16 November 2017
The Florida Supreme Court ruled, on 9 November 2017, in Emma Gayle Weaver, etc. v. Stephen C. Myers, M.D., et al., that the right to privacy under Florida’s Constitution does not end upon an individual’s death (‘the Ruling’). The Ruling concerned a medical malpractice claim brought by Weaver as an individual and as personal representative of the estate of her late husband. In particular, Weaver challenged the constitutionality of the 2013 amendments (‘the Amendments’) to Sections 766.106 and 766.1065 of the Florida Statutes, which relate to disclosures that should be made as part of medical negligence actions, on the basis that these violated the right to privacy under Florida’s Constitution. The Florida Statutes and the Amendments required Weaver to authorise the release of her husband’s protected health information (‘PHI’), which she alleged was irrelevant to the case, as well as to consent to secret, ex parte interviews between the health providers and the defendant or his legal representatives, in order to proceed with the medical negligence action.
Elizabeth G. Litten, Partner and HIPAA Privacy & Security Officer at Fox Rothschild LLP, told DataGuidance, “In general, I think the Court got it right in this decision […] [The Ruling] is completely compatible with the Health Insurance Portability and Accountability Act 1996 (‘HIPAA’) regulations, which provide that a covered entity (and its business associates) must comply with HIPAA’s privacy protections with respect to the PHI of a deceased individual for a period of 50 years following the death. Although HIPAA is a legal framework that vests privacy and security obligations with those that create, receive, maintain or transmit PHI, rather than creating a general right to privacy of individually identifiable health information inherent to the individual, Americans are familiar with the idea that PHI is uniquely protected under HIPAA and that this protection doesn’t disappear when one dies.”
Americans are familiar with the idea that PHI is uniquely protected under HIPAA and that this protection doesn’t disappear when one dies
The Supreme Court noted that the Amendments compelled Weaver to disclose his medical and other information up to two years prior to the alleged act of medical negligence as a condition to filing a malpractice claim, regardless of its relevance to the claim. In relation to the secret, ex parte interviews allowed under the Amendments, the Supreme Court noted that these involve unsupervised interviews without the presence of the claimant or the representative, potentially exposing irrelevant, private, constitutionally protected information, which would be nearly impossible to address in light of its secrecy, and that these are not the least intrusive means for gathering otherwise discoverable information.
Litten said, “What really interests me about the Ruling is the Court’s focus on the ex parte interview process and other informal discovery tools which interfere with the deceased person’s constitutional right to privacy. HIPAA’s judicial and administrative proceedings disclosure rule contains limits on when and what PHI can be disclosed, and under what conditions, and specifically allows these disclosures in the context of judicial or administrative proceedings that include notice to the affected individual. The HIPAA regulations do not permit disclosure in an ex parte context, which, by definition, is one-sided.”
The Supreme Court concluded that the Amendments are unconstitutional since they impermissibly intruded on the fundamental and explicit constitutional right to privacy, noting that the possibility that a person’s extremely sensitive private medical information will be exposed is the type of intrusion that the Florida Constitution protects against, and that the consequences of disclosure to nonparties could not be ignored. The Supreme Court therefore ruled that the unconstitutional language from the Amendments should be struck, quashed the prior decision, and remanded the case for further proceedings.
Pascale Arguinarena | Privacy Analyst