Court Upholds HIPAA over Florida Law

It is always interesting when a state law conflicts with a federal law. Which law does one follow? Nursing homes in Florida found themselves in this very predicament when the Florida law regarding disclosure of patient records conflicted with the privacy law of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). A few nursing homes were penalized after refusing to disclose patient records due to restrictions imposed by the HIPAA rules and sought the court’s help for clarification on what law to abide by.

Under Florida state law nursing homes are required to disclose deceased patient medical records to a spouse, guardian, surrogate, proxy, or attorney in fact. While the HIPPA privacy rule does permit a nursing home to disclose a deceased individual’s protected health information (PHI), there is a Final Omnibus Rule that states a covered entity (nursing home) is only allowed to do so if the PHI is relevant to the person’s involvement and not inconsistent with an expressed preference of the deceased patient.

In layman terms, if Joe’s daughter passed away than under Florida Law he could obtain her protected health information but if the daughter expressed preference that only her husband have access to her PHI, than her father Joe would not be able to obtain her PHI under the HIPAA Final Omnibus rule.

The court ruled that Florida law “impedes the accomplishment and execution of the full purposes and objectives of HIPAA and the Privacy Rule in keeping an individual’s protected health information confidential”. The court further suggested that the Florida law be amended to comply with HIPAA privacy rules as currently the law is too broad and lets anyone without a need for authorization to obtain confidential medical information on a deceased individual.