Connecticut State Medical Society v. Commission on Hospitals & Health Care , 223 Conn. 450 ( 1992 )

Covello, J.

This is an administrative appeal from a declaratory ruling of the defendant, the Commission on Hospitals and Health Care (CHHC). The dispositive issue is whether § 19a-165q-2 of CHHC’s regulations required submission to CHHC of data that violated the privacy and confidentiality rights of patients as set forth in General Statutes § 52-146e, 42 U.S.C. §§ 290dd-3, 290ee-3 (1985), and 42 C.F.R. §§ 2.11, 2.53 and 2.54 (1985). We conclude that this is so with respect to one item and, therefore, reverse, in part, the judgment of the trial court that held to the contrary.

Examination of the record discloses that on April 26, 1985, CHHC adopted §§ 19a-165q-l through 19a-165q-24 of the Regulations of Connecticut State Agencies. Thereafter, on June 14, 1985, the named plaintiff and others,¹ filed a petition for a declaratory ruling,² seeking invalidation of § 19a-165q-2 of the newly adopted regulations on the ground that it required the submission of statutorily protected patient data. On September 3, 1986, after hearings, CHHC issued a declaratory ruling concluding that the regulation was valid. The plaintiffs subsequently commenced the instant administrative appeal in the Superior Court, seeking to vacate and set aside CHHC’s declaratory ruling. The trial court, having found the plaintiffs aggrieved, rendered judgment for CHHC, concluding that the specified information did not violate the statutorily protected privacy and confidentiality rights of the plaintiffs and that the contested regulation was, therefore, valid. The Connecticut Hospital Association and the four general hospitals who were parties in the action below, appealed to the Appellate Court. We thereafter transferred the matter to ourselves pursuant to Practice Book § 4023.

The history of the statutory enactments that served as the basis for the promulgation of § 19a-165q-2 is as follows. On June 5, 1984, the General Assembly passed No. 84-315 of the 1984 Public Acts, which was thereafter codified as General Statutes (Rev. to 1985) §§ 19a-165 through 19a-165q. The statutory scheme established a prospective payment system whereby general hospital rates were established in advance based upon a fixed charge per diagnosis or medical procedure. Section 19a-165a directed CHHC to “require hospitals to submit such data as it deems necessary for the development and implementation of the prospective payment system . . . .” Section 19a-165q directed CHHC to “adopt regulations, in accordance with the provisions of chapter 54 to implement, administer arid ensure compliance with the prospective payment system established under sections 19a-165 to 19a-165q, inclusive.” Thereafter, CHHC promulgated § 19a-165q-2. Section 19a-165q-2 (b) (1) required all of Connecticut’s general hospitals to file with CHHC a “hospital discharge data set for each patient discharged from the hospital after September 30,1983.” Each data set contained thirty items of information concerning a given patient.

In their application for a declaratory ruling, the plaintiffs challenged thirteen items in each data set, arguing that the information was unnecessary for purposes of the prospective payment system and, further, that disclosure of the material violated patient privacy and confidentiality rights. The challenged data included: (1) patient identification code; (2) ZIP Code; (3) ZIP Code suffix; (4) attending physician; (5) operating physician; (6) principal procedure day;³ (7) other procedure I day; (8) other procedure II day; (9) other procedure III day; (10) other procedure IV day; (11) admission status; (12) expected principal source of payment; and (13) race.

I

As a threshold consideration, we must address CHHC’s claim that the issues presented are moot because of the legislature’s repeal in 1989 of the statutes that authorized the prospective payment system and its enactment of a different method for determining hospital budgets. There is no dispute that CHHC, in response to the 1989 legislative changes, adopted § 19a-167g-94⁴ of the Regulations of Connecticut State Agencies, which superseded § 19a-165q-2.⁵ Since there is no longer a requirement to submit data pursuant to § 19a-165q-2, CHHC argues that there is no longer a justiciable controversy concerning this regulation before the court. CHHC argues that “[i]t is a well-settled general rule that the existence of an actual controversy is an essential requisite to appellate jurisdiction; it is not the province of appellate courts to decide moot questions, disconnected from the granting of actual relief or from the determination of which no practical relief can follow.” Reynolds v. Vroom, 130 Conn. 512, 515, 36 A.2d 22 (1944). While we agree that this is a correct statement of the law, we conclude that it is not applicable in the present instance.

It is undisputed that CHHC continues to maintain six years of data accumulated pursuant to § 19a-165q-2 and that CHHC refuses either to return the data to the plaintiffs or to purge the data from CHHC’s computer files. The plaintiffs’ claim, meanwhile, remains the same, i.e., that CHHC cannot legally retain the data because of its confidential nature, and that it should be required to return the same or purge its computer files.

Although the repeal of an offending law or regulation or the cessation of a challenged activity can render an action to enjoin its enforcement moot; Roy v. Mulcahy, 161 Conn. 324, 328, 288 A.2d 64 (1971); the repeal will not render moot a claim for redress of an injury occurring while the enactment was in force. Hallas v. Windsor, 217 Conn. 689, 692, 587 A.2d 149 (1991); Gunther v. Dubno, 195 Conn. 284, 288, 487 A.2d 1080 (1985). The plaintiffs claim that while § 19a-165q-2e was in force, they became prospectively liable to prior patients for the release to CHHC, over a six year period, of material that the plaintiffs argue is confidential. Until the regulation is either determined to have been valid because the requested material is not confidential or the offending material is ordered excised or, in the alternative, some other basis is determined for retaining the material, we conclude that a sufficient controversy exists to survive CHHC’s claim of mootness occasioned by the legislature’s subsequent enactments.

II

The plaintiffs’ argument throughout these proceedings has been, inter alia, that the contested regulation required them to submit to CHHC data that is confidential and, therefore, exempt from disclosure by reason of both state and federal law. With respect to Connecticut statutes, the plaintiffs refer us specifically to General Statutes § 52-146e (a), which prohibits the disclosure of records “which identify a patient to any . . . governmental agency . . . .”⁶

With respect to federal statutes, the plaintiffs rely upon 42 U.S.C. § 290dd-3 (a), which prohibits the disclosure of records concerning “any patient which are maintained in connection with the performance of any program or activity relating to alcoholism or alcohol abuse . . . .”⁷ An identical provision governing confidentiality of patients diagnosed or treated for drug abuse is found in 42 U.S.C. § 290ee-3 (a). Implementing federal regulations define “patient identifying information” to include, inter alia, “information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information.” 42 C.F.R. § 2.11 (j) (1985).

CHHC responds to these claims of an alleged breach of patient confidentiality by pointing out that, with respect to each data set, the actual name of the patient is not disclosed, but only a patient identifying number supplied by the hospital. This number serves only to show that a particular set of data relates to one patient’s hospital stay, but does not link the data to the actual identity of the patient. CHHC argues that such a number is expressly excluded from the meaning of the term “patient identifying information” in the federal regulation, specifically, “[t]he term does not include a patient identifying number assigned by a program.” 42 C.F.R. § 2.11 (1985).

Despite their objection before CHHC and the trial court to thirteen items of information in each data set, including the patient identifying number, the linchpin of the plaintiffs’ claim to us that a breach of confidentiality has occurred, lies, not in the submission of a patient identifying number, but rather, in the requirement to supply the patient’s ZIP Code including its four digit suffix. The plaintiffs argue that the ZIP Code constitutes “other descriptive data from which a person acquainted with the patient might reasonably recognize the patient as the person referred to.” General Statutes § 52-146d (4) (A). In its declaratory ruling, CHHC specifically rejected this essentially fact driven argument.⁸ Since this determination was one of fact, we will not reverse or modify such a holding unless we determine that the decision is clearly erroneous in view of the evidence and pleadings in the whole record. Practice Book § 4061.

“ ‘A finding is “clearly erroneous” when although there is evidence to support it, the reviewing court on the entire evidence is left with the definite and firm conviction that a mistake has been committed.’ ” Doyle v. Kulesza, 197 Conn. 101, 105, 495 A.2d 1074 (1985), citing United States v. United States Gypsum Co., 333 U.S. 364, 395, 68 S. Ct. 525, 92 L. Ed. 746 (1948). We conclude that CHHC’s determination with respect to the ZIP Code information, and a person’s inability to determine a specific patient’s identity from it, was clearly erroneous.

On July 29, 1981, § 122.6 of the Domestic Mail Manual was revised to define and describe a national ZIP Code system that included for the first time, a nine digit ZIP Code. It provided: “The ZIP Code system is a numbered coding system which facilitates efficient processing of mail. The most complete ZIP Code is a nine-digit number divided by a hyphen between the fifth and sixth digits. The Postal Service has adopted the term ‘ZIP+4’ as its trademark for the 9-digit ZIP Code. The first three digits identify the delivery area of the section center facility (SCF) or major city post office serving the area in which the address is located. The next two digits (the fourth and fifth digits) identify the delivery area of the associate post office or branch station of the major city post office serving the address. The sixth and seventh digits (the first two digits following the hyphen) identify an area known as a sector. The eight and ninth digits identify a smaller area known as a segment. The final four digits of the ZIP+4 Code identify specific geographic units such as: a side of a street between intersections; individual buildings; a floor or group of floors in a large building; a firm within a building; a span of boxes on a rural route; or a group of post office boxes in which mail delivery will be made by a single postal employee.” See United States Postal Service, Domestic Mail Manual, § 122.612 (1992), incorporated by reference in 39 C.F.R. § 111.1, § 111.5 (c) (2) (iv) (1991).

In response to the introduction of this nine digit system, the United States Postal Service published a series of ZIP + 4 State Directories, excerpts of which were furnished to CHHC in connection with the plaintiffs’ petition for a declaratory ruling. Examination of this directory discloses that a given four digit suffix refers to a very small number of postal addresses. Indeed, in numerous instances, this suffix identifies by name just one person. Under such circumstances, we conclude that the four digit ZIP Code suffix constituted “other descriptive data from which a person acquainted with the patient might reasonably recognize the patient as the person referred to.” General Statutes § 52-146d (4) (A). That portion of the regulation requiring the submission of the ZIP Code suffix was contrary to the confidentiality mandates of existing law and was, therefore, invalid.

Once relieved, however, of their prospectively identifying four digit ZIP Code suffix, the remaining twelve items in the data set can no longer be linked to an ascertainable individual. Although the plaintiffs argued to CHHC that the remaining data constituted “information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information”; 42 C.F.R. § 2.11 (1985); or, in the alternative, that it constituted a record “which identifies] a patient to any . . . governmental agency”; General Statutes § 52-146e (a); CHHC rejected these arguments based upon its evaluation of the evidence in the record. Unlike the claim with respect to the ZIP Code suffix, we see nothing in this record that suggests that CHHC’s rejection of these further factual claims was clearly erroneous.

The plaintiffs further argue that § 19a-165q-2 violated their patients’ constitutional rights to privacy and that the plaintiffs, as hospitals, have the right as third parties to advance the constitutional claims of their patients under the federal rule of jus tertii. The foundation of such an argument relies on the factual predicate that the hospitals had furnished CHHC confidential information pursuant to § 19a-165q-2. In view of our determination that with the excision of the four digit ZIP Code suffix, there is no reasonable likelihood of correlating a given data set with a specific patient, confidential information within any constitutional sense was not accumulated. We, therefore, decline to address this issue.

The judgment is reversed in part and the matter is remanded to the trial court with direction to render judgment ordering the excision of the ZIP Code suffix from the material accumulated by CHHC.

In this opinion the other justices concurred.

1 The original petitioners were the Connecticut State Medical Society, the Connecticut Hospital Association, Inc., Joseph C. Czarsty, M.D., William A. Whalen, M.D., Joseph P. Zeppieri, M.D., the Greenwich Hospital Association, the Hospital of St. Raphael, Rockville General Hospital, Saint Vincent’s Medical Center and the Sharon Hospital. All of the petitioners, with the exception of Zeppieri, appealed from the agency’s decision to the Superior Court. The Connecticut Hospital Association, Inc., the Greenwich Hospital Association, Rockville General Hospital, St. Vincent’s Medical Center and the Sharon Hospital are the only parties to the present appeal.

2 General Statutes (Rev. to 1985) § 4-176 provides: “Each agency may, in its discretion, issue declaratory rulings as to the applicability of any statutory provision or of any regulation or order of the agency, and each agency shall provide by regulation for the filing and prompt disposition of petitions seeking such rulings. If the agency issues an adverse ruling, the remedy for an aggrieved person shall be an action for declaratory judgment under section 4-175 unless the agency conducted a hearing pursuant to sections 4-177 and 4-178 for the purpose of finding facts as a basis for such ruling, in which case the remedy for an aggrieved person shall be an appeal pursuant to section 4-183. If the agency fails to exercise its discretion to issue such a ruling, such failure shall be deemed a sufficient request by the plaintiff for the purposes of section 4-175. Rulings disposing of petitions have the same status as agency decisions or orders in contested cases.”

3 Section 19a-165q-2 (a) of the Regulations of Connecticut State Agencies then provided in part: “definitions. For the purpose of this section and except as otherwise noted, the following words and phrases have the following meanings:

“(12) Procedures and days performed.

“(A) ‘Procedure’ means a significant procedure that carries an operative or anesthetic risk, requires highly trained personnel, or requires special facilities or equipment. Procedures will be reported in ICD-9-CM coding. For each procedure, the day in the length of stay on which the procedure was performed is also to be reported.”

4 Section 19a-167g-94 (g) (7) of the Regulations of Connecticut State Agencies provides in part as follows: “Data elements and suppression thresholds for nonconfidential reports.

“(A) To create a nonconfidential report, the following data elements collected under this section will be replaced by substitute data elements which have been modified for purposes of confidentiality as follows . . .

“(iv) Zip code will be replaced by an aggregation of zip codes composed of at least two contiguous zip codes and subject to the provisions of subsection (7) (B). . . .

“(B) Thresholds for data suppression for nonconfidential reports. . . .

“(iv) Any nonaggregated report which contains data elements by discharge shall not contain the data element ‘hospital code,’ and shall contain a substitute for the data element ‘zip code.’ This substitute shall be composed of an aggregation of zip codes equivalent to the health service areas created pursuant to the National Health Planning and Resources Development Act, Public Law 93-641.”

5 The history of the statutory enactments that served as the basis for the promulgation of § 19a-167g-94 of the Regulations of Connecticut State Agencies is as follows. On June 30,1989, the General Assembly passed No. 89-371 of the 1989 Public Acts, which repealed, inter alia, General Statutes § 19a-165q and its attendant regulation, § 19a-165q-2 of the Regulations of Connecticut State Agencies. It was thereafter codified as General Statutes §§ 19a-167g through 19a-167k. It provided for the establishment of net and gross revenue caps for each hospital as a means of determining a hospital’s total revenues during a given fiscal year. General Statutes § 19a-167g provides that the “commission shall adopt regulations . . . to implement, administer and ensure compliance with sections 19a-167 to 19a-167f, inclusive, and section 19a-167h and to establish hospital efficiency standards to be used in the budget review process pursuant to section 19a-167c.” It was pursuant to this statute that CHHC promulgated § 19a-167g-94.

6 General Statutes § 52-146e (a) provides in relevant part: “Except as provided in sections 52-146Í to 52-146i, inclusive, no person may disclose or transmit any communications and records or the substance or any part or any resume thereof which identify a patient to any person, corporation or governmental agency without the consent of the patient or his authorized representative.” (Emphasis added.)

General Statutes § 52-146d defines material that “identifies a patient” as follows: “privileged communications between psychiatrist and PATIENT. DEFINITIONS. . . .

“(4) ‘Identifiable’ and ‘identify a patient’ refer to communications and records which contain (A) names or other descriptive data from which a person acquainted with the patient might reasonably recognize the patient as the person referred to, or (B) codes or numbers which are in general use outside of the mental health facility which prepared the communications and records.”

7 Title 42 of the United States Code, § 290dd-3 (a) provides: “Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to alcoholism or alcohol abuse education, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b) of this section.”

8 CHHC concluded that “[t]he data which is submitted, pursuant to Connecticut Regulations § 19a-165q-2, (including the ZIP Code), does not contain descriptive data such that a person acquainted with the patient might reasonably recognize the patient as the person referred to in the data.”