Olsen v. Hamilton

Nancy Torresen, United States Chief District Judge This suit against the Commissioner of the Maine Department of Health and Human Services ("MDHHS " or "the Department ") is a pre-enforcement, facial challenge to the rules implemented by the MDHHS this year under the Maine Medical Marijuana Act ("MMMA "). The operative Second Amended Complaint ("SAC ") seeks declaratory and injunctive relief on three counts. Count One alleges that Section 10 of the MDHHS rule, which relates to compliance and enforcement, exceeded the agency's delegated legislative authority in violation of the Maine Administrative Procedures Act, 5 M.R.S. §§ 8051 - 8074 (2013). Count Two alleges that Section 10 of the rule authorizes the search and seizure of participants' homes and workspaces in violation of the Fourth Amendment and allows questioning of participants in violation of the Fifth Amendment. Count Three alleges that Section 10 of the rule provides for disclosure of medical marijuana patient information to the MDHHS in violation of the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA "), *548Pub. L. No. 104-191, § 264, 110 Stat. 1936 (1996), and its Privacy Rule, 45 C.F.R. §§ 164.502(a) and 164.508(a)(1). The motions now before me are the Plaintiffs' motions for a temporary restraining order and a preliminary injunction seeking to restrain the State from implementing Section 10 of the MMMA rule (ECF Nos. 19, 29) and the Defendant's motion to dismiss under Federal Rules of Civil Procedure 12(b)(1) for lack of justiciability and 12(b)(6) for failure to state a claim. (ECF No. 32.) For the following reasons, the Defendant's motion to dismiss is GRANTED and the Plaintiffs' motions are DENIED. FACTUAL BACKGROUND The MMMA provides for the legal use of marijuana to treat certain debilitating conditions. Under this framework, patients who qualify may obtain marijuana lawfully by: (1) growing limited amounts for themselves, (2) buying it from a registered "caregiver," or (3) buying it from a registered dispensary.1 SAC ¶ 19. A "qualifying patient" is defined as "a person who has been diagnosed by a medical provider as having a debilitating medical condition and who possesses a valid written certification regarding medical use of marijuana." 22 M.R.S. § 2422(9). Although qualifying patients can register with the State, they are not required to do so. 22 M.R.S. §§ 2425(9-A). A "caregiver" is, in essence, a person who is designated by the qualifying patient to provide care to that patient and who is allowed, for the purposes of assisting the qualifying patient, to grow, store, and sell limited amounts of marijuana for up to five patients. 22 M.R.S. §§ 2422(8-A), 2423-A(2) ; SAC ¶ 20. Caregivers, unless they fall into an exemption for family members of qualifying patients, are required to register with MDHHS. 22 M.R.S. §§ 2425(9-A), 2423-A(3)(C). Caregivers must complete an application indicating the number (but not the names) of the patients that they serve. SAC Ex. D-1 (ECF 18-4). As of 2016, there were 51,324 qualifying patients and 3,258 caregivers in Maine. SAC ¶¶ 18-19. When the MMMA became law in 2009, it authorized the MDHHS "to adopt rules to carry out the purposes of this chapter." 22 M.R.S. § 2424. The MDHHS most recently amended its implementing rules in February 2018 through the Maine Medical Use of Marijuana Program Rule ("the 2018 Rule "). (ECF No. 18-1.) The 2018 Rule addresses, inter alia, marijuana cultivation, certification and registration of participants, and compliance and enforcement. The authorization to conduct on-site assessments contained in the compliance and enforcement rules found in Section 10 of the 2018 Rule is the focus of this suit. An "on-site assessment" is defined as the review process to determine compliance. An on-site assessment may include a paper review, interview and inspection of the medical marijuana cultivation, processing and retail sites and administrative locations for the purpose of ensuring compliance with the requirements of the statute and this rule. 2018 Rule § (1)(Q). Section 10 provides that MDHHS "may initiate an on-site assessment ... to ensure compliance prior to issuing a registry identification card, as a routine review, in response to an allegation of non-compliance or as part of a plan of correction." 2018 Rule § 10(B). During an on-site assessment, the Department's mission is primarily to: (1) verify information submitted in an application; (2) review records; (3) conduct interviews; (4) ensure that the amount of marijuana is within the specified limits and that it is identifiable *549and maintained as required; (5) take samples; and (6) assess conduct for compliance with the statute. 2018 Rule § 10(B)(1). On-site assessments may occur in areas "reportedly used by a registered primary caregiver for conduct authorized by this rule," regardless of whether it is a workspace or a residence, and "areas within a person's residence reportedly used for conduct authorized by this rule." 2018 Rule § 10(B)(3)(a)-(c). Registered caregivers will not receive advance notice before an inspection, but those who are not required to register (e.g., patients) will receive at least 24 hours advance notice. 2018 Rule § 10(B)(3)(a)-(c). A provision headed "Prior to entry" states: The Department will show proof of identity when requesting entry to conduct an on-site assessment and to inspect an area reportedly used for conduct described under this rule and the statute. The Department will also provide the reason for the on-site assessment in standard written form developed by the Department prior to entry. 2018 Rule § 10(B)(4). If a registered caregiver or qualifying patient refuses to allow the Department entry during an on-site assessment, the 2018 Rule provides that: the Department will consider such an action a failure to comply with the provisions of this rule. a. Upon refusal, the Department may refer to law enforcement as a progressive enforcement action when compliance cannot be determined. b. Additionally, if denied entry by a cardholder, the Department may also take action to revoke the registry identification card or dispensary registration certificate. 2018 Rule § 10(B)(7). Section 10 also states: Failure to comply with provisions of statute and rule may result in remedial action up to, and including, directed corrective action; suspension, revocation and denial of a registry identification card or registration certificate; civil penalties; and referral to the appropriate agency, department or entity if the conduct is determined to be outside the scope of MMMP, is not appropriate for agency directed corrective action, or has not been rectified through corrective action. 2018 Rule § 10(A)(4). The Plaintiffs assert that recent passage of the Maine Marijuana Legalization Act ("MMLA ") makes available marijuana that is less regulated and "will likely entice current medical marijuana patients, and future such patients, to consider foregoing compliance" with the MMMA. SAC ¶ 54. The Plaintiffs fear that this will lead patients to seek marijuana from sources that are not subject to background checks and do not provide careful prescriptions. SAC ¶ 54. The Plaintiffs allege that "[t]his enticement will be substantially greater if the present search-and-seizure provisions under the 2018 Rule that is the subject of this action are not enjoined with the attendant disclosure to the state of Maine of the identity of medical marijuana patients within this state." SAC ¶ 54. There are four plaintiffs in this suit. Plaintiffs Justin Olsen and Nancy Shaw are authorized caregivers under the MMMA who conduct business as New World Organics, Inc. in Belfast, Maine. SAC ¶¶ 9-10. As caregivers, they receive patient designations and certifications from medical providers, including records regarding the patients' medical conditions and symptoms. SAC ¶ 31. They also counsel qualifying patients on the use of medical marijuana and dispense medical marijuana to qualifying patients. SAC ¶ 28. Plaintiffs Jane Doe and John Doe are qualifying patients under the MMMA. SAC *550¶¶ 11-12. Jane Doe has cancer, and John Doe experiences pain from injuries sustained in combat while deployed with the U.S. Army. SAC ¶¶ 11-12. Olsen and Shaw "have acted" as the caregivers for Jane Doe and John Doe. SAC ¶ 21. The Defendant is Ricker Hamilton, in his official capacity as the Commissioner of the MDHHS.2 Plaintiffs Olsen and Shaw received a form letter from the MDHHS dated May 10, 2018, with the subject line "Maine Medical Use of Marijuana Program (MMMP) 2018 Rule." Olsen Decl. Ex. A-1 (ECF No. 47-1). The letter was addressed to "MMMP Participant," and stated that "MMMP is implementing its revised rule (original implementation) as of the date of this letter," and included a link the MDHHS's website on the 2018 Rule. Olsen Decl. Ex. A-1. A Frequently Asked Questions section of the website includes the following text: Section 10 Can the Department inspect a patient? Yes, the Department may request permission to inspect the premises used by a qualifying patient for conduct authorized under this chapter. The Department assesses conduct reported as a violation of the rule or statute by making contact by phone or requesting access to locations where this conduct is reportedly taking place. The patient may voluntarily permit entry or request an administrative warrant before allowing the Department to enter the location which may be the patient's home. When the Department is refused entry or otherwise unable to ensure compliance, the Department may proceed with obtaining an administrative warrant and/or refer to law enforcement. Olsen Decl. Ex. A-4 (ECF No. 47-1). PROCEDURAL HISTORY The Plaintiffs filed this suit on January 16, 2018. On the same day, the Plaintiffs also filed a motion to proceed under the aliases Jane Doe and John Doe. (ECF No. 4.) The Plaintiffs subsequently amended their complaint twice; the operative SAC was filed January 30, 2018. On January 31, 2018, the Plaintiffs filed a motion for a preliminary injunction. (ECF No. 19.) Later on the same day, the Governor issued a public notice that he would stay the implementation of the 2018 Rule by 90 days until May 1, 2018, and the Plaintiffs filed a motion to stay this action for 90 days, which was granted on February 2, 2018. (ECF Nos. 21, 22.) On May 7, 2018, the Plaintiffs filed a motion for a temporary restraining order ("TRO ") or for an expedited briefing schedule. (ECF No. 29.) I responded to the TRO motion that same day, issuing a text order granting the expedited briefing schedule but reserving on the motion for the TRO. On May 14, 2018, ahead of oral argument on the preliminary injunction, the Defendant filed a motion to dismiss the SAC under Federal Rules of Civil Procedure 12(b)(1) for lack of justiciability and 12(b)(6) for failure to state a claim. (ECF No. 32.) Oral argument was held May 23, 2018, at which I conditionally granted the motion to proceed under aliases. (ECF No. 42.) This order follows on the pending motions for preliminary injunction, TRO, and dismissal of the SAC. *551LEGAL STANDARD The court has an obligation to ensure that it has jurisdiction before proceeding to the merits. Steel Co. v. Citizens for a Better Env't , 523 U.S. 83, 88-89, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). Article III provides federal courts with limited jurisdiction, which only extends to actual cases and controversies. The related justiciability doctrines of standing and ripeness are at issue in this case. The justiciability doctrine of standing requires that a plaintiff allege "such a personal stake in the outcome of the controversy as to assure that concrete adverseness which sharpens the presentation of issues upon which the court so largely depends for illumination of difficult constitutional questions." Baker v. Carr , 369 U.S. 186, 204, 82 S.Ct. 691, 7 L.Ed.2d 663 (1962). To establish standing, the plaintiff bears the burden of showing "(i) that she has suffered an actual or threatened injury in fact, which is (ii) fairly traceable to the statute, and (iii) can be redressed by a favorable decision." Ramirez v. Sanchez Ramos , 438 F.3d 92, 97 (1st Cir. 2006) (citing Lujan v. Defenders of Wildlife , 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). In addition to the Article III requirements, prudential standing concerns include that the plaintiff is seeking to protect her own legal rights, that her complaint does not represent a generalized grievance, and that the complainant falls in the zone of interests protected by the law invoked. Pagan v. Calderon , 448 F.3d 16, 27 (1st Cir. 2006). The ripeness analysis considers the two prongs of "fitness" and "hardship." Reddy v. Foster , 845 F.3d 493, 501 (1st Cir. 2017). Fitness involves both whether there is a case or controversy to satisfy Article III and prudential considerations about "judicial restraint from unnecessary decision of constitutional issues." Id. The hardship prong deals with prudential concerns about the harm to parties from withholding a decision. Id. The doctrines of standing and ripeness " 'originate' from the same Article III limitation." Susan B. Anthony List v. Driehaus , 573 U.S. 149, 134 S.Ct. 2334, 2341 n.5, 189 L.Ed.2d 246 (2014). "Much as standing doctrine seeks to keep federal courts out of disputes involving conjectural or hypothetical injuries, the Supreme Court has reinforced that ripeness doctrine seeks to prevent the adjudication of claims relating to 'contingent future events that may not occur as anticipated, or indeed may not occur at all.' " Reddy , 845 F.3d at 500 (quoting Texas v. United States , 523 U.S. 296, 300, 118 S.Ct. 1257, 140 L.Ed.2d 406 (1998) ). In many cases, including this one, the Article III standing and ripeness problems "boil down to the same question."See Susan B. Anthony List , 134 S.Ct. at 2341 n.5 (quoting MedImmune, Inc. v. Genentech, Inc. , 549 U.S. 118, 128 n.8, 127 S.Ct. 764, 166 L.Ed.2d 604 (2007) ). An injury "sufficient to satisfy Article III must be 'concrete and particularized' and 'actual or imminent, not 'conjectural or hypothetical.' ' " Susan B. Anthony List , 134 S.Ct. at 2341 (quoting Lujan , 504 U.S. at 560, 112 S.Ct. 2130 ). Within this framework, a plaintiff "need not actually violate the statute or suffer the prescribed penalty in order to establish an injury in fact." Ramirez , 438 F.3d at 98 (citing Steffel v. Thompson , 415 U.S. 452, 459, 94 S.Ct. 1209, 39 L.Ed.2d 505 (1974) ). "An allegation of future injury may suffice if the threatened injury is 'certainly impending,' or there is a 'substantial risk that the harm will occur.' " Susan B. Anthony List , 134 S.Ct. at 2342 (quoting Clapper v. Amnesty Int'l USA , 568 U.S. 398, 410, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013) ). *552Although the parties cite no cases addressing standing in the context of a Fourth Amendment facial challenge,3 there have been some important recent developments in this area of the law. In City of Los Angeles v. Patel , --- U.S. ----, 135 S.Ct. 2443, 192 L.Ed.2d 435 (2015), the Supreme Court put to rest the idea that facial challenges based on the Fourth Amendment were "categorically barred or especially disfavored." Id. at 2449. Patel involved a Los Angeles municipal code provision which allowed police to inspect hotel registry information. Failure to make the records available was punishable as a criminal misdemeanor and could subject the hotelier to immediate arrest. Id. at 2452. The Court found that the plaintiffs, a group of motel operators and a lodging association, had standing to assert a facial Fourth Amendment challenge to the provision, but it acknowledged that: claims for facial relief under the Fourth Amendment are unlikely to succeed when there is substantial ambiguity as to what conduct a statute authorizes: Where a statute consists of 'extraordinarily elastic categories,' it may be 'impossible to tell' whether and to what extent it deviates from the requirements of the Fourth Amendment. Id. at 2450 (citing and clarifying Sibron v. New York , 392 U.S. 40, 60 n.20, 88 S.Ct. 1889, 20 L.Ed.2d 917 (1968) ). As Patel clarified, where a law is susceptible to a wide variety of interpretations; where it is difficult to tell precisely what conduct a statute authorizes; and where further factual development would enhance a court's ability to deal with the legal issues presented, a facial Fourth Amendment challenge is not ripe. Plains All Am. Pipeline L.P. v. Cook , 866 F.3d 534, 543 (3d Cir. 2017) (citing Patel and Sibron in analyzing a Delaware escheat law). DISCUSSION I analyze the Plaintiffs' standing on each count, starting with the federal claims and concluding with the state law claim. See Pagan , 448 F.3d at 26. I. Count Two: Constitutional Challenges The Plaintiffs' articulated injury under Count Two is that the on-site inspections provided for in the 2018 Rule would violate their rights under the Fourth and Fifth Amendments. SAC ¶¶ 5, 46-48. These injuries could occur, they allege, through the unlawful search of their medical records at the caregivers' facility, through an unlawful search of their private homes, and through interviews that take place during the search. SAC ¶¶ 46, 48. Because no such on-site assessments have yet taken place, the threshold inquiry for both the standing and ripeness inquiries is whether the Plaintiffs have adequately alleged an imminent, threatened injury. *553An "injury is imminent if it is certainly impending or if there is a substantial risk that harm will occur." Reddy , 845 F.3d at 500. In the context of this facial challenge to the 2018 Rule, I consider whether the injury is certainly impending or there is a substantial risk that such a search or interrogation would occur if the Department attempts to conduct an on-site assessment under Section 10. Because there are numerous ambiguities within the 2018 Rule, it is difficult, if not impossible, to tell whether any such attempt would result in conduct that violates the Fourth or Fifth Amendment. First, as the State points out, the Department would have to decide to seek an on-site assessment. Given that there are two inspectors and approximately 55,000 qualifying patients and caregivers, the likelihood of these Plaintiffs being subjected to an on-site assessment is limited.4 While it is possible that the State would beef up its enforcement branch and hire additional inspectors, at present the likelihood of an on-site assessment is quite low. Second, even if state inspectors decide to conduct an on-site assessment, it is apparent from Section 10 that the caregivers and patients can refuse entry. Section 10's language that the Department will show proof of identity when requesting entry implies that inspectors cannot insist upon entry. 2018 Rule § 10(B)(4). The letter sent by the Department to Jane and John Doe reinforces this idea, stating that "the Department may request permission to inspect the premises" and suggesting that a patient could refuse entry and ask the officials to seek an administrative warrant. Olsen Decl. Ex. A-4. The Plaintiffs argue that if they refuse entry they will be expelled from the protection of the medical marijuana program. Patients will lose their right to use marijuana as medication, and caregivers will lose their livelihood. But these predictions rest on assumptions. Section 10's provision dealing with refusal of entry contemplates that the Department will consider a refusal to allow entry a "failure to comply" with 2018 Rule. 2018 Rule § 10(B)(7). But what the Department will ultimately do with such a failure to comply is unclear. There are no criminal penalties attached to such a refusal, as was the case in Patel ,5 and the Department, as discussed above, has considerable discretion in choosing remedial action; in addition to revocation, remedial options include directed corrective action, suspension, and civil penalties. 2018 Rule § (10)(A)(4). Section 10's remedial actions themselves are ambiguous. "Directed corrective action," for example, is an undefined term. None of the remedial options available to the Department has been tested in the state courts. 2018 Rule § (10)(A)(4). And while the revocation of a registry identification card is possible, there are due process protections which attach to such a revocation, including written notice and a right to appeal. See 2018 Rule §§ 10(H), (I); Toilet Goods Ass'n, Inc. v. Gardner , 387 U.S. 158, 87 S.Ct. 1520, 18 L.Ed.2d 697 (1967) (facial challenge of FDA regulation that provided for suspension of certification of entities that *554refused FDA inspections was not ripe because judicial appraisal of the regulation would stand on surer footing in the context of a specific application, such as an administrative hearing contesting any such suspension). The 2018 Rule is susceptible to a wide variety of interpretations, and there has been no development of the "potential intersections" between the 2018 Rule and the Fourth Amendment. Patel , 135 S.Ct. at 2450. For the same reasons, the Fifth Amendment injury claim is not adequately developed. Since it is impossible to know how the Department will implement the 2018 Rule and whether the Department will deviate from the requirements of the Constitution,6 I find that the Plaintiffs have failed to establish an imminent threatened injury. Accordingly, I conclude that the Plaintiffs' constitutional allegations are not sufficient to establish standing, and, alternatively, the case is not ripe for adjudication. See Reddy , 845 F.3d at 500. II. Count Three: HIPAA In Count Three, Olsen and Shaw allege that they are medical providers subject to HIPAA's Privacy Rule, which prohibits them from disclosing medical information about their medical marijuana patients. SAC ¶¶ 27, 69. Plaintiffs contend that HIPAA preempts Section 10's requirement that caregivers disclose to Department agents any patient information. SAC ¶¶ 70-72. The Plaintiffs seek a declaratory judgment under Count Three that they are not bound by Section 10 of the 2018 Rule to disclose the identity of their qualifying patients. SAC ¶¶ 71, 75. Assuming, without deciding, that the Plaintiffs have sufficiently demonstrated that they have standing to raise this claim, it is easily disposed of on the merits. "One of Congress's objectives in enacting HIPAA was to address concerns about the confidentiality of patients' individually identifiable health information." OPIS Mgmt. Res., LLC v. Sec'y, Fla. Agency for Health Care Admin. , 713 F.3d 1291, 1294 (11th Cir. 2013). To that end, the Department of Health and Human Services ("DHHS ") was tasked with promulgating privacy regulations. Id. at 1295. In fulling that obligation, DHHS promulgated the Privacy Rule which prohibits covered entities7 from "us[ing] or disclos[ing] protected health information" without valid authorization. 45 C.F.R. §§ 164.502(a), 164.508(a)(1). As the Defendant points out, there are exceptions to the Privacy Rule that allow a covered entity to use or disclose protected health information without authorization of the patient. The Defendant contends that the exception for health oversight activities applies here. That exception provides: (d) Standard: Uses and disclosures for health oversight activities. (1) Permitted disclosures. A covered entity may disclose protected health information to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, *555or criminal investigations; inspections; licensure or disciplinary actions; civil administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of: (i) The health care system; ... [or] (iii) Entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards. 45 C.F.R. § 164.512(d). To prevail on their preemption claim, the Plaintiffs would have to establish that the disclosure requirement of the 2018 Rule was contrary to HIPAA and its accompanying regulations.8 The Plaintiffs make no attempt to address how the caregivers' provision of patient information to the Department pursuant to Section 10 of the 2018 Rule is contrary to HIPAA given the exception found in 45 C.F.R. § 164.512(d) for health oversight activities. On its face, the exception in § 164.512(d) establishes the Department's authority to request records from caregivers. As such, the Plaintiffs have failed to assert a viable claim that HIPAA preempts the 2018 Rule.9 Accordingly, I dismiss Count Three for failure to state a claim. III. Count One: Maine APA Challenge Having found a lack of standing under Count Two and a failure to state a claim under Count Three, I decline to exert supplemental jurisdiction over the state law claims in Count One. CONCLUSION For the reasons stated above, the Court GRANTS the Defendant's motion to dismiss and DENIES the Plaintiffs' motions for a temporary restraining order and preliminary injunction. SO ORDERED. Footnotes [1] Dispensaries are subject to on-site assessments as well, but since they are not the focus of this lawsuit, I do not address the rules that apply to dispensaries. [2] Effective May 2, 2018, responsibility for administering the medical marijuana program has transferred to the Department of Administrative and Financial Services. P.L. 2017, ch. 409, § E-12. Neither the Plaintiffs nor the Defendant have moved to change the named defendant or add an additional party. [3] The parties cite primarily to First Amendment cases. These cases, however, operate under a distinct standard of review. See, e.g., Osediacz v. City of Cranston , 414 F.3d 136, 140 (1st Cir. 2005) ("When certain types of facial challenges to statutes, ordinances, regulations, or governmental policies are premised on First Amendment grounds, they invite a lowering of conventional standing barriers because the traditional jus tertii ban on litigating the rights of third parties is arguably inapplicable."); N.H. Right to Life Pol. Action Comm. v. Gardner , 99 F.3d 8, 13 (1st Cir. 1996) ("an actual injury can exist when the plaintiff is chilled from exercising her right to free expression or forgoes expression in order to avoid enforcement consequences"). However, "[t]he solicitude shown to First Amendment rights is likely inapplicable in the Fourth Amendment context," in part because "Fourth Amendment rights are personal rights ... which may not be vicariously asserted." Knick v. Twp. of Scott , 862 F.3d 310, 320 n.7 (3d Cir. 2017) (quoting Alderman v. United States , 394 U.S. 165, 174, 89 S.Ct. 961, 22 L.Ed.2d 176 (1969) ). [4] The chances of Jane Doe and John Doe is even further attenuated because they have not registered with the State, and their actual identities are unknown to the State. In their case, the Department would first have to learn their identities (and home addresses), during an on-site assessment of their caregiver and then decide to do an on-site assessment at their homes. [5] The Plaintiffs assert that the inspectors may refer caregivers or patients who refuse entry to law enforcement. 2018 Rule § 10(B)(7); Olsen Decl. Ex. A-4. This is a distinguishable risk from the authorization to arrest. Anything can be referred to law enforcement, and nothing in the 2018 Rule changes the constitutional constraints on law enforcement's response. [6] Here, it is unclear whether the 2018 Rule actually even authorizes unreasonable searches under the Fourth Amendment. As to the caregivers, the administrative search doctrine will probably supply the governing Fourth Amendment principles and limitations on State authority. Although the Department's authority to enter patients' homes is more constitutionally suspect, if the 2018 Rule is interpreted to require consent, it may withstand Fourth Amendment scrutiny. If the Plaintiffs can refuse entry for the purpose of an on-site inspection, it likewise will be difficult to establish custody as a basis for a Fifth Amendment violation. [7] I assume, without deciding, that Plaintiffs Olsen and Shaw are "health care providers" and thus "covered entities" under HIPAA and 45 C.F.R. § 160.103. [8] Congress passed an express preemption provision, providing that HIPAA "shall supersede any contrary provision of State law...." 42 U.S.C. § 1320d-7(a)(1). A state law is "contrary" to HIPAA if: (1) A covered entity ... would find it impossible to comply with both the State and Federal requirements; or (2) The provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of [HIPAA]. 45 C.F.R. § 160.202. [9] There is also a statutory exception to express preemption for state laws that address controlled substances. 42 U.S.C.A. § 1320d-7(a)(2)(A). Since I find that the 2018 Rule is not contrary to State law given the regulatory exception, and since the Defendant did not raise the statutory exception, I do not address it.