HHS sued over medical privacy rules

The lawsuit by the South Carolina Medical Assn. alleges that by creating regulations without adequate guidance from Congress, the agency exceeded its constitutional authority.

By Amy Snow Landa, AMNews staff. Aug. 6, 2001.

Washington -- The South Carolina Medical Assn. has sued the Dept. of Health and Human Services in an effort to halt federal medical privacy regulations that the Bush administration allowed to take effect earlier this year.

The SCMA suit, filed July 16 in the U.S. District Court for the District of South Carolina, Columbia Division, alleges that HHS violated the Constitution by crafting patient privacy regulations with virtually no guidance from Congress, thereby assuming powers constitutionally delegated to the legislative branch.

The Health Insurance Portability and Accountability Act of 1996 directed HHS to issue medical privacy regulations if Congress did not pass comprehensive health privacy legislation within three years. When Congress failed to pass a bill by the deadline, the agency began crafting regulations that, after an extended comment period, took effect earlier this year.

By allowing HHS to "act as federal legislators" in drafting and enacting the patient privacy regulations, Congress abdicated its lawmaking role, the suit states.

"We're fighting this to enforce the Constitution," said SCMA President J. Capers Hiott, MD. "If we win, [medical privacy] is going to get thrown back into the Congress. Then at least we can have some input with our ... representatives. With the bureaucratic arm, we have no input at all."

In its suit, the SCMA is also challenging HIPAA on the grounds that it provides an "impermissibly vague" preemption for states that already have enacted patient privacy laws. The suit asks the court to overturn a clause in HIPAA stating that federal patient privacy regulations shall not supersede a contrary provision of state law if the state law is "more stringent" than the federal one. [...]