Opinion No. ( 1995 )

The Honorable Jim Keet State Senator P.O. Box 23603 Little Rock, Arkansas 72221-3603

Dear Senator Keet:

This is in response to your request, made on behalf of Dr. Charles P. Fitzgerald and Mr. Lanny W. Hassell, for an opinion on the constitutionality of Act 670 of 1995. Correspondence from Dr. Fitzgerald and Mr. Hassell to you, attached to your request, expresses concern that the act may violate "an individual's right to privacy as outlined in the Fourth Amendment. . . ." Dr. Fitzgerald and Mr. Hassell are of the view that the act may permit the Department of Health to obtain, from physicians and hospitals, all health care information concerning individuals. They state as a possibility that "everything a person tells his or her physician, including the prescriptions and numbers of refills and the results of all tests will be on file in the [Department of Health] computer." They also express the view that the act imposes financial and criminal penalties upon any physician who refuses to release the requested data.

Section 2(a) of the act provides that the Department of Health shall act as a "state health data clearing house for the acquisition and dissemination of data from state agencies and other appropriate sources. . . ." Sections 2(d) and 2(f) require all state agencies, and all hospitals and outpatient surgery centers licensed by the state, to submit information to the Department.

Act 670 does not clearly designate the type and amount of information to be provided to the Department. With respect to state agencies, section 2(d) provides that they "shall make available to the Department of Health such data as are necessary for the Department of Health to carry out its responsibilities as prescribed by this section or such rules and regulations as may be adopted. . . ." The information to be made available includes, at the least, "data relating to the Medicaid program. . . ." Section 2(d). Section 2(f) requires hospitals and outpatient surgery centers licensed by the state to "submit information in a form and manner as prescribed by rules and regulations by the Arkansas State Board of Health. . . ."

Section 2(a) of the act, which contains legislative findings, cites "an urgent need to understand patterns and trends in the availability, use, and costs of [health care] services." In view of this finding, the act's lack of specificity about the information to be provided, and the rulemaking authority in this area delegated to the Arkansas State Board of Health (see section 2(h) of the act), I will assume, for purposes of this opinion, that the Department will be entitled to obtain from state agencies, hospitals, and outpatient surgery centers all information in their possession relating in any significant way to the "availability, use, and costs of [health care] services." Certain other provisions of the act are described elsewhere in this opinion.

In my opinion, Act 670 is not unconstitutional.

As an initial matter, I will address the constitutional argument suggested by Dr. Fitzgerald and Mr. Hassell. It is my view that the Fourth Amendment, which protects the people from unreasonable searches and seizures, is not implicated by Act 670 because no search or seizure, within the meaning of those words as used in the Fourth Amendment, will occur pursuant to the provisions of the act. In Whalen v. Roe,429 U.S. 589 (1977), discussed at greater length below, the Supreme Court considered the constitutionality of a state statute requiring the recordation, in a central computer system, of the names and addresses of all persons who obtained, under prescription, certain controlled drugs for which both legal and illegal markets existed. In rejecting a right-to-privacy argument based on the Fourth Amendment, the Court pointed out that its prior cases containing language suggesting a right to privacy embodied in the Fourth Amendment "involve affirmative, unannounced, narrowly focused intrusions into individual privacy during the course of criminal investigations." Whalen, 429 U.S. at 604, fn. 32. The Court continued: "We have never carried the Fourth Amendment's interest in privacy as far as [was urged by the plaintiffs in Whalen]. We decline to do so now." Id. Because of the factual similarities between Act 670 and the statute addressed in Whalen, it is my opinion that the holding in Whalen is dispositive of any argument based upon the Fourth Amendment here as well.

Neither your request nor the letter of Dr. Fitzgerald and Mr. Hassell suggests any other constitutional theory under which the Act 670 might be invalidated. I will, however, discuss two cases presenting similar facts in which other theories were raised and rejected by the courts.

As stated above, Whalen involved a statute providing for a central computerized repository of information regarding prescriptions for certain controlled drugs that are commonly used both legally and illegally. The statute required prescriptions for such drugs to be prepared on an official form identifying the prescribing physician, the dispensing pharmacy, the drug and dosage, and the name, address, and age of the patient. A copy of the prescription was required to be submitted to the state health department, which entered the data in a computer. The copies of the prescriptions were kept on file for five years, then destroyed as required by the statute.¹ Various precautions were undertaken to protect the security of the computer room and the data, and public disclosure of the identity of patients was prohibited by the statute and a regulation.

The plaintiffs, who were patients, doctors, and associations of physicians, first advanced an argument that the statute was unconstitutional because the state had been unable to demonstrate the necessity for the requirement that patients be identified in the system. The Court rejected the argument:

State legislation which has some effect on individual liberty or privacy may not be held unconstitutional simply because a court finds it unnecessary, in whole or in part. For we have frequently recognized that individual States have broad latitude in experimenting with possible solutions to problems of vital local concern.

Whalen, 429 U.S. at 597 (footnotes omitted).

The Court characterized the statute as a "considered attempt to deal with such a problem" and "manifestly the product of an orderly and rational legislative decision." Id. The Court cited legitimate reasons why the state may have deemed the inclusion of patient information necessary, and concluded that the statute was a reasonable exercise of legislative power.

Likewise, in my view, Act 670, as a whole, is the product of a rational legislative decision to attempt to cope with the "urgent need to understand patterns and trends in the availability, use, and costs of [health care] services" and is not constitutionally vulnerable on the grounds that no necessity therefor has been demonstrated.

The plaintiffs in Whalen also made a general right-to-privacy argument citing the Fourteenth Amendment and several provisions of the Bill of Rights. The Court noted that the right to privacy is "founded in the Fourteenth Amendment's concept of personal liberty. . . ." Whalen,429 U.S. at 598, fn. 23, citing Roe v. Wade, 410 U.S. 113 (1973). The plaintiffs argued that the statute impaired both sorts of interests that had been generally characterized as constituting the right of privacy: the interest in avoiding disclosure of personal matters and the interest in independence in making certain important decisions. The plaintiffs' argument was that the existence of the records made disclosure of personal matters a risk, and that the risk of disclosure would impair individuals' ability to make freely important decisions about prescribing and taking the covered drugs.

The Court rejected the argument. With respect to the risk of disclosure, the Court acknowledged that information could be disclosed by health department personnel (which disclosure, whether negligent or intentional, would constitute a violation of the statute), in the course of a judicial proceeding, or voluntarily by a physician, pharmacist, or patient. The Court refused to give any weight to the last possibility, such a disclosure being possible regardless of the existence of a central records system. The Court noted no support in the record for an assumption that the health department would administer improperly the security provisions of the statute, and characterized as "remote" the possibility that judicial supervision of the use of information as evidence would provide inadequate protection against unwarranted disclosure.

The Court also addressed the more limited disclosure inherent in the scheme created by the statute, the disclosure to the health department itself. Because the Court's statements in this regard appear particularly applicable to the case at hand, I quote from them at some length:

Even without public disclosure, it is, of course, true that private information must be disclosed to the authorized employees of the New York Department of Health. Such disclosures, however, are not . . . meaningfully distinguishable from a host of other unpleasant invasions of privacy that are associated with many facets of health care. Unquestionably, some individuals' concern for their own privacy may lead them to avoid or to postpone needed medical attention. Nevertheless, disclosures of private medical information to doctors, to hospital personnel, to insurance companies, and to public health agencies are often an essential part of modern medical practice even when the disclosure may reflect unfavorably on the character of the patient. Requiring such disclosures to representatives of the State having responsibility for the health of the community, does not automatically amount to an impermissible invasion of privacy.

Whalen, 429 U.S. at 602 (footnote omitted).

The Court also rejected the argument based upon the statute's potential to affect individuals' decisions about their health care practices. It noted that the volume of prescriptions received by the health department under the statute was so great that it was clear that the statute did not deprive the public of access to the drugs. The Court also pointed out that the statute did not prohibit entirely the use of the drugs at issue or require the consent of a state official or third party.

Finally, the Court rejected as frivolous an argument by the plaintiffs who were also physicians to the effect that the statute impaired their right to practice medicine free of unwarranted state interference.

In my view, the statute at issue in Whalen and Act 670 are sufficiently similar that the Court's decisions on the constitutional arguments raised in Whalen would control if similar arguments were raised in an attack on Act 670.

With respect to the possibility of disclosure by the Department of Health to the general public, the act does not set forth any security requirements, but it does contain criminal penalties for violation of provisions of the act, or any rule thereunder, relating to confidentiality of information.² Section 3(a). The penalties are applicable to anyperson (not just Department of Health personnel) who violates such a requirement, so I perceive little or no significance or increased risk of disclosure in the provision of the act, noted by Dr. Fitzgerald and Mr. Hassell, authorizing the Department of Health to contract with private entities to collect data. See section 2(c). In addition, I believe it would be unreasonable for me to assume that the Department of Health will not implement adequate security precautions, in view of the fact that the act addresses confidentiality in at least five instances. See sections 2(b)(4), 2(g), 2(h) (two instances), and 3(a).

The possibility of disclosure in litigation appears to be less than was the case with the statute in Whalen, because the act provides that data collected pursuant to the act that identifies or could be used to identify an individual patient, provider, institution, or health plan is not subject to discovery pursuant to the Arkansas Rules of Civil Procedure or the Freedom of Information Act of 1967, A.C.A. §§ 25-19-101 to -107 (Repl. 1992 and Supp. 1993). And as was the case in Whalen, the act does not affect the risk that a patient or provider will disclose private information.

With respect to the disclosure to the government that will occur under the provisions of the act, it is true that the Department of Health may contract with private entities or individuals to collect health data. In my view, however, this fact is not sufficient to compel a different decision than that reached in Whalen. Ultimately, individuals will have access to the data, whether they work for the government or not. Whether there are adequate safeguards against unauthorized disclosure, not the identity of the employer of individuals with access to the information, appears to be the relevant inquiry. Again, the penalties against unauthorized disclosure apply to all, and I cannot assume that the governmental entities responsible for the collection and dissemination of information will not implement adequate safeguards.

The possibility that Act 670 will have an impact on individuals' decisions about health care appears to be minimal at most. As discussed above, the danger of unauthorized public disclosure is not so great that a person should reasonably take it into account in making health care decisions. And as in Whalen, the limited disclosure to the government and its employees and contractors is simply another factor, like disclosure to an insurance company, that people may or may not take into account in making decisions in our day and age. Act 670 contains no prohibitions on the provision of any type of health care and does not require any person to receive the approval of any other person in order to receive any type of health care. In my view, Act 670 is not so intrusive as to constitute a significant constraint on individual freedom to choose the type and amount of health care desired.

I believe my analysis of the act under the standards set forth in Whalen is consistent with the view of the Supreme Court of Arkansas on similar questions, as evidenced by its opinion in Arkansas Dep't of HumanServices v. Heath, 312 Ark. 206, 848 S.W.2d 927 (1993). In Heath, a circuit court found that a report of child abuse leveled against an individual was unsubstantiated. The circuit court ordered the Department of Human Services to expunge the individual's name from its records, finding unconstitutional a law that required even unsubstantiated reports of child abuse to be retained in a central registry for three years.

The Supreme Court reversed, rejecting arguments based upon the separation of powers doctrine, due process, and equal protection, as well as the right to privacy. With respect to the latter, the court cited Whalen and held that the statutory safeguards against unwarranted disclosure were sufficient.

Finally, I would point out that Dr. Fitzgerald and Mr. Hassell appear to have misread the act when they contend that its provisions apply to individual physicians. Nothing in Act 670 purports to impose upon individual physicians a duty to disclose any information to the state; as stated above, the mandatory disclosure provisions of the act apply to state agencies and to hospitals and outpatient surgery centers licensed by the state. It follows that an individual physician may not be fined or otherwise punished under the act for failing or refusing to disclose any information to the Department of Health.

The foregoing opinion, which I hereby approve, was prepared by Assistant Attorney General J. Madison Barker.

Sincerely,

WINSTON BRYANT Attorney General

WB:JMB/cyh

¹ The Court's opinion does not indicate, however, that the statute required the state, at any time, to destroy or discard the data contained in the prescriptions and duplicated by the state on magnetic media for use on its computer.

² One might note that a violation of confidentiality carries a more severe penalty than a violation consisting of a refusal to transmit the required information. A person may be jailed for the former but not the latter. Compare section 3(a) with section 3(b).