On October 31 the U.S. Court of Appeals for the Third Circuit held that the federal medical privacy rule does not violate federal constitutional rights because it only permits, but does not require, the sharing of health information without patient consent. However, the ruling affirmed that states can pass tougher privacy laws.

The Court of Appeals in Citizens for Health v. Leavitt affirmed the trial court’s earlier conclusion that the rule is constitutional because “(1) neither the First Amendment nor the Fifth Amendment places an affirmative obligation on the State to protect individuals’ rights from harm by [private] third parties and (2) the Amended Rule is wholly permissive as to whether covered entities seek consent from an individual before using or disclosing personal health information for routine uses....”  As the Court of Appeals explained, although the right to medical privacy is legally cognizable under the U.S. Constitution, the boundaries of that right have not been delineated and, further, that any violation must be “ascribed to the government” rather than “the hands of private entities.”

Besides finding that the rule permits but does not compel disclosures without a patient’s consent, the Court of Appeals based its affirmance on two other important legal interpretations: (1) patients have a right to request restrictions on uses and disclosures of their health information, although doctors and other covered entities do not have to comply [thus the rule does not guarantee patients true confidentiality] and (2) the rule does not preempt more stringent state privacy laws.

Citizens for Health filed its lawsuit in April 2003 and after a hearing in December 2003, the District Court ruled in favor of the secretary of the U.S. Department of Health and Human Services (HHS).  Following that decision, an appeal was filed in the U.S. Court of Appeals for the Third Circuit and a hearing was held last March.

Court Claims Lawsuit Did Not Challenge Specific Disclosures by HHS or Federal Health Plans