W. Va. Dept. of Health and Human Resources/Behavioral Health v. E.H.

No. 14-0965 - West Virginia Department of Health and Human Resources, Bureau for Behavioral Health and Health Facilities v. E.H., et al.

FILED October 22, 2015 RORY L. PERRY II, CLERK Davis, Justice, dissenting: SUPREME COURT OF APPEALS OF WEST VIRGINIA

In this proceeding, Legal Aid sought to force DHHR to continue to allow Legal Aid to have complete access to patient records, without patient consent, at the Bateman and Sharpe psychiatric facilities. Before this Court, DHHR argued that it was violating federal law, specifically HIPAA, when it previously authorized Legal Aid to have complete access to patient records without the consent of the patients. The circuit court and majority opinion disagreed with DHHR. The circuit court found that Legal Aid did not need patient consent to have unfettered access to patient records, because Legal Aid came under the following exceptions recognized by HIPAA: business associate, health oversight agency, health care operations, and legal requirement. The majority opinion correctly found that not one of the exceptions relied upon by the trial court applied to Legal Aid. Rather than stopping there and reversing the circuit court’s order, the majority opinion affirmed the circuit court on a different ground. With absolutely no legal analysis, the majority opinion determined that Legal Aid could have unfettered access to patient information because of the “more stringent” State law exception found under HIPAA.

As I will demonstrate below, if the majority opinion had performed but a *2 scintilla of the legal analysis that is required to determine whether a State law is more stringent than HIPAA, it would have reversed the circuit court’s order. Consequently, for the reasons set out below, I dissent.

The Majority Decision Authorizes Legal Aid to Violate Federal Law

Because of the arrogant and complete disregard of federal law by the majority opinion, I must start my dissent with a review of some basic legal principles. To begin, it has been noted that “[t]he preemption doctrine has its origin in the Supremacy Clause of the United States Constitution[.]” Hartley Marine Corp. v. Mierke, 196 W. Va. 669, 673, 474 S.E.2d 599, 603 (1996). See also Harrison v. Skyline Corp., 224 W. Va. 505, 510, 686 S.E.2d 735, 740 (2009) (“[T]he preemption doctrine has its roots in the supremacy clause of the United States Constitution and is based on the premise that federal law can supplant inconsistent state law.”). The Supremacy Clause of the federal constitution provides that the laws of the United States “shall be the supreme law of the Land; . . . anything in the Constitution or laws of any state to the Contrary notwithstanding.” U.S. Const. Art. VI, Cl. 2. We have recognized that “[t]he Supremacy Clause of the United States Constitution, Article VI, Clause 2, invalidates state laws that interfere with or are contrary to federal law.” Syl. pt. 1, Cutright v. Metropolitan Life Ins. Co., 201 W. Va. 50, 491 S.E.2d 308 (1997). Pursuant to the Supremacy Clause, federal preemption of state law occurs if: (1) Congress expressly preempts state law; (2) Congress has completely supplanted state law in that field; (3) adhering to both state and federal law is not possible; or (4) state law impedes the *3 achievement of the objectives of Congress. See Crosby v. Nat’l Foreign Trade Council, 530 U.S. 363, 372, 120 S. Ct. 2288, 2293-94, 147 L. Ed. 2d 352 (2000). “Although Congressional intent is commonly the starting point for federal preemption analysis, the existence of an express preemption provision in a statute nullifies the need for further analysis.” Wade v. Vabnick-Wener, 922 F. Supp. 2d 679, 686 (internal citations omitted). See also Syl. pt. 4, Morgan v. Ford Motor Co., 224 W. Va. 62, 680 S.E.2d 77 (2009) (“When it is argued that a state law is preempted by a federal law, the focus of analysis is upon congressional intent. Preemption is compelled whether Congress’ command is explicitly stated in the statute’s language or implicitly contained in its structure and purpose.”). HIPAA sets out an express preemption provision; therefore, no further analysis is necessary to discern Congressional intent. See Cipollone v. Liggett Grp., Inc., 505 U.S. 504, 517, 112 S. Ct. 2608, 2618, 120 L. Ed. 2d 407 (1992) (“When Congress has considered the issue of pre-emption and has included in the enacted legislation a provision explicitly addressing that issue, and when that provision provides a reliable indicium of congressional intent with respect to state authority, there is no need to infer congressional intent to pre-empt state laws from the substantive provisions of the legislation. . . . Therefore, we need only identify the domain expressly pre-empted by each of those sections.” (internal quotations and citations omitted)).

Congress enacted HIPAA in 1996, in part, to protect the privacy of individually identifiable health information. See Jennifer Guthrie, “Time Is Running Out–The Burdens *4 and Challenges of HIPAA Compliance: A Look at Preemption Analysis, the ‘Minimum Necessary’ Standard, and the Notice of Privacy Practices,” 12 Annals Health L. 143, 146 (2003) (“The main premise of HIPAA is to protect individually identifiable health information. This means that certain information will not be revealed without a patient’s express authorization, in an effort to contain important information to as few people as possible.”). For purposes of HIPAA, protected health information “is any health information, oral or recorded, that is individually identifiable and transmitted or maintained by a covered entity in any form or medium.” Holman v. Rasak, 486 Mich. 429, 435-36, 785 N.W.2d 98, 102 (2010). The Secretary of Health and Human Services was directed by Congress to promulgate regulations setting privacy standards for health information. See Northwestern Mem’l Hosp. v. Ashcroft, 362 F.3d 923, 924 (7th Cir. 2004) (“Section 264 of HIPAA, 42 U.S.C. § 1320d . . . , directs the Secretary of Health and Human Services to promulgate regulations to protect the privacy of medical records[.]”).1 In 2000, the Secretary responded by issuing the Standards for Privacy of Individually Identifiable Health Information, known as the “Privacy Rule” and codified at 45 C.F.R. 160, 164. See Smith v. Am. Home Prods. Corp. Wyeth-Ayerst Pharm., 372 N.J. Super. 105, 111 n.2, 855 A.2d 608, 612 n.2 (2003) (“On December 28, 2000, pursuant to a mandate under the ‘administrative simplification’ provisions of HIPAA, the Department of Health and Human Services issued

1 Actually, “HIPAA mandated the passage of comprehensive privacy legislation by Congress within three years, otherwise the Department of Health and Human Services was required to step in and create privacy regulations.” Guthrie, “Time Is Running Out,” 12 Annals Health L. at 144.

new standards for privacy of individually identifiable health information (IIHI) called ‘The Final Privacy Rule’ as published in the Federal Register.”).2 Compliance with the Privacy Rule was not required until 2003.3 See United States v. Sutherland, 143 F. Supp. 2d 609, 612 (W.D. Va. 2001) (“Although the Standards were effective April 14, 2001, compliance is not required until April 14, 2003.”). Specific to the case at hand, the Secretary promulgated a federal regulation on HIPAA’s preemptive effect. See Morgan v. Ford Motor Co., 224 W. Va. 62, 70, 680 S.E.2d 77, 85 (2009) (“[T]he U.S. Supreme Court has recognized that an agency regulation with the force of law can explicitly or implicitly preempt conflicting state regulations.”). This regulation states that “[a] standard,

2 It is important that I point out the significance of the year in which HIPAA was created, 1996, and the date the Privacy Rule was created, 2000, because this will help explain the initial broad authority DHHR gave to Legal Aid. When the litigation originally began in this case, 1981, HIPAA did not exist–no expansive patient privacy rights existed. It was in 1990, pre-HIPAA, that DHHR first contracted to have Legal Aid monitor patient health care services at Bateman and Sharpe. It was only after the creation of HIPAA that DHHR realized that, in order for Legal Aid to continue to have access to patient records without patient consent, Legal Aid had to come under an exception to HIPAA. It appears that, initially, DHHR believed that Legal Aid came under the “business associate” exception created by the Privacy Rule. The majority opinion acknowledged this fact in footnote 28. However, in 2014, an astute Privacy Officer at DHHR realized that it was permitting Legal Aid to violate HIPAA, because Legal Aid did not come under the “business associate” exception to the privacy requirements. It was only after this determination, which even the majority opinion conceded was correct, that DHHR began requiring Legal Aid comply with HIPAA by obtaining patient consent before it could review patient records. There was nothing sinister in this, as was suggested by the majority opinion. DHHR simply was trying to comply with federal law–something the majority believes is not necessary in spite of the Supremacy Clause. 3 For ease in understanding, I will refer to HIPAA and the Privacy Rule collectively as HIPAA.

requirement, or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law.” 45 C.F.R. § 160.203.4 See Nat’l Abortion Fed’n v. Ashcroft, No. 03 Civ. 8695(RCC), 2004 WL 555701, at *3 (S.D.N.Y. March 19, 2004) (“Recognizing that HIPAA’s privacy provisions might differ from state regulations, Congress directed that all state laws contrary to the regulations promulgated by HHS be preempted, unless the state laws fall within the exception created by HIPAA[.]”). It has been recognized that the regulations “restrict and define the ability of health plans, health care clearinghouses, and most health care providers to divulge patient medical records.” United States v. Sutherland, 143 F. Supp. 2d 609, 612 (W.D. Va. 2001).

“[T]he intent of HIPAA is to ensure the integrity and confidentiality of patients’ [medical] information and to protect against unauthorized uses or disclosures of the information[.]” In re Antonia E., 838 N.Y.S.2d 872, 874-75 (2007) (internal quotations and citations omitted). Under HIPAA, the general rule is that a covered entity may not use or disclose protected health information without a written authorization from the individual. See 45 CFR 164.508. However, as recognized by the majority opinion, HIPAA enumerates several specific situations in which a covered entity may use or disclose protected health information without the written authorization of the individual. See Pal v. New York Univ.,

4 The regulations define State law as “a constitution, statute, regulation, rule, common law, or other State action having the force and effect of law.” 45 C.F.R. § 160.202. See Crenshaw v. MONY Life Ins. Co., 318 F. Supp.2d 1015, 1028 (S.D. Cal.2004).

No. 06Civ.5892 (BSJ)(FM), 2007 WL 1522618, at *3 (S.D.N.Y. May 22, 2007) (“HIPAA permits the disclosure of ‘protected health information’ without a patient’s consent in a variety of circumstances.”). The majority opinion found that only one of HIPAA’s exceptions to the general privacy of health information applied to the facts of this case.5 That exception involves a State law that is “more stringent” than HIPAA. See 45 C.F.R. § 160.203(b) (“The provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter.”). That is, “courts have recognized that HIPAA does not preempt ‘more stringent’ privacy protections guaranteed under state law.” Pac. Radiation Oncology, LLC v. Queen’s Med. Ctr., 47 F. Supp. 3d 1069, 1081 (D. Haw. 2014). Accord Citizens for Health v. Leavitt, 428 F.3d 167, 174 (3d Cir. 2005).

The majority opinion reached the conclusion that our State law was more stringent than HIPAA without performing any legal analysis of this complex issue. The majority opinion, in a rather awkward way, merely pointed out that DHHR had annually “conclud[ed] that our state laws set forth in 64 CSR § 59 are not preempted by HIPAA as our provisions are more stringent.” The majority opinion then went on to provide:

5 I previously noted that the majority opinion correctly found that the exceptions for business associate, health oversight agency, health care operations, and required by law did not apply.

From the record submitted in this case, the protections set forth in Title 64, Series 59 have been determined to be more stringent than those required by federal law. Accordingly, our state regulations set forth in Title 64, Series 59 are not preempted by HIPAA.

This was the sum total of how and why the majority opinion determined that our State law was more stringent than HIPAA. This total lack of analysis makes no sense. It is illogical to rely on a general finding by DHHR that its regulations are more stringent than HIPAA, when DHHR already had realized its disclosures to Legal Aid violated HIPAA, and DHHR tried to correct the violation by asserting that no authority exists for Legal Aid to indiscriminately access patient information. More fundamentally, the yard stick used by the majority opinion to determine whether a State law is more stringent than HIPAA is absurd! Under the majority opinion’s mind-boggling yardstick, all that any state must do to get around HIPAA is unilaterally proclaim that its laws are more stringent than HIPAA. Surely Congress did not mean for HIPAA and the Supremacy Clause to be defeated in such a selfserving manner. Indeed, as I will demonstrate below, this absolutely was not what Congress intended.

“[A] standard is more stringent if it provides greater privacy protection for the individual who is the subject of the individually identifiable health information than the standard set forth in the rules and regulations.” Bayne v. Provost, 359 F. Supp. 2d 234, 237-38 (N.D.N.Y. 2005) (internal quotations and citations omitted). See also Wade v. Vabnick-Wener, 922 F. Supp. 2d 679, 686 (“To meet the ‘more stringent’ requirement, a state *9 law must ‘provide greater protection for the individual who is the subject of the individually identifiable health information’ than the standard set forth by HIPAA and its regulations.”). More importantly, it has been recognized that, under federal law, “‘[m]ore stringent,’ as defined in 45 C.F.R.§ 160.202, means, that the state law meets any one of six criteria.” Law v. Zuckerman, 307 F. Supp. 2d 705, 709 (D. Md. 2004). See also Webb v. Smart Document Sols., LLC, 499 F.3d 1078, 1087 (9th Cir. 2007) (“‘More stringent’ laws are defined.”). The six criteria under HIPAA that define “more stringent,” have been summarized by the Fourth Circuit as follows:

[1] the state law prohibits or restricts a use or a disclosure of information where HIPAA would allow it; [2] the state law provides an individual with greater rights of access or amendment to his medical information than provided under HIPAA; [3] the state law provides an individual with a greater amount of information about a use, a disclosure, rights and remedies; [4] [state law provides requirements that narrow the scope or duration, increase the privacy protections afforded, or reduce the coercive effect of the circumstances surrounding the express legal permission of an individual to disclose information]; [5] the state law provides for the retention or reporting of more detailed information or for a longer duration; or [6] the state law provides greater privacy protection for the individual who is the subject of the individually identifiable health information.

South Carolina Med. Ass’n v. Thompson, 327 F.3d 346, 355 (4th Cir. 2003). Accord In re Antonia E., 838 N.Y.S.2d 872, 876 (2007).

Simply put, in order for a court to determine that a State law is more stringent than HIPAA, it must find that the State law satisfies one of the six definitions of “more stringent” contained under 45 C.F.R.§ 160.202. The majority opinion in this case literally *10 failed to even cite, let alone discuss, the mandatory six criteria set out under 45 C.F.R. §160.202. Ignoring the law, or pretending the law does not exist, should not be a license to manipulate and corrupt the law.

My research revealed that other courts called upon to decide whether a State law was more stringent than HIPAA have complied with federal law and applied the six criteria under 45 C.F.R.§ 160.202. For example, a case which examined all six criteria under 45 C.F.R. § 160.202 is State v. La Cava, No. CR060128258S, 2007 WL 1599888 (Conn. Super. Ct. May 17, 2007). In La Cava, the court was asked to decide whether a Connecticut statute, which authorized disclosure of patient information in a judicial proceeding and in certain other circumstances, was more stringent than HIPAA. The Connecticut statute allowed:

(1) any patient who has been treated in a private hospital, public hospital society or corporation receiving state aid to, upon the demand, examine and/or copy her hospital record, including the history, bedside notes, charts, pictures and plates kept in connection with her treatment and authorize her physician or attorney to do the same; (2) a hospital, society or corporation that is served with a subpoena issued by competent authority directing the production of a hospital record to deliver such record or a copy thereof to the clerk of such court where it will remain sealed except upon the order of a judge of the court concerned; (3) any and all parts of the hospital record or copy that is not otherwise inadmissible to be admitted in evidence without the necessity of having a witness from the hospital identity the records as ones kept in the usual course of business by the hospital.

La Cava, 2007 WL 1599888, at *3. The decision in La Cava summarily applied the six *11 criteria under 45 C.F.R.§ 160.202 and determined that the Connecticut statute was not more stringent than HIPAA:

In comparison to [HIPAA’s requirements for disclosures for judicial and administrative proceedings], [the state statute] does not: (1) prohibit or restrict a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted under the federal rule; (2) permit greater rights of access or amendment to the individual who is the subject of the individually identifiable health information; (3) provide a greater amount of information to the individual who is the subject of the individually identifiable health information about a use, a disclosure, rights, and remedies; (4) provide requirements that narrow the scope or duration, increase the privacy protections afforded, or reduce the coercive effect of the circumstances surrounding the need for express legal permission from the individual who is the subject of the individually identifiable health information with respect to the form, substance, or the need for express legal permission; (5) provide for the retention or reporting of more detailed information or for a longer duration with respect to recordkeeping or requirements relating to accounting of disclosures; and (6) provide greater privacy protection for the individual who is the subject of the individually identifiable health information with respect to any other matter. Accordingly, the state statute is not more stringent than the federal regulation.

Because [the state statute] is a contrary state law that is not more stringent than the Privacy Rule, it is preempted in accordance with 45 C.F.R. § 160.203 (2007).

La Cava, 2007 WL 1599888, at *3.

In U.S. ex rel. Stewart v. Louisiana Clinic, No. CivA. 99-1767, 2002 WL 31819130 (E.D. La. Dec. 12, 2002), the defendants attempted to prevent disclosure of patient information in a judicial proceeding by invoking the protections of a Louisiana statute. The *12 disclosure was allowed under HIPAA, but was not allowed under Louisiana law. The opinion in Stewart framed the issue as follows:

Defendants argue that HIPAA does not preempt Louisiana law concerning disclosure of nonparty patient records without patient consent. . . .

Defendants focus solely on the “more stringent” element of this regulatory test and on paragraph (4) of the definition of “more stringent.” “More stringent” means a State law that meets one or more of the following criteria: . . .

(4) With respect to the form, substance, or the need for express legal permission from an individual, who is the subject of the individually identifiable health information, for use or disclosure of individually identifiable health information, provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as by expanding the criteria for), or reduce the coercive effect of the circumstances surrounding the express legal permission, as applicable.

Defendants argue that the Louisiana health care provider/patient privilege law is more stringent than the federal regulations. They contend that the Louisiana statute increases the privacy protections afforded to individual patients by requiring either patient consent for the disclosure or, in the absence of consent, that a “court shall, issue an order for the production and disclosure of a patient’s records . . . only: after a contradictory hearing with the patient . . . and after a finding by the court that the release of the requested information is proper.”

Stewart, 2002 WL 31819130, at *4-5. The court in Stewart found that, based upon the defendants’ reliance solely on the fourth criterion of 45 C.F.R. § 160.202, Louisiana law was not more stringent than HIPAA:

Defendants’ argument fails because this provision of Louisiana law does not address “the form, substance, or the need

for express legal permission from an individual,” as required by 45 C.F.R. § 160.202 for the exception to apply. Rather, the Louisiana statute provides a way of negating the need for such permission. In other words, although the individual patient may attend the contradictory hearing, the Louisiana provision states that the court shall issue an order for disclosure (despite the patient’s lack of consent), if the court finds that release of the information is proper. Because the Louisiana statute does not fit within the exception from preemption cited by defendants, it is preempted by the HIPAA regulations. Therefore, Louisiana law does not apply in this pure federal question case.

Stewart, 2002 WL 31819130, at *5.

A case which illustrates a State statute that was actually found to be more stringent than HIPAA is Wade v. Vabnick-Wener, 922 F. Supp. 2d 679. In Wade, the court was called upon to decide whether Tennessee’s privacy law, on ex parte communication with a plaintiff’s treating physician was more stringent than HIPPA. The opinion relied upon the sixth criterion of 45 C.F.R. § 160.202. That is, “a state law must ‘provide greater protection for the individual who is the subject of the individually identifiable health information’ than the standard set forth by HIPAA and its regulations.” Wade, 922 F. Supp. 2d at 686. The opinion determined that, based upon the sixth criterion, Tennessee’s law was more stringent than HIPAA:

It is therefore clear that Tennessee law is more stringent than HIPAA’s privacy rules concerning ex parte communications with health care providers. Absent a plaintiff's express consent, Tennessee law prohibits informal communications with the plaintiff’s treating physician to obtain health information. On the contrary, HIPAA only bars such communications prior to the entry of a qualified protective

order. After the requisite protective order is entered, whether by consent or over the plaintiff’s objection, defendant is free to utilize informal discovery, including specifically ex parte interviews, under HIPAA.

Accordingly, because the laws of Tennessee are more stringent than HIPAA concerning defense counsels ability to make use of informal discovery methods, HIPAA does not preempt Tennessee’s ban on ex parte communications with a plaintiff’s non-party treating physician.

Wade, 922 F. Supp. 2d at 691-92. See Nat’l Abortion Fed’n v. Ashcroft, No. 04 C 55, 2004 WL 292079, at *4 (N.D. Ill. Feb. 6, 2004) (“Because we find that Illinois law is more stringent than HIPAA’s disclosure requirements and that it would be impossible for Northwestern to comply with both Judge Casey’s HIPAA-pursuant Order and various provisions of Illinois law, Illinois’s nonparty patient privacy laws are not preempted by HIPAA and its subsequent regulations.”); Pal v. New York Univ., 2007 WL 1522618, at *3 (“Because New York law requires patient consent before disclosure and HIPAA provides for certain exceptions to that rule, New York law is more stringent.”); Tyson v. Warden, No. CV064001202, 2007 WL 4171583, at *2 (Conn. Super. Ct. Nov. 5, 2007) (“It is clear to this court that § 52-146k and 52-146o prohibit disclosure where the HIPAA regulation relied upon by the petitioner would allow it. Sections 52-146k and 52-146o provide greater protection of the victim’s private health information and are therefore not preempted by HIPAA.”); In re Antonia E., 838 N.Y.S.2d 872, 876 (2007) (“Upon consideration of the physician-patient privilege and the broad provisions for court ordered disclosure under HIPAA, this Court finds that HIPAA provisions do not supersede New York law.”).

The above cases clearly demonstrate that a court cannot determine that a State statute is more stringent than HIPAA by relying solely on a state agency’s statement that a particular state law is more stringent than HIPAA. If that was true, as the majority opinion concludes, then there would have been no reason to define “more stringent” under 45 C.F.R. § 160.202. The term “more stringent” is defined for a purpose. That purpose, to me, is quite clear. The definition is designed to narrow the circumstances in which a state law may be categorized as more stringent than HIPAA. “[W]e are not free to rewrite HIPAA’s mandates; we are required to follow them.” Holman v. Rasak, 486 Mich. 429, 458, 785 N.W.2d 98, 114 (2010) (Hathaway, J., dissenting). The majority opinion in this case has made a mockery of the unambiguous and mandatory language contained in 45 C.F.R. § 160.202.

I can surmise only that the majority opinion ignored the law as dictated under 45 C.F.R. § 160.202 because it wanted to reach a result that simply could not be reached by following the law. A cursory review of what the relevant state law allowed in this case clearly shows that it was not more stringent than HIPAA.

What should be clearly understood is that, for purposes of the “more stringent” requirement of HIPAA, “any state law providing greater privacy protection for the individual who is the subject of the individually identifiable health information is a more stringent state law.” Natalie F. Weiss, “To Release or Not to Release: An Analysis of the HIPAA Subpoena Exception,” 15 Mich. St. U. J. Med. & L. 253, 260 (2011) (emphasis added). This point *16 needs to be emphatically understood–the “more stringent” requirement under HIPAA can never be satisfied by a State law that provides lesser privacy protection. In this case, the majority opinion has indicated that the applicable state law is found in 64 C.S.R. § 59-11-5.1.d, which provides:

No written consent is necessary for employees of the department, comprehensive behavioral centers serving the client or advocates under contract with the department.

In sum, this state regulation allows Legal Aid, as an “advocate,” to have complete access to patient information without the consent of the patient. On its face, it is clear that this law does not provide greater privacy protection. Instead, it exposes all patient information to a private legal entity in the absence of patient consent for either representation by the agency or the disclosure of their medical records to the agency.

It has correctly been observed that “[i]f state law can force disclosure without a court order, or the patient’s consent, it is not ‘more stringent’ than the HIPAA regulations.” Law v. Zuckerman, 307 F. Supp. 2d 705, 711 (D. Md. 2004). Through a summary application of HIPAA’s six criteria, it is clear that the state regulation at issue in this matter does not: (1) prohibit or restrict a use or a disclosure of information where HIPAA would allow it; (2) provide an individual with greater rights of access or amendment to his medical information than provided under HIPAA; (3) provide an individual with a greater amount of information about a use, a disclosure, rights and remedies; (4) provide requirements that narrow the scope or duration, increase the privacy protections afforded, or reduce the *17 coercive effect of the circumstances surrounding the express legal permission of an individual to disclose information; (5) provide for the retention or reporting of more detailed information or for a longer duration; or (6) provide greater privacy protection for the individual who is the subject of the individually identifiable health information. Insofar as the state regulation does not satisfy any of the above six factors contained in 45 C.F.R. § 160.202, the state law is not more stringent than HIPAA. The majority knew this, and that is why its opinion completely ignored 45 C.F.R. § 160.202. See In re Funderburke, No. 687-0026, 1988 WL 1607927, at *4 (S.D. Ga. Jan. 18, 1988) (“[T]he record shows that the [majority] did nothing except to assume the position of an ostrich with its head in the sand and ignore [the law] which [was] readily available to it.”).

Finally, I wish to point out that the majority opinion conceivably has opened the floodgates for civil litigation, because of the unlawful access it has given Legal Aid to patient hospital information. This Court recently held that “[c]ommon-law tort claims based upon the wrongful disclosure of medical or personal health information are not preempted by the Health Insurance Portability and Accountability Act of 1996.” Syl. pt. 3, R.K. v. St. Mary’s Med. Ctr., Inc., 229 W. Va. 712, 735 S.E.2d 715 (2012). If the majority opinion is not appealed to the United States Supreme Court, I have no doubt that civil law suits will follow in the wake of the misguided majority opinion.

For the reasons so stated, I dissent. 18