Citizens for Health v. Leavitt - Opposition

No. 05-1311

In the Supreme Court of the United States

CITIZENS FOR HEALTH, ET AL., PETITIONERS

v.

MICHAEL O. LEAVITT, SECRETARY OF HEALTH AND HUMAN SERVICES

ON PETITION FOR A WRIT OF CERTIORARI
TO THE UNITED STATES COURT OF APPEALS
FOR THE THIRD CIRCUIT

BRIEF FOR THE RESPONDENT IN OPPOSITION

PAUL D. CLEMENT
Solicitor General
Counsel of Record

PETER D. KEISLER
Assistant Attorney General

MARK B. STERN
CHARLES W. SCARBOROUGH
Attorneys
Department of Justice
Washington, D.C. 20530-0001
(202) 514-2217

QUESTION PRESENTED

Whether the United States Department of Health and Human Services violated petitioners' asserted constitutional right to privacy in personal health information when it promulgated regulations that do not require treatment providers to obtain patient consent in order to use and disclose protected health information for certain routine purposes.

No. 05-1311

CITIZENS FOR HEALTH, ET AL., PETITIONERS

v.

MICHAEL O. LEAVITT, SECRETARY OF HEALTH AND HUMAN SERVICES

ON PETITION FOR A WRIT OF CERTIORARI
TO THE UNITED STATES COURT OF APPEALS
FOR THE THIRD CIRCUIT

BRIEF FOR THE RESPONDENT IN OPPOSITION

OPINIONS BELOW

The opinion of the court of appeals (Pet. App. 1a-42a) is reported at 428 F.3d 167. The opinion of the district court (Pet. App. 43a-80a) is unreported.

JURISDICTION

The judgment of the court of appeals was entered on October 31, 2005. A petition for rehearing was denied on January 13, 2006 (Pet. App. 81a-83a). The petition for a writ of certiorari was filed on April 13, 2006. The juris diction of this Court is invoked under 28 U.S.C. 1254(1).

STATEMENT

1. In Title II, Subtitle F of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. No. 104-191, 110 Stat. 2021, Congress sought to improve "the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of stan dards and requirements for the electronic transmission of certain health information." HIPAA § 261, 110 Stat. 2021 (42 U.S.C. 1320d note). To accomplish that goal, Congress instructed the Department of Health and Hu man Services (HHS) to adopt standards for unique iden tifiers, such as identifiers for health-care plans and health-care providers across the nation, and also to adopt standards for transactions and data elements re lating to health information, the security of that infor mation, and authentication of electronic signatures. HIPAA § 262, 110 Stat. 2024-2026 (42 U.S.C. 1320d-2).

Congress recognized that the new regulatory scheme posed risks to the privacy of confidential patient infor mation by eroding practical barriers that historically had prevented improper access to that information. See H.R. Rep. No. 496, 104th Cong., 2d Sess. 99-100 (1996). Congress therefore directed HHS to submit "detailed recommendations on standards with respect to the pri vacy of individually identifiable health information" within one year after the statute's enactment. HIPAA § 264(a), 110 Stat. 2033 (42 U.S.C. 1320d-2 note). Con gress specified that those recommendations should ad dress "at least" three areas: (1) "[t]he rights that an in dividual who is a subject of individually identifiable health information should have," (2) "[t]he procedures that should be established for the exercise of such rights," and (3) "[t]he uses and disclosures of such infor mation that should be authorized or required." HIPAA § 264(b), 110 Stat. 2033 (see 42 U.S.C. 1320d-2 note).

HIPAA further provided that, "[i]f legislation gov erning standards with respect to the privacy of individu ally identifiable health information" was not enacted within three years after HIPAA's enactment, HHS would be required to "promulgate final regulations con taining such standards." HIPAA § 264(c)(1), 110 Stat. 2033 (see 42 U.S.C. 1320d-2 note). Under HIPAA, the privacy regulations adopted by HHS pursuant to that directive "shall not supercede a contrary provision of State law, if the provision of State law imposes require ments, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regula tion." HIPAA § 264(c)(2), 110 Stat. 2033-2034 (see 42 U.S.C. 1320d-2 note).

2. No further legislation to protect the privacy of individually identifiable health information was enacted within the three-year period after HIPAA's enactment. To fulfill its responsibilities under HIPAA, HHS subse quently proposed and modified privacy standards that went through four major iterations. See 64 Fed. Reg. 59,918 (1999) (Proposed Original Rule); 65 Fed. Reg. 82,462 (2000) (Original Rule); 67 Fed. Reg. 14,776 (2002) (Proposed Amended Rule); 67 Fed. Reg. 53,182 (2002) (Final Amended Rule). As HHS explained, those stan dards sought to "improve the efficiency and effective ness" of health-care services "by providing enhanced protections for individually identifiable health informa tion." 64 Fed. Reg. at 59,918. The various iterations of the privacy rule generally prohibited health-care provid ers and other covered entities from using or disclosing protected health information, see id. at 59,924, while specifying certain circumstances in which the federal prohibition would not apply, see id. at 60,056-60,059 (al lowing uses and disclosures for certain public policy pur poses, including research, health oversight, and law en forcement).

The Original Rule initially promulgated by HHS would generally have required health-care providers that directly treat patients to obtain patients' consent "prior to using or disclosing protected health informa tion to carry out treatment, payment, or health care op erations." 65 Fed. Reg. at 82,810 (text of former 45 C.F.R. 164.506(a)(1) (2002)). Before that requirement took effect, however, HHS received thousands of com ments from covered entities explaining that a consent requirement for such "routine uses" of individual health information would significantly impair the health-care industry's ability to provide timely and efficient medical services. See 67 Fed. Reg. at 14,779 (summarizing pub lic comments criticizing consent requirement). In re sponse to those comments, HHS proposed several modi fications to the Original Rule, see id. at 14,776, and ulti mately promulgated a final rule that eliminated the con sent requirement for routine uses, see id. at 53,182.

The Final Amended Rule expressly allows covered entities to seek consent to use or disclose information for routine uses if they choose to, see 45 C.F.R. 164.506, and it retains most of the specific privacy protections contained in the Original Rule, see 67 Fed. Reg. at 53,211. The Final Amended Rule also retains the gen eral requirement that disclosures must be limited to the "minimum necessary" to accomplish the intended pur pose. 45 C.F.R. 164.502(b). Consistent with HIPAA and earlier versions of the rule, the Final Amended Rule also provides that state law will not be preempted if it estab lishes more stringent standards for protecting the pri vacy of individually identifiable health information. 45 C.F.R. 160.203(b).

3. Petitioners are health-care providers, health-care organizations, and individuals. They filed suit against HHS in district court challenging the Final Amended Rule. Petitioners alleged that HHS had violated the Administrative Procedure Act (APA), 5 U.S.C. 553, 701- 706, by failing to provide a reasoned explanation for its decision to eliminate the consent requirement for rou tine uses; that HHS had exceeded its authority under HIPAA by eliminating the consent requirement; and that HHS's decision not to require consent for routine uses violated petitioners' constitutional rights, including privacy rights protected by the Fifth Amendment and an asserted First Amendment right to engage in confi dential physician-patient communications. See Pet. App. 9a, 57a.

On cross-motions for summary judgment, the district court upheld the Final Amended Rule in all respects. Pet. App. 43a-80a. After finding that at least some of the petitioners had standing to challenge the Final Amended Rule, id. at 59a-65a, the court held that HHS had provided a reasoned explanation for its decision to eliminate the consent requirement and had adequately examined and responded to the relevant data and public comments as required by the APA, id. at 65a-71a. The district court also held that the Final Amended Rule was within the scope of HHS's authority under HIPAA and that the rule was not impermissibly retroactive. Id. at 71a-74a. Finally, while assuming arguendo that peti tioners had a constitutional right to privacy in their medical records, the court held that the Final Amended Rule did not violate such a right because the rule "is wholly permissive with respect to whether a covered entity should seek consent from a patient before using his or her information for routine purposes." Id. at 75a.

4. The court of appeals affirmed. Pet. App. 1a-42a. The court held that petitioners had established their standing to sue, id. at 34a n.9, and it assumed that peti tioners had a constitutional right to privacy in their per sonal health information, id. at 36a n.10. Without defin ing the precise contours of that right, however, the court held that the privacy violations alleged by petitioners could not properly be ascribed to the government. Id. at 12a-13a. Noting that "the 'violations' of the right to medical privacy that [petitioners] have asserted, if they amount to violations of that right at all, occurred at the hands of private entities," the court concluded that "the protections of the Due Process Clause of the Fifth Amendment are not implicated in this case." Ibid.

The court of appeals observed that petitioners do "not challenge any use or disclosure [of private medical information] by the Secretary [of HHS] himself, or urge that the third parties were somehow acting on the Secre tary's behalf." Pet. App. 14a. Rather, petitioners' con stitutional claim is premised on the fact that "the nonconsensual use or disclosure of individual health in formation by private parties" is "permitted by the Amended Rule." Id. at 15a. Under those circumstances, the court stated, the relevant question is "whether the [government] provided a mantle of authority that en hanced the power of the harm-causing individual actor." Id. at 16a (quoting NCAA v. Tarkanian, 488 U.S. 179, 192 (1988)). The court found that petitioners could not make the requisite showing of affirmative governmental assistance in private disclosures because (1) there was no evidence that such disclosures had previously been forbidden by federal law, and (2) any state-law restric tions on disclosure of private health information remain in force and are not preempted by HIPAA or the Amended Rule. Id. at 18a.

The court of appeals further explained that none of the state-action cases upon which petitioners relied "supports the view that a government authorization of conduct that was already legally permissible satisfies the constitutional state action requirement." Pet. App. 19a-20a. Because "[t]he Amended Rule has not en hanced covered entities' power, under federal or state law, to use or disclose confidential health information without patients' consent," id. at 23a, the court rejected petitioners' Fifth Amendment claim, id. at 23a-24a. The court rejected petitioners' First Amendment challenge for essentially the same reason, id. at 24a-25a, explain ing that "the potential 'chilling' of patients' rights to free speech derives not from any action of the government, but from the independent decisions of private parties with respect to the use and disclosure of individual health information," id. at 25a.1

ARGUMENT

The Final Amended Rule that is the subject of peti tioners' constitutional challenge imposes restrictions on the use and disclosure of certain health information by private parties. It does not authorize or encourage any uses or disclosures that were not previously lawful, and it does not displace existing privacy protections. Peti tioners contend that the government violated their rights under the First and Fifth Amendments by failing to require that certain health-care providers obtain pa tient consent before using or disclosing protected health information for specified purposes relating to such mat ters as treatment and payment. The court of appeals concluded that HHS's refusal to impose such a require ment did not provide a sufficient basis for attributing any subsequent private disclosures to the federal gov ernment. That holding is correct and does not conflict with any decision of this Court or of any other court of appeals. Further review is not warranted.

1. The Final Amended Rule establishes a compre hensive scheme under which covered entities are forbid den to use or disclose protected health information ex cept as expressly authorized by the Rule. See 45 C.F.R. 164.502(a), 164.508. The Rule allows patients to request additional restrictions on the use or disclosure of their health information, which would then bind any covered entity that agreed to such limits, see 45 C.F.R. 164.522(a), and it generally restricts uses and disclo sures to the "minimum necessary" to accomplish a per mitted purpose, 45 C.F.R. 164.502(b). The Final Amended Rule thus provides enhanced federal protec tions for the privacy of individual health information.

Petitioners believe that additional use and disclosure restrictions are warranted. They contend that HHS should have retained an earlier version of the regulation that would have required certain health-care providers to obtain patient consent before using or disclosing pro tected health information for treatment, payment, or health-care operations. See Pet. 23-24. The Final Amended Rule does not require such consent. See 45 C.F.R. 164.506(a).

As the court of appeals recognized (see, e.g., Pet. App. 15a-16a), HHS's decision not to prohibit certain private disclosures that petitioners find objectionable provides no basis for treating those disclosures as ac tions of the federal government. The Final Amended Rule does not compel any disclosures in connection with treatment, payment, or health-care operations. To the contrary, the Rule expressly allows covered entities to seek patients' consent for such uses or disclosures if the covered entity elects to do so. 45 C.F.R. 164.506(b). Nor does the Final Amended Rule supersede or displace "more stringent" privacy protections provided under state law. 45 C.F.R. 160.203(b). Rather, under the Final Amended Rule, patients retain whatever preexisting rights they may have had to prevent the use and disclo sure of their protected health information.

2. While apparently recognizing that the Final Amended Rule does not require the disclosure of any private health information, petitioners contend that "state action is present where the federal government merely authorizes, encourages or endorses but does not compel or command" private conduct. Pet. 21. This Court's decisions make clear, however, that the govern ment's mere failure to prohibit particular private con duct-even within a general sphere of activity that is subject to "extensive state regulation"-is an insuffi cient basis for attributing that conduct to the govern ment. See American Mfrs. Mut. Ins. Co. v. Sullivan, 526 U.S. 40, 52 (1999). Rather, state-action analysis "depends on whether the State has exercised coercive power or has provided such significant encouragement, either overt or covert, that the choice must in law be deemed to be that of the State. Action taken by private entities with the mere approval or acquiescence of the State is not state action." Ibid. (citations and internal quotation marks omitted).

In American Manufacturers, this Court reviewed a due process challenge to a Pennsylvania workers' com pensation statute that allowed, but did not require, pri vate insurers to withhold payments for disputed medical treatment pending "utilization review" of the claims. See 526 U.S. at 45-46. While acknowledging that "the State's decision to provide insurers the option of defer ring payment for unnecessary and unreasonable treat ment pending review can in some sense be seen as en couraging them to do just that," the Court explained that "this kind of subtle encouragement is no more sig nificant than that which inheres in the State's creation or modification of any legal remedy." Id. at 53. The Court further observed that "[t]he State's decision to allow insurers to withhold payments pending review can just as easily be seen as state inaction." Ibid. The Court explained that, although the applicable statutory scheme "previously prohibited insurers from withhold ing payment for disputed medical services, it no longer does so. Such permission of a private choice cannot sup port a finding of state action." Id. at 54.

The same analysis applies here. Indeed, the argu ment for attributing the challenged private conduct to the government is even weaker in this case than in American Manufacturers. That case involved a legisla tive change that removed preexisting restrictions on the freedom of private insurers to withhold payments pend ing resolution of disputes concerning the reasonableness of treatment. See 526 U.S. at 53-54. The regulations at issue here, by contrast, give covered entities no greater freedom to use or disclose health information than they possessed under prior law. See Pet. App. 18a.

3. Contrary to petitioners' contention (Pet. 21-28), the Third Circuit's decision in this case does not conflict with any precedent of this Court or of another court of appeals.

a. Petitioners' reliance (Pet. 20-21) on Skinner v. Railway Labor Executives' Ass'n, 489 U.S. 602 (1989), is misplaced. Skinner involved a Fourth Amendment challenge to drug and alcohol tests that were performed by railroads and were authorized but not compelled by federal regulations. The Court explained that "[w]hether a private party should be deemed an agent or instrument of the Government for Fourth Amendment purposes necessarily turns on the degree of the Govern ment's participation in the private party's activities." Id. at 614. The Court observed that the federal regula tions governing drug and alcohol testing of railroad em ployees "pre-empt[ed] state laws, rules, or regulations covering the same subject matter" and barred the rail roads from divesting themselves by contract of the au thority conferred by the regulations, thereby "remov[ing] all legal barriers to the testing." Id. at 615. The Court further concluded that the government, through its promulgation of the challenged regulations, had "made plain not only its strong preference for test ing, but also its desire to share the fruits of such intru sions." Ibid. By contrast, the Final Amended Rule at issue in this case, which is challenged principally on sub stantive due process rather than Fourth Amendment grounds, does not preempt more stringent privacy protections under state law, see 45 C.F.R. 160.203(b); it expressly allows health-care providers to enter into agreements requiring patient consent if they choose to do so, see 45 C.F.R. 164.506(b); it reflects no preference in favor of use or disclosure; and it manifests no intent that private health information should be shared with federal personnel.2

b. Petitioners' extensive discussion of other cases finding state action in the absence of governmental com pulsion (Pet. 13-21) is also largely beside the point. As the court of appeals recognized, the laws "struck down in these cases allowed private parties to take some ac tion (usually discrimination based on race) where they would otherwise have been prohibited from doing so," Pet. App. 20a, and most of the cases concerned concrete governmental involvement in such conduct through funding, enforcement of private conduct or other means. The Final Amended Rule, by contrast, "has not en hanced covered entities' power, under federal or state law, to use or disclose confidential health information without patients' consent," id. at 23a, and there is no further involvement by the federal government in the private conduct of covered entities.

Although this Court has frequently found state ac tion when government officials encouraged or facilitated private racial discrimination, Congress's failure to pro hibit particular discriminatory conduct, standing alone, is not a sufficient basis for attributing the discrimination to the federal government. For example, Title VII's prohibition on racial discrimination in private employ ment applies only to "a person engaged in an industry affecting commerce who has fifteen or more employees for each working day in each of twenty or more calendar weeks in the current or preceding calendar year." 42 U.S.C. 2000e(b) (definition of "employer"); see, e.g., Arbaugh v. Y&H Corp., 126 S. Ct. 1235, 1239 (2006). The exclusion from Title VII's coverage of firms with fewer than 15 employees could not reasonably be viewed as a basis for attributing to the federal government any acts of racial discrimination that such firms might com mit. Similarly here, HHS's decision not to impose a cat egorical ban on unconsented uses or disclosures of pri vate health information does not constitute the sort of affirmative encouragement that would justify treating such private disclosures as the actions of the federal government.

c. Petitioners contend that the court of appeals' rul ing conflicts with decisions of the D.C. and Fourth Cir cuits holding that "state action can be evidenced by 'en couragement and support' from the federal government even if it does not compel the private choice." Pet. 27 (citing, inter alia, Franz v. United States, 707 F.2d 582 (D.C. Cir. 1983), and Doe v. Charleston Area Med. Ctr., Inc., 529 F.2d 638 (4th Cir. 1975)). But the court of ap peals recognized that governmental encouragement and support of private conduct may, in some circumstances, justify treating that conduct as state action. See, e.g., Pet. App. 20a-23a. The court simply held that HHS's decision not to require covered entities to obtain patient consent before using or disclosing protected health in formation for routine purposes does not represent the sort of affirmative encouragement that could make the use or disclosure of such information legally attributable to the government.3

Contrary to petitioners' contention (Pet. 28), the court of appeals did not base its decision on a "radical new formulation of the state action doctrine." Rather, after careful consideration of a variety of factors, the court of appeals concluded that the private conduct that is the anticipated source of harm to petitioners is not properly attributed to the federal government because the Final Amended Rule did not compel any non-consen sual uses or disclosures of protected health information and did not "enhance" covered entities' authority to take measures that were previously unlawful. Pet. App. 23a. The court's holding is correct and is consonant with the general principle that "permission of a private choice cannot support a finding of state action." American Mfrs., 526 U.S. at 54.

CONCLUSION

The petition for a writ of certiorari should be denied.

Respectfully submitted.

PAUL D. CLEMENT
Solicitor General

PETER D. KEISLER
Assistant Attorney General

MARK B. STERN
CHARLES W. SCARBOROUGH
Attorneys

JUNE 2006

1 The court of appeals also rejected petitioners' non-constitutional challenges to the Final Amended Rule. Pet. App. 25a-29a. The court noted that HIPAA requires HHS "to 'balance privacy protection and the efficiency of the health care system-not simply to enhance privacy,'" id. at 26a (citations omitted), and it held that the Final Amended Rule does not interfere with any reasonable expectations of privacy, particularly given the Rule's express preservation of any preexisting rights under state law, ibid. The court further held that HHS had acted reasonably by declining to include a consent require ment in the Final Amended Rule, explaining that the agency had examined the relevant data, fully considered the voluminous public comments on that issue, and adequately explained its decision. Id. at 28a-29a. Petitioners do not challenge those holdings in this Court.

2 Despite the express provision in the Final Amended Rule allowing covered entities to seek consent for routine uses and disclosures, petitioners contend that the rule "provides significant discouragement to private entities that may wish to continue providing a consent process as they have in the past." Pet. 25. In support of that claim, petitioners characterize the consent process authorized by the Rule as "cumbersome," and they suggest that providers will be unwilling to enter into voluntary agreements restricting uses and disclosures because a failure to abide by such agreements "is a violation of the Rule subjecting the covered entity to potential civil sanctions." Ibid. The fact that uses and disclosures in violation of a confidentiality agreement are treated as violations of the Final Amended Rule, however, simply underscores the strength of the privacy protections in that Rule. In any event, nothing in the Rule prevents covered entities from seeking consent to disclosures on an ad hoc basis, or from declining to make disclosures for which consent has not been given, even in the absence of a formal agreement to that effect.

3 Petitioners also criticize the court of appeals for not addressing the question whether HHS directly violated petitioners' privacy rights in its role "as a 'covered entity' charged with administration of the Medicare, Medicaid and Indian Health Services programs." Pet. 15 n.6. That claim lacks merit. The court of appeals correctly held that petitioners "did not challenge any use or disclosure [of information] by the Secretary himself, or urge that the third parties were somehow acting on the Secretary's behalf." Pet. App. 14a. Although petitioners suggest that general allegations in their complaint should be deemed sufficient to state such a claim, Pet. 15 n.6, they do not identify any specific allegations regarding HHS in its role as a covered entity.