Law Office of William Most
637 Kerlerec Street ♦ New Orleans, LA 70116
650-465-5023

williammost@gmail.com
MEMORANDUM

TO:

File

FROM:

William Most

RE:

Louisiana DPS&C HIPAA Lawsuit

DATE:

March 2, 2016

Question Presented:

Has the LA Department of Public Safety and Corrections violated HIPAA by refusing to
give inmates access to their their medical records? And if so, can we enforce it by means
of § 1983?

Short Answer:

Yes to the first question, no to the second. Every case I’ve seen that directly addresses the
question says that 1983 cannot be used as a vehicle to enforce HIPAA violations.
DISCUSSION

I.

HIPAA’s Privacy Rule

“The Health Insurance Portability and Accountability Act of 1996 (HIPAA), which provides for the
promulgation of privacy regulations (the HIPAA Privacy Rule)1 is the key federal law that shapes the legal
environment underlying health information-sharing in correctional contexts. HIPAA provides a baseline standard
of privacy protection for health information—federal and state laws that offer more stringent privacy protections
are not superseded by the Privacy Rule.2” (Melissa Goldstein, Health Information Privacy in the Correctional
Environment (April 2012).)
Relevant portions of the Privacy Rule:
45 C.F.R. 164.524
(a) Standard: Access to protected health information
(1) Right of access. Except as otherwise provided in paragraph (a)(2) or (a)(3) of this section, an individual
has a right of access to inspect and obtain a copy of protected health information about the individual in a
designated record set, for as long as the protected health information is maintained in the designated
record set, except for:
(i) Psychotherapy notes; and
(ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative
action or proceeding.
(2) Unreviewable grounds for denial. A covered entity may deny an individual access without providing the
individual an opportunity for review, in the following circumstances.
(i) The protected health information is excepted from the right of access by paragraph (a)(1) of this
section.
(ii) A covered entity that is a correctional institution or a covered health care provider acting under the
direction of the correctional institution may deny, in whole or in part, an inmate's request to obtain a
copy of protected health information, if obtaining such copy would jeopardize the health, safety,
security, custody, or rehabilitation of the individual or of other inmates, or the safety of any officer,
                                                            

1
2

45 C.F.R. §§ 160, 164
45 C.F.R. § 160.203. 

March 2016
HIPAA Memorandum

employee, or other person at the correctional institution or responsible for the transporting of the
inmate.
...
(b) Implementation specifications: Requests for access and timely action
(1) Individual's request for access. The covered entity must permit an individual to request access to
inspect or to obtain a copy of the protected health information about the individual that is maintained in a
designated record set. The covered entity may require individuals to make requests for access in writing,
provided that it informs individuals of such a requirement.
(2) Timely action by the covered entity.
(i) Except as provided in paragraph (b)(2)(ii) of this section, the covered entity must act on a request
for access no later than 30 days after receipt of the request as follows.
(A) If the covered entity grants the request, in whole or in part, it must inform the individual of
the acceptance of the request and provide the access requested, in accordance with paragraph
(c) of this section.
(B) If the covered entity denies the request, in whole or in part, it must provide the individual
with a written denial, in accordance with paragraph (d) of this section.
Note: The section about incarcerated inmates left out the word “inspect.” Incarcerated inmates may be
denied a copy of their records, but the relevant section does not say they can’t inspect their records.
“As explained by the drafters of the Rule, the purpose for the exception, and the reason that the exception
is limited to denying an inmate a copy of the PHI, is to “give correctional institutions the ability to maintain order
in these facilities and among inmates without denying an inmate the right to review his or her protected health
information.” (Health Information Privacy in the Correctional Environment, citing Department of Health and
Human Services, Final Rule, Preamble, 65 Fed. Reg. at 82555.)
II.

Relevant State Law and Prison Policies

DOC has a number of overlapping and contradictory policies. (Compare HC-33 § 11(A) (“Medical
records . . . shall be available to anyone having a legitimate interest”) with HC-25 § 5(b)(3) (“Persons who are not
direct health care providers shall not be given access to health records/information of an offender.”).)
A.

State Law Equivalent – 1299.96

A.

R.S. 44:7 Hospital records

C. Whenever the past or present condition, sickness or disease, physical or mental, of any patient treated
in any hospital, adult or juvenile correctional institution, center or school, set forth in Subsection A of this Section
shall be at issue or relevant in any judicial proceeding, the charts, records, reports, documents and other
memoranda referred to in said Subsection A shall be subject to discovery, subpoena and introduction into
evidence in accordance with the general law of the state relating to discovery, subpoena and introduction into
evidence of records and documents.
B.

22 LAC § 101(H)(1):

2
 

March 2016
HIPAA Memorandum

“Access to and release of medical records is governed by R.S. 44:7 and Health Care Policy No. HC-33
“Offender Medical Records.”
C.

Department Regulation No. B-03-004 (20 January 2009)

“Access to and release of medical records is governed by La. R.S. 44:7 and Health Care Policy No. HC33 ‘Offender Medical Records.’”
D.

Health Care Policy No. HC-33 “Offender Medical Records”

§ 6(B): “Medical information shall not be disclosed to anyone except in accordance with Health Care
Policy No. HC-25 ‘Confidentiality’ and applicable state and federal law.”
§6(E): “Offenders shall not be allowed access to their medical record or the medical record of other
offenders unless authorized by the Warden or designee.”
§ 11(A): “Medical records, except psychiatric records (which includes any psychological or mental health
records), shall be available to anyone having a legitimate interest, provided the offender or in case of death, the
legal heir or next of kin, has consented in writing to their release utilizing the Authorization to Release Medical
Information (Form HC-33-A). Upon receipt of advance payment of the copying charges, the medical records shall
be released.
§ 11(H): The Department does not conduct covered transactions defined in the Health Insurance and
Portability Act of 1996 (HIPPA) [sic] and therefore, is not a “covered entity’ under HIPPA.
E.

Health Care Policy No. HC-25 “Confidentiality”

§ 5(b)(3): “Persons who are not direct health care providers shall not be given access to health
records/information of an offender. Any disclosure of such health information shall be approved by the Health
Authority.”
§ 5(b)(8): “Only the information necessary to preserve the health and safety of an offender, other
offenders, volunteers, visitors or correctional staff shall be released regarding an offender’s health status.”
To Get:
 Authorization to Release Medical Information (Form HC-33-A).
 Health Information Disclosure Reference Chart (attachment to HC-33)
III.

Is the DOC A Covered Entity?

The DOC claims it isn’t. (HC-33 § 11(H): “The Department does not conduct covered transactions
defined in the Health Insurance and Portability Act of 1996 (HIPPA) [sic] and therefore, is not a “covered entity’
under HIPPA.”)
But, in its contracts with hospitals, it says “Each party agrees to comply with [HIPAA] . . . including,
without limitation, the federal privacy regulations contained in 45 C.F.R. Parts 160 and 164 . . . 142” (Bruce
Reilly Files “Payments, reimbursements, Medicaid” at 307-308.)
3
 

March 2016
HIPAA Memorandum

According to one commentator:
In response to the initial version of the Privacy Rule, which would have excluded the individually
identifiable health information of correctional facility inmates from the definition of PHI because
“unimpeded sharing of inmate identifiable health information is crucial for correctional and detention
facility operations,”3 DHHS received many, ultimately persuasive, comments arguing that excluding
such information from protection sends the message that, with respect to this population, abuses do not
matter. Commenters argued that, on the contrary, inmates have a right to privacy in their health
information and that information obtained in these settings can be misused. . . The drafters of the final
regulation were persuaded by these arguments and eliminated the exception.4 . . .
Guidance produced by the Centers for Medicare and Medicaid Services indicates that such institutions
therefore are not health care clearinghouses or health plans within the meaning of the Rule.5 A
correctional institution’s status as a covered entity would then depend solely on its qualification (or lack
thereof) as a health care provider who transmits health information in electronic form in connection with a
covered transaction. That is, if the organization “furnishes, bills, or is paid for health care in the normal
course of business”6 and transmits information in electronic form in connection with one of the following
eight types of transactions, it is a covered entity and must comply with HIPAA: health care claims or
equivalent encounter information; eligibility for a health plan; referral certification and authorization;
health care claim status; enrollment and disenrollment in a health plan; health care payment and
remittance advice; health plan premium payments; and coordination of benefits.
Although correctional institutions are not likely to engage in most of the transaction types specified by the
regulations, it is conceivable that one might transmit clinical encounter information for the purpose of
reporting health care; request review of health care in order to secure an authorization; and/or receive
payment of health care claims from a private or public health plan. If the correctional institution
electronically transmits one of these transactions or has a contract with another provider who transmits
the health care information electronically, it will be required to comply with HIPAA.7
Melissa M. Goldstein, Health Information Privacy in the Correctional Environment (April 2012).
https://www.statereforum.org/system/files/hit_corrections.pdf

                                                            
3

Department of Health and Human Services, Standards for Privacy of Individually Identifiable Health Information; Proposed
Rule, 64 Fed. Reg. 59918-60065, 59938 (November 3, 1999).
4
Department of Health and Human Services, Standards for Privacy of Individually Identifiable Health Information; Final
Rule, Preamble, 65 Fed. Reg. 82462-82829, at 82540-82541, 82622 (Dec. 28, 2000).
5
See US Department of Health and Human Services, Centers for Medicare and Medicaid Services (CMS). Covered Entity
Charts: Guidance on How to Determine Whether an Organization or Individual is a Covered Entity Under the Administrative
Simplification Provisions of HIPAA, http://www.cms.gov/HIPAAGenInfo/ Downloads/CoveredEntitycharts.pdf (accessed
March 2012).
6
“Health care provider” is defined as “a provider of services (as defined in section 1861(u) of the Act, 42 U.S.C. 1395x(u)), a
provider of medical or health services (as defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or
organization who furnishes, bills, or is paid for health care in the normal course of business.” 45 C.F.R. § 160.103.
7
45 C.F.R. §§ 162 Subparts J-R; See CMS, Covered Entity Charts 

4
 

March 2016
HIPAA Memorandum

Source: Corrections, Law Enforcement & the Courts
We know that at least LSP uses the Eceptionist electronic system to schedule surgeries for patients. (E.g.,
Eceptionist Doc.) This may constitute a “referral certification, authorization.” Also, LSP participates in a
telemedicine program. More investigation is necessary here to determine whether these activities bring the DOC
within the scope of HIPAA.
There may be other ways of the DOC being covered. According to another commentator:
If the correctional institution does employ its own health care providers (including psychiatrists,
psychologists, etc.) and, say, checks a prisoner’s eligibility to receive Medicare, Medicaid or veteran’s benefits
with the intent of taking advantage of those health plan benefits (all of these referenced “plans” are
governmental but are specifically defined as covered entity health plans pursuant to HIPAA) to offset the costs
to the correctional institution and eligibility is checked through a web site, the correctional institution (or at
least the health care part of the correctional institution) would be a covered entity health care provider pursuant
to the HPAA Administrative Simplification Provisions because eligibility verification is a HIPAA transaction
and HIPAA specifically allows the use of web based transactions instead of batch transactions (it is called
direct data entry or DDE).
If the correctional institution medical staff check eligibility via a web site, this would make the
correctional institution a hybrid entity – part covered by HIPAA and part not. Even if state laws allow
correctional institution to withhold certain healthcare information, HIPAA would trump because it provides the
correctional institution, as an individual, greater access to his or her medical information (considered more
stringent than state law). All states have differing laws around health care information and prisoners as it
relates to the release of medical records. If the prison is found to be a hybrid entity, though, they cannot
withhold the mental/behavioral health information relating to the prisoner’s treatment. See 45 CFR
164.512(k)(5)(ii).
(Chris Apgar, HIPAA – Even States Must Comply.)
5
 

March 2016
HIPAA Memorandum

IV.

DOC’S Violations of HIPAA

Assuming the DOC is covered by HIPAA, some provisions of the DOC policies may be facial violations
of HIPAA’s Privacy Rule. (E.g., HC-25 § 5(b)(3): “Persons who are not direct health care providers shall not be
given access to health records/information of an offender.”)
DOC practices may also violate the Privacy Rule. The DOC’s failure to respond at all to requests for
medical records access should violate 45 C.F.R. 164.524(b)(2)(i) (“the covered entity must act on a request for
access no later than 30 days after receipt of the request”). Or, if the DOC is denying requests without a
individualized assessment of the risk associated with records disclosure, it is likely violating 45 C.F.R.
164.524(a)(2)(ii).
V.

Can We Use 1983 As a Cause of Action for the DOC’s HIPAA Violations?

No. Every case I’ve seen that directly addresses the question says that 1983 cannot be used as a vehicle to
enforce HIPAA violations.
A.

Background

“While HIPAA imposes a host of obligations on covered entities in an attempt to increase patient privacy,
it does not explicitly create any individual rights for patients affected by medical privacy violations. Therefore, a
patient who has been seriously harmed as a result of these privacy leaks cannot bring a lawsuit against the
responsible party.” Joshua Collins, Toothless HIPAA: Searching for a Private Right of Action to Remedy Privacy
Rule Violations, Vanderbilt L. Rev. Vol. 60:1:199 (January 2007.)
Since Thiboutot, § 1983 has played an important role in the enforcement of private rights
by empowering private citizens to bring actions against those who are not in compliance with
constitutional or statutory requirements. However, the Court has chipped away at Thiboutot’s
broad interpretation of § 1983, a trend culminating in Gonzaga University v. Doe8 and City of
Rancho Palos Verdes v. Abrams.9
...
Plaintiffs seeking to use § 1983 to redress Privacy Rule violations must allege that
HIPAA gives them the right to medical privacy and that the defendant deprived them of this right
by disclosing their private medical information. However, the Supreme Court’s trend toward
limiting the applicability of § 1983 makes it doubtful that a plaintiff could successfully use §
1983 to enforce a violation of HIPAA’s Privacy Rule. The Privacy Rule ostensibly lacks the
explicit rights-creating language that the court required in Gonzaga. Additionally, Abrams poses a
barrier to the use of § 1983 to enforce Privacy Rule violations since the administrative remedies
set forth by HIPPA arguably preclude resort to § 1983.
(Toothless HIPAA at 202, 208.)

                                                            

8
9

Gonzaga Univ. v. Doe, 536 U.S. 273 (2002).
City of Ranch Palo Verdes v. Abrams, 544 U.S. 113 (2005). 

6
 

March 2016
HIPAA Memorandum

B.

Case law specifically addressing HIPAA and 1983

“Defendants move for dismissal of plaintiffs’ complaint on the ground that HIPAA creates no private
right of action enforceable under § 1983. It does not, so I must dismiss plaintiffs’ § 1983 claims.” Richard Clyde
Adams v. Eureka Fire Protection District, Case No. 4:08CV1309 CDP (E.D. Missouri 01/08/09).
“It is well established that, because there is no private right to action under HIPAA, a violation of the Act
cannot serve as the basis of a § 1983 claim.” Rodgers v. RENSSELAER COUNTY SHERIFF'S DEPARTMENT
No. 1:14-CV-01162 (N.D. NY. July 17, 2015).
"Since HIPAA does not create a private right, it cannot be privately enforced . . . via § 1983. . . ." Dade v.
GAUDENZIA DRC, INC., Dist. Court, ED Pennsylvania 2013, citing Adams v. Eureka Fire Prot. Dist., 352 F.
App'x 137, 138 (8th Cir. 2009)
“HIPAA provides no private right of action enforceable in a section 1983 action.” Taylor v. Sherman,
Civil Action No. 13-00516-KD-M, (S.D. Alabama February 26, 2014).
“Because HIPAA does not include any express or implied right, plaintiff cannot enforce
any HIPAA rights in a section 1983 action.” Woods v. Colon, Case No. 3:14-cv-1467 (VLB) (D. Conn. October 6,
2015.)
VI.

False Claims Act?
A plaintiff attempting to establish a cause of action under the FCA for a Privacy Rule violation
must prove two major elements. First, the plaintiff must show that the covered entity either expressly or
impliedly certified compliance with HIPAA regulations. The plaintiff may be able to point to an actual
representation of compliance since Medicare laws expressly require claimants to certify compliance with
all federal laws.120 However, even absent evidence that claimants have expressly certified compliance,
the plaintiff could proceed under the implied false certification theory by arguing that Medicaid hospitals
have an affirmative duty to ensure compliance with all HHS regulations.121
Second, the plaintiff must prove that a recent Privacy Rule violation made the representation of
compliance legally false. In the current health care climate, where Privacy Rule violations occur on a
regular basis, this second requirement would be easily met.

(Toothless HIPAA at 218.)
But Toothless HIPAA comes up with many reasons not to use the FCA for HIPAA enforcement.
VII.

Other Recourse

File a “complaint with the Department of Health and Human Services (“HHS”).10 If HHS decides to pursue a
victim’s complaint, it may impose fines against the responsible covered entity.11 However, since HIPAA’s
                                                            

10
11

45 C.F.R. § 160.306.
42 U.S.C. § 1320d-6(b) (2006). 

7
 

March 2016
HIPAA Memorandum

enactment, HHS has rarely imposed fines or criminal sanctions.12 Regardless of any enforcement action taken by
HHS, the victim will not be compensated for the harm caused by this breach of privacy.” (Toothless HIPAA at
202.)
Phone call with Elizabeth Cumming on 3/3/2016 – she suggested that the Privacy Rule could be enforced under
tort law – that it might be the standard of care.
VIII.

Does HIPAA Supersede This State Law?

“A provision…requirement…or a standard or implementation specification adopted or established…shall
supersede any contrary provision of State law, including a provision of State law that requires medical or health
plan records (including billing information) to be maintained or transmitted in written rather than electronic
form.”
But a “provision or requirement under this part, or a standard or implementation specification adopted or
established under sections 1172 through 1174, shall not supersede a contrary provision of State law, if the
provision of State law— . . . (B) subject to section 264(c)(2) of the Health Insurance Portability and
Accountability Act of 1996, relates to the privacy of individually identifiable health information.” Public Law
191, 110 Stat. 2030, 104th Congress, 2nd Session (21 August 1996), Health Insurance Portability and
Accountability Act.
IX.

Other States Records Policies

“Several state correctional systems have declared themselves a “covered entity” under the provisions of HIPAA
(e.g., Florida). Other states have determined that their correctional systems are not covered entities (e.g.,
Washington), but have ongoing efforts to assure reasonable compliance.” Dave Thomas and Jacqueline Thomas,
HIPAA and YOU Covered Entities— Do you even have to bother? AMERICAN JAILS (March/April 2003).
The Massachusetts Department of Public Health regulations, which apply to all correctional facilities,
including jails, require the jail to allow prisoners to inspect and have copies of their medical records.
http://www.mass.gov/courts/docs/lawlib/104-105cmr/105cmr205.pdf
Texas has recognized prisoners’ right to access PHI for many years. Op.Atty.Gen.1981, No. MW-381
(quoting that ‘with regard to all Texas Department of Corrections medical records which are generated or held by
a physician, an inmate has a statutory right of access unless the physician determines that access "would be
harmful to the physical, mental or emotional health" of the inmate’).
California:

West's Ann.Cal.Civ.Code § 56.35
§ 56.35. Compensatory and punitive damages; attorneys' fees and costs
                                                            
12

According to one report, HHS had not yet brought a single civil enforcement action under HIPAA as of November, 2005.
Joseph Conn, Ruling Called HIPAA Barrier, MODERN HEALTHCARE, Nov. 14, 2005, at 16. There has only been one
criminal conviction under HIPAA. United States v. Gibson, No. CR04-0374RSM, 2004 WL 2188280 (W.D. Wash. Aug. 19,
2004); Trial Pleading, United States v. Gibson, No. CR04-0374RSM, 2004 WL 2237585 (W.D. Wash. Aug. 19, 2004).

8
 

March 2016
HIPAA Memorandum

In addition to any other remedies available at law, a patient whose medical information has been used or
disclosed in violation of Section 56.10 or 56.104 or 56.20 or subdivision (a) ofSection 56.26 and who has
sustained economic loss or personal injury therefrom may recover compensatory damages, punitive damages
not to exceed three thousand dollars($3,000), attorneys' fees not to exceed one thousand dollars ($1,000), and
the costs of litigation.
West's Ann.Cal.Civ.Code § 56.36
§ 56.36. Misdemeanors; violations; remedies
(a) Any violation of the provisions of this part that results in economic loss or personal injury to a patient is
punishable as a misdemeanor.
(b) In addition to any other remedies available at law, any individual may bring an action against any person
or entity who has negligently released confidential information or records concerning him or her in violation
of this part, for either or both of the following:
(1) Except as provided in subdivision (e), nominal damages of one thousand dollars ($1,000). In order to
recover under this paragraph, it shall not be necessary that the plaintiff suffered or was threatened with actual
damages.
(2) The amount of actual damages, if any, sustained by the patient.
(c)(1) In addition, any person or entity that negligently discloses medical information in violation of the
provisions of this part shall also be liable, irrespective of the amount of damages suffered by the patient as a
result of that violation, for an administrative fine or civil penalty not to exceed two thousand five hundred
dollars ($2,500) per violation.
X. Can An Inmate’s Lawyers Get Access to Medical Records?
From the HHS FAQs:
Q:

Can the personal representative of an adult or emancipated minor obtain access to the individual's medical
record?

A:

The HIPAA Privacy Rule treats an adult or emancipated minor’s personal representative as the individual
for purposes of the Rule regarding the health care matters that relate to the representation, including the
right of access under 45 CFR 164.524. The scope of access will depend on the authority granted to the
personal representative by other law. If the personal representative is authorized to make health care
decisions, generally, then the personal representative may have access to the individual’s protected health
information regarding health care in general. On the other hand, if the authority is limited, the personal
representative may have access only to protected health information that may be relevant to making
decisions within the personal representative’s authority. . . . There is an exception to the general rule that
a covered entity must treat an adult or emancipated minor’s personal representative as the individual.
Specifically, the Privacy Rule does not require a covered entity to treat a personal representative as the
individual if, in the exercise of professional judgment, it believes doing so would not be in the best
interest of the individual because of a reasonable belief that the individual has been or may be subject to
domestic violence, abuse or neglect by the personal representative, or that doing so would otherwise
endanger the individual.

XI.

Cost of Access to Records
9

 

March 2016
HIPAA Memorandum

From the HHS FAQs:
Q:

If patients request copies of their medical records as permitted by the Privacy Rule, are they required to
pay for the copies?

A:

The Privacy Rule permits the covered entity to impose reasonable, cost-based fees. The fee may include
only the cost of copying (including supplies and labor) and postage, if the patient requests that the copy
be mailed. If the patient has agreed to receive a summary or explanation of his or her protected health
information, the covered entity may also charge a fee for preparation of the summary or explanation. The
fee may not include costs associated with searching for and retrieving the requested information. See 45
CFR 164.524.
The HITECH Act does not create a private right of action, but it does give financial incentives to
complainants. Individuals who are harmed by HIPAA violations may now be able to share in any monetary
penalties or settlements collected as a result of those violations. - See more
at:https://www.shrm.org/legalissues/federalresources/pages/intensifiedhipaaenforcement.aspx#sthash.NXklnK
Gl.dpuf
Note: CC attorney general, who can sue for civil violations of HIPAA

10