IN THE UNITED STATES COURT OF APPEALS

FOR THE THIRD CIRCUIT

Appellate Docket No. 04-2550

Citizens for Health, American Psychoanalytic Association, American Association for Health Freedom, New Hampshire Citizens for Health Freedom, American Mental Health Alliance, American Association of Practicing Psychiatrists, Health Administration Responsibility Project, Congress of California Seniors, National Coalition of Mental Health, Professionals and Consumers, California Consumer Health Care Council, American Association of Practicing Psychiatrists, Sally Scofield, Eugene B. Meyer, Daniel S. Schrager, Morton Zivan, Michaele Dunlap, Tedd Koren, Jane Doe, Janice Chester, Deborah Peel

Appellants

v.

Tommy G. Thompson, Secretary,

U.S. Department of Health

and Human Services

Appellee

Appeal from Summary Judgment Order Issued by

United States District Court for the Eastern District of Pennsylvania

REPLY BRIEF OF APPELLANTS

Peter Winebrake, Esq. Trujillo Rodriguez & Richards, LLC The Penthouse 226 West Rittenhouse Sq. Philadelphia, PA 19103

Robert N. Feltoon, Esq. Conrad, O’Brien, Gellman & Rohn, P.C. 1515 Market Street 16th Floor Philadelphia, PA 19102

James C. Pyles, Esq. Powers, Pyles, Sutter & Verville, P.C. 1875 Eye Str., N.W. 12th Floor Washington, D.C. 20006

TABLE OF CONTENTS

Page

I.                               Federal Authority Granted by the Amended Privacy Rule

Violates Plaintiffs’ Constitutional Rights to Medical Privacy................ 1

A. Medical Privacy is a Well-Established Fundamental Right.......... 1

B. The Amended Rule Impermissibly Grants Federal Authority to Eliminate Plaintiffs’ Medical Privacy....................................................................... 4

C. The Amended Rule is Not “Wholly Permissive”........................ 5

1. The District Court Was Correct In Finding That the

Amended Rule Has a “Determinative or Coercive Effect”..... 5

2. The Secretary Cannot Authorize Private Entities to Engage

in Conduct that Would Violate the Constitution if the

Government Engaged in It Directly....................................... 8

D. The Amended Rule Eliminates Pre-existing Privacy Rights......... 13

E. Other Protections in the Amended Do Not Protect Privacy........ 16

F. The Right of Consent is Essential for Medical Privacy .............. 18

G. Plaintiffs Do Not Seek the Secretary’s Protection...................... 19

II. The Amended Rule is Inconsistent with the Intent of Congress ........... 20

A.               The Legislative History of HIPAA Does Not Support the

Amended Rule......................................................................... 20

B.                HIPAA Should Be Construed Consistently with Other Laws

and the Agency’s Contemporaneous Interpretation.................... 23

III. The Amended Rule is Arbitrary and Capricious.................................. 25

A.               The Amended Rule is a Radical Departure from Settled Agency

Action..................................................................................... 25

B.                The Record Is Devoid of Findings to Support the Complete

Reversal of Prior Agency Action.............................................. 27

C.               The Amended Rule Eviscerates Privacy Without Improving

Efficiency................................................................................ 30

IV. Conclusion........................................................................................ 31

Addendum

TABLE OF AUTHORITIES

Page

Cases

American Lung Ass’n v. EPA, 134 F.3d 388 (D.C. Cir. 1998)............................ 28

Ashcroft v. ACLU, 124 S. Ct. 2783 (2004).......................................................... 2

Bartnicki v. Vopper, 532 U.S. 514, 121 S. Ct. 1753 (2001)................................... 2

Burton v. Wilmington Parking Authority, 365 U.S. 715, 81 S. Ct. 856 (1961)....... 10

Commodity Futures Trading Comm’n v. Schor, 478 U.S. 833, 106 S. Ct. 3245 (1986) 24-25

E. Hoffman-LaRoche, Ltd. v. Empagran S.A., 124 S. Ct. 2359 (2004)........... 21, 23

F.E.C. v. Mass. Citizes for Life, Inc., 479 U.S. 238, 107 S. Ct. 616 (1986)........... 8

Ferguson v. City of Charleston, 532 U.S. 67, 121 S. Ct. 1281 (2003)....... 14, 19, 21

Fraternal Order of Police v. City of Philadelphia, 812 F.2d 105 (3d Cir. 1987)..... 14

Gilmore v. City of Montgomery, Ala., 417 U.S. 556, 94 S. Ct. 2416 (1974)......... 11

Givens v. Mullikin, 75 S.W.3d 383 (Tenn. 2002)................................................ 14

Gruenke v. Seip, 255 F.3d 290 (3d Cir. 2000)...................................................... 1

Hunt v. Cromartie, 526 U.S. 541, 119 S. Ct. 1545 (1999)...................................... 8

Intel Corp. v. Advanced Micro Devices, Inc., 124 S. Ct. 2466 (2004)............ 21, 23

Jaffee v. Redmond, 518 U.S. 1, 116 S. Ct. 1923 (1996)....................... 2, 15, 21, 31

Lawrence v. Texas, 539, U.S. 558, 123 S. Ct. 2472 (2003)............................... 1, 8

Loving v. Virginia, 388 U.S. 1, 87 S. Ct. 1817 (1967)........................................... 8

M.L.B. v. S.L.J., 519 U.S. 102, 117 S. Ct. 555 (1996).......................................... 8

McCabe v. Atchison, Topeka & Santa Fe R., 235 U.S. 151, 35 S. Ct. 69 (1914). 10

Motor Vehicles Mftrs Ass’n v. State Farm Mut. Ins. Co., 463 U.S. 29, 103 S. Ct. 2856 (1983) 25, 26, 28

Nat’l Abortion Fed’n v. Ashcroft, 2004 WL 555701, *6 (S.D.N.Y. 2004)........... 15

Nixon v. Condon, 286 U.S. 73, 52 S. Ct. 484 (1932).................................... 10, 11

Nuclear Energy Institute, Inc. v. EPA, 373 F.3d 1251 (D.C. Cir. 2004)................ 21

Planned Parenthood of Southeastern Pennsylvania v. Casey, 505 U.S. 833, 112 S. Ct. 2791 (1992)...................................................................................................................... 1, 8

Prometheus Radio Project v. F.C.C. 373 F. 3d 372 (3d Cir. 2004)...................... 28

Reitman v. Mulkey, 387 U.S. 369, 87 S. Ct. 1627 (1967)........................... 9, 10, 12

Santa Fe Independent School Dist. v. Doe, 530 U.S. 290,

120 S. Ct. 2266 (2000)……………………………………………………………12

Sterling v. Borough of Minersville, 232 F.3d 190 (3d Cir. 2000)............................ 1

Texas State Employees Union v. Texas Department of Mental Health and Mental

Retardation, 746 S.W.2d 203 (Tex. 1987).......................................................... 14

Thornburg v. Amer. Coll. of Obst. and Gyn., 476 U.S. 747, 106 S. Ct. 2169

(1986)................................................................................................................ 1

Troxel v. Granville, 530 U.S. 57, 120 S. Ct. 2054 (2000)...................................... 1

Tucson Women's Clinic v. Eden, 379 F.3d 531 (9^th Cir. 2004).............................. 1

United States v. Westinghouse, 638 F.2d 570 (3d Cir. 1980)............................... 18

Wallace v. Jaffree, 472 U.S. 38, 105 S. Ct. 2479 (1985)...................................... 11

Washington v. Davis, 426 U.S. 229, 96 S. Ct. 2040 (1976)................................... 8

Whalen v. Roe, 429 U.S. 589, 97 S. Ct. 869 (1977).............................................. 1

Yick Wo v. Hopkins, 118 U.S. 355, 6 S. Ct. 1064 (1886)..................................... 9

Federal Statutes

15 U.S.C. §6502(b)(1)(A)(ii).............................................................................. 23

18 U.S.C. §2710(b)(2)(B).................................................................................. 22

18 U.S.C. §2721(b)(13)................................................................................ 22-23

42 U.S.C. §1320d-5 and 6................................................................................... 7

State Statutes

Ariz. Rev. Stat. §12-2292.................................................................................. 13

Code Miss. R. 28 000 080 §17.......................................................................... 13

D.C. Code Ann. 7-1202.05................................................................................ 13

16 Del. C. §1232................................................................................................. 6

Fla. Admin. Code Ann. r. 4-128.017.................................................................. 13

Ga. Code Ann. §24-9-47(b)............................................................................... 13

Idaho Code §54-4711........................................................................................ 13

410 Ill. Comp. Stat. 50/5................................................................................... 13

Iowa Code §228.2............................................................................................. 13

Kan. Stat. Ann. §40-3226(a).............................................................................. 13

Md. Code Ann., Health-Gen. §§4-302, 4-303(a)................................................. 13

Me. Rev. Stat. tit. 22, sec. 1711-C 2.................................................................. 13

Mich. Comp. Laws §330.1748........................................................................... 13

Minn. Stat. §144.335, subd. 3a, 144.651, subd. 16.............................................. 13

Mont. Code Ann. §33-19-306............................................................................ 13

N.D. Cent. Code §26.1-36-12.4......................................................................... 13

N.H. Rev. Stat. §151:21(X)................................................................................ 13

N.J. Stat. Ann. §26:2H-12.8(g), §§ 26:5C-8, 26:2H-2........................................... 13

Neb. Rev. Stat. §44-916.................................................................................... 13

63 P.S. §422.41(8).............................................................................................. 6

S.C. Code of Regulations R 69-58 §17, §44-115-50........................................... 13

Va. Code Ann. §32.1-127.1:03(A) and (D)(1)..................................................... 13

Weil’s Code Wy. R. 0044-000-054 §17............................................................. 13

Other Authorities

“Administration Sets Forth a Limited View on Privacy”, The New York Times (March 6, 2004) 15

§264 of the Administrative Simplification provisions of HIPAA................. 4, 15, 20

Black’s Law Dictionary, 7^th ed., 1160.................................................................. 4

"Health Information: First-Year Experiences," GAO-04-965, p. 20 (Sept. 2004).. 16

"Medical Privacy Falls Victim to Fierce Aborton Fight", USA Today, Editorial (Feb. 19, 2004) 15

"Medical Record Privacy, The U.S. Injustice Department”, The Philadelphia Inquirer, Editorial (Feb. 17, 2004).......................................................................................................... 15

Regulations

45 C.F.R. §164.506(a)........................................................................................ 4

45 C.F.R. §164.506(a)....................................................................................... 16

45 C.F.R. §164.520(b)(1)................................................................................. 6-7

45 C.F.R. §164.520(c)(2)(i)(A).......................................................................... 16

45 C.F.R. §164.528(a)(1)(iii).............................................................................. 17

REPLY BRIEF OF APPELLANTS

II.                           Federal Authority Granted by the Amended Privacy Rule Violates Plaintiffs’ Constitutional Rights to Medical Privacy

A.               Medical Privacy is a Well-Established Fundamental Right

Several uncontested facts and principles emerge from the briefs filed by Plaintiffs-Appellants and the Secretary.[1] The right of individuals to keep their identifiable health information private in the absence of a narrowly defined, compelling governmental interest is a fundamental right deeply rooted in the nation’s history and implicit in the concept of ordered liberty protected by the Due Process Clause of the Fifth Amendment. Lawrence v. Texas, 539 U.S. 558, 123 S. Ct. 2472 (2003); Troxel v. Granville, 530 U.S. 57, 120 S. Ct. 2054 (2000); Planned Parenthood of Southeastern Pennsylvania v. Casey, 505 U.S. 833, 112 S. Ct. 2791 (1992); Thornburg v. Amer. Coll. of Obst. and Gyn., 476 U.S. 747, 106 S. Ct. 2169 (1986); Whalen v. Roe, 429 U.S. 589, 605-06, 97 S. Ct. 869, 879 (1977); Gruenke v. Seip, 225 F.3d 290 (3d Cir. 2000); Sterling v. Borough of Minersville, 232 F.3d 190 (3d Cir. 2000). See also, Tucson Woman’s Clinic v. Eden, 379 F.3d 531, 551 (9^th Cir. 2004). Pls.’ Br. 10-24, Scrty’s Br. 50.

The right of individuals to communicate specific types of information in private without disclosure to the public is protected by the First Amendment right to freedom of speech unless the government demonstrates that it used the “least restrictive alternative” in intruding on that right. Ashcroft v. ACLU, 124 S. Ct. 2783, 2791 (2004); Bartnicki v. Vopper, 532 U.S. 514, 121 S. Ct. 1753 (2001). Pls.’ Br. 26-32; Scrty’s Br. 50. The right of patients to have private communications with psychotherapists is also well-established under the psychotherapist-patient privilege. Jaffee v. Redmond, 518 U.S. 1, 116 S. Ct. 1923 (1996). Pls.’ Br. 41. Health information privacy is also protected by the laws of many states and is a core concept of medical ethics.

The Amended Privacy Rule issued by the Secretary adopted a “global,” rather than a “tailored,” approach eliminating the health information privacy of all individuals, regardless of their wishes, with respect to all health information in all routine situations without identifying any compelling governmental interest. Pls.’ Br. 24, Scrty’s Br. 43. Effective April 14, 2003, that Rule authorized thousands of covered entities and their business associates to use Plaintiffs’ identifiable health information, including private communications with physicians and psychotherapists, and to disclose it to both public and private individuals and entities without Plaintiffs’ permission and against their will. Thousands of Plaintiffs and their family and association members are avoiding seeking needed care and making full disclosures of health information to medical practitioners in an effort to protect their privacy. Pls.’ Br. 27-29. [2]

The Secretary has not distinguished any of the case law or disputed any of the facts presented by Plaintiffs. Instead, he has elected to hinge the defense of the Amended Rule entirely on the District Court’s mistaken conclusion that the Amended Rule is “wholly permissive,” and for that reason does not violate Plaintiffs’ fundamental rights to medical privacy and private communications. Scrty’s Br. 48; JA 14-15.[3]

B.               The Amended Rule Impermissibly Grants Federal Authority to Eliminate Plaintiffs’ Medical Privacy

After 50 pages portraying the Amended Rule as a benign measure with no adverse effect on medical privacy, the Secretary admits that the Amended Rule completely changes the landscape of federal common law and constitutional law and “provides express authority” for the nonconsensual use and disclosure of health information for routine purposes. Scrty’s Br. 51.[4]

Indeed, by the Secretary’s own admission, the Amended Privacy Rule did much more than fail to preserve the right of consent. It “replaced” the individual’s right of consent with “regulatory permission” which conferred federal authority on covered entities and their business associates to use and disclose virtually any identifiable health information regardless of Plaintiffs’ wishes. JA 1381; Pls.’ Br. 10. In fact, the statutory provision on which the Secretary relies states that the privacy standards are to set forth uses and disclosures that should be “authorized or required” by regulation. Section 264(b)(3), JA 39. In any event, a commonsense understanding of “regulatory permission” is that it is a grant of federal regulatory authority.[5]

C.               The Amended Rule is Not “Wholly Permissive”

1.                                   The District Court Was Correct In Finding That the Amended Rule Has a “Determinative or Coercive Effect”

The Secretary argues that the Amended Rule does not violate Plaintiffs’ Fifth and First Amendment rights to medical privacy and private communications because it allegedly is “wholly permissive” and “does not compel anyone” to use or disclose Plaintiffs’ health information without their consent. Scrty’s Br. 48.[6] Yet, the Amended Rule indisputably “compels” Plaintiffs to disclose their past, present and future identifiable health information to countless public and private entities and individuals by conferring that very authority on covered entities. Every Plaintiff submitted one or more sworn affidavits (none rebutted by the Secretary) stating that the personal identifiable health information for themselves, their families, their patients and their members is being used and disclosed over their objection by covered entities exercising the authority granted by the Amended Rule. JA 45-332, 1476-1485.

The Secretary does not contest the District Court’s finding that the Amended Rule has a “determinative or coercive effect” on providers (and presumably covered entities subject to the same provisions). Scrty’s Br. 51. While the District Court noted that covered entities theoretically could provide a consent process, few had. JA 10. The Amended Rule not only grants covered entities unfettered authority to obtain information without consent and to ignore or reject any request for a consent process, it also includes strong disincentives to provide such a process.

For example, the notice of privacy practices which the Amended Rule requires covered entities to furnish on the date of the first service delivery requires a description of each of the routine uses and disclosures that are authorized without consent by the Amended Rule, regardless of state law, standards of medical ethics, or the privacy practices actually adopted by the covered entity.[7] 45 C.F.R. § 164.520(b)(1). Thus, there is a strong incentive for all covered entities simply to adopt the model described in the Amended Rule as their privacy practices in order to simplify the notice. The numerous notices of privacy practices received by the Plaintiffs since the April 2003 compliance date show this is precisely what has occurred. See, e.g., JA 117-120, 193-196, 215-218.

While the Amended Rule permits covered entities to provide a consent process by entering into an agreement to restrict uses and disclosures, it creates a disincentive for them to do so by providing that “[f]ailure of a covered entity to act in accordance with an agreed-to restriction is a violation of the Rule.” 67 Fed. Reg. 53, 213, JA 1383. Pls.’ Br. 53. The Secretary has yet to issue final rules implementing these provisions, but statutory penalties for violating the Amended Rule range from civil penalties of $100 to $25,000 and criminal penalties ranging from fines of $50,000 and imprisonment for one year to fines of $250,000 and imprisonment for up to ten years. 42 U.S.C. § 1320d-5 and 6, JA 35. So, covered entities have a strong incentive to avoid a risk of civil and criminal penalties by never agreeing to a request for restrictions. The undisputed evidence shows that no such “voluntary” restrictions have been permitted. Pls.’ Br. 26.

2.                                   The Secretary Cannot Authorize Private Entities to Engage in Conduct that Would Violate the Constitution if the Government Engaged in It Directly

There is a broad consensus in Supreme Court case law that the constitutional validity of a law must be determined by an examination of its effect, design, application, purpose or intent. Pls.’ Br. 36-38. See, Lawrence v. Texas, 123 S. Ct. 2472, 2478, 2495 (2003) (Scalia, J., The Chief Justice, and Thomas, J. dissenting but concurring that the “purpose” of a law is always important to consider). See also, Hunt v. Cromartie, 526 U.S. 541, 546, 119 S. Ct. 1545, 1549 (1999) (intent); M.L.B. v. S.L.J., 519 U.S. 102,126-27, 117 S. Ct. 555, 569 (1996) (operation); Planned Parenthood of Southeastern Pennsylvania v. Casey, 505 U.S. 833, 878, 112 S. Ct. 2791, 2821 (1992) (purpose or effect); F.E.C. v. Mass. Citizens for Life, Inc., 479 U.S. 238, 255, 107 S. Ct. 616, 626 (1986) (practical effect); Washington v. Davis, 426 U.S. 229, 241-42, 96 S. Ct. 2040, 2048-49 (1976) (purpose); Loving v. Virginia, 388 U.S. 1, 11, 87 S. Ct. 1817, 1823 (1967) (design).

The fact that a law authorizes, but does not require, third parties to curtail the liberties of individuals does not save it from being constitutionally invalid. As both Plaintiffs and amicus Texas Civil Rights Project have shown, the government may not confer discretion on a third party to deprive individuals of constitutionally protected fundamental rights, particularly where that is the clear intent, design and effect of the action taken. Pls.’ Br. 38; TCRP Br. 13-14.

The constitutional analysis in Reitman v. Mulkey, 387 U.S. 369, 87 S. Ct. 1627 (1967) makes clear that the government may not authorize private actors to extinguish constitutional rights. There the Court invalidated a provision in the California Constitution that conferred “absolute discretion” on private citizens to sell or refuse to sell their real property to anyone. The State of California took the position that the state constitutional provision was merely a “permissive” provision repealing two state statutes that had prohibited racial discrimination in the housing market. The State argued that it could never repeal such laws if permissive and neutral provisions were always said to “authorize” and “encourage” discrimination. Id. at 376. The Court held it was “quite proper[]” in considering the constitutionality of a law to examine its “immediate objective.” its “ultimate effect” and its “historical context and the conditions existing prior to its enactment.” Id. at 373. (Citing a lengthy line of case law beginning with Yick Wo v. Hopkins, 118 U.S. 355, 6 S. Ct. 1064 (1886)).

The Court first affirmed the lower court’s ruling that the state was not required by the 14^th Amendment to adopt a law prohibiting private discrimination in housing. The Court, however, then confirmed that the state constitutional provision “expressly authorized . . . the private right to discriminate . . .  [and] . . . would encourage and significantly involve the State in private racial discrimination contrary to the Fourteenth Amendment.” Id. at 376. According to the Court, the state constitutional provision “struck more deeply and widely” than merely repealing the prior antidiscrimination statutes because it authorized private discriminations to enjoy a far different status in that “[t]hose practicing racial discriminations need no longer rely solely on their personal choice,” but can “invoke express [governmental] authority, free from censure or interference of any kind from official sources.” 387 U.S. at 377, 87 S. Ct. at 1632.

The Court observed that this assessment was no different than “considering a permissive state statute as an authorization to discriminate” as it had done many times in the past. 387 U.S. at 379-80, 87 S. Ct. at 1633, citing McCabe v. Atchison, Topeka & Santa Fe R., 235 U.S. 151, 35 S. Ct. 69 (1914); Nixon v. Condon, 286 U.S. 73, 52 S. Ct. 484 (1932); Burton v. Wilmington Parking Authority, 365 U.S. 715, 81 S. Ct. 856 (1961) and other cases. According to the Court, a constitutional violation occurred with respect to what otherwise would have been a purely private act when the state government “elected to place its power . . . and prestige behind the admitted discrimination . . .”. Id. (quoting the holding in Burton.). The Court concluded that the California state constitutional amendment “was intended to authorize, and does authorize” unconstitutional discrimination. 387 U.S. at 381, 87 S. Ct. at 1634.

Similarly, the constitutional rights of individuals were violated when a state authorized, but did not require, a privately organized political party to determine who could vote in party primaries, and the party exercised that authority to exclude minorities. Nixon v. Condon, 286 U.S. 73, 82, 84, 88, 52 S. Ct. 484, 486-87 (1932) (Power that is not delegated by a private entity, but rather “by virtue of an authority originating or supposed to originate in the mandate of the law,” must be exercised “in submission to the mandates of equality and liberty that bind officials everywhere.”).

In another example, the constitutional rights of individuals were violated when a municipality permitted, but did not require, exclusive use of public recreational facilities by private schools that excluded minorities. Gilmore v. City of Montgomery, Ala., 417 U.S. 556, 568, 570, 94 S. Ct. 2416, 2423-24 (1974) (The constitutional rights of individuals “can neither be nullified openly and directly by state legislators or state executive or judicial officers, nor nullified indirectly by them through evasive schemes . . . whether attempted ‘ingeniously or ingenuously’”).

The constitutional rights of school children were violated when a state authorized, but did not require, public schools to provide a period of silence for meditation or voluntary prayer. Wallace v. Jaffree, 472 U.S. 38, 40, 58, 105 S. Ct. 2479, 2481, 2491 (1985) (“The unrebutted evidence of . . . intent” showed that the state law was intended to promote religion in public schools in violation of the Establishment Clause of the First Amendment.). See also, Santa Fe Independent School Dist. v. Doe, 530 U.S. 290, 309, 120 S. Ct. 2266, 2278 (2000).

So too in this case, the Secretary may not effectively extinguish the Plaintiffs’ fundamental right to medical privacy and liberty by authorizing, without requiring, the nonconsensual use and disclosure of all health information in routine circumstances. The Amended Rule has “struck more deeply and widely” than merely eliminating the requirement that private parties obtain consent from other private parties before using and disclosing their identifiable health information. The Amended Rule was intended to authorize, and admittedly does authorize, the use and disclosure of Plaintiffs’ health information to both public and private parties under the power and prestige of the federal government. As in Reitman, the authority to violate Plaintiffs’ fundamental right to personal privacy “is now one of the basic policies of [the federal government].” 387 U.S. at 381, 87 S. Ct. at 1634.

If this Court were to uphold the constitutional validity of the Amended Rule, the adverse consequences for constitutional rights generally, as well as the constitutional right to liberty and privacy, would be difficult to overstate. States presumably could grant “regulatory permission” to property owners to enter into restrictive covenants and refuse to sell or rent land to minorities. Political parties could obtain “regulatory permission” to exclude minorities from voting in primary elections. Municipalities could grant “regulatory permission” for the exclusive use of public facilities by private schools that do not admit minority students, and the state (or federal government) could grant “regulatory permission” to public schools to require students to engage in “meditation or voluntary prayer.”[8] A ruling that such “wholly permissive” regulations are valid would conflict with at least seventy years of constitutional jurisprudence.

D.                           The Amended Rule Plainly Eliminates Pre-existing Privacy Rights

The Secretary’s argument that the Amended Privacy Rule only provides authority for providers to do what they have always been free to do is also inaccurate. Scrty’s Br. 51. At least 21 states have medical privacy laws that prohibit the use and disclosure of health information without patient consent unless otherwise “authorized” or “provided” by law.[9] Several states, like South Carolina, Virginia and Wyoming, have general laws requiring consent but permit nonconsensual disclosures to the extent authorized under federal law, in order to minimize conflict and confusion. Thus, notwithstanding HIPAA’s legislative design to the contrary, broad federal authorization under the Amended Rule for nonconsensual uses and disclosures reduces or eliminates pre-existing state privacy law protections.

Further, health information privacy in many states has been protected under tort law theories “such as invasion of privacy and breach of confidential relationship” and as implied contracts between providers and patients. 65 Fed. Reg. 82,473/2, JA 344; Givens v. Mullikin, 75 S.W.3d 383, 407 (Tenn. 2002). Medical privacy has long been protected under state and federal constitutional common law based on whether the individual in the specific situation traditionally has a “reasonable expectation” of privacy. See, Ferguson v. City of Charleston, 532 U.S. 67, 78, 121 S. Ct. 1281, 1288 (2003); NASW Amicus Br. 9, citing, Fraternal Order of Police v. City of Philadelphia, 812 F.2d 105, 112-113 (3d Cir. 1987). See also, Texas State Employees Union v. Texas Department of Mental Health and Mental Retardation, 746 S.W.2d 203, 205-06 (Tex. 1987). A national policy of authorized nonconsensual uses and disclosures in routine situations erodes the “reasonable expectation” of medical privacy that forms the basis for traditional privacy protections under tort, contract and constitutional law.[10]

The Amended Privacy Rule also jeopardizes the federal common law psychotherapist-patient privilege that has been recognized as essential for effective psychotherapy. Jaffee v. Redmond, 518 U.S. 1, 10, 116 S. Ct. 1923, 1928 (1996).[11] Privileges may be recognized as a matter of common law under Rule 501 of the Federal Rules of Evidence if Congress has not spoken to the issue. According to one court, the Amended Privacy Rule, implementing HIPAA, “speaks directly” to the question of medical privileges by not recognizing any. Nat’l Abortion Fed’n v. Ashcroft, 2004 WL 555701, *6 (S.D.N.Y. 2004).[12]

E.     Other Provisions in the Amended Rule Do Not Protect Privacy

The broad grant of federal authority in the Amended Rule undermines most of the other “privacy” measures cited by the Secretary. See, Scrty’s Br. 33-34. While the Amended Rule ostensibly does not preempt “more stringent” state privacy laws, it makes it impossible for individuals to assert their rights under those laws because covered entities are authorized to use and disclose their health information without providing prior notice or an opportunity for the individual to object. 45 C.F.R. § 164.506(a). The Rule requires notice of privacy practices to be given only once, “at the date of the first service delivery” after the April 14, 2003 compliance date (45 C.F.R. § 164.520(c)(2)(i)(A)), but authorizes infinite disclosures of an individual’s information regardless of when or whether any notice is given.[13]

Another facet of the “protection” cited by the Secretary is that the Rule requires covered entities to make a “good faith effort” to get patients to acknowledge they have received the notice of privacy practices in order “to discuss privacy practices and concerns with providers.” Scrty’s Br. 34; 67 Fed. Reg. 53,211/1, JA 1381. It is difficult to see how any meaningful discussion could take place when the Amended Rule authorizes all health information to be used and disclosed without notice, and any accurate notice would have to inform individuals that the federal government has granted the covered entity the right to use and disclose their health information regardless of their “concerns.”

Individuals also have little ability to assert their state privacy rights to remedy past violations because covered entities are expressly excused from providing any accounting of past disclosures for routine purposes. 45 C.F.R. § 164.528(a)(1)(iii).

The nationwide disclosure authority conferred by the Amended Rule also creates a mechanism for covered entities to circumvent “more stringent” state laws. Covered entities, such as health plans and clearinghouses, which believe their “efficiency” is hampered by more stringent state privacy laws, can electronically transmit health information to states that do not have such laws and then be free to exercise their new federal authority unencumbered by more stringent protections. The privacy policies of the Amended Rule, which the Secretary contends are merely a “floor” of protections, thereby also become a national ceiling.[14]

Moreover, the Secretary has now taken the position that more stringent state laws have no effect in any administrative or judicial cases involving federal issues even if the individual is not a party to the case. Pls.’ Br. 51-52. Thus, more stringent state privacy laws may now be avoided at the whim of any federal litigant who wishes to invoke the Amended Rule.

The Secretary also claims that a covered entity may obtain consent for routine uses and disclosures under the Amended Rule. Scrty’s Br. 34. However, a consent process is completely “optional on the part of all covered entities,” and virtually no covered entity has exercised that option after the compliance date. 67 Fed. Reg. 53,211/1, JA 1381; JA 10; Pls.’ Br. 26.

So, the Amended Rule both renders Plaintiffs more vulnerable to privacy violations by eliminating their ability to give or withhold consent, and facilitates the violation of their medical privacy by granting express federal authority to covered entities to use and disclose their health information repeatedly with no notice or permission and against their will.

F. The Right of Consent is Essential for Medical Privacy

Although the Secretary argues that consent has never been the equivalent of medical privacy, (Scrty’s Br. 36, n.9), this Court has long acknowledged that medical privacy essentially is “the right to be let alone” and includes “control over knowledge about oneself.” United States v. Westinghouse, 638 F.2d 570, 576 n.5 (3d Cir. 1980). HHS similarly noted in the Original Rule that the right of medical privacy is the claim of individuals to control when, how, and to what extent information about them is communicated and that “maintaining control” over the disclosure of one’s personal information is “fundamental” to liberty. 65 Fed. Reg. 82,465/1, JA 336; Pls.’ Br. 15. Thus, the core element of medical privacy is the ability to exercise some control over one’s health information through the ability to give or withhold consent. See, Ferguson v. City of Charleston, 532 U.S. at 78, 121 S. Ct. at 1288 (the “reasonable expectation of [medical] privacy” is that health information will not be shared without “consent”). Some control over personal information is essential for privacy, and consent is the means of exercising that control and, thereby, the right to privacy.

G. Plaintiffs Do Not Seek the Secretary’s Protection

The Secretary incorrectly states that Plaintiffs’ principal contention is that the Amended Rule is constitutionally invalid because it did not go far enough in protecting their medical privacy. Scrty’s Br. 52. In fact, Plaintiffs charge that the Amended Rule is invalid because it renders them defenseless and affirmatively violates their fundamental right to medical privacy. Accordingly, the Supreme Court cases cited by the District Court and the single case mentioned by the Secretary are inapplicable. Plaintiffs do not ask for the Secretary’s protection. To the contrary, they ask this Court to preserve their fundamental constitutional right, “as against the government, to be let alone.” Pls.’ Br. 10, 35.

III.                       The Amended Rule is Inconsistent with the Intent of Congress

A.               The Legislative History of HIPAA Does Not Support the Amended Rule

The Secretary asks this Court to accept his unsupported assertion that, when Congress enacted §264 of the Administrative Simplification section of HIPAA, it intended to authorize the Secretary to adopt a national health privacy policy that would conflict with federal common law, most state privacy laws and 2,400 years of medical ethics. Scrty’s Br. 36.

The Secretary cites no statutory language or legislative history in support of his position. He does not deny that the legislative history cited by Plaintiffs shows a clear Congressional intent “to give individuals control over who actually has access to their medical records.” Pls.’ Br. 39. Nor does he dispute that HHS concluded in issuing the Original Rule that patient control over health information is the essence of medical privacy and that privacy is essential both for access to quality health care, and for the improved efficiency and effectiveness of the health care system intended by Congress. Pls.’ Br. 38. The Secretary simply claims he has the power to authorize nonconsensual uses and disclosures for routine situations because the statute gives him “broad rulemaking authority.” Scrty’s Br. 35.

It is well-established that courts and governmental agencies must give effect to the express intent of Congress and that courts “must exhaust the traditional tools of statutory construction to determine whether Congress has spoken to the precise question at issue.” Nuclear Energy Institute, Inc. v. EPA, 373 F.3d 1251, 1269 (D.C. Cir. 2004).[15] Such tools clearly include an examination of the legislative history, the agency’s prior statutory interpretations, and consistency with the laws of this and other countries. E. Hoffman-LaRoche, Ltd. v. Empagran S.A., 124 S. Ct. 2359, 2365-66, 2371 (2004); Intel Corp. v. Advanced Micro Devices, Inc., 124 S. Ct. 2466, 2480-81 (2004). Even the absence of evidence of congressional intent can be a determinative indicator when an agency seeks to embark on a sweeping change in past practice or “diverges from any realistic meaning of the [statute].” Nuclear Energy Inst., 373 F.3d at 1270; Intel Corp, 124 S. Ct. at 2480.

The legislative history reveals the intent that “privacy should come first” and should not be sacrificed to the interest in “reduced business costs.” Pls.’ Br. 39. In issuing the final Original Rule, HHS noted that Congress recognized the exceptional importance of privacy standards by separating out those standards from the directive to establish regulatory standards for the electronic transmission of health information so that privacy standards could be subject to Congressional action. 65 Fed. Reg. 82,469/3, JA 340. Congress also provided a “failsafe” mechanism under which the Secretary was required to issue privacy standards by regulation if Congress failed to act within 36 months of the enactment of HIPAA. 65 Fed. Reg. 82,470/1, JA 341. HHS concluded in issuing the final Original Rule that “[t]he Congress recognized that adequate protection of the security and privacy of health information is a sine qua non of the increased efficiency of information exchange brought about by the electronic revolution . . .”. 65 Fed. Reg. 82,474/2, JA 345.

Further, HHS noted that the Administrative Simplification provisions of HIPAA were enacted “against the backdrop of decades of privacy-enhancing statutes.” 65 Fed. Reg. 82,469/1, JA 340. Many of those statutes require the individual’s consent for the use or disclosure of identifiable personal information. For example, the Video Privacy Protection Act (1988) requires a video tape service provider to obtain “the informed, written consent of the consumer” in order to release personally identifiable information concerning any consumer. 18 U.S.C. § 2710(b)(2)(B). The Drivers’ Privacy Protection Act (1994) provides that a State department of motor vehicles cannot disclose personal information about any individual in most situations unless the requester demonstrates it has “obtained the written consent of the individual to whom the information pertains.” 18 U.S.C. § 2721(b)(13). The Children’s Online Privacy Protection Act (1998) requires the operator of a web site that collects personal information about children to obtain “verifiable parental consent.” 15 U.S.C. § 6502(b)(1)(A)(ii). The Secretary has cited no basis to assume that Congress intended to provide less privacy protection for highly personal and sensitive health information than for personal video rental or drivers’ license information.

Indeed, if Congress had intended for the Secretary to adopt a national health privacy policy that runs counter to 2,400 years of medical ethics, it would have included legislative language to this effect. Intel Corp., 124 S. Ct. at 2480. This conclusion is clear in light of the backdrop of Congressional concern about the threats to personal privacy when HIPAA was enacted in 1996.

B.               HIPAA Should Be Construed Consistently with Other Laws and the Agency’s Contemporaneous Interpretation

Even if §264 were found to be ambiguous, it should be construed to avoid conflict with the laws of other countries because courts may assume that Congress takes account of such laws. This rule of construction “helps the potentially conflicting laws of different nations work together in harmony—a harmony particularly needed in today’s highly interdependent commercial world.” E. Hoffman-LaRoche Ltd. v. Empagran, 124 S. Ct. at 2366.

As HHS concluded in adopting the final Original Rule, it is “important for the U.S. to join the rest of the developed world in establishing basic medical privacy protections,” citing the 1995 EU Data Privacy Directive. 65 Fed. Reg. 82,469/2, JA 340. The EU Data Privacy Directive, §33 states that data which by their nature are capable of infringing “fundamental freedoms or privacy” should not be used or disclosed “unless the data subject gives his explicit consent.” JA 360. The United States has issued “Safe Harbor Privacy Principles” for entities doing business with EU countries which provide for “Choice (i.e., consent)” and an “opt-in” mechanism for “personal information specifying medical or health conditions.” 65 Fed. Reg. 82,486/3, n. 1; 65 Fed. Reg. 45,667-68, JA 362-63. HHS found that the Original Rule and the EU directive were consistent and “based on common principles of fair information practices.” 65 Fed. Reg. 82,487/1. The Secretary did not address the apparent conflict with the EU directive when he reversed his policy on consent in the Amended Rule. The Original Rule’s interpretation of Congressional intent, therefore, should be given deference for this reason as well.

He further asserts that the proposed Original Rule, which would have authorized nonconsensual disclosures had it been adopted, was a more contemporaneous interpretation of the statute and, therefore, is entitled to greater deference. Scrty’s Br. 48, n.12. However, “[i]t goes without saying that a proposed regulation does not represent an agency’s considered interpretation of the statute  . . .”. Commodity Futures Trading Comm’n v. Schor, 478 U.S. 833, 845, 106 S. Ct. 3245, 3253 (1986). Thus, the final Original Rule’s recognition of the traditional right of consent represents the agency’s “considered” contemporaneous interpretation of the statute and is entitled to deference.

IV.                        The Amended Rule is Arbitrary and Capricious

A.               The Amended Rule is a Radical Departure from Settled Agency Action

The Secretary does not dispute that a settled course of agency behavior is entitled to a presumption that it best implements the intent of Congress. Pls.’ Br. 42-43; Motor Vehicles Mftrs Ass’n v. State Farm Mut. Ins. Co., 463 U.S. 29, 41-42, 103 S. Ct. 2856, 2866 (1983). He simply contends that the right of consent in the Original Rule was unsettled because he reopened the rulemaking within two months of its adoption in December 2000. Scrty’s Br. 46. The Secretary suppresses the fact, however, that he affirmatively elected to put the Original Rule into effect on April 14, 2001 after the rulemaking he conducted from February 26 through March 30, 2001. Pls.' Br. 46-47. The Secretary then kept the Original Rule in effect until he made the Amended Rule effective twenty months later on October 15, 2002. JA 1376. In putting the Original Rule into effect, the Secretary announced that he and the President were taking a “bold and definitive step to protect the rights of citizens to keep their medical records confidential” and that this action was intended to “give patients…more control over how their personal information is used.” JA 831; Pls.’ Br. 47. The Original Rule was at least as settled a course of agency action as the safety standard in Motor Vehicles which was rescinded before its compliance date. 463 U.S. at 37-38, 103 S. Ct. at 2863-64.

The Secretary also glosses over the fact that in adopting a policy in the Amended Rule of substituting control by covered entities for control by individuals over their health information in routine situations, he adopted the very approach that had been rejected twice, once by his predecessor and once by him. 65 Fed. Reg. 82,473/3, 67 Fed. Reg. 53,183/1, JA 344, 1377. Unlike Motor Vehicles where a new Secretary attempted to rescind a rule adopted by his predecessor, the Secretary in this case has reversed his own decision.

The Secretary also fails to mention that all of the concerns that he cited as support for reversing himself in the Amended Rule actually were brought to his attention in the February 26 to March 30, 2001 rulemaking he conducted before he put the Original Rule into effect. Pls.’ Br. 46-47.[16] He stated that an “expedited review” of these comments allowed him to determine that it was “appropriate” to put the Original Rule into effect on April 14, 2001. 67 Fed. Reg. 53,183; JA 1377. While he asserts in his brief that he reversed himself because of “unintended consequences” brought to his attention, he admittedly put the Original Rule into effect only after determining the provisions of the rule “would protect patients’ privacy without creating unanticipated consequences that might harm patients’ access to health care or quality health care . . .”. 67 Fed. Reg. 53,183 JA 1377 (emphasis added).

Sometime between the April 14, 2001 effective date of the Original Rule and the August 14, 2002 publication date of the Amended Rule, the Secretary radically changed his approach to medical privacy. In adopting the Original Rule, the Secretary (and his predecessor) concluded the individual’s ability to exercise his right to medical privacy was necessary for effective, high quality health care and a “sine qua non” of the efficiency intended by Congress. 65 Fed. Reg. 82,467, 82,474, JA 338, 345. Eighteen months later, however, the Secretary had come to believe medical privacy and efficiency were in irreconcilable conflict, and privacy had to give way to the desire for “enhanced efficiency.” Scrty’s Br. 37.

B.               The Record Is Devoid of Findings to Support the Complete Reversal of Prior Agency Action

Neither the District Court decision, the preamble to the Amended Rule nor the Secretary’s brief suggest any change in the statute, Congressional intent, or factual circumstances. In order for a rule to survive scrutiny under the Administrative Procedure Act’s arbitrary and capricious standard, particularly where an agency has reversed its “former views,” the agency must set forth a basis of facts and findings in support of that reversal. Pls.’ Br. 43. Prometheus Radio Project v. F.C.C., 373 F.3d 372, 390 (3d Cir. 2004) citing Motor Vehicle Mfts. Ass’n, 463 U.S. at 29, 103 S. Ct. at 2856. Courts cannot be compelled to guess at the theory underlying the agency’s action, and an agency has the “heaviest of obligations” to explain every step in its reasoning where individuals’ lives and welfare hang in the balance. American Lung Ass’n v. EPA, 134 F.3d 388, 392 (D.C. Cir. 1998).

The Amended Rule literally leaves the Court to guess what new facts or changed circumstances occurred between April 14, 2001 and August 14, 2002 that would have justified such a radical reversal. Further, the Court is left to guess why the right to medical privacy which was identified as synonymous with the trust that is essential for quality health care was abruptly viewed as subordinate to “enhanced efficiency” for covered entities. JA 338. The Court must also guess why it was necessary to eliminate the ability of all individuals to control the use and disclosure of their health information in all routine situations when the Secretary’s principal concern related to first encounters. Scrty’s Br. 39.

The Court also is left to guess why the Secretary did not cite any example in the history of the country of a patient who was unable to obtain needed health care because a covered entity could not obtain consent. Pls.’ Br. 47-48. The Secretary responds that it is “highly misleading” for Plaintiffs to point out this omission because the Original Rule was amended before the final compliance date and, in any event, some state laws permit some nonconsensual disclosures. Scrty’s Br. 42. This is hardly a sufficient explanation for the lack of a factual basis to support the reversal of a major health privacy policy since it ignores HHS’ own findings that (a) most providers obtain consent before using and disclosing a patient’s health information, (b) prior consent has been required under the standards of medical ethics throughout the history of medicine, (c) many states have statutory or common law requiring prior consent, (d) federal common law has long recognized a psychotherapist-patient privilege which cannot be waived without the patient’s consent, and (e) there is an established expectation among patients that their health information will not be used or disclosed for routine purposes without their consent. 65 Fed. Reg. 82,464/3, 82,472-74, JA 335, 343-45. These findings make it far more likely that the right of consent has enhanced, rather than impeded, access to quality health care.

The Secretary also does not dispute that the California statute that he used as a model for the Amended Rule actually provides a general right of consent like the Original Rule and that the only survey evidence cited in support of the Amended Rule was the same survey HHS cited for the opposite proposition in support of the Original Rule. Pls.’ Br. 53-56. These two errors seriously undermine the basis for the Amended Rule which erroneously stated “[t]he fact that there is a State law that has been using a similar model for years provides us confidence that this is a workable approach.” 67 Fed. Reg. 53,211/1, JA 1381. There was nothing in the state law or the survey that should have inspired this confidence.

C.               The Amended Rule Eviscerates Privacy Without Improving Efficiency

Finally, the Secretary argues that the Amended Rule was necessary to improve the efficiency of the health delivery system. Scrty’s Br. 27-29, 37. However, the “flexibility” the Rule professes to give to covered entities to disclose identifiable health information with or without the individuals’ permission undermines the “floor” of federal privacy standards that Congress intended be established to assure patients that their privacy would be protected. JA 342. The notices of privacy rights that a patient might have received on the day before and the day after the Amended Rule’s compliance date are illustrative.

Before the Amended Rule:

“Consistent with established standards of medical ethics and state law, I will use and disclose your identifiable health information for routine purposes only to the extent that you give your consent.”

After the Amended Rule:

“The federal government has granted me ‘regulatory permission’ to use and disclose any of your identifiable personal medical information for the past, present, or future to a broad range of ‘covered entities’ and their ‘business associates’ for certain routine purposes without your consent and over your objection. You have a right to seek a consent process by requesting an agreement to restrict uses and disclosures, but the federal government gives me the right to deny that request for any reason or for no reason. Disclosures without your consent are prohibited by my profession’s standards of medical ethics, but those standards do not have the force and effect of law. You may have a right under state law to not have your identifiable health information used and disclosed without your consent, but only if the state law and the federal Privacy Rule are in conflict and the state law confers ‘more stringent’ privacy protections and only if your records are not sought in any federal proceeding regardless of whether you are a party. The identifiable health information that I am authorized by federal law to use and disclose includes any information related to what I determine to be a routine purpose regardless when it was placed in your medical record and regardless whether it is needed to provide medical services to you. You have no right under the federal Privacy Rule to notice of these uses and disclosures or to request an accounting. This information may be used and disclosed to limit, terminate or determine the cost of health insurance for you and your family, for certain marketing activities and for certain business reasons that have nothing to do with any health care service you may have requested in the past or may request in the future.”

In fact, this hypothetical notice is quite similar to the notices that Plaintiffs actually have received since April 14, 2003. JA 58, 79, 110, 118, 122, 128, 144, 155, 223, 248, 250, 254, 257, 265, 290. As the Supreme Court has noted, uncertain medical privacy is little better than none at all. Jaffee v. Redmond, 518 U.S. at 18, 116 S. Ct. at 1932.

V.                           Conclusion

Neither the District Court’s holding nor the Secretary’s brief obscure the plain fact that the Amended Privacy Rule eliminates Plaintiffs’ rights to medical privacy in most situations. Nor can there be any doubt that the Rule is having an adverse impact on the trust essential for access to effective health care. The Amended Rule eliminates the privacy of Plaintiffs’ past, present and future health information regardless whether they protest, pay out of pocket or avoid the health care system altogether. Plaintiffs’ unrebutted affidavits and numerous national surveys in the record show that individuals value medical privacy even to the point of avoiding medical care. CACC Br. 10. That is hardly surprising since medical care preserves health for the present while medical privacy preserves hope and opportunity for the future. JA 338.

By eliminating Plaintiffs’ right of consent and granting federal “regulatory permission” for the use and disclosure of their health information, the Amended Rule, under the guise of being “wholly permissive,” in fact, eliminates Plaintiffs’ privacy rights under federal common law, state statutory and common law, and traditional standards for the ethical practice of medicine.

The decision in this case may well determine whether law-abiding individuals who pose no public health threat continue to have a “reasonable expectation” of a right to medical privacy in routine situations. If they do not have such a right with respect to information about their physical, mental and genetic make up, it is difficult to imagine they would have a right to privacy for any personal information. Accordingly, the right to personal privacy, and therefore liberty, will be extinguished in the city where it was first recognized.

Plaintiffs ask this Court to restore and preserve the status quo of medical privacy and consent which has existed throughout the history of the country and medicine prior to the adoption of the Amended Rule. They ask this Court to uphold their right, as to the government, to be let alone.

Respectfully submitted,

James C. Pyles

Powers, Pyles Sutter & Verville, P.C.

1875 Eye Street, NW

Washington, D.C. 20006

(202) 466-6550

Counsel for Appellants

Dated: November 8, 2004

Certificate of Service

I HEREBY CERTIFY that on this 8^TH day of November, 2004, two copies of the foregoing Reply Brief of Appellants were served by hand delivery upon counsel:

Charles Scarborough

Mark B. Stern

U.S. Department of Justice

Civil Division, Appellate Staff

950 Pennsylvania Avenue, N.W.

Room 7244

Washington, D.C. 20530-3001

James Gilligan

United States Department of Justice

Civil Division

20 Massachusetts Avenue, N.W.

Room 7136

Washington, D.C. 20001

And by first-class mail to:

Sharon J. Arkin

Robinson, Calcagnie & Robinson

620 Newport Center Drive, 7^th Floor

Newport Beach, CA 92660

Susan L. Burke

Stacy Alison Fols

Montgomery, McCracken, Walker & Rhoads, LLP

123 South Broad Street

Philadelphia, PA 19109

David P. Felsher

488 Madison Avenue, 11^th Floor

New York, NY 10022

John Gould

Jonathan Martel

Arnold & Porter, LLP

555 Twelfth Street, N.W.

Washington, D.C. 20004

M. Duncan Grant

Pepper Hamilton LLP

3000 Two Logan Square

18^th & Arch Streets

Philadelphia, PA 19103

Sheri Joy Nasya Tolliver

Texas Civil Rights Project

Michael Tigar Human Rights Center

1405 Montopolis Drive

Austin, TX 78741

James C. Pyles

POWERS, PYLES, SUTTER & VERVILLE, P.C.

1875 Eye Street, N.W.

Twelfth Floor

Washington, D.C. 20006-5409

(202) 466-6550

(202) 785-1756 Fax