Seeking Clarity on Medical Privacy in Fla. Class Actions

Just a few examples could be: dunning letters to patients, which could be alleged to violate the Florida Consumer Collection Practices Act; telephone calls inviting patients to a seminar, which could be alleged to be a violation of the Telephone Consumer Protection Act; or a case arising from a data breach alleging that patients' information was exposed on the dark web.

As part of standard class action discovery, the named plaintiff in these types of cases will serve discovery requests and potential third-party subpoenas seeking the names and contact information of the other individuals in the putative class.

As an example, here is a typical discovery request directed to a defendant in a TCPA class action involving text messages sent to patients of a medical practice inviting them to a seminar: "Please produce a list of all the target names, telephone numbers, and any contact information of the individuals who were sent the same text message that the Plaintiff was sent."

Class actions over any subject involving medical practices typically have similar requests, as the named plaintiff and their counsel will want to know the names of the other people in the class. But when the class action involves a medical practice, hospital or other medical provider, both the federal Health Insurance Portability and Accountability Act and Florida's constitutional right to privacy are implicated.

HIPAA prohibits health care providers from disclosing to third parties any patient health information that could lead to the identification of the patient without the patient's express consent or a qualified protective order.

The act does allow disclosure of "protected health information in the course of any judicial or administrative proceeding ... [i]n response to an order of a court" without notice to a patient or a patient's express authorization.[1] State and federal trial courts in Florida do indeed enter such "qualified protective orders" upon request by the parties.[2]

So how does HIPAA impact a discovery request in a class action in which medical records may be at issue? It means that absent affirmative consent from the patients, a qualified protective order is necessary. And that is how the issue is routinely handled.

But that is not the end of the story in Florida — and the paucity of case law on the matter suggests that this issue has not received sufficient attention.

This is because Florida law provides stronger constitutional and statutory protections for citizens' medical information, including requiring patient notification upon issuance of a subpoena seeking disclosure of that patient's medical information. And both the state and federal courts in Florida are in accord that HIPAA does not preempt such heightened protections.[3]

As the Florida Supreme Court has repeatedly held — most recently in 2017 in Weaver v. Myers — the Florida Constitution "explicitly provides [its citizens] a right to privacy."[4] In Weaver, the Florida Supreme Court recognized that this right "is broader, more fundamental, and more highly guarded than any federal counterpart."[5]

The court stated that "[a] patient's medical records enjoy a confidential status by virtue of the right to privacy contained in the Florida Constitution."[6] The court also warned that "[t]he potential for invasion of privacy is inherent in the litigation process."[7] Likewise, in Estate of Carrillo v. Federal Deposit Insurance Corporation in 2012, and Hansen v. Uber Technologies Inc. in 2018, the U.S. District Court for the Southern District of Florida and the U.S. District Court for the Middle District of Florida, respectively, have recognized that "Florida law recognizes the confidentiality of a patient's medical record pursuant to the Right of Privacy clause, contained in Article I, Section 23 of the Florida Constitution."[8]

Florida Statutes Section 456.057, implementing Florida's broad constitutional right to privacy, "unequivocally creates 'a broad and express privilege of confidentiality as to the medical records and the medical condition of a patient,'" as stated by Florida's Second District Court of Appeal in Crowley v. Lamming.[9] Except as otherwise provided, Section 456.057 states that a patient's medical records:

may not be furnished to, and the medical condition of the patient may not be discussed with, any person other than the patient or the patient's legal representative or other health care practitioners and providers involved in the care or treatment of the patient, except upon written authorization of the patient.[10]

According to the statute, however, such records may "be furnished without written authorization ... [i]n any civil or criminal action, unless otherwise prohibited by law, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice to the patient or the patient's legal representative by the party seeking such records."[11]

You may be wondering what the protections for "medical records" have to do with the names and contact information of potential members of a putative class. The answer to that question lies in a 2020 decision issued by Florida's First District Court of Appeal in Saints120 LLC v. Moore, in which the appellate court quashed a discovery order compelling the production of documents reflecting the names, addresses and next of kin of nursing home residents who were present in the same unit as the decedent.[12]

In relevant part, the appellate court held that nonparty residents were entitled to notice under Section 456.057(7)(a)(3) before any release of their medical records, and that "giving notice to those residents before releasing their medical records is paramount to protecting their privacy interests."

In other words, the mere fact of being a patient at the medical facility was itself a medical record, as the court noted that "the principal priority is to protect the non-party patients' identities." At least one court has followed Saints120 to preclude the discovery of similar information.[13]

Getting back to class action discovery, the Saints120 definition of a "medical record" covered by Section 456.057 may indeed render class treatment more difficult. Keep in mind that in Saints120, the error the appellate court identified was that the trial court failed to require predisclosure notice to the impacted patients.

While the opinion doesn't indicate how many patients were affected, one would imagine that it would be a few to, at most, a few dozen people. That is not an intractable burden.[14]

Notwithstanding the clear language in Saints120, many courts continue to order the disclosure of nonparty medical records if a HIPAA order is in place. A recent example is an order issued in February by Judge Brian Davis of the U.S. District Court for the Middle District of Florida, in McCrimmion v. Centurion of Florida LLC.[15]

In McCrimmion, the estate of an inmate who died while at a Florida correctional facility is suing the facility for claims arising out of medical care the decedent inmate allegedly received or needed when he was an inmate at that correctional facility.

The plaintiff there served an interrogatory asking the defendant to identify every Clostridium difficile[16] case at the correctional facility during a specified time frame, "along with inmate names, information about diagnosis and treatment, and medical personnel involved," and to produce the "medical records of those inmates identified in response to the interrogatory."

The defendant objected to producing this information for several reasons, including HIPAA.[17] However, the court rejected that argument, "given the parties are bound by a HIPAA qualified protective order."[18]

The problem is — as is often the case — that the HIPAA qualified protective order[19] does not say anything about Section 456.057. It also appears that the defendant did not raise an objection under Section 456.057, and only cited HIPAA to support a medical objection.[20]

One piece of good news is that litigants and courts are not without a road map for how to navigate privacy statutes that require notice to nonparties before their information will be released. Specifically, in Lee v. Global Tel*Link Corp. in 2018,[21] Judge Otis Wright of the U.S. District Court for the Central District of California had to work through a state statute that required nonparty telephone subscribers to be provided notice, and an opportunity to be heard, before their information would be released pursuant to a subpoena.

The court dealt with the requirements of that statute by ordering a process wherein a third-party administrator would send notice to the subscribers advising them that their personal information was being requested, and providing them with an opportunity to object. The path in Lee was similar to one used in other cases, including a case from a federal district court in Pennsylvania.[22]

In any event, the right to privacy under the Florida Constitution and Florida Statutes Section 456.057 is an important right that this author — and the more than 21 million other Florida citizens — enjoys. There is no shortage of class actions and other litigation against medical service providers in Florida, so it will be helpful if this issue starts to get raised in these cases, and litigants can benefit from reasoned decisions on the issue.

Reprinted with permission from Law360.

[1] See 45 C.F.R. § 164.512(e)(1)(i).

[2] See, e.g., Rudolph v. Correct Care Sols. LLC , No. 5:15-cv-00317, 2016 WL 4157367, at *1 (N.D. Fla. July 29, 2016) (Hinkle, J.); Crosswinds Rehab Inc. v. Am. Eldercare Inc., No. 2017-CA-023840, 2018 WL 7626055, at *1 (Fla. 11th Cir. Ct. April 19, 2018) (Thomas, J.).

[3] Paylan v. Fitzgerald , 223 So. 3d 431, 434 (Fla. 2d DCA 2017) ("HIPAA only preempts state laws relating to substantive privacy rights concerning individually identifiable health information which are less stringent than HIPAA's privacy protections"); Murphy v. Dulay , 768 F.3d 1360, 1368–77 (11th Cir. 2014) (holding that an authorization form required by Florida statute for use in advance of a medical negligence suit was not preempted by HIPAA).

[4] Weaver v. Myers, 229 So. 3d 1118, 1125 (Fla. 2017) ("Every natural person has the right to be let alone and free from governmental intrusion into the person's private life except as otherwise provided herein" (citing Fla. Const. Art. I, § 23)).

[5] Id. at 1125.

[6] Id. at 1126 (citing State v. Johnson, 814 So. 2d 390, 393 (Fla. 2002)).

[7] Id.

[8] Estate of Carrillo v. FDIC , No. 1:11-cv-22668, 2012 WL 1831596, at *3 (S.D. Fla. May 18, 2012) (Simonton, M.J.); Hansen v. Uber Techs. Inc. , No. 6:17-cv-01559, 2018 WL 7361084, at *2 (M.D. Fla. Aug. 13, 2018) (Kelly, M.J.) (same).

[9] Crowley v. Lamming , 66 So. 3d 355, 358 (Fla. 2d DCA 2011) (citing Acosta v. Richter , 671 So. 2d 149, 154 (Fla. 1996)).

[10] Fla. Stat. § 456.057(7)(a).

[11] Fla. Stat. § 456.057(7)(a)(3) (emphasis added); see also Graham v. Dacheikh , 991 So. 2d 932, 937 (Fla. 2d DCA 2008) (holding that, in a negligence action, the trial court departed from the essential requirements of the law by compelling a physician who examined the plaintiff to disclose reports from prior examinations of other personal injury plaintiffs without notice to such nonparties); Carrillo, 2012 WL 1831596 at *3 (noting that Florida Statutes Section 456.057 "restricts the disclosure of medical records without a patient's written authorization" or at least a demonstration that the patient's "received sufficient notice of the … intent to subpoena the[ir] [medical] records"); Wollschlaeger v. Governor, Fla. , 848 F.3d 1293, 1314 (11th Cir. 2017) ("Florida law … places significant limits on the disclosure of a patient's confidential medical records" (citing Fla. Stat. §456.057(7)(a))).

[12] 292 So. 3d 1209(Fla.1stDCA2020).

[13] See Durrah v. Bowling Green Inn of Pensacola LLC , No. 3:20-cv-05234, 2020 WL 8910886, at *6 (N.D. Fla. June 10, 2020) (Timothy, M.J.) (evaluating a discovery request for names and contact information of patients of a medical facility who may have witnessed an incident at the center of the case, and concluding that the individuals sought medical treatment "presumably with the knowledge they were doing so in confidence," and that their identities were protected from disclosure under the applicable Florida law).

[14] The decision in Reyes v. BCA Financial Services Inc., No. 1:16-cv-24077, 2018 WL 5004864 (S.D. Fla. Oct. 15, 2018) (Goodman, M.J.), does merit discussion. Reyes was a TCPA case involving debt collection calls to the patients of a medical practice. The defendant argued that Section 456.057 prevented an obstacle to class certification, because the plaintiff's expert would have to provide the class members' protected health information to various third parties. The court rejected this argument, noting that the "stipulated protective order that the parties agreed to in this case, however, specifically provides that the parties and their attorneys shall be permitted to use or disclose the confidential information for purposes of prosecuting or defending this action, including any appeals of this case. This includes, but is not necessarily limited to,identification of potential class members and disclosure to attorneys, experts, consultants, court personnel, court reporters, copy services, trial consultants, and other entities or persons involved in the litigation process.
Id. at *6. Thus, while not explicitly stated, Reyes can be said to have been decided on the basis of waiver (i.e., the knowing decision to give up a potential argument), as opposed to examination of counters of Section 456.057 on its merits.

[15] No. 3:20-cv-00036, 2022 WL 356160, at *7 (M.D. Fla. Feb. 7, 2022) (Davis, J.).

[16] The inmate at issued allegedly "died from pseudo membranous colitis, caused by an infection called Clostridium difficile." Id. at *1.

[17] Id. at *8.

[18] Id.

[19] McCrimmion v. Centurion of Fla. LLC ., No. 3:20-cv-0036, 2020 WL 13032624, at *1 (M.D. Fla. Sept. 21, 2020) (Klindt, M.J.).

[20] McCrimmion v. Centurion of Fla. LLC., No. 3:20-cv-0036, ECF No. 176 (M.D. Fla. Nov. 24, 2021).

[21] Lee v. Global Tel*Link Corp., 2:15-cv-02495, 2018 WL 11008970 (C.D. Cal. Jan. 16, 2018) (Wright, J.).

[22] See, e.g., Kelly v. Verizon Pa. LLC , 2017 WL 11549625 (E.D. Pa. Aug. 8, 2017) (Goldberg, J.) (requiring the party seeking records protected by a state statute, to bear the "full cost" of a third-party administrator necessary to provide notice to the impacted customers).