
administrative activities including customer service, the sale,
transfer, merger or consolidation of covered entities, and due
diligence related to such potential transactions.  Compare Cal.
Civ. Code, §56.10(c) with 45 C.F.R. § 164.501 (as
amended).  The California statute also provides that health
information may not be “further disclosed” without the individual’s
permission even by those who may use the information under one of the
limited exceptions while the Amended Rule allows covered entities to
re-disclose identifiable health information to other covered entities
and to their “business associates” without permission.  Compare
Cal. Civ. Code §56.10(c) with 45 C.F.R. §§ 164.502(e)
and 164.506(c), J.A. 44.  Relying on the California statute as a
model should have resulted in retaining the right to privacy and
consent as in the Original Rule.

The only evidence cited by the Secretary for his reversal of position
highlights the arbitrariness of his action since the same evidence was
cited for the opposite proposition in the basis for the Original
Rule.  The January 1999 survey by the California HealthCare
Foundation was cited in support of the Original Rule to show Americans
are increasingly concerned about the loss of their medical
privacy.  That survey is cited in the Amended Rule to show
Americans do not have increased concerns when their health information
is disclosed without their consent.  Compare 65 Fed. Reg. at
82,468/1, J.A. 339 with 67 Fed. Reg. at 53,210/3, J.A. 1,380.

The Secretary appears to misread the survey since the lead conclusion
is that “Americans trust their doctors and hospitals with confidential
medical information, but fear disclosure when it is handled and stored
by private health insurance plans and others” and that there is “a
pervasive distrust of private and governmental health insurers to keep
personal information confidential.”  J.A. 1359-1362.  These
are exactly the disclosures the Amended Rule authorizes without the
individual’s permission and against his or her will.  Agency
reliance on survey data that does not support its decision is arbitrary
and capricious action.  Prometheus Radio, 373 F.3d at 405-06.

Accordingly, the Secretary’s decision runs counter to the evidence in
the record and is so implausible that it cannot be ascribed to a
difference in view or the product of agency expertise.

D.    The Secretary Failed to Address Significant
Comments and Alternatives

In the basis for the Amended Rule, the Secretary stated there were

“[m]any commenters” who supported eliminating medical privacy in
routine situations and it was this “substantial amount of support” that
led to the reversal of the agency’s position.  67 Fed. Reg. at
53,211/3, 53,212/3, J.A. 1381, 1382.  The Secretary gave no
indication that retaining the right to privacy and consent was
supported overwhelmingly by patients, consumers and most practitioners.

    An undisputed affidavit showed that nearly 5,000
comments on the Amended Rule were submitted by or on behalf of
approximately 220 million consumers and medical practitioners urging
the Secretary to retain the right of privacy and consent set forth in
the Original Rule.  J.A. 940-948.  By contrast, approximately
4,000 comments submitted by covered entities urged the Secretary to
adopt the proposed amendment.  More than 3,000 of these were
submitted by hospitals, health facilities and insurers, and many were
form letters generated by a few large insurance companies and health
systems.  J.A. 942.  At least one commenter brought these
form letters to the Secretary’s attention and pointed out that they
were inaccurate and misleading.  J.A. 1256-60.  The Secretary
recognized such an orchestrated campaign prior to putting the Original
Rule into effect and did not allow it to influence his decision. 
J.A. 832.  In reversing the agency’s position in the Amended Rule,
however, the Secretary ignored the fact that the arguments did not
represent the views of the public and had been rejected on two prior
occasions.

    The Secretary failed to address comments from the
American Medical Association that optional consent combined with a
broad definition of health care operations “would effectively compel
patients, as a condition of obtaining health care services, to allow
uses and disclosures of their protected health information that are not
routine or necessary for a covered entity to run its business.” 
J.A. 1,300.  The Secretary summarily dismissed this concern
stating the agency had already determined in the Original Rule that
narrowing the definition of health care operations would “place serious
burdens on covered entities.”  67 Fed. Reg. at 53,212/3, J.A.
1,382.  This response ignored the thrust of the comment that the
loss of medical privacy would compel patients to allow their health
information to be used against their will.

    Other significant concerns that went ignored
included that the Amended Rule would result in (a) patients going
without treatment or withholding information leading to improper
diagnosis and treatment, complications of  illness or injury and
even death (American Nurses Association, J.A. 1,003); (b)
discrimination, job loss and denial of insurance (The Epilepsy
Foundation, J.A. 1,121); (c) patients avoiding testing that could lead
to early detection of diseases (Institute of Electrical and Electronics
Engineers, J.A. 1,150); (d) information about abused children being
disclosed (Jewish Children’s Bureau, J.A. 1,156); (e) fewer people
seeking and receiving mental health services (National Association of
Social Workers, J.A. 1,196); (f) elimination of a central and core
privacy protection (National Conference of State Legislatures, J.A.
1,207); (g) an inability of patients to make informed decisions about
health care (New York Attorney General, J.A. 1,225); (h) elimination of
the right to medical privacy that is essential for effective health
care (Northwestern University, Feinburg School of Medicine and
University of Miami School of Medicine, J.A. 1,235, 1,268) and (i) a
threat to the public’s willingness to use online monitoring devices
(Wellmed, Inc., J.A. 1,275).

    It is well-established that an agency “must address,
with some precision, the major comments received.” Action on Smoking
and Health v. Civil Aeronautics Board, 699 F.2d 1209, 1216 (D.C. Cir.
1983).  While the agency need not respond to every comment, it
must explain how significant problems raised were resolved. 
Id.  The Secretary neither addressed these major comments nor
explained how the problems raised would be resolved.

    In order to show the reversal of a policy was the
product of reasoned decision making, agencies must also provide
evidence of why they rejected alternatives within the ambit of the rule
they seek to rescind.  Motor Vehicle, 463 U.S. at 52, 103 S.Ct. at
2871.  Comments suggested at least two “targeted” alternatives and
many “general” alternatives to eliminating the right to medical privacy
and consent.  67 Fed. Reg. at 53, 211-12, J.A. 1381-82.  The
Secretary failed, however, to discuss most of the general alternatives
and failed to provide valid reasons for rejecting the targeted
alternatives.

    The “most troubling, pervasive problem” the
Secretary ostensibly sought to address was that the consent requirement
might not permit providers to use and disclose an individual’s health
information “prior to their initial face-to-face contact with the
patient.”  67 Fed. Reg. at 53,209/2, J.A. 1,379.  This
definition of the problem is problematic because the consent provision
in the Original Rule did not require a “face-to-face” contact, and it
included exceptions that could have addressed the concerns.  J.A.
42.

The Secretary did not explain why consent could not have been obtained
using the same process the Amended Rule provided for obtaining written
acknowledgement of notices of privacy practices.  45 C.F.R. §
164.520(c)(2)(ii).  That acknowledgement can be provided by mail
or electronically.  67 Fed. Reg. at 53,239-43.  The Original
Rule permitted consent to be requested simultaneously with the notice
of privacy practices and to be combined with informed consent for
treatment.  65 Fed. Reg. at 82511/2, J.A. 348.  In any event,
the alleged access problem arose only in connection with “first
encounters”, but the Secretary never explained why it was necessary to
eliminate medical privacy for all individuals for all routine purposes
and to grant regulatory permission to all covered entities, even where
the hypothetical problems did not exist.

The Secretary mentions that commenters suggested alternatives such as
(a) providing regulatory permission for certain uses and disclosures
prior to the first service delivery; (b) permitting oral consents with
documentation; (c) allowing individuals to opt out of the consent
requirement; (d) allowing the consent to apply to activities of
referred-to providers; and (e) retaining consent and adding
flexibility, not exceptions.  67 Fed. Reg. at 53,212/1, J.A.
1382.  He never explained, however, why they were unacceptable.

    The Secretary also failed to explain why he refused
to take a “patient oriented” approach and allow consent to be inferred
from the presence of a physician’s order until such time as written
consent could be obtained since a physician’s order is necessary for a
hospital procedure or a prescription.  APA and NCMHPC at J.A.
1323-25.  The Secretary’s failure to provide this explanation is
difficult to understand since his representative testified before
Congress on April 16, 2002, during the comment period on the proposed
Amended Rule, that the Administration would take this approach. 
J.A. 1,323.  By rejecting all “patient oriented” alternatives, the
Secretary misled the public and its representatives.

The Secretary rejected a “targeted” approach of allowing certain uses
and disclosures prior to first encounters because it allegedly would
not address the concerns of tracking consents, use of historical data
for quality purposes, or the concerns of emergency treatment
providers.  67 Fed. Reg. at 53,212/2, J.A. 1382.  The
Secretary never explained why the same concerns had not arisen in the
context of consent for treatment and under state and federal laws and
standards of medical ethics.

The Secretary also rejected “global” suggestions of eliminating consent
and privacy for “treatment” or just for “uses” and not “disclosures” on
the grounds that activities such as scheduling appointments and
surgeries and conducting other pre-admission activities for individual
patients are “health care operations” rather than “treatment”
activities.  67 Fed. Reg. at 53,212/2, J.A. 1382.  That
explanation is inconsistent with the agency’s own definition of
“treatment” as activities by a provider with respect to a particular
patient.  65 Fed. Reg. at 82,497-98, 45 C.F.R. §
164.501.  Also, the Secretary explained that these activities
would be difficult to conduct prior to a “face-to-face contact” with
the patient which, as noted, was not required under the Original Rule.

In short, the Secretary erroneously defined the perceived problems and
the potential solutions in a way that allowed only the “global fix”
that he wished to adopt.  By failing to analyze the issues and
alternatives fairly and accurately, he has failed to provide a rational
connection between the facts found and the choice made sufficient to
pass muster under the arbitrary and capricious standard.  Motor
Vehicle, 463 U.S. at 56, 103 S.Ct. at 2873. 

Conclusion

If citizens who pose no threat to society have no “right to be let
alone” in routine situations with respect to their personal health
information, then privacy that is the essence of liberty and is
necessary for quality health care, cannot exist.  The Amended Rule
should be enjoined. 

           
            Respectfully
submitted,



           
           
_______________________________

           
            James C. Pyles

           
            Powers, Pyles
Sutter & Verville, P.C.

           
            1875 Eye
Street, NW

           
            Washington,
D.C. 20006

           
            (202) 466-6550



Dated:  August 23, 2004