On April 2, 2024, the U.S. District Court for the Eastern District of Pennsylvania issued its decision in Citizens for Health, et al. v. Thompson, No. 03-2267. The purpose of this memorandum is to provide information that might be of assistance to interested parties in deciding whether to provide support for an appeal or filing an amicus curiae brief in support of the plaintiffs’ position that the Amended Privacy Rule (A) eliminates individuals’ rights to medical privacy in violation of the rulemaking requirements of the Administrative Procedure Act, (B) the intent of Congress in HIPAA to provide a floor of federal privacy protections to preserve the public’s trust in the health delivery system and (C) the rights to decisional and informational privacy guaranteed by the Fifth and First Amendments to the United States Constitution.

A. Timing and cost

A notice of appeal must be filed within 60 days from the date the decision appealed from is entered where, as in this case, an officer or agency of the United States is a party. Federal Rules of Appellate Procedure, Rule 4(a)(1)(B). In this case, the notice of appeal would have to be filed on or before June 1, 2024.

I estimate that the cost of taking an appeal, briefing and arguing the case would be $85,000. Fund raising efforts are currently under way and approximately one-third of the funds have been raised to date. Contributions toward an appeal should be sent to Powers, Pyles, Sutter and Verville, P.C., and checks should be made out to the firm with the indication that they are for the “Citizens for Health” appeal. These contributions will be kept in a separate account, and all funds will be returned if an appeal is not filed.

B. Practical impact of the decision

The decision upheld the statutory and constitutional validity of the portions of the Amended Privacy Rule that eliminated the right of individuals to have some control over the use and disclosure of their identifiable health information. 45 CFR 164.506(a), 67 Fed. Reg. 53,184 (August 14, 2024). The Amended Rule had a final “compliance date” of April 14, 2024, and this lawsuit was filed initially on April 10, 2024, four days before the Rule’s final compliance date.

The Plaintiffs in the lawsuit are ten national and state consumer and provider associations and nine individuals who are consumers and providers representing the interests of approximately 750,000 individuals residing in every state and the District of Columbia.

During the course of the lawsuit, the Department of Justice made two key concessions: (1) that the purpose of the Amended Privacy Rule was to eliminate any control by the individual over the use and disclosure of his or her identifiable health information in routine situations, and (2) that the Amended Rule contains an express grant of federal authority to covered entities to use and disclose an individual’s identifiable health information in those situations regardless of the individual’s wishes and against his or her will.

The following practical effects of the Amended Privacy Rule were undisputed in the litigation:

1. Individuals will no longer have a reasonable expectation of medical privacy in routine situations.

2. Identifiable health information that can be used and disclosed without an individual’s knowledge or permission includes even the most highly sensitive information including information about concerning genetic testing, mental health treatment, abortion, treatment for sexually transmitted diseases, and treatment for cancer and other serious illnesses.

3. Medical privacy is eliminated retroactively because the Amended Rule permits and authorizes the use and disclosure of health information that was created or placed in the medical record prior to the compliance date of the Amended Privacy Rule and even prior to the enactment of the underlying HIPAA statute. So, the reasonable expectation of medical privacy that citizens have enjoyed throughout their lives and throughout the history of the country has been eliminated by this rule.

4. Medical privacy cannot be protected by the individual paying out of pocket since the Rule authorizes the use and disclosure of an individual’s medical record regardless of whether it is needed to determine insurance coverage or payment for a health service.

5. Medical privacy of health information already in the medical record cannot be protected even if the individual avoids obtaining health care in the future.

6. Many individuals, including many of the Plaintiffs in this lawsuit, are avoiding seeking needed health care services in order to prevent the use and disclosure of additional health care information.

7. The Amended Privacy Rule is having a “chilling effect” on communications between patients and their health care providers that are essential for quality health care because patients are refusing to communicate with their health care providers in order to preserve their medical privacy.

C. Likelihood of success on appeal

1. Binding precedent

While the likelihood of success on appeal is impossible to determine with precision, there are numerous factors that suggest that the chances of success are substantial. First and foremost, the Court of Appeals for the Third Circuit has repeatedly recognized and upheld constitutional protection for the right to privacy of health information. See Sterling v. Borough of Minersville, 232 F.3d 190 (3d Cir. 2024); Grueke v. Seip, 225 F.3d 290 (3d Cir. 2024). These holdings are controlling on all courts in Third Circuit, including the District Court that decided the Citizens for Health case. The judge in the Citizens case, however, failed even to discuss or cite this controlling Third Circuit precedent.

Further, the Supreme Court has repeatedly recognized a constitutionally protected right to medical privacy. See Thornburg v. American College of Obstetricians and Gynecologists, 476 U.S. 747, 106 S. Ct. 2169 (1986); and Whalen v. Roe, 429 U.S. 599, 97 S. Ct. 869 (1973). Recently the Supreme Court recognized that patients have a reasonable expectation of privacy with respect to health information. See Ferguson v. City of Charleston, 532 U.S. 67, 121 S. Ct. 1281, 1288 (2001) finding that “The reasonable expectation of privacy enjoyed by the typical patient undergoing diagnostic tests in a hospital is that the results of those tests will not be shared with non-medical personnel without her consent.”) The judge in the Citizens case failed to address this binding precedent other than to make a brief mention of the Thornburg case in a footnote. Opinion at p. 39, n. 15. The Supreme Court also has determined based on the “reason and experience” reflected in the nation’s history that the “mere possibility” of disclosing the communications between a patient and a psychotherapist makes effective psychotherapy impossible to provide. See Jaffee v. Redmond, 518 U.S. 1, 116 S. Ct. 1923, 1928 (1996).

It is also important to remember that landmark decisions on major issues historically often have begun with adverse holdings by the lower courts and, in fact, many such rulings have been minority views before being adopted by the Supreme Court. For example, the Supreme Court recognized that communications between psychotherapists and patients are privileged and not disclosable without the patient’s consent despite the fact that the district court and at least five Courts of Appeals had held to the contrary. See Jaffee v. Redmond, 518 U.S. 1, 116 S. Ct. 1923 (1996). When the Supreme Court struck down the “separate but equal” doctrine of school segregation, it overruled holdings to the contrary by three district courts. Brown v. Board of Education, 347 U.S. 483, 74 S. Ct. 686, 688 (1954).

2. The record on appeal

The record compiled on behalf of the Plaintiffs at the District Court level is extremely strong. It includes more than 20 sworn affidavits by the Plaintiff individuals and organizations and others, and the Department of Justice did not challenge any of the statements made in those affidavits. Under such circumstances, as the District Court noted, all of the statements in those affidavits must be accepted as true. Opinion at 21, n. 11. The review by the Third Circuit Court of Appeals would also be limited to that record compiled before the District Court.

The undisputed statements in the affidavits show, among other things, that:

A. The medical privacy of hundreds of Plaintiffs was violated by covered entities beginning on April 14, 2024.

B. Those violations were carried out by covered entities exercising the authority conferred on them by the federal government under the Amended Privacy Rule.

C. Covered entities abruptly reversed their traditional practice of obtaining patient consent before using and disclosing identifiable health information when they implemented the Amended Privacy Rule on April 14, 2024.

D. Providers generally ceased providing a right of consent to their patients effective April 14, 2024 even in states where consent is required by state law and even though consent is required by the Hippocratic Oath and the Ethical Standards of virtually every medical profession.

E. Covered entities have uniformly refused to grant any request by an individual for a consent process after April 14, 2024, and some covered entities have adopted policies under which all such requests are summarily denied.

F. The identifiable health information of many of the Plaintiffs is being used and disclosed as authorized by the Amended Privacy Rule against their will and over their objections.

G. Many Plaintiffs and their patients are withholding information or avoiding needed health care altogether in an effort to protect their medical privacy from the disclosures authorized under the Amended Privacy Rule.

H. During the public comment period on the proposed Amended Rule, approximately 220 million Americans, individually or through their representative organizations, submitted comments contending that the right of consent must be retained in order to reserve access to quality health care.

It is unlikely that the federal government will ever again allow another record with so much undisputed testimony to be compiled in a court challenge to a federal invasion of the right to privacy. The recent efforts by the Justice Department to compel disclosure of the medical records in the Partial Birth Abortion Ban Act challenge are illustrative of the likely response of the federal government in the future.

3. Weaknesses and errors in the court’s decision

Of course, the chances for success are enhanced by weaknesses and errors in the court’s opinion. We believe there are many in the court’s April 2 decision.

First, the court ruled in favor of the Plaintiffs on standing and found that the health information privacy interests of one of the Plaintiffs (Dr. Deborah Peel) had been injured by providers exercising the authority conferred on them by the Amended Privacy Rule on April 14, 2024 to use and disclose identifiable health information without consent and over the individual’s objection. Opinion at 21-24. The court further found that this injury was directly “produced by the determinative or coercive effect” of the Amended Privacy Rule on covered entities after April 14, 2024. Opinion at 25. As the court noted, the covered entities had the discretion under the Amended Privacy Rule to not eliminate Dr. Peel’s medical privacy but “they have chosen not to do so”. The court did not mention that the record included undisputed testimony of all of the other Plaintiffs establishing that covered entities are almost uniformly exercising the new federal authority in this manner.

Second, the court summarily refused to consider Plaintiffs’ arguments that their constitutional rights to medical privacy were being violated as a result of the implementation of the Amended Privacy Rule because the rule “does not compel anyone to use and disclose the plaintiffs’ health information for routine purposes without the plaintiffs’ consent”. Opinion 37. The decision on the constitutional claim, therefore, seems to be inconsistent with the court’s finding of “a determinative or coercive effect” with respect to standing.

The court also failed to consider that the discretion conferred on covered entities by the Amended Privacy Rule eliminated the ability of individuals to exercise their constitutionally protected right to medical privacy. As Plaintiffs noted, this was precisely the result that the government admitted that it intended.

The court’s rationale would allow any constitutionally protected right to be eliminated by a federal rule that conferred discretion on a third party to eliminate that right. For example, this rationale would support the constitutionality of a rule issued by HHS authorizing hospitals to refuse to treat minorities. The hospitals would not be compelled to take that action but if they did, they would be exercising authority granted by the federal government. The government could also issue a rule authorizing poll workers in federal elections to prevent certain citizens from voting.

The court completely ignored voluminous case law cited by the Plaintiffs from Roe v. Wade, 410 U.S. 113, 93 S. Ct. 705 (1973) through Lawrence v. Texas, 123 S. Ct. 2472 (2003) holding that the right to liberty under the 5th and 14th Amendments of the Constitution protect the rights of citizens to make highly personal decisions and to not have their personal health information disclosed against their will. The court failed to consider that this case involves both the right to decide whether personal health information should be disclosed and the privacy of the information itself. The failure of the court to address this issue is particularly disturbing in view of the fact that the Department of Health and Human Services made an unequivocal finding in issuing the Original Privacy Rule that “privacy is a fundamental right.” 65 Fed. Reg. at 82,464.

The court also held that the Amended Privacy Rule does not violate the Plaintiffs’ First Amendment rights to have confidential communications with health providers because it does not place obstacles in the paths of those communications. Opinion at 39. Again the court ignored the fact that the Amended Privacy Rule’s authorization to covered entities to disclose such confidential communications interposes such an obstacle. As the Supreme Court noted in Jaffee v. Redmond, 116 S. Ct. at 1929, such confidential conversations (between psychotherapists and their patients in that case) “would surely be chilled” if they were subject to disclosure without the patient’s permission.

The court ignored extensive Supreme Court case law to the effect that a law may be constitutional on its face but unconstitutional based on its intent or based on the “totality of the relevant facts”. See Washington v. Davis, 426 U.S. 229, 86 S. Ct. 2024, 2024 (1976). See also, M.L.B. v. S.L.J. 519 U.S. 102, 126-127, 117 S. Ct. 555, 569 (1996); Gilmore v. City of Montgomery, Alabama, 417 U.S. 556, 94 S. Ct. 2416 (1974); Reitman v. Mulkey, 387 U.S. 369, 373, 87 S. Ct. 1218, 1224-25 (1967). Further, it is well established that constitutional rights are violated when “the source of power and authority” by which the rights have been lost is a government law or regulation. Railway Employees Dept. v. Hanson, 351 U.S. 225, 232, 76 S. Ct. 714, 718 (1956). Finally, constitutional violations occur where actions by private individuals are backed by the full “power” and “prestige” of the federal government. Burton v. Wilmington Parking Authority, 365 U.S. 715, 725 (1961).

The court was incorrect when it stated that the Plaintiffs, in essence, merely challenge HHS’ decision to “not compel covered entities to obtain prior consent.” Opinion at 39. In fact, Plaintiffs expressly challenged, not only the elimination of consent, but also HHS’ action in conferring federal authority on covered entities to use and disclose Plaintiffs’ identifiable health information against their will. As Plaintiffs clearly stated in the complaint and consistently throughout the litigation, HHS eliminated their constitutionally protected right to medical privacy in a two-step process by first eliminating their ability to exercise their right to privacy by giving or withholding consent, and second, by vesting covered entities with “regulatory permission” to use and disclose identifiable information against the individual’s will. Thus, the court failed to address a major portion of the Plaintiffs’ challenge.

Third, the court also erroneously denied Plaintiffs’ challenge that the Amended Privacy Rule was “arbitrary and capricious” in violation of the Administrative Procedure Act on the principal ground that HHS only had to consider recently determined “relevant factors” with respect to inefficiencies experienced by covered entities in having to obtain consent to use and disclose identifiable health information. Opinion 31-34. Thus, the court concluded that HHS could reverse its decision that strong privacy protections, including the right of consent, are essential for individuals to obtain quality health care, without considering the extensive evidence supporting that decision despite the fact that the evidence was again brought to HHS’ attention in the comments on the proposed Amended Rule. Allowing an agency to reverse its decision on a critical policy without requiring at least some explanation of why the evidence supporting the original decision is no longer valid, would seem to be the epitome of arbitrary action. Such agency action would appear to be particularly arbitrary when overwhelming public comments showed that the public felt that preservation of the right of consent was essential for quality health care and for permitting citizens to exercise their constitutional right to privacy.

The court also held that the Amended Rule was consistent with the Congressional intent behind the privacy provisions of the HIPAA statute. Opinion at 35-36. However, the court failed to cite the legislative history of the statute or the HHS’ own prior findings that the intent behind those provisions was to enhance the privacy protections under federal law in order to preserve the public’s trust in the health delivery system as the storage and transmission of health information by computer was facilitated by other provisions of HIPAA.

The court also found that the Amended Privacy Rule “is not retroactive” because it does not impair stricter privacy rights created by state law, ethical codes or standards of practice. Opinion at 37. The court thereby ignored its own prior statement that the Amended Rule provides that “health information created or obtained prior to April 14, 2024, may be used and disclosed after that date for routine purposes without prior consent.” Opinion at 17. It is undisputed that such federal authority to use and disclose health information retroactive to the compliance date of the Amended Rule had never previously existed. Thus, the rule clearly affected the rights of citizens under federal law retroactively. The court failed to address the fact that the Supreme Court has held that statutes will not be construed to include the power to make retroactive rules “unless that power is conveyed by Congress in express terms.” Bowen v. Georgetown Univ. Hospital, 488 U.S. 204, 109 S. Ct. 468 (1988).

D. Conclusion

For the above reasons, it is my opinion that Plaintiffs would have a substantial chance of success on appeal.

Back to Mental Health Issues Index