MITCHELL LAW GROUP
813-223-1959
101 E. Kennedy Boulevard
Tampa, Florida 33602
HR and Tax Newsletter-April 2003

These newsletters are provided free to MLG clients and friends. .

Note: The Department of Labor has published proposed changes to clarify the white collar exemption under the Fair Labor Standards Act. SHRM is seeking comments on the proposed changes. Feedback can be e-mailed to Wwunsh@shrm.org

HIPAA Privacy Rule. On April 14, 2003, the HIPAA privacy rule became effective. Broadly this rule limits the disclosure of certain kinds of health information. The April 14, 2003 deadline applies to health care providers and to businesses that provide health benefits to their employees. An important exception is for business providing health benefits through a plan with annual receipts of $5 million or less. They are not covered until April 14, 2004 (plans with fewer than 50 participants and which are self administered are excluded from coverage under the privacy rule).

HIPAA Supplements (Not Replaces) State Privacy Rights. The HIPAA Privacy Rule does not limit state law privacy protections that are more stringent than the HIPAA Privacy Rule. For example, the Florida Constitution contains an express privacy right. Although this constitutional provision is limited to governmental actions (such as conditioning employment on having abstained from specified but legal sexual practices for one year) it can apply more broadly to limit government investigations and to limit the disclosure of medical information that is sought by subpoena (for example information on the identity of blood donors in connection with automobile negligent driving claim)( In contrast, HIPAA permits disclosure of subpoenaed information if certain requirements are met).

Similarly, the HIPAA privacy rule does not limit lawsuits in the employment context for invasion of privacy under Florida common (i.e. court made) law.

Keeping in mind state privacy laws (which may impose additional restrictions) HIPAA permits protected information to be turned over pursuant to:

1. An order of a court or administrative tribunal.

2. A subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal if the Covered Entity does one of the following:

(a) Receives satisfactory assurance, from the party seeking the information, that reasonable efforts have been made by it to ensure that the individual has been given notice of the request. Generally, "satisfactory assurance" means the receipt, by the Covered Entity from the party seeking the information, of a written statement and accompanying documentation demonstrating that a good faith effort has been made to provide written notice to the individual with sufficient information to permit the individual to raise an objection, that the time for raising objections has elapsed, and that either no objections were filed or all objections filed have been resolved in a manner consistent with the disclosures being sought. 45 CFR 164.512(e)(1)(iii).

(b) Receives satisfactory assurance, from the party seeking the information, that reasonable efforts have been made by it to secure a qualified protective order. "Satisfactory assurance" means the receipt by the Covered Entity from the party of a written statement and accompanying documentation demonstrating that either (i) the parties to the dispute have agreed and presented to the court or administrative tribunal a "qualified protective order," or (ii) the party seeking the information has requested a qualified protective order from such court or administrative tribunal. 45 CFR 164.512(e)(1)(iv).

(c) Makes reasonable efforts to provide notice to the individual or to seek a qualified protective order sufficient to meet the "satisfactory assurance" requirements described in the above paragraphs.



The above requirements do not supercede other provisions in 45 CFR 164.512 that permit or restrict uses or disclosures of Protective Health Information. 45 CFR 164.512(e)(2).