Offering a reminder that even deceased individuals’ health information is afforded privacy protection under federal law, a federal appeals court struck down a Florida law authorizing certain persons to obtain deceased nursing home residents’ medical records as in conflict with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Faced with medical record requests from deceased former nursing home residents’ spouses and other persons, several nursing homes in Opis Management Resources LLC v. Secretary Florida Agency for Health Care Administration, No. 12-12593 (11th Cir. Apr. 9 2013) pointed to HIPAA to support their refusal to release the records under the Florida law. That state law required licensed nursing homes to provide a current or former nursing home resident’s medical records to the resident’s spouse, guardian, surrogate, proxy, or attorney-in-fact. The nursing homes claimed that under provisions of HIPAA that protect the privacy of deceased individuals’ health information, the requesters did not have authority to act on behalf of the deceased residents and therefore were not their “personal representative”; thus, HIPAA prevented the nursing homes from disclosing the records. Florida regulators, on the other hand, maintained a contrary interpretation and issued citations to the nursing homes for not complying with the Florida law.

According to the U.S. Court of Appeals for the Eleventh Circuit, HIPAA and the Florida law “[could not] be reconciled” because the Florida law stood “as an obstacle to the accomplishment and execution of the full purposes and objectives of HIPAA in keeping an individual’s protected health information strictly confidential.” The court emphasized that while HIPAA sanctions the disclosure of deceased individuals’ protected health information to a “personal representative” and other identified persons “who were involved in the individual’s care or payment for health care prior to the individual’s death” to the extent the disclosed information is “relevant to such person’s involvement,” the law otherwise ensures the privacy protection of deceased individuals’ health information by generally prohibiting its use and disclosure except in certain circumstances or with authorization. In contrast, the court explained, the Florida law allowed for “sweeping disclosures, making a deceased resident’s protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident’s stead.” In light of this apparent conflict, the court concluded, HIPAA preempted the Florida law.

For nursing homes in Florida and other HIPAA-covered entities subject to potentially broad state medical record disclosure laws like Florida’s, OPIS Management provides a defense in refusing to release deceased individuals’ medical records for litigation or other purposes. Curiously, the court’s ruling arrives just as the U.S. Department of Health and Human Services recently relaxed the HIPAA regulations governing deceased individuals’ health information to protect the privacy of such information only for 50 years (previously, protection was indefinite) and to authorize disclosure of such information to family members and other identified persons who were involved in the individual’s health care or payment for care. As this case demonstrates, however, these provisions are not limitless. HIPAA-covered entities should take care to scrutinize the qualifiers in these HIPAA rules as they navigate the intricacies of HIPAA and similar state laws, particularly where these laws conflict or diverge.