Since a federal appeals court recently ruled that the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") preempts Florida's nursing home records law, owners/operators of Florida nursing homes should be cautious when responding to requests for patients' medical records. Florida law requires that nursing homes furnish to the "spouse, guardian, surrogate, proxy, or attorney in fact" of a former resident a copy of the resident's records which are in the possession of the facility. HIPAA provides that covered entities, such as nursing homes, may only disclose medical records to a patient or his/her "personal representative".  HIPAA defines a personal representative to mean only an "executor, administrator, or other person who has authority under applicable state law to act on behalf of a deceased individual or of the individual's estate".  Therefore, in many situations, Florida law requires nursing homes to release medical records when HIPAA prohibits it.

In a recent decision by the United States Court of Appeals for the Eleventh Circuit, the court ruled that the federal HIPAA law preempted the Florida nursing home records law (Opis Management Resources, LLC v. Florida Agency for Health Care Administration).  In this case Opis and several other managers and operators of Florida nursing homes refused to provide the medical records of deceased residents to their spouses and attorneys since they were not the residents’ “personal representatives” as defined by HIPAA.  As a result, the Florida Agency for Health Care Administration (“AHCA”) cited the nursing homes for failing to provide the records as required by the Florida law, and the nursing home operators sought relief in federal court.

The federal district court ruled in favor of Opis and the other nursing home operators, and AHCA took an appeal to the Eleventh Circuit Court of Appeals.  On appeal AHCA argued that the Florida law did not conflict with HIPAA but merely clarified who should be considered the “personal representative” of the deceased resident.  The appeals court rejected AHCA’s argument and said:

"The fatal flaw in the State Agency’s argument is that … the unadorned text of the state statute authorizes sweeping disclosures, making a deceased resident’s protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident’s stead."

The amendments to the HIPAA Privacy Rule issued earlier this year authorize covered entities to release a deceased individual’s protected health information to family members or other persons who were involved in the individual’s care or payment for healthcare if the information is relevant to such person’s involvement.  The Eleventh Circuit also rejected AHCA’s argument that this new HIPAA rule saved the Florida law, and it pointed out that the Florida law did not contain any of the limitations or restrictions in the new HIPAA rule.

The Eleventh Circuit concluded that the Florida law frustrated HIPAA’s objective of limiting disclosures of protected health information and was therefore preempted by the federal law.