Kyle Faget and Aaron Maguregui Unpack Conflict Between Federal and State Health Care Privacy Laws

Foley & Lardner LLP partners Kyle Faget and Aaron Maguregui offered perspective on a looming conflict between state and federal health care privacy laws in the Inside Health Policy article, “DOJ’s Gender-Affirming Care Subpoena to Children’s Hospital Triggers Privacy Battle.”

“The Trump administration is likely using a mishmash of law enforcement carve outs within the Health Insurance Portability and Accountability Act to request the gender-affirming care information, including for purposes of preventing or controlling disease, injury, or disability, which is fairly broad,” Maguregui said of the U.S. Department of Justice’s subpoena to Children’s Hospital of Philadelphia (CHOP). He noted that a similar request issued by the Centers for Medicare & Medicaid Services was likely categorized as a health oversight activity, allowing a health agency to oversee certain activities authorized by law.

Maguregui added that while HIPAA sets a national floor for personal health data protections, more stringent privacy laws have been implemented at the state level. If a state has specific protections for certain types of health information, providers and hospitals are unable to turn that data over even if a subpoena is issued, he continued.

“CHOP is trying to argue that the Third Circuit’s 1980 Westinghouse decision that addressed a different type of administrative subpoena should apply to review of HIPAA subpoenas in order to ensure that ‘the privacy interests of patients whose records are subject to an administrative subpoena are appropriately considered and balanced against the requesting agency’s need for information,’” Faget observed, noting that the hospital contends that patient privacy interests outweigh the agency’s need for personal health information as the government has not presented evidence that suggests consumer protection violations or other misconduct at the hospital.

Assessing DOJ’s response that Westinghouse likely does not apply in this instance because HIPAA was enacted years later and it does expressly authorize the agency to seek personal health information, Faget said, “There are some limits to DOJ’s authority to issue HIPAA subpoenas, but those limits probably are broader than what CHOP seeks here.”

(Subscription required)