Kelly and Evarist Schneider II (the Schneiders) were informed by Children’s Health Care (Children’s) that protected health information of their child, M.S., was disclosed by Children’s to its institutionally related foundation and its business associate for fundraising purposes. The Schneiders claimed that they had not given consent to Children’s to disclose M.S.’s health information for fundraising purposes, and they therefore sued Children’s for violating the Minnesota Health Records Act (Minn. Stat. §§ 144.291–.298 (2022)).
The Schneiders’ claim involved the interpretation of Minn. Stat. § 144.293, subd. 2(2), which prohibits the disclosure of protected health information without “specific authorization in law.” Children’s argued that federal regulations implementing the federal Health Insurance Portability and Accountability Act (HIPAA) is a “specific authorization in law,” and subsequently point to a federal regulation permitting disclosure of protected health information for fundraising purposes. The Schneiders argued that the statutory language refers only to specific authorizations in Minnesota law. The district court agreed with Children’s interpretation, the Minnesota Court of Appeals affirmed, and the Minnesota Supreme Court took up the issue.
The Minnesota Supreme Court, in its Opinion filed on October 11, 2023, held that Children’s was permitted to use protected health information of its patients for fundraising purposes, agreeing with Children’s that the federal regulation at issue in the case is a “specific authorization in law” under Minn. Stat. § 144.293, subd. 2(2).
HIPAA Privacy Rule
The HIPAA Privacy Rule generally prohibits a covered entity from disclosing protected health information unless such a disclosure is authorized by the HIPAA Privacy Rule. 45 C.F.R. § 164.502(a) (2022). The HIPAA Privacy Rule authorizes
the disclosure of certain protected health information for fundraising purposes: “[A] covered entity may use, or disclose to a business associate or to an institutionally related foundation, the following protected health information for the purpose of raising funds for its own benefit, without an authorization meeting the requirements of § 164.508:
(i) Demographic information relating to an individual, including name, address, other contact information, age, gender, and date of birth;
(ii) Dates of health care provided to an individual;
(iii) Department of service information;
(iv) Treating physician;
(iv) Outcome information; and
(v) Health insurance status.
45 C.F.R. § 164.514(f)(1).
To take advantage of the fundraising exception, a health care provider must provide notice to patients of potential fundraising communications in the provider’s federally mandated privacy notice. § 164.514(f)(2)(i) (2022). In each
fundraising communication to a patient, the notice must also provide the patient “with a clear and conspicuous opportunity to elect not to receive any further fundraising communications.” § 164.514(f)(2)(ii) (2022).
However, the HIPAA Privacy Rule’s provisions do not preempt a “provision of State law relat[ing] to the privacy of individually identifiable health information” that is “more stringent than a standard, requirement, or implementation specification” of the HIPAA Privacy Rule. § 160.203(b). A provision of state law is “[m]ore stringent” when it, for example, “provides greater privacy protection for the individual who is the subject of the individually identifiable health information” or “provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as by expanding the criteria for), or reduce the coercive effect of the circumstances surrounding the express legal permission” required for disclosure. 45 C.F.R. § 160.202 (2022).
Minnesota enacted its own privacy law regarding the disclosure of protected health information. The Minnesota Health Records Act generally provides that “[a] provider, or a person who receives health records from a provider, may not release a patient’s health records to a person” unless an exception applies. Minn. Stat. § 144.293, subd. 2. One of those exceptions allows disclosure when there is a “specific authorization in law.” subd. 2(2).
The Minnesota Supreme Court held: “contrary to the Schneiders’ assertion, the statute plainly encompasses law that is binding in Minnesota—that is, Minnesota and federal law. And because the HIPAA Privacy Rule is a federal regulation with the “force and effect” of federal law, Perez, 575 U.S. at 96 (citation omitted) (internal quotation marks omitted), the fundraising exception in the HIPAA Privacy Rule is plainly a “specific authorization in law” under Minn. Stat. § 144.293, subd. 2(2).”
Source Schneider vs. Children’s Health Care, A22-0275.
If you or a loved one suffered a serious injury (or worse) as a result of medical negligence in Minnesota or in another U.S. state, you should promptly find a Minnesota medical malpractice lawyer, or a medical malpractice in your state, who may investigate your medical malpractice claim for you and represent you or your loved one in a medical malpractice case, if appropriate.
Click on the “Contact Us Now” tab to the right, visit our website, or call us toll-free in the United States at 800-295-3959 to find medical malpractice attorneys in your state who may assist you.
Turn to us when you don’t know where to turn.