The South Carolina Medical Association last week filed a federal lawsuit challenging HHS' constitutional authority to develop and require sweeping restrictions on the use of patients' medical details in healthcare settings.
The association's lawsuit charges that Congress illegally delegated lawmaking authority to an executive branch agency. "The Constitution does not allow the executive branch to make law," said William Mahon, the medical group's chief executive officer.
Furthermore, even if courts were to uphold the delegation of authority as constitutional, HHS went beyond the law's intent to protect individuals' privacy from inappropriate disclosure of information in electronic form, Mahon said. "All they have is this one section that says, `If we (in Congress) don't do it, you do it.' And they went overboard," he said.
The resulting 1,500 pages of regulations will force physicians to radically change the way they practice, often when they haven't had problems ensuring patient privacy, he said.
The lawsuit is the first court challenge of final regulations on the privacy of patients' medical information issued last December under the Health Insurance Portability and Accountability Act of 1996, an HHS spokesman said. He declined further comment. The Louisiana State Medical Society also joined the complaint, which was filed on July 16 in U.S. District Court in Columbia, S.C. Besides arguing that HHS overstepped its authority, the complaint challenged a provision that permits more-stringent elements of state privacy laws to pre-empt HIPAA's restrictions. That violates constitutional rights to due process of law, Mahon said. The complexity of determining which of many state provisions prevail-under threat of fines and other sanctions for a wrong decision-makes it impossible for doctors to know in advance what conduct is prohibited, the lawsuit charged.
The South Carolina association said in a statement that it "vigorously supports the protection of privacy" but that the regulations "represent a classic case of a cure that is worse than the disease."
If successful in striking down the privacy section, "We would have it put back in the congressional arena," said J. Capers Hiott, M.D., president of the medical association. "That way we can at least have some meaningful communications with the elected officials and some input."
Hiott is one of six practicing physicians who joined the lawsuit charging that HHS' actions amount to an illegal and unjustifiable burden. By nullifying the actions of HHS and regaining the ear of elected representatives, physicians "could get this toned down a little," he said.
But legal observers warn that the bid to overturn congressional will is a long and daunting task, both legally and politically.
"Judges are not enthusiastic about exercising the right to declare an act of Congress unconstitutional," said Richard Marks, a lawyer with Davis Wright Tremaine in Washington. A body of law going back to the New Deal of the 1930s is designed to protect the constitutionality of legislation, and "courts avoid confrontation with legislators to the highest possible extent," Marks said.
Marks argued successfully in 1978 to overturn a section of the Communications Act on behalf of a coalition of public broadcasting station owners. But it took nearly three years and two trips to the U.S. Court of Appeals in Washington to do it.
What's more, the doctors' objective of sending the privacy issue back to Congress makes sense only if lawmakers have changed their minds about taking on the issue itself instead of letting HHS handle it, said Mark Lutes, a lawyer with Epstein, Becker and Green in Washington. As he reads it, Congress remains serious about protecting privacy but also "quite happy being able to hand it off" to a rulemaking agency.
Congressional concern over privacy in 1996 arose from other HIPAA provisions standardizing electronic transactions. Those standards would facilitate transfer of patient data but also increase at least the perceived ease of inappropriate disclosure. Congress gave itself 36 months from the passage of the law-until August 1999-to come up with privacy legislation, after which HHS inherited the authority to propose and implement regulations.
"If (Congress) wanted the burden, it had plenty of chances to take it. But it didn't," Lutes said. Even if a court were to take HHS to task for misreading some aspect of the congressional will when taking the handoff, Congress would be "more likely to perfect the handoff" than to take back the responsibility, he said.