Falco and Future of State's Confidentiality Laws

November 17, 2000 Published Work
Reprinted with permission from the The Connecticut Law Tribune, September 25, 2000

Copyright 2000, The National Law Journal

Much attention has focused recently on proposed federal regulations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) containing, among other things, standards for security and privacy of patient-identifiable health information. By the end of this year, the final HIPAA regulations should be fully launched.

These requirements, together with the evolution of technology that necessitated them, will forever change how we collect, maintain, use, disclose and even think about patient-identifiable health care information. However, while awaiting further federal developments in health information privacy and security, one should not overlook the continuing critical importance of state law in this area.

There are good reasons for the federal government to lead the charge in defining requirements for handling personal health information, most notably that many health care payers and providers conduct their business and operations across state lines. However, the regulation of both health care and confidentiality have long been the subject of state authority.

Most states, including Connecticut, have a collection of statutes and regulations enacted over many years that address confidentiality and access to health care information. Congress has expressly recognized a continuing state role in providing that the HIPAA law and implementing privacy regulations will not supercede a contrary provision of state law which contains more stringent privacy requirements, standards or implementation specifications.

Thus, even after HIPAA, Connecticut statutes, court decisions and regulations will retain their essential role in determining the degree of privy protection afforded to personal health information. The importance of Connecticut's state privacy law, in particular the psychiatric-patient privilege, was recently highlighted in the Connecticut Supreme Court decision, Falco v. Institute of Living, 254 Conn. 321 (2000).

The Falco Case

In Falco, the state Supreme Court reaffirmed the strength of Connecticut's confidentiality protections for mental health treatment records and information and the strong public policy underlying them.

Plaintiff Falco, a former patient of the Institute of Living, sought the name, address and social security number of another former patient alleged to have attacked the plaintiff during their hospitalization. A trial court has ordered the Institute to turn over this information to enable the plaintiff to bring a civil assault action.

The Appellate Court affirmed, holding that courts could create exceptions beyond those expressly articulated in the statutory psychiatrist-patient privilege, Connecticut General Statutes section 52-146e, whenever deemed appropriate based on "important countervailing considerations." The Institute petitioned the Supreme Court, which agreed to hear the case and reversed the Appellate Court decision.

In considering both the language and purpose of Connecticut's psychiatrist-patient privilege, the Supreme Court concluded that section 52-146e prohibits disclosing even the identity of a patient unless the disclosure is expressly authorized under the statute's specific exceptions.

The Court stated: "The confidentiality of a patient's identity is as essential to the statutory purpose of preserving the therapeutic relationship as the confidentiality of any other information in a patient's communications and records. The statute recognizes the unfortunate reality that a stigma may attach to one who seeks psychiatric care, and that revealing a patient's identity may subject him or her to embarrassment, harassment or discrimination."

The Court also reiterated that "[t]he people of this state enjoy a broad privilege in the confidentiality of their psychiatric communications and records..." Based on this strong public policy and the narrow exceptions defined by the legislature in section 52-146f, the Court concluded that "the psychiatrist-patient privilege may be overridden only by legislatively enacted exception..."

Clear And Reliable Privacy Laws

The Falco decision was an important victory for the Institute of Living, which is devoted to protecting the confidential therapeutic patient relationship. The Court's decision strengthened the privilege for all patients and providers by assuring predictability and certainty in its application.

However, the Falco case also illustrates how easily health care providers and others holding confidential personal health information can get caught in the middle when a third party asserts a need for disclosure of protected information.

Both the holders of information and patients who entrust this information need laws that are understandable and reliable. Current state confidentiality laws reflect public policy considerations that strike a delicate balance between patient privacy and other important state interests such as public health and safety and the prevention of child abuse. The coming changes in federal and eventually Connecticut law will inevitably involve reexamining this balance.

During the next year, there will be many pressures and challenges on holders of personal health information subject to HIPAA. Implementing HIPAA will require an assessment of which state laws still apply, either because they are outside the areas governed by HIPAA, or because they afford more stringent privacy protections.

HIPAA, incorporates some new concepts and approaches and will require the development of many new policies and procedures. In addition, HIPAA has strong new penalties for wrongful disclosure of health information. For example, a person who knowingly and in violation of HIPAA obtains or discloses identifiable health information can be fined up to $ 50,000 and imprisoned for up to one year.

And HIPAA's changes will likely not be the only ones afoot.

In light of the public's concerns about health privacy and the power of states to create more stringent rules, we should expect a loud call for enactment of more state laws protecting personal health information. The HIPAA statute and proposed regulations have significant limitations and weaknesses which, unless addressed by Congress, can be strengthened by relying on state law.

For example, unlike Connecticut law, proposed HIPAA regulations provide no heightened protections for psychiatric or HIV-related information other than psychotherapy notes. Under the proposed HIPAA privacy regulations and without the Connecticut psychiatrist-patient privilege, a court order requiring the Institute of Living to disclose the information requested by Falco would have been lawful. In addition, the only entities directly covered by HIPAA will be health plans, health care providers, and health care clearinghouses. This omission of other important holders of personal health information, such as employers and schools, could be addressed through state law.

As members of the General Assembly and other state policymakers consider further defining and refining Connecticut's privacy laws, the need for clarity and confidence in the law that was behind the Supreme Court's decision in Falco should be a guiding principle. As a member of the Connecticut Law Revision Commission's recent Advisory Group on Confidentiality of Medical Records and otherwise, this author has urged policymakers to proceed carefully in enacting new confidentiality laws.

In order to avoid confusion and chaos, we first must evaluate the impact of final HIPAA privacy and security regulations on all of our existing confidentiality laws and then determine what further protections may be needed.

By taking the steps needed to develop a consistent, integrated, clear and rational scheme of privacy laws, we can preserve and further Connecticut's policies of assuring broad confidentiality protections.