               Case: 12-12593       Date Filed: 04/09/2013       Page: 1 of 13


                                                                                  [PUBLISH]

                 IN THE UNITED STATES COURT OF APPEALS

                           FOR THE ELEVENTH CIRCUIT
                             ________________________

                                    No. 12-12593
                              ________________________

                       D. C. Docket No. 4:11-cv-00400-RS-CAS

OPIS MANAGEMENT RESOURCES LLC,
RULEME CENTER LLC,
GULF COAST HEALTHCARE LLC,
SA-PG-JACKSONVILLE LLC,
SA-PG-SUN CITY CENTER LLC, et al.,

                                                                  Plaintiffs-Appellees,

                                            versus

SECRETARY FLORIDA AGENCY FOR
HEALTH CARE ADMINISTRATION,

                                                                  Defendant-Appellant.
                              ________________________

                     Appeal from the United States District Court
                         for the Northern District of Florida
                           _________________________

                                       (April 9, 2013)

Before DUBINA, Chief Judge, BLACK and ALARCÓN, * Circuit Judges.


      *
        Honorable Arthur L. Alarcón, United States Circuit Judge for the Ninth Circuit, sitting by
designation.
              Case: 12-12593     Date Filed: 04/09/2013   Page: 2 of 13


BLACK, Circuit Judge:

      The issue before us is whether § 400.145 of the Florida Statutes—which

provides for the release of medical records of deceased residents of nursing homes

to certain specified individuals—is preempted by the federal Health Insurance

Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d to d-9,

and its implementing regulations. As it stands, § 400.145 and HIPAA cannot be

reconciled, and we agree with the district court that the Florida statute stands as an

obstacle to the accomplishment and execution of the full purposes and objectives

of HIPAA in keeping an individual’s protected health information strictly

confidential. Accordingly, we affirm.

                                 I. BACKGROUND

      The underlying facts are not in dispute. Plaintiffs-Appellees OPIS

Management Resources, LLC; Ruleme Center, LLC; Gulf Coast Healthcare, LLC;

SA-PG-Jacksonville, LLC; SA-PG-Sun City Center, LLC; Cypress Health Group,

LLC; and Consulate Health Care, LLC (collectively the Nursing Facilities or the

Facilities) are operators and managers of skilled nursing facilities in Florida. In the

course of their operations, the Nursing Facilities received requests from spouses

and attorneys-in-fact for the medical records of deceased nursing home residents.

The Facilities refused to disclose the records because the parties requesting them

were not “personal representatives” under the relevant provisions of HIPAA,


                                           2
                  Case: 12-12593        Date Filed: 04/09/2013        Page: 3 of 13


which regulates the release of protected health information by covered entities. 1

See 45 C.F.R. § 164.502.2 Consequently, the requesting parties filed complaints

with the U.S. Department of Health and Human Services Office for Civil Rights,

which concluded the Nursing Facilities’ actions were consistent with HIPAA.

       Defendant-Appellant Florida Agency for Health Care Administration (the

State Agency), however, issued citations to the Nursing Facilities for violating

Florida law by refusing to release the records. Specifically, the Facilities were

cited for violating § 400.145 of the Florida Statutes, which requires licensed

nursing homes to release a former resident’s medical records to the spouse,

guardian, surrogate, or attorney-in-fact of any such resident. See Fla. Stat.

§ 400.145(1). In written correspondence to individuals who had requested and

been denied deceased residents’ medical records, the State Agency explained that

it interprets § 400.145 in a manner allowing a spouse to qualify as a personal

representative such that a deceased spouse’s medical records may be disclosed

under HIPAA.

       Given the dueling interpretations of the relevant statutes, the Nursing

Facilities filed a complaint in the district court seeking a declaratory judgment that


       1
           The parties do not dispute that the Nursing Facilities are covered entities.
       2
        We note that various amendments to the Code of Federal Regulations relating to
HIPAA became effective March 26, 2013, while this appeal was pending. The amendments,
however, are largely immaterial to the issue before us, except for the addition of 45 C.F.R.
§ 164.510(b), which we discuss in further detail below.
                                                   3
                Case: 12-12593       Date Filed: 04/09/2013       Page: 4 of 13


§ 400.145 is preempted by HIPAA. 3 The parties then filed cross-motions for

summary judgment. In ruling on the motions, the district court found that

§ 400.145 was preempted because it impeded the accomplishment and execution of

HIPAA’s purposes and objectives. The court granted the Nursing Facilities’

motion for summary judgment, explaining that the Florida statute affords nursing

home residents less protection than is required by the federal law. This appeal

followed.

                               II. STANDARD OF REVIEW

       We review the district court’s grant of summary judgment de novo, viewing

the evidence and drawing all reasonable inferences in the light most favorable to

the nonmoving party. Fresenius Med. Care Holdings, Inc. v. Tucker, 704 F.3d

935, 939 (11th Cir. 2013).

                                      III. DISCUSSION

       The State Agency contends the district court erred in granting summary

judgment to the Nursing Facilities because § 400.145 does not impede the goals

and purposes of HIPAA. Instead, laws such as § 400.145 play a vital role in the

federal statute’s requirements, which look to state law to define the category of




       3
        In Claim Two, the Nursing Facilities also sought injunctive relief. The Facilities,
however, successfully moved to dismiss the claim following the district court’s grant of partial
summary judgment, and that claim is not before us on appeal.
                                                4
              Case: 12-12593     Date Filed: 04/09/2013   Page: 5 of 13


“personal representatives” to whom a deceased individual’s protected health

information may be disclosed.

      We begin our analysis with the bedrock principle that the Constitution

designates the laws of the United States as the supreme law of the land, requiring

that “all conflicting state provisions be without effect.” Maryland v. Louisiana,

451 U.S. 725, 746, 101 S. Ct. 2114, 2128–29 (1981); see also U.S. Const. art. VI,

cl. 2. Accordingly, where state and federal law directly conflict, “state law must

give way.” PLIVA, Inc. v. Mensing, 131 S. Ct. 2567, 2577 (2011). In addition,

“[t]here is no doubt that Congress may withdraw specified powers from the States

by enacting a statute containing an express preemption provision.” Arizona v.

United States, 132 S. Ct. 2492, 2500–01 (2012). As the Supreme Court has

explained, “[w]hen a federal law contains an express preemption clause, we focus

on the plain wording of the clause,” as the plain language of the text is “the best

evidence of Congress’ preemptive intent.” Chamber of Commerce of U.S. v.

Whiting, 131 S. Ct. 1968, 1977 (2011) (internal quotation omitted). Nevertheless,

“when the text of a pre-emption clause is susceptible of more than one plausible

reading, courts ordinarily accept the reading that disfavors pre-emption.” Altria

Grp., Inc. v. Good, 555 U.S. 70, 77, 129 S. Ct. 538, 543 (2008) (internal quotation

omitted).




                                          5
              Case: 12-12593     Date Filed: 04/09/2013   Page: 6 of 13


      In drafting HIPAA, Congress included an express preemption provision. 42

U.S.C. § 1320d-7. HIPAA’s preemption clause provides that the statute “shall

supersede any contrary provision of State law,” and lists certain exceptions that are

not at issue here. Id. § 1320d-7(a). A state law is “contrary” to HIPAA if:

      (1) A covered entity or business associate would find it impossible to
      comply with both the State and Federal requirements; or

      (2) The provision of State law stands as an obstacle to the
      accomplishment and execution of the full purposes and objectives
      of . . . section 264 of Public Law 104-191. . . .

45 C.F.R. § 160.202. HIPAA, however, does not preempt state laws that provide

“more stringent” privacy protections. See id. § 160.203(b).

      One of Congress’s objectives in enacting HIPAA was to address concerns

about the confidentiality of patients’ individually identifiable health information.

See Health Insurance Portability and Accountability Act of 1996, Pub. L. No.

104-191, § 264, 110 Stat. 1936; see also S.C. Med. Ass’n v. Thompson, 327 F.3d

346, 348, 354 (4th Cir. 2003) (“Recognizing the importance of protecting the

privacy of health information in the midst of the rapid evolution of health

information systems, Congress passed HIPAA in August 1996.”). To that end,

Congress provided for the Secretary of Health and Human Services to promulgate

privacy regulations addressing individuals’ rights to individually identifiable health

information, procedures for exercising such rights, and the uses and disclosures of

such information. Pub. L. No. 104-191, § 264(b) & (c)(1); S.C. Med. Ass’n, 327
                                          6
                Case: 12-12593       Date Filed: 04/09/2013       Page: 7 of 13


F.3d at 349. In compliance with the statute, the Department of Health and Human

Services issued final regulations known as the “Privacy Rule.” S.C. Med. Ass’n,

327 F.3d at 349; see also Citizens for Health v. Leavitt, 428 F.3d 167, 172–74 (3d

Cir. 2005) (detailing the history of the Privacy Rule’s promulgation and explaining

its requirements). The Privacy Rule establishes that “[a] covered entity or business

associate may not use or disclose protected health information,” except in certain

circumstances not at issue here, or with valid authorization. 45 C.F.R.

§§ 164.502(a), 164.508(a)(1). Among the disclosures permitted by the Privacy

Rule are disclosures to the individual whose information is being protected, as well

as disclosures to the individual’s personal representative. Id. § 164.502(a)(1)(i),

(g)(1) (“[A] covered entity must . . . treat a personal representative as the

individual for purposes of this subchapter.”).

       As of March 26, 2013, “[a] covered entity must comply with the

requirements of [the Privacy Rule] with respect to the protected health information

of a deceased individual for a period of 50 years following the death of the

individual.” Id. § 164.502(f). 4 Regarding deceased individuals, the Privacy Rule

further specifies that:

       If under applicable law an executor, administrator, or other person has
       authority to act on behalf of a deceased individual or of the
       individual’s estate, a covered entity must treat such person as a

       4
         Prior to March 26, 2013, § 164.502(f) did not contain any time limitation with respect to
the disclosure of a deceased individual’s protected health information.
                                                7
                Case: 12-12593       Date Filed: 04/09/2013   Page: 8 of 13


      personal representative under this subchapter, with respect to
      protected health information relevant to such personal representation.

Id. § 164.502(g)(4). 5 Also as of March 26, 2013, if an individual is deceased,

      a covered entity may disclose to a family member, or [other relatives,
      close personal friends of the individual, or any other persons
      identified by the individual] who were involved in the individual’s
      care or payment for health care prior to the individual’s death,
      protected health information of the individual that is relevant to such
      person’s involvement, unless doing so is inconsistent with any prior
      expressed preference of the individual that is known to the covered
      entity.

Id. § 164.510(b)(5).

      Since 1987—nearly a decade before Congress enacted HIPAA—Florida law

has required licensed nursing homes to disclose deceased residents’ medical

records to certain individuals who request them. See Fla. Stat. § 400.145; see also

1987 Fla. Sess. Law Serv. 87-302. Specifically, § 400.145 provides that:

      Unless expressly prohibited by a legally competent resident, any
      nursing home licensed pursuant to this part shall furnish to the spouse,
      guardian, surrogate, proxy, or attorney in fact . . . of a current
      resident, . . . or of a former resident, . . . a copy of that resident’s
      records which are in the possession of the facility. Such records shall
      include medical and psychiatric records and any records concerning
      the care and treatment of the resident performed by the facility, except
      progress notes and consultation report sections of a psychiatric nature.
      Copies of such records shall not be considered part of a deceased
      resident’s estate and may be made available prior to the administration
      of an estate, upon request, to the spouse, guardian, surrogate, proxy,
      or attorney in fact . . . .

Fla. Stat. § 400.145(1).

      5
          We read “applicable law” to mean state law.
                                               8
             Case: 12-12593     Date Filed: 04/09/2013   Page: 9 of 13


      The State Agency’s argument against preemption hinges on the Privacy

Rule’s mandate that any person who has authority to act on behalf of a deceased

individual under state law be treated as a personal representative. See 45 C.F.R.

§ 164.502(g)(4). This is important because an individual’s personal representative

enjoys the same broad access to protected information and freedom from the

Privacy Rule’s strictures as the individual. See 45 C.F.R. § 164.502(g)(1).

According to the State Agency, § 400.145 enumerates groups of people, including

spouses, who may access a deceased resident’s medical records “on behalf of” the

resident, meaning that they should be treated as personal representatives. Thus,

rather than conflicting with HIPAA and the Privacy Rule, § 400.145 supplements

and works in tandem with the federal law.

      The fatal flaw in the State Agency’s argument is that the plain language of

§ 400.145 does not empower or require an individual to act on behalf of a deceased

resident. The unadorned text of the state statute authorizes sweeping disclosures,

making a deceased resident’s protected health information available to a spouse or

other enumerated party upon request, without any need for authorization, for any

conceivable reason, and without regard to the authority of the individual making

the request to act in a deceased resident’s stead. See 45 C.F.R. § 164.502(g)(4)

(providing that a person authorized to act on behalf of a deceased individual must

be treated as a personal representative “with respect to protected health information


                                         9
              Case: 12-12593     Date Filed: 04/09/2013    Page: 10 of 13


relevant to such personal representation” (emphasis added)). We therefore agree

with the district court that § 400.145 frustrates the federal objective of limiting

disclosures of protected health information, and that the statute is thus preempted

by the more stringent privacy protections of HIPAA and the Privacy Rule.

      The State Agency’s contention that 45 C.F.R. § 164.510(b)(5) saves

§ 400.145 suffers from the same problem. While § 164.510(b)(5) authorizes

covered entities to release a deceased individual’s protected health information to

family members or other individuals, the regulation does not open a broad new

avenue of access to protected health information, as the State Agency contends.

Instead, § 164.510(b)(5) permits covered entities to release a deceased individual’s

protected health information in narrowly delineated circumstances. First, the

regulation applies only to two groups of people: (1) those involved in the deceased

individual’s health care, and (2) those who paid for the deceased individual’s

health care. Second, covered entities may release only protected health

information that is relevant to such person’s involvement, i.e., information that is

relevant to the care of the deceased individual or to the payment of the deceased

individual’s health care. Section 400.145, by comparison, contains no such

limitations or restrictions.

      The State Agency’s reliance on Alvista Healthcare Center, Inc. v. Miller,

686 S.E.2d 96 (Ga. 2009), is also unavailing. In Alvista, the widow of a deceased


                                          10
             Case: 12-12593      Date Filed: 04/09/2013    Page: 11 of 13


nursing home resident requested copies of her late husband’s medical records to

investigate a potential action for wrongful death. Id. at 97. After the requests were

denied, the widow sued the operator of the nursing home. Id. The Georgia

Supreme Court held that a provision of state law, O.C.G.A. § 31-33-2, authorized a

surviving spouse “to act on behalf of the decedent or his estate in obtaining

medical records and, therefore, that the surviving spouse [was] entitled to access

the decedent’s protected health information in accordance with 45 C.F.R.

§ 164.502(g)(4).” Id.

      Central to the Georgia Supreme Court’s resolution of the case was the fact

that, in 2006, the Georgia legislature specifically amended § 31-33-2 to comply

with HIPAA. See id. at 98. The legislature addressed HIPAA and the Privacy

Rule by requiring any request for medical records by an individual specified in the

statute be accompanied by an authorization that comported with HIPAA and its

implementing regulations. Id. In addition, the Georgia statute was amended to

provide a hierarchy of individuals who could submit an authorization and thus act

on behalf of a decedent or his estate, with the first priority given to an

administrator or executor, and a surviving spouse receiving authority only in the

absence of an administrator or executor. Id. Thus, it was clear that the statute

treated a surviving spouse “as a personal representative in lieu of the executor or

administrator with respect to requests for medical records.” Id. The Georgia


                                           11
               Case: 12-12593       Date Filed: 04/09/2013       Page: 12 of 13


Supreme Court emphasized that the limited personal representation created by

§ 33-31-2 did not extend to any context other than obtaining a decedent’s medical

records, and that the statute was “carefully tailored” to provide the authority

contemplated by the Privacy Rule. Id.

       Unlike the situation in Alvista, the Florida legislature has not amended or

modified § 400.145 to address the impact of HIPAA and its implementing

regulations. Section 400.145 does not require a HIPAA-compliant authorization to

accompany a request for a deceased individual’s medical records, nor can the

statute plausibly be read as creating a limited personal representation in the person

of a surviving spouse in light of the blanket disclosures that it requires. Given the

opportunity, we are confident the Florida legislature could bring § 400.145 into

compliance with federal law in any number of ways. Amending the statute,

however, is a task for the state legislature, not a panel of federal judges.

       Finally, we emphasize that we have no occasion to address the State

Agency’s argument that it is possible to comply with both HIPAA and § 400.145

because 45 C.F.R. § 164.512(a)(1) permits a covered entity to use and disclose

protected health information as “required by law.” 6 The State Agency did not

advance this argument before the district court, and we decline to consider it for


       6
         Section 164.512(a)(1) provides that “[a] covered entity may use or disclose protected
health information to the extent that such use or disclosure is required by law and the use or
disclosure complies with and is limited to the relevant requirements of such law.”
                                               12
               Case: 12-12593        Date Filed: 04/09/2013       Page: 13 of 13


the first time on appeal. See, e.g., Access Now, Inc. v. Sw. Airlines, Co., 385 F.3d

1324, 1331 (11th Cir. 2004) (“This Court has repeatedly held that an issue not

raised in the district court and raised for the first time in an appeal will not be

considered by this [C]ourt.” (quotations omitted)).7 Thus, nothing that we have

said should be inferred as expressing an opinion regarding the “required by law”

provision.

                                     IV. CONCLUSION

       For the foregoing reasons, we agree with the district court that § 400.145 of

the Florida Statutes impedes the accomplishment and execution of the full

purposes and objectives of HIPAA and the Privacy Rule in keeping an individual’s

protected health information confidential. Accordingly, the district court’s grant of

summary judgment is AFFIRMED.




       7
          Although the State Agency cited § 164.512 in its motion for summary judgment, it did
so in support of its argument that § 400.145 is more stringent than the Privacy Rule. The State
Agency did not raise the argument it presents on appeal, i.e., that § 164.512 provides a separate,
independent means of harmonizing federal and state law. Accordingly, the specific argument
advanced on appeal was not sufficiently raised before the district court and we will not address
it. See Bryant v. Jones, 575 F.3d 1281, 1308 (11th Cir. 2009) (“It is well established in this
circuit that, absent extraordinary circumstances, legal theories and arguments not raised squarely
before the district court cannot be broached for the first time on appeal.”).
                                                13
