Denver Law Review

Volume 79 Issue 4 Symposium - Article 9

December 2020

The of Medical Records - Balancing of Competing Expectations

Joel Glover

Erin Toll

Follow this and additional works at: https://digitalcommons.du.edu/dlr

Recommended Citation Joel Glover & Erin Toll, The Right to Privacy of Medical Records - Balancing of Competing Expectations, 79 Denv. U. L. Rev. 540 (2002).

This Article is brought to you for free and open access by Digital Commons @ DU. It has been accepted for inclusion in Denver Law Review by an authorized editor of Digital Commons @ DU. For more information, please contact [email protected],[email protected]. The Right to Privacy of Medical Records Balancing Competing Expectations byJoel Glover, Esq.& Erin Toll, Esq.

Introduction

Today, the right to privacy of medical iecords is seldom contested. A recent decision by the United States Supreme Court recognized our "reasonable expectation" that medical records are private. Courts permit claims fo- invasion of privacy where medical record information is disclosed. Tn addition, new federal regulations promulgated under the Health Insurance Portability and Accountability Act ("IIIPAA") are being implemented on the presumption that medical records are private and entitled toprotection- This article examines the development of that right to privacy and the related balancing of expectations in the federal courts and the Colorado courts. Even where privacy rights have been recognized, those rights often failin the balancing test when compared to society's legitimate interest in monitoring health care information. Finally, this article addresses the information that the HIPAA regulations 3 consider to be private and subject to protection. The law recognizes our two competing expectations regarding medical records7 privacy. First, we each expect our medical records to be private and confidential. Second, wc understand that privacy will be regularly invaded as a

540 I DENVER UNIVERSITY LAW REVIEW part of the health care system to support national independence of patients for whom Schedule II drgs arc priorities such as the protection of public health, health medically indicated is sufficient to constitute an invasion care research, health care quality monitoring, and the of any right or liberty protected by the Fourteenth prevention of crime, including health care . Amendment."' However, in rejecting a constitutional These competing expectations are reflected in the violation, the Court created the framework by which balancing tests established in the federal and state cases future courts would develop the right to privacy in and more recently, in the IIIPAA regulations. First, medical records. medical records are private, consistent with our In deciding that there was no privacy violation, the expectations. Second, our privacy expectation will be Court discussed two different types of individual privacy invaded as necessary to satisfy society's needs to utilize interests: (1)the interest in avoiding disclosure of health care information of the population to promote the personal matters; and (2) the interest in independence in public welfare. While HIPAA, at least in part, appears to making certain important kinds of decisions. 9 The be based on an attempt to codify case law, even after the program did not pose a sufficiently grievous threat to HIPAA regulations, a precise understanding of that either interest.( The Court concluded that any privacy balancing test can be elusive. As is evident from the case invasions would not be meaningfully distinguishable law, it often comes down to a case-by-case approach with "from a host of other unpleasant invasions of privacy that the balance typically favoring a limited invasion of our are associated with many facets of health care."I privacy expectations when societal interests outweigh our privacy needs. Nevertheless, disclosures of private medical information to doctors, to hospital personnel, I. Development of the right to privacy in to insurance companies, and to public health medical records. agencies are often an essential part of modern medical practice even when the disclosure may 4 A. 7he Whalen decision - an arguable righttoprivacvy reflect unfavorably on the character of the Over the last thirty years, the federal courts have patient. Requiring such disclosures to uniformly accepted the principal that medical records are representatives of the State having private and entitled to protection. The existence of a right responsibility for the health of the community, to privacy in medical records can be traced to the United States Supreme Court's decision in Whalen v. Roe.5 In some ways, the Whalen decision is an unusual authority to serve as the basis for such an important privacy right. In answering the question before it, the Court ruled that there was no constitutional violation and expressly did not decide whether there was a right to 6 privacy in medical records. Nevertheless, it is repeatedly cited as precedent for that right. The Whalen Court was presented with the question "whether the State of New York may record, in a centralized computer file, the names and addresses of all persons who have obtained, pursuant to a doctor's prescription, certain drugs for which there is both a lawful and an unlawful market.'7 The Court, in an opinion does not automatically amount to an drafted by Justice Stevens, answered the question impermissible invasion of privacy. 2 affirmatively and held that, "neitier the immediate nor the threatened impact of the patient-identification In essence, the Court balanced the two individual requirements in the New York State Controlled interests against the societal need to protect the public's Substances Act of 1972 on either the reputation or the health and to deter criminal activity. Although Wbalen

VOLUME . 79 ISSUE . 4 1 541 held that the mandatory disclosure of department to undergo psychological There can be no question that prescriptions and patient identities testing. Even in the absence of public an employee's medical records, was not a violation of privacy, the disclosure of the results, the district which may contain intimate Court also explained that "[tlhe right court determined that the "character facts of a personal nature, are to collect and use such data for and amount of information given to well within the ambit of public purposes is typically the Government alone is itself an materials entitled to privacy accompanied by a concomitant intrusion on the privacy interest in protection. Information about statutory or regulatory duty to avoid nondisclosure of personal one's body and state of health 3 unwarranted disclosures."' The information to government is a matter which the individual 1 Court then concluded that "in some employees recognized in Whalen."2 is ordinarily entitled to retain circumstances that duty arguably has As a result, the court required 4 Jersey within the "private enclave its roots in the Constitution." City to "justify the burden imposed where he may lead a private Although clearly identified as an on the constitutional right of privacy life.'25 issue "not decided" by the Court, by the required psychological As is evident from the quotation, 22 subsequent cases nevertheless relied evaluations." After confirming a Weslinghouse was one of the first on Whalen's reasoning to develop right to privacy, the court determined cases to accept explicitly Justice what has become a generally that there was "sufficient support to Stevens' "argument" that medical accepted right to privacy in medical conclude that the psychological records may be subject to records, evaluation and hiring procedure constitutional protection. While the Shortly after Whalen, two district taken as a whole [was] useful and court noted "there can be no courts implicitly adopted Justice effective in identifying applicants question" of this right, there was also Stevens' analysis that the right to whose emotional make-up makes no previous judicial authority that 26 privacy in medical records arguably them high risk candidates for the job could be cited for that proposition. 23 has its roots in the Constitution, of fire fighting." As in Whalen, the In the absence of judicial decisions although in both cases the right to court balanced the individual's for authority, the Third Circuit relied privacy did not prohibit disclosure. privacy interests against society's on a law review article and In one of the first district court interest in having a psychologically protections for medical records in the decisions to rely on Whalen, an sound fire department. Federal Rules of Civil Procedure and 27 employer, du Pont, raised the right to the Freedom of Information Act. privacy argument as a defense to a B. The Third Circuitaccepts the right Seven years later, relying on its own subpoena seeking employee health to privacy in medical records. Westinghouse decision, the Third A federal appellate court soon

th.iticutCuto peal concude that,

untorl0uauulo. I lie eipIoyer - argued that the medical records / Circuit again recognized the right to of its employees were protected Nprivacy in medical records.28 In by a constitutional right of 1995, the Third Circuit relied on privacy and thus could not be /the Westinghouse declsion to 6 disclosed.' Relying on Whalen, the conclude that records of district court inplicitly accepted that prescription medications are a right to privacy in medical records followed . private.2 9 "An individual using 7 existed.' Accordingly, the issue was suit, prescription drigs has a right to "not whether a right of privacy exists identifying a right to ' ' expect that such information will respecting the information sought, privacy in medical customarily remain private. "30 but rather whether the record records though typically finding in indicates that such right will be favor of the invasion of that right. In C. A division among the circuits on 8 abridged."' Although the court one of the first decisions by a circuit the right loprivacy in upheld the subpoenas over the right court of appeals upholding a right to medical records. to privacy claim, the court echoed privacy in medical records, the Third Although the Third Circuit adopted Justice Stevens' concern in Whalen Circuit Court of Appeals relied on the Justice Stevens' argument, the Sixth that unwarranted disclosure of the Whalen decision to conclude that Circuit did not follow suit. Without there is medical records could violate the a protected privacy right "not citation to Westinghouse or Whalen, 19 to have an individual's private affairs Constitution. 24 the Sixth Circuit Court of Appeals by the government." Just a year later, in McKenna v. made public concluded that, "[disclosure of 20 Fargo, a district court considered a The Third Circuit concluded that plaintiff s medical records does not program in which Jersey City medical records fall within one of the rise to the level of a breach of a right required applicants for its fire zones of privacy entitled to protection: recognized as 'fundamental' under

542 I DENVER UNIVERSITY LAW REVIEW 31 the Constitution." medical deterninations. 38 The complete employee medical records This difference of opinion among plaintiffs were seeking to challenge a needed to be turned over to the the circuits was brought to the United federal statute limiting Medicare government in response to a States Supreme Court's attention by a payments for certain cataract subpoena issued Linder the decision of the Fourth Circuit Court services. 39 Plaintiffs maintained "that Occupational Safety and Health 44 of Appeals. In Ferguson v.City of the right to privacy protects patients' Act. The court found that "the 32 Charleston, the Fourth Circuit interest in procuring the treatment of interest in occupational safety and expressly noted the division among choice" and insisted that "all medical health to the employees inthe the circuits, as follows: treatment decisions are protected particular plant, employees in other from state interference because they plants, future employees and the Although the Supreme Court are inherently private and peculiarly public at large is substantial.45 The addressed a claim to a right of 'personal.'"4° The court concluded court also relied on the security privacy in medical records in that "[tihere is no basis ulnder current measures that would be taken to Whalen, it declined to decide privacy case law for extending such protect against the disclosure of the whether such information stringent protection to every decision informration.46 Recognizing that there merits constitutional privacy bearing, however indirectly, on a may still be privacy concerns, the protection. See Whalen, 429 person's health and physical well- Court permitted employees the UI.S.at 605-06. And, the being."4' opportunity to raise a personal claim circuit courts of appeals are 4 7 33 of privacy. divided on this issue. II. Application of a balancing test The Third Circuit has repeatedly to privacy rights in medical utilized these Westinghouse factors to Although the Uinited States records. Supreme Court reversed and conclude that the balance favors of remanded the Fourth Circuit's Even in the cases where medical invasion the privacy right in decision in Ferguson, the Court did records were considered within a medical records. For example, in In not address the division of authority zone of privacy, that privacy was re:,48 the Third noted among the circuits, Instead, it nearly always invaded after Circuit concluded the balance acknowledged an "expectation of application of a balancing test to favored disclosure of medical records privacy" in medical records, as determine whether the "societal where the patients were already follows, "[t]he reasonable expectation interest in disclosure outweighs the known through insurance of privacy enjoyed by the typical privacy interest on the specific facts submissions and separate 4 guard patient undergoing diagnostic tests in of the case." According to the Third mechanisms existed to against

a hospital is that the results of those Circuit, the factors to be considered tests will not be shared with in deciding whether an intrusion into disclosure and to maintain the confidentiality of the records. 49 nonmedical personnel without her an individual's privacy is justified are: As . "34 The Court did not well, in FraternalOrder of Police v. indicate whether this expectation of [The type of record Philadelphia,[0the Third Circuit privacy was protected by the requested, the information it again concluded that the balance does or might contain, the favored the goverment's need fo Constitution, as had been "argued" 5 1 by Stevens in Whalen. potential for harm in any the medical records. subsequent nonconsensual D. No right toprivacy in making disclosure, the injury from Because the medical medical decisions. disclosure to the relationship information requested is The Westinghouse line of authority in which the record was directly related to the interest and the Fergusondecision focus on generated, the adequacy of of the police department in the first type of privacy identified in safeguards to prevent selecting officers who are Whalen, that is avoiding disclosure of unauthorized disclosure, the physically and mentally personal matters. 35 The second type degree of need for access, capable of working in of privacy identified in Whalen is and whether there is an dangerous and highly independence in making certain express statutory mandate, stressful positions, important kinds of decisions. 6 it has articulated public policy, or sometimes over long periods not received much, if any, support other recognizable public of time, and because police from the courts. For example, in New interest militating toward officers have little reasonable 43 York State OphtbalmologicalSociety access. expectations that such v. Bowen,37 the court determined that medical information will not In lVeaslinghoue, the court balanced there was no right to privacy in be requested, we hold that the factors and conclided that questions 18 [physical

VOLUME . 79 ISSUE, 4 I 543 7 defects], 19 [prescription medical records but found in favor of authorized by a court. i drugs] and 20 [mental or the government's interest in psychiatric condition] do not 63 reviewing that information. In that III. unconstitutionally The right to privacy in impinge case, patients were attempting to upon the applicants' privacy medical records in Colorado. 52 keep a regulatory body from interests, reviewing the medical records Various states, including Colorado, maintained by their doctor.64 The Finally, in SEPTA, the court have adopted an approach to privacy court focused on the purpose of the concluded that the right to privacy in based on the federal courts' 53 information and the safeguards, as medical records was not absolute. approach. More than twenty years follows: In that case, an employer learned that ago, in a case not specifically related one employee suffered from an HIV- to medical records, the Colorado Given the Board's mission of related illness when the employer Supreme Court adopted the Whalen identifying physicians who reviewed medical records that gave privacy analysis, and performed a engage in immoral or each employee's name and listed the balancing test to invalidate a state unprofessional conduct, and 72 prescription drugs each employee agency's regulation. Several life the Board's goal of purchased through a prescription insurance agents brought suit to preventing future drug program. 54 In its review, the enjoin the Colorado Division of misconduct, courts in this court concluded that audits of drug Insurance's enforcement of a Circuit would most likely information, in the aggregate, are regulation requiring them to notify a find that the Board's activity essential to the public interest 55 The life insurer whose insurance was furthers a compelling state review of the identity of the being replaced of the proposed interest, Moreover, because employee and his medication was replacement, even when the insured Maryland's statutory not a violation of the employee's specifically requested that the restrictions against 73 privacy largely because it was transaction remain confidential. disclosure of medical unintentional. 56 The employer did Acknowledging that the United records are adequate to not ask for the employee's identity States Constitution does not explicitly protect the Patients from from the drug company.57 mention any right to privacy, the widespread disclosure, In concluding that the balance Colorado court, citing several United courts in this Circuit would favors disclosure, other courts have States Supreme Court cases, found most likely find no relied on the purpose of the that the right to privacy is implicit in constitutional violation 65 disclosure in order to override the various Constitutional amendments, privacy rights. For example, in 1985, 66 including the First, Fourth, Fifth, In In Re: Subpoena Duces Tecum, the District Court for New Jersey Ninth, and Fourteenth Amendments the court considered challenges to 74 concluded that the privacy interests and the Bill of Rights. The Colorado four subpoenas issued arising from in medical records were not absolute court adopted the Whalen definition an investigation into federal health and needed to be balanced against of two types of privacy interests: "1) care offenses. 67 The doctor argued the legitimate interests of the state in the individual interest in avoiding 58 that his patients' privacy interests in securing such information. In disclosure of personal matters; and 2) their medical files outweigh the Shoemaker, jockeys were required to 68 the individual interest in making government's interest in those files. disclose illnesses or conditions for certain kinds of important The court rejected the argument 75 which a particular drug had been decisions." The court found that the because the government has a prescribed or used. 59 However insurance regulation clearly invaded compelling interest in identifying access to the information was the insured's interest in avoiding illegal activity and in deterring future 76 limited.60 In concluding that the disclosure of personal matters. The misconduct.69 That interest balance favored the interests of the Colorado court enjoined outweighs the privacy rights of those state, the court focused on the enforcement of the regulation but whose records were turned over to purpose, noting that "[s]uch noted that "a burdensome regulation the government, particularly in light information is gathered with may be validated by a sufficiently of the protections associated with the 77 'rehabilitative' and not 'penal' compelling state interest." "A subpoena. 71 The subpoena purposes in mind.' 61 Another generalized concern for protecting prohibited use of disclosed example is Patientsof Dr.Barbara the public from unscrupulous information except as directly related Solomon v. Board of Physician practices or misrepresentations by to receipt of health care, payment for QualityAssurance. 62 There, the court replacing insurers is outweighed by health care, a fraudulent claim acknowledged a privacy interest in the insured's request for related to health care or as nondisclosure. 78

544 1 DENVER UNIVERSITY LAW REVIEW Seven years later, without cases, the emphasis in Colorado has others at the office. 94 Because there discussion of the constitutional been on the first interest expressed in was a reasonable belief that the other aspects of the right, the Colorado Whalen, that of avoiding disclosure individuals needed to review the Supreme Court implicitly recognized of personal matters, as opposed to report, the court ruled that the a right to privacy regarding medical the second interest of independence 7 9 employer was not liable, even information. Respondents were in making certain kinds of decisions. though the situation could "have recipients of donated blood infected been handled in a more sensitive with the AIDS virus.80 They sought IV. Privacy rights in medical 9 way." 5 disclosure of the identities of each of records give rise to a tort Other cases have resulted in the the donors whose blood was used claim for invasion of privacy. employer's liability for invasion of and production of all of the donors' privacy. For example, in Levias, the records in order to pursue their The Whalen and Westinghouse 81 medical examiner for an employer claims. The blood center asserted decisions address medical records' (United Airlines) received a report that compelling public policy right of privacy in the context of from a flight attendant containing grounds, including the maintenance government actions. However, courts details of contemplated of the supply of volunteer blood and have also recognized that the private gynecological surgery.9 6 The medical the privacy interests of volunteer sector may be liable for claims for blood donors, prohibited disclosure examiner disclosed most of that 82 violating privacy with respect to identities. 88 information to the flight attendant's of the donors' medical records. Even in cases male flight supervisor, who had no The court performed a balancing where there was no liability, a court test and determined compelling reason to know it, and to that the blood would not rule out the possibility that donors had a "privacy interest in the employee's husband.9 7 The flight instances may exist where the remaining anonymous and avoiding supervisor repeatedly contacted her collection of highly personal the embarrassment and potential to discuss the details of her medical information irrelevant to any humiliation of being identified as condition and its effect on her 83 legitimate business purpose might AIDS carriers." The blood center, employment. 98 The flight attendant constitute an invasion of privacy by and society as a whole, had "an had not authorized the medical unreasonable intrusion.8 9 interest in maintaining the availability examiner to disclose any of that The state law claim of invasion of of an abundant supply of volunteer information, and she considered it 84 privacy generally requires the blood. " The petitioners had an highly personal. 99 The court upheld a their claims.8 5 plaintiff to establish: "1) an intrusion interest in pursuing claim (for compensatory upon her seclusion or solitude or in Therefore, the court tailored a limited damages but not punitive damages) discovery procedure her private affairs; 2) a public designed to for the flight attendant, concluding provide the respondents with tie disclosure of embarrassing private that it was "doubtful that either the information without risking the facts; 3) publicity which places her in flight attendant's supervisors or her consequences of public disclosure of a in the public eye; or 4) an husband had a real need to know the the donors' identities or infringing appropriation, for the defendant's disclosed data." 10 upon society's interests in a safe, advantage, of the plaintiff's name or 86 As another example, in Colorado, adequate, voluntary blood supply. likeness." 90 While medical records in a case of first impression, the While no constitutional authority was often trigger privacy interests, the Colorado Supreme Court recognized cited, the Belle Bonfils case indicated communications may be considered a tort claim for invasion of privacy "in that Colorado courts would privileged where the following the nature of unreasonable publicity recognize a right to privacy elements are satisfied: "1) good faith; given to one's private life," in the concerning medical information, but 2) an interest to be upheld; 3) a context of medical information.IrI that this right must be balanced by statement limited in its scope to this the societal interest The court determined that disclosure in disclosing the purpose; 4) a proper occasion; and 5) of "disgraceful illnesses" are information. publication in a proper manner and Although the Colorado 9 1 considered private in nature and courts have to proper parties only." not explicitly applied the Wbalen disclosure of such facts constitutes an In Ross, an employee had analysis to medical information, invasion of the individual's right of complaints about working under 102 when considering privacy interests, privacy. fluorescent lights. 92 The employer the courts recognize a right to Though admittedly based on a required her to see the agency's privacy regarding medical different test, the court's recognition doctor, a psychologist. 93 The information, and balance the of a tort claim for invasion of privacy employee authorized the doctor to individual's privacy interests with based on medical records generally forward a copy of the psychological society's interest in obtaining the appears to track the approach set 87 evaluation to one individual, who information. As with the federal forth in Whalen and Westinghouse. then distributed the report to three continuedonpage 553

VOLUME . 79 ISSUE . 4 I 545 continuedfrompage545 electronic technologies. The absence continuedfrom page518 The courts recognize a privacy of national standards for the Californiav. Ciraolo24, the Court held interest in medical records and then confidentiality of health information that an overflight of the defendant's balance that interest against various has made the health care industry property by a police airplane did not legitimate purposes associated with and the population in general amount to a search, on the unusual disclosing that information. uncomfortable about this primarily ground that the plane was in FAA financially-driven expansion in the approved air space. The Court's V. The HIPAA regulations use of electronic data.""' The HHS rationale for this rule was that no adopt and seek to implement focused on one of the same concerns expectation of privacy could be the privacy interests and that was recognized by various reasonable, as "[alny member of the balancing tests developed in courts, the consequences of sharing public flying in this airspace who the various cases. information without the knowledge glanced down could have seen 12 of the patient involved." everything that these officers 25 In 1996, Congress enacted the In concluding that "privacy is a observed." Here, the individual's Health Insurance Portability and fundamental right," HHS looked to fault is not conveying information Accountability Act ("HIPAA"). 13 judicial authority and, in particular, to to a third party, but failing to properly Among other things, HIPAA required the Whalen decision. 113 In several safeguard his property: Congress to enact new safeguards to aspects, the HIPAA regulations have protect the security and followed the guidance from the That the area is within the confidentiality of health care federal courts. 114In relying on this does not itself bar information. Congress failed to do so, federal authority, HHS did not all police observation. The requiring the Department of Health specifically address the fact that the Fourth Amendment and Human Services ("HHS") to judicial authority it cited related to protection of the home has promulgate regulations for such the right to privacy from the never been extended to 10 4 protections In November of 1999, perspective of government actors require law enforcement HHS published proposed regulations rather than the private sector, which officers to shield their eyes and, during the comment period, is not subject to the constitutional when passing by a hone on 15 received 52,000 communications restrictions. 1 public thoroughfares. Nor 1 0 5 from the public In December There are several principles from does the mere fact that an 2000, HHS issued the final rule that the federal decisions that are individual has taken took effect on April 14, 2001,106 reflected and expanded in the HIPAA measures to restrict some However, most covered entities have regulations. First, the cases generally views of his activities until April 14, 2003 to comply with accept that there is an expectation of preclude an officer's 10 7 the final rule's provisions. The privacy in medical records, although observations from a public HIPAA regulations are intended to the extent to which it reaches a vantage point where he has a right to be and which renders establish a set of basic national constitutionally protected right may 6 6 visible.2 privacy standards to serve as a floor be debated.11 In promulgating the the activities clearly of ground rules for health care regulations, HHS characterized providers, health plans and health privacy as a "fundamental right" and In its most recent Fourth 108 care clearinghouses to follow. concluded that the "United States Amendment case, Kyllo v. United 27 In promulgating the regulations, Supreme Court has upheld the States, the Court held that the use of HHS considered the need for privacy constitutional protection of personal thermal imaging technology to 117 of medical records to be great. 10' The health information" in Wbalen. measure the heat coming off of a HHS recognized a "growing concern" Second, the HIPAA regulations focus dwelling was a search subject to the stemming from several trends, on the first type of individual privacy requirements of the Fourth "including the growing use of protection identified in Whalen, the Amendment. The Court held that 18 because the device provided details interconnected electronic media for protection for medical records. about the interior of a home that business and personal activities, our The HIPAA regulations do not seek to could not otherwise be obtained increasing ability to know an protect medical decision-making, an without trespassing into the home individual's genetic make-up, and, in interest also largely ignored by the and because the device had not yet health care, the increasing courts.119 Third, the HIPAA entered into general use, its use complexity of the system."" 0) Unless regulations acknowledge that the constituted a search. 28 The flip-side of those public concerns were allayed, right to privacy "is not absolute" and this argument appears to be that had the HHS believed we would be must be balanced against legitimate the device used by the police "unable to obtain the full benefits of continued onpage556 continued onpage 574

VOLUME . 79 ISSUE . 4 I 553 continuedfrompage 553 characteristics 126 locating 2 ° a suspect, fugitive, public uses of that information.' Similar to the balancing test from material witness or missing However, steps must be taken to 30 judicial decisions, the regulations person. ensure that the balancing does not This list focuses on many of the result in unnecessary privacy identify many situations where the "protected purposes identified in the federal breaches. 121 health information" may case law as appropriate and Initially, the HIPAA regulations be disclosed, even without consent, seek to implement necessary societal uses of medical these principles so long as it Is required by law and with its definitions. The regulations records. As noted by justice Stevens the use or disclosure complies with protect the defined term "protected in Whalen, disclosures for these health information" by generally and is limited to the relevant types of purposes are those 127 "unpleasant limiting the use of that information to requirements of law. Similar to the invasions of privacy that the individual or with the individual's federal case law, appropriate are associated with many facets of consent."a That key phrase - disclosures are determined based on health care. "'31 The HIPAA protected health information -is regulations seek to implement the their purposes and scope of based on another defined phrase, 12 29 courts' case-by-case analysis by disclosure. Some examples of "individually identifiable health itemizing those instances where information. ",123 In turn, "individually permitted disclosures include: society's needs outweigh the identifiable health information" is individual's privacy rights. While the defined as a subset of health To a public health authority regulatory approach provides more information, including demographic to prevent or control specificity, it also lacks the flexibility information collected from an disease or injury; individual that: that would be exercised by a court enforcing the existing case-by-case (1) Is created or received by To a public health authority a approach. However, that specificity health care provider, health authorized by law to plan, employer or health may provide greater certainty and receive reports of child care clearinghouse; and predictability, which are critical for abuse or neglect; (2) Relates to the past, the entities subject to HIPAA. present, or future physical or To a person who may have mental health or condition of Conclusion an individual; the provision been exposed to a of health care to communicable disease or an The right to privacy in medical individual; or the past, may otherwise be at risk of records is balanced against society's present or future payment contracting or spreading a expected invasions of privacy related for the provision of health disease or condition; to health care. Our expectation of care to an individual; and privacy in (i) That identifies the To a social service agency those records has never been seriously contested. Federal individual; about a victim of abuse, courts have consistently reached that (ii) With respect to neglect or domestic conclusion without the need for which there is a violence, if required by law reasonable basis to precedent. However, those and if the individual rights believe the often fail in the balancing test or if there is a against information can be society's interests. The extent to belief that disclosure is used to identify the which the privacy expectation rises 124 necessary to prevent individual. serious harm to individuals; to a constitutional right has not yet However, health information that been resolved and may never be does not identify an individual or resolved, The HTPAA regulations permit identification of the individual To a health oversight attempt to adopt the balance does not meet the definition of agency for oversight "identifiable health information."1 25 activities authorized by established by the courts, by In order to satisfy this exclusion, law; protecting medical records and numerous identifiers must be protecting society's legitimate uses of removed, including identifiers such To a law enforcement the health care information. as names, dates, numbers, addresses official's request for the and any unique identifying purpose of identifying or E

556 1 DENVER UNIVERSITY LAW REVIEW