Citation[]
South Carolina Med. Ass'n v. Thompson, 327 F.3d 346 (4th Cir. 2003) (full-text).
Factual Background[]
Appellants, South Carolina Medical Association filed suit seeking to have declared unconstitutional several provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Appellants sought declaratory relief from HIPAA provisions but the suit was dismissed by the district court.
Appellate Court Proceedings[]
Appellants appealed arguing (1) HIPPA violates the non-delegation doctrine by authorizing the Department of Health and Human Services ("HHS") to promulgate the regulations at issue in absence of an intelligible principle from Congress; (2) the Privacy Rule exceeds the scope of authority granted to HHS under HIPAA; and (3) HIPPA's non-preemption of "more stringent" state privacy laws is unconstitutionally vague.
Sections 261 thru 264 of HIPPA were designed to improve the efficiency and effectiveness of the health care systems by facilitating the exchange of information with respect to financial and administrative transactions carried out by health plans, health care clearinghouses, ad health care providers who transmit information in connection with such transactions.
In a delegation challenge, the constitutional question is whether the statute has delegated legislative power to an agency of the executive branch. The doctrine is "rooted in the principle of separation of powers that underlies our tripartite system of government." Congress cannot delegate its legislative power to another branch.
In determining what Congress may do in seeking assistance from another branch, the extent and character of that assistance must be fixed according to common sense and the inherent necessities of the governmental coordination. Where Congress lays down by legislative act an intelligible principle to which the person or body authorized to exercise the assigned duty is directed to conform, such legislative reaction is not a forbidden delegation of legislative power.
Delegation of legislative power will found constitutionally sufficient if Congress clearly delineates the general policy, the public agency which is to apply it, and boundaries of this delegated authority. The government does not bear an onerous burden in demonstrating the existence of an intelligible principle; Congress has been able to delegate authority under "broad standards."
The language of the statute mandates that HHS implement regulations addressing three particular subjects: (1) the right that an individual who is a subject of individually identifiable health information should have; (2) the procedures that should be established for the exercise of such rights; and (3) the uses and disclosures of such information that should be authorized or required.
The general purpose of HIPPA is to improve the Medicare program by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information.
The procedures outlined by Congress establish a more explicit oversight mechanism than usually accompanies a rulemaking mandate imposed upon an agency. Congress always reserves the right to engage in lawmaking. Congress did not unconstitutionally relinquish its lawmaking function by mandating that final regulations governing standards with respect to privacy of individually identifiable health information be promulgated within 36 months of enactment of HIPAA if no further legislation on the subject were enacted.[1]
If legislation governing standards with respect to the privacy of individually identifiable health information transmitted in connection with the transaction described in section 1173(a) of the Social Security Act is not enacted, the Secretary of HHS shall promulgate final regulations containing such standards. Regulations promulgated by Department of Health and Human Services (HHS) pursuant to the Health Insurance Portability and Accountability Act (HIPAA) did not impermissibly regulate non-electronic forms of medical information. "Health information" includes any information "whether oral or recorded in any form or medium." HHS could reasonably determine that the regulation of individually identifiable health information should include non-electronic forms of that information. Section 1173(a) directs HHS to develop "standards for transactions, and data elements for such transactions, to enable health information to be exchanged electronically."
The validity of regulation promulgated by agency pursuant to congressional mandate is to be sustained so long as it is reasonably related to purposes of enabling legislation under which it was promulgated. If coverage were limited to electronic data, there would be perverse incentives for entities covered by the rule to avoid the computerization and portability of any medical records.
It is a basic principle of due process that an enactment is void for vagueness if its prohibitions are not clearly defined. A state law is "more stringent" than HIPAA if it "provides greater privacy protection for the individual who is the subject of the individually identifiable health information." A state law is "more stringent" where it meets one or more of the following criteria: the state law prohibits or restricts a use or disclosure of information where HIPAA would allow it; state law provides an individual with "greater rights of access or amendment" to his medical information than provided under HIPPA; state law provides for the retention or reporting of more detailed information or for a longer duration; or the state law "provides greater privacy protection for the individual who is the subject of the individually identifiable health information."
Ripeness depends on fitness of issues for judicial decision and hardship to parties of withholding court consideration. Challenge to sections of HIPAA providing for preemption of state laws unless they were "more stringent" than HIPAA was ripe, considering fitness of issues for judicial decision and hardship to parties of withholding court consideration.[2]