No.

In The

Supreme Court Of The United States

Kathleen Leonard,Petitioner,

v.

Retailer’s Credit Association OfGrass Valley, Inc.,

Respondent.

On Petition For Writ Of Certiorari

To The

California Court Of Appeal, Third Appellate District

Patrick H. DwyerCounsel of Record P.O. Box 1705 17318 Piper Lane Penn Valley, CA 95946 530-432-5407

Attorney for PetitionerMay 7, 2014

Questions Presented

Background:

Respondent, a debt collection agency, filed acomplaint for breach of contract by Petitioner in theNevada County Superior Court, Nevada County,California, alleging failure to pay medical charges. Respondent, without either consent from Petitioneror a court protective order, attached to the complaintun-redacted copies of medical records protected byHIPAA1, thereby placing these medical records intothe public domain of the superior court files.

The appellate court found that, although thecomplaint exhibits were protected by HIPAA, theycould be publicly disclosed under an implied “safeharbor” rule without prior authorization or aprotective order.

1. May health information protected byHIPAA be disclosed in a legal proceedingwithout patient authorization or a protectiveorder?

2. Does the constitutional right to privacyrequire that a suitable protective order beobtained before patient health information isused or disclosed in a legal proceeding?

1 HIPAA is The Health Insurance Portability andAccountability Act, Pub. L. 104–191, 110 Stat. 1936; 42 US§ 1320d, as implemented by the regulations of the Departmentof Health and Human Resources at 45 C.F.R. §§160 et seq.

i

Parties To Proceeding

Kathleen Leonard, an individual

Retailer’s Credit Association of Grass Valley, Inc.

[To Petitioner’s knowledge, there is noparent or publicly held company owning10% or more of this corporation’s stock]

ii

Table Of Contents

Page

Petition For Writ of Certiorari ............................... 1

Opinions Below ....................................................... 1

Jurisdiction .............................................................. 2

The Federal Issues Were Raised In TheAppellate Court ........................................................ 2

Constitutional And Statutory Provisions Involved 3

Statement Of Facts ................................................. 5

Why A Writ For Certiorari Should Issue

A. Introduction ............................................ 9

B. HIPAA Has No Express Exception For Medical Debt Collectors ......................... 10

C. Use Or Disclosure By Legal Counsel For Day To Day Health Care Operations Does Not Allow Further Unprotected Disclosure To Third Parties ................. 13

D. HIPAA Does Not Have A “Safe Harbor” For Medical Debt Collectors ... 14

The Lower Court Decision ..................................... 15

Conclusion .............................................................. 16

Petitioner’s Appendix .................................. A1-A33

iii

TABLE OF AUTHORITIES

PageUnited States Federal District Court

Crenshaw v. MONY Life Insurance Co. 318 F. Supp. 1015 (S.D. Cal. 2004) .................... 6n5

Law v. Zuckerman 307 F. Supp. 2d 705 (E.D. Cal. 2007)................................................... 6n5

Federal Statutes

Health Insurance Portability and Accountability Act (“HIPAA”),Pub. L. 104–191, 110 Stat. 1936; 42 USC § 1320d .................................................... 4

The Health Information Technology for Economic and Clinical Health Act (“HITECH”), Pub. L., 111-5, 42 U.S.C. §17931 ........................ 11

Federal Regulations

45 CFR §160.103 ..................................... 5n3, 11, 14

45 C.F.R. §164.501 .......................................... 11-12

45 C.F.R. §164.502(a) ...................................... 3, 11

45 C.F.R. §164.502(b)(2) ................................ 3, 11

45 C.F.R. §164.506(a) .......................................... 11

45 C.F.R. §164.506(b)&(c) ................................... 11

iv

45 C.F.R. §164.508............................................... 11

45 C.F.R. §164.512(b) to (l) ................................. 11

45 C.F.R. §164.512(e) ............................... 3-4, 12-15

45 C.F.R. §164.512(e)(v) ....................................... 12

United States Constitution

14th Amendment, United States Constitution .... 8 California Supreme Court

Doe v. City of Los Angeles (2007) 42 Cal. 4th 531 .................................................... 5n4

Construction Protective Services, Inc. v. TIG Speciality Ins. Co. (2002) 29 Cal. 4th 189 ........... 6n4

California Rules of Court

California Rule of Court 8.1005 .......................... 1n2

California Rule of Court 8.1006 .......................... 1n2

California Statutes

California Civil Code §§56 et seq., the Confidentiality Of Medical Information Act, ("CIMIA") ........................................................... 6n5

California Code of Civil Procedure §425.10 ........ 5n4

v

Petition For A Writ Of Certiorari

Kathleen Leonard respectfully petitions for awrit of certiorari to the United States SupremeCourt to review the denial by the California Court ofAppeal of a Petition For Transfer of the Decision ofthe Appellant Division of the California SuperiorCourt For The County Of Nevada in the matter ofthe appeal of Retailer’s Credit Association of GrassValley, Inc. v. Kathleen Leonard (3rd DCA No.C075603; NCSC No. L78288A)

Opinions Below

The unreported opinion of the AppellantDivision of the California Superior Court For TheCounty Of Nevada in Case No. L78288A was filedDecember 4, 2013. Petitioners’ Appendix (“Pet.App.”) at A28-A33. An Application for Transfer ToThe California Court of Appeal was denied onJanuary 10, 2014. Pet. App. at A26-A27. A PetitionFor Transfer To The California Court Of Appeal,Case No. C075603, Pet. App. at A2-A25, was deniedon February 10, 2014, by the California Court ofAppeal without comment. Pet. App. at A1.2

2 Under California Rules of Court (“CRC”) 8.1000 et seq.,for a case that is a limited action (i.e, the amount in controversyis under $25,000) an appeal lies to the appellate division of theSuperior Court. A decision by the Appellate Division may betransferred to the Court of Appeal upon the granting of requestfor certification of transfer by the Appellate Division, CRC8.1005, or upon the granting of a Petition to the Court of Appealfor transfer. CRC 8.1006. There is no further right to appeal orpetition to the California Supreme Court.

1

Jurisdiction

The jurisdiction for this petition for a writ ofcertiorari is based upon 28 U.S.C. §1257(a).

The Federal Issues Were Raised In The Appellate Court

The federal questions regarding theapplication of HIPAA to California courts wereraised by Petitioner in the Petition For Transfer ToThe California Court of Appeal. Pet. App. at A2-A25.

2

Constitutional and Statutory Provisions

1. Health Insurance Portability andAccountability Act (“HIPAA”), Pub. L. 104–191, 110Stat. 1936; 42 USC § 1320d, and the implementingregulations issued by the United States Departmentof Health and Human Services, including 45 C.F.R.§ 164.502(a), the “Privacy Rule” for protected healthinformation:

... A covered entity may not use ordisclose protected health information,except as permitted or required by thissubpart or by subpart C of part 160 ofthis subchapter.

2. United States Department of Health andHuman Services, 45 C.F.R. § 164.512(e):

.... Standards: Disclosures for judicialand administrative proceedings ....

(iv) ... a covered entity receivessatisfactory assurances from a partyseeking protected health information, ifthe covered entity receives from suchparty a written statement andaccompanying documentationdemonstrating that:

(A) The parties to the dispute givingrise to the request for information haveagreed to a qualified protective orderand have presented it to the court oradministrative tribunal withjurisdiction over the dispute; or

3

(B) The party seeking the protected healthinformation has requested a qualifiedprotective order from such court oradministrative tribunal.

(v) For purposes of paragraph (e)(1) ofthis section, a qualified protective ordermeans, with respect to protected healthinformation requested under paragraph(e)(1)(ii) of this section, an order of acourt or of an administrative tribunalor a stipulation by the parties to thelitigation or administrative proceedingthat:

(A) Prohibits the parties from using ordisclosing the protected health information forany purpose other than the litigation orproceeding for which such information wasrequested; and

(B) Requires the return to the covered entityor destruction of the protected healthinformation (including all copies made) at theend of the litigation or proceeding.

3. U.S. Constitution, Amendment XIV, § 1:

... No State shall make or enforce any law whichshall abridge the privileges or immunities of citizensof the United States; nor shall any State deprive anyperson of life, liberty, or property, without dueprocess of law; nor deny to any person within itsjurisdiction the equal protection of the laws.

4

Statement Of Facts

In January 2012, Respondent filed acomplaint against Petitioner for alleged breach ofcontract to pay medical charges incurred byPetitioner at Sierra Nevada Memorial Hospital, part of the Dignity Health System (“Dignity”). Without prior notice to Petitioner and without aprotective order from the court, Respondent attachedto the complaint five exhibits that containedPetitioner’s health information protected underHIPAA. By filing the complaint and exhibitswithout a protective order, Petitioner’s protectedhealth information (“PHI”)3 was placed into thepublic domain.4

3 PHI is defined under HIPAA at 45 C.F.R. § 160.103 in atwo part analysis. First, there has to be identifying informationabout the individual or that could be used to identify theindividual. Second, the identifying information must beconnected with:

any information, whether oral or recorded inany form or medium, that: (1) is created orreceived by a health care provider ...; and (2) relates to the past, present or future physicalor mental health or condition of an individual;the provision of health care to an individual; orthe past, present or future payment for theprovision of health care to an individual.(Emphasis added.)

4 Under California law, all that is required to plead abreach of contract is a statement of “ultimate” facts constitutinga cause of action. California Code of Civil Procedure §425.10. The facts to be pleaded are those upon which liability willdepend. Doe v. City of Los Angeles (2007) 42 Cal. 4th 531,549-550 ("Doe"). The ultimate fact of the existence of a contract

5

Petitioner was shocked to find that her PHIhad been attached to the complaint without herconsent and without any protection from public useand disclosure. Not being able to afford privatecounsel, Petitioner proceeded pro se.

Petitioner timely filed an answer to thecomplaint denying the allegations about non-payment of the alleged medical debt. Petitioner alsofiled a cross complaint for injunctive relief anddamages for violation of HIPAA, CIMIA5 and herconstitutional right of privacy arising fromRespondent’s attachment of her PHI to thecomplaint without her written authorization or acourt approved protective order as required underHIPAA. Respondent filed a general denial to thecross complaint.

Trial was held on June 11, 2012, in California

may be pleaded either in hac verba (word for word, typicallydone by attachment) or generally according to the contractsintended legal effect. See Construction Protective Services, Inc.v. TIG Speciality Ins. Co. (2002) 29 Cal. 4th 189, 198-199. Acomplaint will be upheld if it provides the defendant with noticeof the issues sufficient to enable the preparation of a defense. Doe at 549-550. Thus, it was not necessary for Respondent to attachthe contracts that contained PHI, it only had to plead the essentialultimate facts: i.e., that there was a contract for medical services, theservices were provided, and all or part of the charges remain unpaid. There is no need to plead any PHI to state a viable cause of action.

5 The California Confidentiality Of Medical InformationAct, California Civil Code §§56 et seq. ("CIMIA") was found bythe lower court to be less stringent than HIPAA, and therefore,preempted by HIPAA. See e.g., Crenshaw v. Mony LifeInsurance 318 F. Supp. 2d 1015 (S.D. Cal. 2004) at 1029; Law v.Zuckerman 307 F. Supp. 2d 705 (E.D. Cal. 2007) at 709-711.Thus, CIMIA is not pertinent in a federal appeal.

6

Superior Court For Nevada County. There was notrial transcript, but there is a minute order datedJune 11, 2012, that contains some record of theproceeding. According to the minute order, the trialcourt found that there was nothing “confidential”about the exhibits or the action and deniedPetitioner’s motion to close the courtroom to protecther PHI from public disclosure.

Petitioner, not wanting to disclose even moreof her PHI, refused to offer into evidence additionalPHI that she could have used to refute theallegations about failure to pay the medical charges.

The trial court then admitted into evidence allof Respondent’s complaint exhibits, plus fouradditional pages of Petitioner’s medical records,6 andfound for Respondent on both the complaint andcross Complaint.

On July 27, 2012, Respondent filed a Notice ofEntry of Judgment. Petitioner found legal counseland on August 13, 2012, filed a Notice of Appeal tothe Appellate Division of the California SuperiorCourt. Petitioner also filed a motion to place theexhibits under seal pending appeal, but that motionwas denied.

The decision of the Appellate Division wasfiled on December 4, 2013. That decision found thatHIPAA had an implied “safe harbor” rule that,notwithstanding HIPAA’s Privacy Rule and expressprovisions governing the disclosure of PHI in a legal

6 These pages contained test and the names ofPetitioner’s doctors. These pages were found by the lowerappellate court to be both protected by HIPAA and not subjectto an implied safe harbor rule. They were ordered sealed.

7

proceeding, allowed medical debt collectors to putcertain PHI into the public domain, including thefollowing specific information about Petitioner:

1. Petitioner and her minor child'sname, age and date of birth;

2. Petitioner and her minor child'sindividual medical ID numbers used toaccess their medical files at DignityHealth;

3. the treating departments at thehospital (e.g., oncology);

4. The date the services were provided;

5. the admit status (i.e., the level ofpatient acuity);

6. a bar code that encodes the aboveitems and is an access code for thepatient’s complete medical record; and

7. The name of the minor child’s father.

Petitioner filed an Application ForCertification For Transfer to the California Court ofAppeal on December 18, 2013. This was denied onJanuary 10, 2014. Petitioner then filed a PetitionerFor Transfer to the California Court of Appeal. Thiswas denied on February 10, 2014. This petition for awrit of certiorari followed.

8

Why A Writ For Certiorari Should Issue

A. Introduction

This case presents two simple, but urgentissues. First, may health information protected byHIPAA be disclosed in a legal proceeding withoutpatient authorization or a protective order? Second,does the constitutional right to privacy require that asuitable protective order be obtained before patienthealth information is used or disclosed in a legalproceeding?

The California Court of Appeal has let stand alower appellate court decision that medical debtcollectors operate under an implied “safe harbor”exception to HIPAA’s Privacy Rule that permitsthem to use and disclose certain protected healthinformation in a litigation without authorization ofthe patient and without a court protective order,thereby placing the patient’s health information intothe public domain. The decision neither defines orlimits what protected health information is subjectto this “safe harbor”, nor sets forth any criteria to beused for making such a determination.

The practical effect of this undefined “safeharbor” exception to HIPAA is that any medical debtcollector in California may now ignore HIPAA anddisclose protected health information withoutrepercussion. Quite literally, a medical debtcollector may threaten a patient with public use anddisclosure of their protected health informationunless they pay the alleged medical bill. This willsubject alleged debtors to coercion.

In prosecuting this appeal in the courts below,

9

it has become apparent that there is a much biggerarea for concern. Does HIPAA apply whenever apatient with PHI is a litigant and their PHI isrelevant to the matter at issue?

For example, in the context of tort litigation itis well established that when a plaintiff files anaction alleging physical injury, their health becomesan issue and their PHI is subject to discovery. Doesthis mean that a patient/plaintiff must place theirPHI into the public domain of the legal forum toobtain relief for their claims? Or does HIPAAimpose a procedural due process requirement that alitigant has a right to a protective order, just like theright to notice and hearing?

In addition, is there a substantive due processright to privacy under the 14th Amendment thatrequires the protection of private health informationin a legal proceeding irrespective of HIPAA? Theburden of obtaining a protective order for privatehealth information as a matter of due process is verysmall with the potential for harm through thedisclosure of private health information into thepublic domain of a legal proceeding.

B. HIPAA Has No Express Exception ForMedical Debt Collectors

The Department of Health and HumanResources (“DHHS”) regulations implementingHIPAA begin with the general principal that acovered entity may not use or disclose “protectedhealth information” except: (1) as the privacy rulepermits or requires; or (2) as authorized in writingby the patient. 45 C.F.R. § 164.502(a)(1). This is the

10

“Privacy Rule”. Covered entities include all healthcare providers, health plans and health careclearinghouses. 45 C.F.R. §160.103. The HIPAAregulations were extended to include “businessassociates”7 of covered entities by the HealthInformation Technology for Economic and ClinicalHealth Act (“HITECH”), Pub. L., 111-5, 42 U.S.C.§17931.

A covered entity (or business associate) isauthorized to use or disclose PHI in the course ofperforming its internal day-to-day “Health CareOperations” defined at 45 C.F.R. §164.501. However, the use or disclosure of PHI to thirdparties is not allowed except as expressly permitted.45 C.F.R. §164.502.

HIPAA authorizes covered entities to use ordisclose PHI for their own internal activities, 45C.F.R. §164.506(a), but not in external legalproceedings. 45 C.F.R. §164.506(b) & (c). There is nospecific authorization for the use or disclosure of PHIin a litigation by a collection agency or an attorneyfor a covered entity.

The use or disclosure of PHI outside of theinternal operations of a covered entity is governed by45 C.F.R. §164.508 which prohibits the use anddisclosure of PHI unless there is patientauthorization or the use or disclosure falls withinone of the few exceptions set forth at 45 C.F.R.§164.512 (b) through (l). There are no expressexceptions for debt collection in §164.512.

7 In this action, Respondent is a medical debt collectorand it agreed that it was a “business associate” for purposes ofenforcing HIPAA.

11

When use or disclosure is expresslyauthorized, the covered entity may only use ordisclose the “minimum necessary” amount PHI forthe authorized purpose. 45 C.F.R. §164.502(b)(2). This is the “Minimum Necessary” rule.

The only express exception under whichRespondent could have used or disclosed Petitioner’sPHI was the litigation exception at 45 C.F.R.§164.512(e). This allows for the use and disclosure ofPHI in a legal proceeding if there is either writtenpatient authorization or there is a court approvedprotective order that meets regulation’srequirements. These requirements specify that anysuch protective order must require that all PHI bereturned or destroyed at the conclusion of thelitigation. 45 C.F.R. §164.512(e)(v). In other words,HIPAA forbids the disclosure of PHI into the publicdomain of a legal forum. In this case, Respondent neither obtainedwritten authorization to use or disclose Petitioner’sPHI nor sought a protective order from the trialcourt before attaching and filing Petitioner’s PHI inthe court’s public record.

Respondent admitted that there is no expressauthorization under HIPAA to use or disclose PHI ina legal proceeding, including this case.

Instead, Respondent made two arguments. First, it contended that its disclosure of Petitioner’sPHI was impliedly allowed under the definition ofday to day “Health Care Operations” at 45 C.F.R.§164.501. This definition includes the "conducting orarrangement for ... legal services". Respondentargued that its use and disclosure of Petitioner’s PHIin this case, i.e., by attaching it to the complaint and

12

then introducing it at trial, fell within the definitionof day to day operations of a covered entity and itwas not required to follow 45 C.F.R. §164.512(e) andeither obtain prior written authorization or a courtapproved protective order.

Second, Respondent acknowledged that,although HIPAA may expressly require writtenauthorization or a court approved protective orderbefore use or disclosure of PHI in a legal proceedingunder 45 C.F.R. §164.512(e), there was also animplied “safe harbor” that allowed the use anddisclosure of the type of PHI that was contained inthe exhibits attached to the complaint.8 While notproviding any definition of what constituted the typePHI that could be disclosed under such a safeharbor, it argued that the PHI disclosed in thecomplaint exhibits fell within this implied safeharbor rule.

C. Use Or Disclosure By Legal Counsel ForDay To Day Health Care Operations DoesNot Allow Further Unprotected DisclosureTo Third Parties

Petitioner argued that day to day Health CareOperations may have authorized the disclosure byDignity (the health care provider) to Respondent (thebusiness associate debt collector), but that thefurther disclosure by Respondent by means ofunauthorized attachment to the complaint was not

8 The kinds of PHI that were found disclosable under theimplied “safe harbor” rule are set out in the Statement of Facts,supra.

13

included in the definition of day to day operations.Petitioner agrees that day to day operations

by a covered entity do allow for the internal use by ordisclosure to legal counsel (whether inside or outsidecounsel). However, there is nothing in the definitionof day to day operations that permits the furtherexternal disclosure by such legal counsel into thepublic domain of a legal proceeding, except asexpressly permitted by 45 C.F.R. §164.512(e) whichrequires written authorization or a protective order.

D. HIPAA Does Not Have A “Safe Harbor” ForMedical Debt Collectors

With regard to the second argument thatthere was an implied “safe harbor” under 45 C.F.R.§164.512(e) for disclosure or certain types of PHI,Petitioner pointed out that there was no definition orcriteria with which to determine what PHI could orcould not be disclosed under such an implied safeharbor. Further, the definition of PHI specificallyincludes “any information” that “[r]elates to the past,present, or future physical or mental health orcondition of an individual; the provision of healthcare to an individual; or the past, present, or futurepayment for the provision of health care to anindividual.” 45 C.F.R. §160.103. This definition is allencompassing and there is no division between PHIthat may or may not be protected under HIPAA – itis all protected under the Privacy Rule.

Under settled principles of construction, alaw's plain meaning controls. There is nothing inthis language that creates a "safe harbor". There isnothing that indicates that collection agencies and

14

their lawyers should be excepted. The constructionproposed by Respondent and adopted by the lowerappellate court defeats the entire purpose of HIPAA. The language of 45 C.F.R. §164.512(e) is not limitedto a particular forum or nature of the litigation; itextends to any judicial or administrative tribunaland any type of proceeding, including a debtcollection suit.

Respondent did not propose a single reason orpolicy consideration why the simple requirements of45 C.F.R. §164.512(e) could not be followed in thiscase. Respondent merely needed to either obtainwritten authorization from Petitioner or get a courtapproved protective order to use Petitioner’s PHI inthe manner that it did.

The burden on Respondent to comply withHIPAA’s express mandate was nominal, whereas theharm to Petitioner was serious. There was nojustification for the failure to follow the law andthere is no compelling interest to create an implied“safe harbor” for the PHI it wrongfully disclosed.

The Lower Court Decision

The Appellate Division ruled orally from thebench, without citation to authority, that there is animplied “safe harbor” that permits public disclosureof PHI by a collection agency, such as RespondentRCA, in a debt collection litigation. There was nodiscussion of what the boundaries of this safe harborare or what PHI is subject to the safe harbor. Theseitems were left undefined.

15

Conclusion

The decision of the lower court creates agaping hole in HIPAA that benefits medical debtcollectors. There are no policy reasons stated for thisexception and there are no criteria with which todetermine the boundaries of this implied “safeharbor.” This decision creates serious policyquestions with very wide implications. All of us havehealth information that we want to keep private. That is why HIPAA was enacted. There is no reasonto create an exception to the Privacy Rule just formedical debt collectors. Doing so not onlyencourages the complete disregard for the protectionof PHI, but it creates the circumstances wheremedical debt collectors will have unfair leverage tocollect alleged debts, regardless of the validity ofsuch claims. Simply put, the burden of compliancewith HIPAA is small compared to the harm fromnon-compliance.

There is a real need to clarify the lawconcerning the protection of PHI in all types oflitigation. The failure to require adequateprotections for PHI in a legal proceeding is a failureto apply the principles of due process, bothprocedural and substantive, under the 14th

amendment.There is no plausible justification for requiring

a litigant to forego privacy in their personal healthinformation in exchange for the right to pursueredress of their grievances. All that is required is asimple protective order that keeps the PHI fromentering the public domain and that ensures thatany copies are returned destroyed at the completion

16

of the matter. With such a simple and nominalburden, the right to privacy in health information,both statutory and constitutional, can be fullysustained.

Respectfully Submitted,

___/s/__________________________Patrick H. DwyerCounsel of Record for Petitioner

P.O. Box 170517318 Piper LanePenn Valley, California 95946530-432-5407pdwyer@pdwyerlaw.com

17