Brown v. Mortensen

51 Cal.4th 1052 (2011) 126 Cal. Rptr. 3d 428 253 P.3d 522

ROBERT A. BROWN et al., Plaintiffs and Appellants,
v.
STEWART MORTENSEN, Defendant and Respondent.

No. S180862.

Supreme Court of California.

June 16, 2011.

Law Offices of Robert A. Brown, Robert A. Brown; Law Offices of Lyle F. Middleton and Lyle F. Middleton for Plaintiffs and Appellants.

Arielle Cohen, Chi Chi Wu; Seth E. Mermin; and Elizabeth De Armond for National Consumer Law Center, Public Good, Privacy Rights Clearinghouse, Privacy Activism, The World Privacy Forum and National Association of Consumer Advocates as Amici Curiae on behalf of Plaintiffs and Appellants.

Carlson & Messer, David J. Kaminski, Stephen A. Watkins and Charles R. Messer for Defendant and Respondent.

OPINION

WERDEGAR, J.—

In this case we address the remedies available to a patient when a debt collector, acting on behalf of a medical professional, is asserted to have illegally disclosed confidential patient medical information to various consumer reporting agencies in the course of a dispute over an alleged medical debt.

Individuals, as patients, have a substantial interest in the privacy of their medical information. (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 41 [26 Cal.Rptr.2d 834, 865 P.2d 633].) As consumers, they have substantial interests as well in the privacy and accuracy of their credit information. Recognizing the importance of these interests, Congress has intervened on both fronts, enacting the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 U.S.C. § 1320d et seq., inter alia) and the Fair Credit Reporting Act (FCRA) (15 U.S.C. § 1681 et seq.) to protect against the mishandling of medical information and credit information, respectively. Our Legislature has been no less diligent, enacting the Confidentiality of Medical Information Act (Confidentiality Act) (Civ. Code, § 56 et seq.) and the Consumer Credit Reporting Agencies Act (id., § 1785.1 et seq.), inter alia, to address the same concerns.

Because of the dual state and federal responses to the protection of an individual's privacy and accuracy interests, when the interests overlap, as in this case, the question of what remedies are available is a federalism problem. As will appear, we conclude that Congress did not intend the state remedies to be preempted. Accordingly, we reverse the Court of Appeal, which held to the contrary.

FACTUAL AND PROCEDURAL BACKGROUND^[1]

Plaintiff Robert A. Brown and his two minor children were dental patients of defendant Dr. Rolf Reinholds.^[2] In July 2000, Dr. Reinholds billed Brown $600 for a permanent dental crown. Brown never received a crown and never entered into an agreement to pay for one. He thus declined to pay the bill.

Dr. Reinholds referred the debt to a collection agency, Credit Bureau Services, the fictitious business name for defendant Stewart Mortensen. Mortensen or his agents contacted Brown and attempted to collect the debt. When Brown requested that Mortensen provide proof of the debt, Mortensen sent Brown a copy of Brown's dental chart, as well as the charts of Brown's minor children. In response, Brown informed Mortensen he did not owe any money to Dr. Reinholds and the dental charts contained his and his children's confidential medical information.

Over the next two years, Mortensen repeatedly disclosed the contents of Brown's and his children's dental charts to the three major national consumer reporting agencies, Experian, Equifax, and TransUnion. Additionally, Mortensen disclosed to the agencies the Browns' names, Social Security numbers, dates of birth, addresses, telephone numbers, and Brown's and his children's entire dental history with Dr. Reinholds, including alleged dental treatments. Mortensen made these disclosures for purposes of verifying to the consumer reporting agencies that a debt was owed, despite the facts that (1) no one contended Brown owed money for dentistry performed on his children, and (2) Brown had never authorized Dr. Reinholds or Mortensen to disclose this information to any third parties, including the three consumer reporting agencies.

From 2001 to 2003, Brown repeatedly but unsuccessfully demanded that Mortensen cease making unauthorized disclosures. Brown also contacted the three consumer reporting agencies and informed them the disclosures made by Mortensen were inaccurate and incomplete. This assertion prompted the agencies to request that Mortensen provide additional information; in response, Mortensen disclosed Brown's dental history dating back 10 years, despite the fact this history included detailed information about Brown's dental treatments and was irrelevant to the present dispute over whether Brown owed anything for a permanent dental crown.

Brown contacted Dr. Reinholds in January 2003 and requested that he submit signed written instructions to the three consumer reporting agencies directing them to delete the disclosures of medical information. Dr. Reinholds declined and instead ratified Mortensen's disclosures; Dr. Reinholds also made further unauthorized disclosures to Equifax.

Brown and his wife, individually and as guardians ad litem for their minor children, then sued Dr. Reinholds and Mortensen, alleging violations of the Confidentiality Act (Civ. Code, § 56 et seq.), inter alia. Only the claims against Mortensen for violation of the Confidentiality Act are at issue; all other claims and parties have been voluntarily dismissed.

In the third and fourth causes of action of the operative complaint, the fourth amended complaint, Brown alleges Mortensen's disclosure of his and his children's medical information to consumer reporting agencies violated the Confidentiality Act. Subject to certain exceptions, that act prohibits the unauthorized dissemination of individually identifiable medical information and provides for compensatory damages and other remedies. (Civ. Code, §§ 56.10, 56.26, 56.35.) The trial court sustained a demurrer with leave to amend and then, when Brown elected not to amend, dismissed the action.

The Court of Appeal affirmed. While it rejected the trial court's conclusion that Brown's Confidentiality Act claims were impermissibly vague, it accepted Mortensen's alternative argument that the FCRA preempted them. The Court of Appeal opined that all state law claims arising from the furnishing of information to consumer reporting agencies are preempted by the FCRA. (See 15 U.S.C. § 1681t(b)(1)(F).)^[3] Reasoning that Mortensen had acted as a furnisher of credit information when disclosing the Browns' medical information to various credit agencies, the court affirmed dismissal.

We granted review to consider the interplay between state and federal laws governing credit reporting and the confidentiality of medical information.

DISCUSSION

I. Preemption Principles

(1) "The supremacy clause of the United States Constitution establishes a constitutional choice-of-law rule, makes federal law paramount, and vests Congress with the power to preempt state law." (Viva! Internat. Voice for Animals v. Adidas Promotional Retail Operations, Inc. (2007) 41 Cal.4th 929, 935 [63 Cal.Rptr.3d 50, 162 P.3d 569]; see U.S. Const., art. VI, cl. 2; Cipollone v. Liggett Group, Inc. (1992) 505 U.S. 504, 516 [120 L.Ed.2d 407, 112 S.Ct. 2608].) Congress may exercise that power by enacting an express preemption provision, or courts may infer preemption under one or more of three implied preemption doctrines: conflict, obstacle, or field preemption. (See In re Jose C. (2009) 45 Cal.4th 534, 550 [87 Cal.Rptr.3d 674, 198 P.3d 1087].) We consider here a single claim of express preemption: Mortensen asserts section 1681t(b)(1)(F), a provision of the FCRA, expressly preempts Brown's causes of action alleging violation of the Confidentiality Act (Civ. Code, § 56 et seq.).

(2) The United States Supreme Court has identified "two cornerstones" of federal preemption analysis. (Wyeth v. Levine (2009) 555 U.S. 555, ___ [173 L.Ed.2d 51, 129 S.Ct. 1187, 1194].) First, the question of preemption "`fundamentally is a question of congressional intent.'" (In re Tobacco Cases II (2007) 41 Cal.4th 1257, 1265 [63 Cal.Rptr.3d 418, 163 P.3d 106], quoting English v. General Electric Co. (1990) 496 U.S. 72, 79 [110 L.Ed.2d 65, 110 S.Ct. 2270]; see also Wyeth, 555 U.S. at p. ___ [129 S.Ct. at p. 1194] ["`[T]he purpose of Congress is the ultimate touchstone in every pre-emption case.'"].) If a statute "contains an express pre-emption clause, our `task of statutory construction must in the first instance focus on the plain wording of the clause, which necessarily contains the best evidence of Congress' pre-emptive intent.'" (Sprietsma v. Mercury Marine (2002) 537 U.S. 51, 62-63 [154 L.Ed.2d 466, 123 S.Ct. 518]; see also Viva! Internat. Voice for Animals v. Adidas Promotional Retail Operations, Inc., supra, 41 Cal.4th at p. 939.) "`Also relevant, however, is the "structure and purpose of the statute as a whole," [citation] as revealed not only in the text, but through the reviewing court's reasoned understanding of the way in which Congress intended the statute and its surrounding regulatory scheme to affect business, consumers, and the law.'" (Olszewski v. Scripps Health (2003) 30 Cal.4th 798, 816 [135 Cal.Rptr.2d 1, 69 P.3d 927], quoting Medtronic, Inc. v. Lohr (1996) 518 U.S. 470, 486 [135 L.Ed.2d 700, 116 S.Ct. 2240].)

(3) "Second, `[i]n all pre-emption cases, and particularly in those in which Congress has "legislated . . . in a field which the States have traditionally occupied," . . . we "start with the assumption that the historic police powers of the States were not to be superseded by the Federal Act unless that was the clear and manifest purpose of Congress."'" (Wyeth v. Levine, supra, 555 U.S. at pp. ___-___ [129 S.Ct. at pp. 1194-1195]; see also Viva! Internat. Voice for Animals v. Adidas Promotional Retail Operations, Inc., supra, 41 Cal.4th at p. 938.) The role of the presumption against preemption is to "`provide[] assurance that "the federal-state balance" [citation] will not be disturbed unintentionally by Congress or unnecessarily by the courts.'" (Olszewski v. Scripps Health, supra, 30 Cal.4th at p. 815, quoting Jones v. Rath Packing Co. (1977) 430 U.S. 519, 525 [51 L.Ed.2d 604, 97 S.Ct. 1305].)

The presumption against preemption applies fully in cases considering whether Congress intended by passage of the FCRA and subsequent amendments to displace state law. (See, e.g., American Bankers Assn. v. Gould (9th Cir. 2005) 412 F.3d 1081, 1086.) State statutory and common law protection of interests in informational privacy long predates federal regulation. (See Gormley, One Hundred Years of Privacy (1992) 1992 Wis. L.Rev. 1335, 1353-1357; Prosser, Privacy (1960) 48 Cal. L.Rev. 383, 386-388, 392-398; Warren & Brandeis, The Right to Privacy (1890) 4 Harv. L.Rev. 193.) It thus comprises a field traditionally occupied by the states and, accordingly, the presumption "applies with particular force here." (Farm Raised Salmon Cases (2008) 42 Cal.4th 1077, 1088 [72 Cal.Rptr.3d 112, 175 P.3d 1170].)

With these principles in mind, we turn to a consideration of preemption under the FCRA.

II. The Scope of FCRA Preemption

A. The FCRA

(4) "Congress enacted FCRA in 1970 to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy." (Safeco Ins. Co. of America v. Burr (2007) 551 U.S. 47, 52 [167 L.Ed.2d 1045, 127 S.Ct. 2201]; see also § 1681(a)(4) [the FCRA was designed to "insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy"].) Specifically, the FCRA requires consumer reporting agencies to adopt procedures for ensuring that consumer credit information is collected, maintained, and dispensed "in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information. . . ." (§ 1681(b); see also TRW Inc. v. Andrews (2001) 534 U.S. 19, 23 [151 L.Ed.2d 339, 122 S.Ct. 441].)

As originally enacted, the FCRA contained a broad savings clause, confirming Congress had no intention of displacing state law except to the extent state law and the FCRA were in irreconcilable conflict.^[4] As well, the FCRA at first focused solely on consumer reporting agencies and imposed no duties on furnishers, i.e., those that provide information to a consumer reporting agency.^[5] (See Pulver v. Avco Financial Services (1986) 182 Cal.App.3d 622, 633 [227 Cal.Rptr. 491].) Consequently, consumers remained free to sue furnishers under state law, subject only to a provision limiting certain state law tort claims to instances where a defendant had acted maliciously or with the intent to injure. (§ 1681h(e).)^[6]

(5) The Consumer Credit Reporting Reform Act of 1996 (Pub.L. No. 104-208 (Sept. 30, 1996) 110 Stat. 3009-426; 1996 Reform Act) amended the FCRA in two ways significant to this case. For the first time, Congress imposed affirmative duties on furnishers. (§ 1681s-2; see Sen.Rep. No. 104-185, 1st Sess., p. 49 (1995) [discussing proposed new section and noting that "[c]urrently, the FCRA contains no requirements applying to those entities which furnish information to consumer reporting agencies"].) Additionally, it amended the savings clause by carving out from the general no-preemption rule a series of discrete areas in which federal law henceforth would govern to the exclusion of state law. (§ 1681t(b).)^[7] One such area is at issue here: that covered by section 1681t(b)(1)(F), relating to the preemption of claims against furnishers.

B. Section 1681t(b)(1)(F) and the Presumption Against Preemption

We begin with the text of section 1681t(b)(1)(F): "(b) No requirement or prohibition may be imposed under the laws of any State—[¶] (1) with respect to any subject matter regulated under— [¶] . . . [¶] (F) section 1681s-2 of this title, relating to the responsibilities of persons who furnish information to consumer reporting agencies, except that this paragraph shall not apply— [¶] (i) . . . [¶] (ii) with respect to section 1785.25(a) of the California Civil Code (as in effect on September 30, 1996)." (Italics added.)

(6) When analyzing an express preemption clause, our task is to "`identify the domain expressly pre-empted'" by its language. (Medtronic, Inc. v. Lohr, supra, 518 U.S. at p. 484, quoting Cipollone v. Liggett Group, Inc., supra, 505 U.S. at p. 517.) The scope of this preemption clause therefore hinges on an interpretation of what the "subject matter regulated" under section 1681s-2 is.

(7) As noted, section 1681s-2 was enacted to, for the first time, impose certain affirmative duties on furnishers of information to consumer reporting agencies. Broadly speaking, section 1681s-2 regulates the actions of furnishers in two areas: it imposes a duty to provide accurate information (§ 1681s-2(a)), and it dictates what furnishers must do upon receiving official notice from a consumer reporting agency of a dispute concerning the completeness or accuracy of information they have provided (§ 1681s-2(b)). (See Sanai v. Saltz (2009) 170 Cal.App.4th 746, 763-764 [88 Cal.Rptr.3d 673]; Stafford v. Cross Country Bank (W.D.Ky. 2003) 262 F.Supp.2d 776, 782-784.)^[8]

The "subject matter regulated" under section 1681s-2 is ambiguous because the level of generality at which one is to characterize that subject matter is unclear, and thus, so is the domain expressly preempted by section 1681t(b)(1)(F). Characterized most narrowly, section 1681s-2 regulates only two discrete areas: what a furnisher must do to ensure the information it provides is accurate (a subject covered in exhaustive detail by the many subparts of § 1681s-2(a)), and what a furnisher must do upon receiving official notice that the accuracy or completeness of its information is in dispute (covered in somewhat less detail by § 1681s-2(b)). The operative preemption provision could thus be read as preempting only state laws that attempt also to regulate a furnisher's duties with respect to accuracy or the handling of disputes after receiving official notice.

Numerous federal district courts have adopted this view. In Stafford v. Cross Country Bank, supra, 262 F.Supp.2d at pages 785-787, for example, the court rejected the argument that section 1681t(b)(1)(F) preempted all state law furnisher claims, rather than only those arising out of the two furnisher duties actually regulated by section 1681s-2. A contrary interpretation, in the court's view, would "extend [section 1681t(b)(1)(F)] well beyond its express terms." (Stafford, at pp. 785-786.) In Pasternak v. Trans Union (N.D.Cal., Apr. 3, 2008, No. C07-04980 MJJ) 2008 U.S.Dist. Lexis 115442, the district court rejected section 1681t(b)(1)(F)'s preemption of a claim that the defendant creditor had failed to properly investigate and cease collection efforts upon being informed personally by the plaintiff that she was the victim of identity theft. (See Civ. Code, § 1798.92 et seq.) The court compared the duty asserted to the precise duties actually regulated by section 1681s-2 and, finding no overlap, allowed the plaintiff to proceed. (Pasternak, at pp. *10-*12.) In Carlson v. Trans Union, LLC (N.D.Tex. 2003) 259 F.Supp.2d 517, 521-522, the district court rejected preemption of a defamation claim against a furnisher because the "subject matter" of the claim was "significantly different" from that regulated by section 1681s-2 (Carlson, at p. 522), reasoning that the duty at issue in a defamation suit does not overlap with the duties actually addressed in section 1681s-2. (See also Dornhecker v. Ameritech Corp. (N.D.Ill. 2000) 99 F.Supp.2d 918, 930-931 [on reasoning analogous to that in Carlson, concluding common law claims involving duties not regulated by § 1681s-2 were not preempted by § 1681t(b)(1)(F)].)

Alternatively, the subject matter of section 1681s-2 could be read more broadly as encompassing all "[r]esponsibilities of furnishers of information to consumer reporting agencies," as the provision is captioned, and thus preempting any attempt by the several states to enforce laws imposing on furnishers duties additional to the two specific duties imposed by the section—that is, as embodying a congressional determination to impose on furnishers these, and only these, duties and to immunize them from any other legal obligations.

The Court of Appeal, apparently overlooking this ambiguity, assumed the latter understanding of the subject matter regulated by section 1681s-2 was correct and thus concluded that "[t]he plain language of section 1681t(b)(1)(F) preempts state law relating to the duties of furnishers of information to consumer reporting agencies," i.e., laws relating to any furnisher duty, not just the two general duties expressly regulated by the section. In light of the ambiguity, however, we are not at liberty to assume this reading is correct; instead, we must determine which of the two plausible readings of section 1681t(b)(1)(F) described above actually hews most closely to congressional intent.

(8) In making this determination, we are assisted by the strong presumption against displacement of state law that applies in the preemption context. That presumption applies not only to the existence, but also to the extent, of federal preemption. (Farm Raised Salmon Cases, supra, 42 Cal.4th at p. 1088.) Because of it, "courts should narrowly interpret the scope of Congress's `intended invalidation of state law' whenever possible." (Olszewski v. Scripps Health, supra, 30 Cal.4th at p. 815, quoting Medtronic, Inc. v. Lohr, supra, 518 U.S. at p. 485; see also Cipollone v. Liggett Group, Inc., supra, 505 U.S. at p. 518 [the "presumption reinforces the appropriateness of a narrow reading" of an express preemption provision]; Cipollone, at p. 533 (conc. & dis. opn. of Blackmun, J.) ["We do not, absent unambiguous evidence, infer a scope of pre-emption beyond that which clearly is mandated by Congress' language."].) Indeed, the presumption against preemption is sufficiently powerful to impose upon courts a "duty to accept the reading that disfavors pre-emption" as among equally plausible interpretations of an express preemption clause. (Bates v. Dow Agrosciences LLC (2005) 544 U.S. 431, 449 [161 L.Ed.2d 687, 125 S.Ct. 1788]; see also Altria Group, Inc. v. Good (2008) 555 U.S. 70, ___ [172 L.Ed.2d 398, 129 S.Ct. 538, 543] ["[W]hen the text of a pre-emption clause is susceptible of more than one plausible reading, courts ordinarily `accept the reading that disfavors pre-emption.'"].)

It follows from the foregoing that absent persuasive evidence Congress intended more expansive preemption, we must prefer the narrower reading of the scope of section 1681t(b)(1)(F)'s preemption clause, the reading that extends preemption only to state laws relating to furnisher accuracy or dispute resolution.

Relying on certain federal "total preemption" cases, Mortensen argues that section 1681t(b)(1)(F) preempts all state law claims against furnishers involving the same general subject matter as section 1681s-2. (See, e.g., Roybal v. Equifax (E.D.Cal. 2005) 405 F.Supp.2d 1177, 1181-1182; Howard v. Blue Ridge Bank (N.D.Cal. 2005) 371 F.Supp.2d 1139, 1144; Davis v. Maryland Bank, N.A. (N.D.Cal., June 19, 2002, No. C XX-XXXXXX SBA) 2002 U.S.Dist. Lexis 26468, pp. *39-*47.) Although Mortensen has the burden of establishing preemption (Bronco Wine Co. v. Jolly (2004) 33 Cal.4th 943, 956-957 [17 Cal.Rptr.3d 180, 95 P.3d 422]), and thus the burden of demonstrating a "clear and manifest" congressional intent to preempt (id. at p. 957, italics omitted), his argument offers little that would support a broader displacement of state law. The total preemption cases he relies on represent but one of three approaches the federal courts have taken to reconciling section 1681t(b)(1)(F) with the potentially overlapping sphere of section 1681h(e), which partially bars and partially permits certain common law claims against furnishers (see ante, fn. 6 and accompanying text), none of which are at issue here. (Buraye v. Equifax (C.D.Cal. 2008) 625 F.Supp.2d 894, 898; see, e.g., Carruthers v. American Honda Finance Corp. (N.D.Fla. 2010) 717 F.Supp.2d 1251, 1257-1258 [total preemption approach]; Sites v. Nationstar Mortgage LLC (M.D.Pa. 2009) 646 F.Supp.2d 699, 708-709 [statutory preemption approach]; Woltersdorf v. Pentagon Federal Credit Union (N.D.Ala. 2004) 320 F.Supp.2d 1222, 1225-1227 [temporal preemption approach].)^[9] Given the different preemption question at issue here, we do not find these cases instructive. Nor, for that matter, do we have occasion here to agree or disagree with either of the two alternative approaches—statutory and temporal preemption—the federal courts have taken to reconciling sections 1681t(b)(1)(F) and 1681h(e). Under any of these approaches, a threshold issue is whether the state law claim involves the same subject matter as that regulated by section 1681s-2. If the claim does not, there is no preemption. It is on that point our analysis turns.

Our own inspection of the overall statutory scheme and the pertinent legislative history reveals evidence suggesting Congress never intended in section 1681t(b)(1)(F) to preempt state laws regulating medical privacy and thereby to relieve entities otherwise obligated to maintain confidentiality of the duty to do so when reporting credit information. We find instructive both (1) Congress's passage of HIPAA at the same time as the 1996 Reform Act and (2) the legislative history of the 1996 Reform Act.

C. The Interplay Between the FCRA and HIPAA

"Recognizing the importance of protecting the privacy of health information in the midst of the rapid evolution of health information systems, Congress passed HIPAA in August 1996." (South Carolina Medical Assn. v. Thompson (4th Cir. 2003) 327 F.3d 346, 348; see Pub.L. No. 104-191 (Aug. 21, 1996) 110 Stat. 1936.) Portions of HIPAA were intended to facilitate information exchange among participants in the health care system (42 U.S.C. §§ 1320d to 1320d-8 (HIPAA §§ 261-262, Pub.L. No. 104-191, §§ 261-262 (Aug. 21, 1996) 110 Stat. 2021-2031)), but Congress foresaw that with easier transmission of intimate medical details would come a heightened risk of privacy loss (65 Fed.Reg. 82469 (Dec. 28, 2000); see also Northwestern Memorial Hosp. v. Ashcroft (7th Cir. 2004) 362 F.3d 923, 928-929 ["the sensitivity that lies behind HIPAA" is concern for the "natural sensitivity that people feel about the disclosure of their medical records"]). Accordingly, Congress tasked the federal Department of Health and Human Services (Department) with recommending privacy standards for the handling of personal medical information (42 U.S.C. § 1320d-2 note (HIPAA, § 264(a), Pub.L. No. 104-191, § 264(a) (Aug. 21, 1996) 110 Stat. 2033)) and, if no legislation was forthcoming within a specified period, with promulgating regulations setting forth national medical information privacy standards (id. (HIPAA, § 264(c)(1), Pub.L. No. 104-191, § 264(c)(1) (Aug. 21, 1996) 110 Stat. 2033)). When Congress failed to agree on legislation, the Department fulfilled its mandate and issued a wealth of detailed regulations, commonly known as the "Privacy Rule." (Stds. for Privacy of Individually Identifiable Health Information, 65 Fed.Reg. 82462 (Dec. 28, 2000), codified at 45 C.F.R. §§ 160, 164 (2010) [original Privacy Rule]; Stds. for Privacy of Individually Identifiable Health Information, 67 Fed.Reg. 53182 (Aug. 14, 2002), codified at 45 C.F.R. §§ 160, 164 (2010) [final modifications to the Privacy Rule].)

Three points about HIPAA and the Privacy Rule are germane here. First, at the time of HIPAA's passage it was expressly contemplated that Congress or the Department would closely regulate the obligations of health plans, medical providers, and their agents to maintain patient confidences. (42 U.S.C. § 1320d-2 note (HIPAA, § 264(b), (c)(1), Pub.L. No. 104-191, § 264(b), (c)(1) (Aug. 21, 1996) 110 Stat. 2033); see 42 U.S.C. § 1320d-1(a) [identifying entities to be covered by new standards].) The Privacy Rule does so, defining and restricting the ability of covered entities to divulge confidential medical information. (See 45 C.F.R. § 164.502(a) (2010) [prohibiting use or disclosure of personal health information except as provided under the Privacy Rule].) The Department's regulations expressly address such matters as the extent to which personal medical information may be disclosed when seeking payment, including to consumer reporting agencies. (See id., § 164.506 [permitting disclosure of personal health information for purposes of payment]; id., § 164.501 [defining payment to include certain limited disclosures of personal health information to consumer reporting agencies].)

(9) Second, both HIPAA and the Privacy Rule's implementation of it expressly favor additional, more protective state legislation. Although HIPAA generally preempts state laws (42 U.S.C. § 1320d-7(a)(1); see 45 C.F.R. § 160.203 (2010)), Congress carved out a different rule for privacy regulation (42 U.S.C. § 1320d-7(a)(2)(B)), directing that only conflicting or less stringent state law be preempted, while more stringent state law be preserved (id., § 1320d-2 note (HIPAA, § 264(c)(2), Pub.L. No. 104-191, § 264(c)(2) (Aug. 21, 1996) 110 Stat. 2033-2034); see 45 C.F.R. §§ 160.202, 160.203(b) (2010)).^[10] As the Department explained when announcing the Privacy Rule: "It is important to understand this regulation as a new federal floor of privacy protections that does not disturb more protective rules or practices. . . . The protections are a mandatory floor, which other governments and any covered entity may exceed." (65 Fed.Reg. 82471 (Dec. 28, 2000).)

(10) Third, HIPAA was enacted just one month before the 1996 Reform Act. While in construing statutes we will always prefer interpretations that harmonize them with other legislation (Lexin v. Superior Court (2010) 47 Cal.4th 1050, 1095 [103 Cal.Rptr.3d 767, 222 P.3d 214]), that canon is particularly appropriate here, where the very same Congress within a few weeks passed both HIPAA and the 1996 Reform Act. Given their contemporaneous nature and overlapping privacy concerns, we must when possible interpret HIPAA and the 1996 Reform Act as a coherent whole.

The 104th Congress could have amended the FCRA to address the scope of a medical provider's duties when furnishing information to a consumer reporting agency, or it could have addressed it as part of HIPAA. It chose to address it as part of HIPAA, authorizing the Department to adopt regulations on the subject, while at the same time inviting the states to continue to regulate to the extent they desired to enact more stringent, privacy-favoring legislation. (See 42 U.S.C. § 1320d-2 note (HIPAA, § 264(c)(1), (2), Pub.L. No. 104-191, § 264(c)(1), (2) (Aug. 21, 1996) 110 Stat. 2033-2034).) We see no plausible basis for reading into sections 1681t(b)(1)(F) and 1681s-2, which are silent on the duties of a furnisher to preserve medical confidentiality, a clear and manifest congressional intent to preempt state legislation on that topic, when the same Congress in HIPAA had just authorized and encouraged further state regulation of such matters. Far more credible is to assume Congress intended preemption only with respect to the specific furnisher duties for which it adopted standards in section 1681s-2, while leaving to other laws and their preemption provisions or savings clauses the task of articulating additional, more general duties and identifying what the several states' roles might be in enacting supplemental legislation.^[11]

D. The Legislative History of the 1996 Reform Act

Additionally, we consider whether anything in the sparse legislative history of the 1996 Reform Act, of which section 1681t(b)(1)(F) is a part, supports Mortensen's and the Court of Appeal's assumption that a broader reading of that preemption provision clearly was intended.^[12] Nothing does.

The 1996 Reform Act was the product of years of discussion and negotiations. (Wu et al., Fair Credit Reporting (7th ed. 2010) p. 16.) On April 6, 1995, Senators Bond and Bryan introduced the Consumer Reporting Reform Act of 1995 (Sen. No. 709, 104th Cong., 1st Sess. (1995)), a bill based in large part on earlier legislative efforts that had narrowly missed enactment. Senator Bond described the measure as providing "limited Federal preemption to ensure that there are uniform Federal standards to govern a number of procedural issues which are part of credit reporting and which will reduce the burdens on the credit industry from having to comply with a variety of different State requirements." (Remarks of Sen. Bond, 141 Cong. Rec. S5450 (daily ed. Apr. 6, 1995).) Senator Bryan assured that the bill "tried to only preempt those areas of this law which affect the operational efficiencies of businesses but do not harm consumers," and that it was not intended to "preempt States' rights in the area of liability." (Remarks of Sen. Bryan, 141 Cong. Rec. S5450 (daily ed. Apr. 6, 1995).) Preemption was appropriate only in order to set "a national uniform standard" on matters such as "disclosure forms or timetables"; such limited preemption would "not set the consumer movement back, yet should help the business community operate more efficiently." (Ibid.)

The Senate Committee on Banking, Housing, and Urban Affairs's subsequent report on the bill reflected the same understanding. (Sen.Rep. No. 104-185, 1st Sess. (1995).)^[13] The committee explained the new preemption provisions were intended to ensure the FCRA stood "as the national uniform standard in these [preempted] areas." (Sen.Rep. No. 104-185, p. 55.) The committee made equally clear that broad field preemption was not intended: "Additionally, the Committee understands that states have the power to protect their own citizens, including protection from abuses in the credit reporting industry. Therefore, the FCRA, as amended by the Committee bill[,] will not infringe upon the rights of states to legislate more stringent requirements that fall outside the scope of those areas specifically preempted to the extent such requirements are not inconsistent with any provisions of the FCRA." (Id. at p. 56.)

To the extent these remarks shed light on the intent behind section 1681t(b), they suggest Congress intended preemption only in a few discrete areas where it had in fact adopted a standard intended to serve as a uniform national standard. (See Watkins v. Trans Union, L.L.C. (N.D.Ala. 2000) 118 F.Supp.2d 1217, 1222 [the legislative history behind § 1681t(b) supports only "discrete" and "sharply drawn" areas of preemption].) Given this history, it seems more plausible that section 1681t(b)(1)(F) was intended to preempt only those areas governing furnishers where Congress had adopted an actual standard, i.e., for furnisher accuracy in submitting information and furnisher responsiveness in reacting to disputes, than that the section was, in an act of minifield preemption, intended to preempt all state laws implicating any duty that could have been regulated by section 1681s-2 but was not.

In short, nothing in the legislative history evinces a clear and manifest congressional intent to displace state law more broadly.

E. The Import of Section 1681t(b)(1)(F)'s Express Exclusion from Preemption of Specific State Statutes

Mortensen offers one textual argument in support of his construction of section 1681t(b)(1)(F). The provision selects out two specific state statutes for exclusion from preemption. (See § 1681t(b)(1)(F)(i), (ii) [saving Mass. Ann. Laws, ch. 93, § 54A(a) and Cal. Civ. Code, § 1785.25, subd. (a)].) It follows, Mortensen argues, that under the principle of expressio unius est exclusio alterius other state laws, including the Confidentiality Act (Civ. Code, § 56 et seq.), are not saved from preemption.

The argument is flawed. That Congress saved two state statutes from preemption evinces an intent to save those particular statutes in light of an understanding that in the absence of an exemption the statutes would have been subject to a colorable claim of preemption.^[14] As Mortensen correctly surmises, other state statutes involving the same subject matter as section 1681s-2, but not specially exempted, are preempted. But the argument begs the point. Congress obviously did not need to, and did not, specially exempt from preemption any of the thousands of state statutes further afield that do not touch on the same subject matter as section 1681s-2. It is that issue— whether claims under the Confidentiality Act involve the same subject matter as section 1681s-2—that is dispositive here.

(11) For all the foregoing reasons, we conclude section 1681t(b)(1)(F) preempts state law claims only insofar as they arise out of a requirement or prohibition with respect to the specific furnisher duties regulated by section 1681s-2, i.e., the duties to provide accurate information and to take action upon being notified of a dispute. We turn to whether the claims in Brown's operative complaint do so.

III. Application of Section 1681t(b)(1)(F) Preemption to Brown's Confidentiality Act Claims

A. Overview of the Confidentiality Act

(12) The Confidentiality Act (Civ. Code, § 56 et seq.) "is intended to protect the confidentiality of individually identifiable medical information obtained from a patient by a health care provider, while at the same time setting forth limited circumstances in which the release of such information to specified entities or individuals is permissible." (Loder v. City of Glendale (1997) 14 Cal.4th 846, 859 [59 Cal.Rptr.2d 696, 927 P.2d 1200]; see Heller v. Norcal Mutual Ins. Co. (1994) 8 Cal.4th 30, 38 [32 Cal.Rptr.2d 200, 876 P.2d 999].)

(13) Civil Code sections 56.10, subdivision (a) (applicable to health care providers) and 56.26, subdivision (a) (applicable to third party administrators) establish the basic prohibition against disclosure of a patient's medical information. "The basic scheme of the [Confidentiality Act], as amended in 1981, is that a provider of health care must not disclose medical information without a written authorization from the patient." (Pettus v. Cole (1996) 49 Cal.App.4th 402, 425 [57 Cal.Rptr.2d 46].) "The `authorization' requirements, which are found in section 56.11, are detailed and demanding, reflecting the Legislature's interest in assuring that medical information may be disclosed only for a narrowly defined purpose, to an identified party, for a limited period of time." (Id. at p. 426.) Alternatively, disclosure will be permitted if the provider "can show that the disclosure is excepted either by the mandatory (§ 56.10, subd. (b)) or permissive (§ 56.10[, subd. (c)]) provisions of the act, allowing disclosure of medical information under specified circumstances." (Heller v. Norcal Mutual Ins. Co., supra, 8 Cal.4th at p. 38.)^[15]

(14) It follows that "in order to violate the [Confidentiality Act], a provider of health care must make an unauthorized, unexcused disclosure of privileged medical information." (Heller v. Norcal Mutual Ins. Co., supra, 8 Cal.4th at p. 38.) Notably, the interest protected is an interest in informational privacy, not informational accuracy; a plaintiff need not show the disclosure was false or misleading. Indeed, the invasion of a privacy interest is all the more pronounced precisely because the disclosed information is true and may accurately reveal intimate details the patient had a right to expect were to be maintained in confidence. (See Hill v. National Collegiate Athletic Assn., supra, 7 Cal.4th at p. 41 ["`A person's medical profile is an area of privacy infinitely more intimate, more personal in quality and nature than many areas already judicially recognized and protected.'"]; Cutter v. Brownbridge (1986) 183 Cal.App.3d 836, 842 [228 Cal.Rptr. 545] ["The `zones of privacy'" protected by Cal. Const., art. I, § 1 "extend to the details of one's medical history."]; Stats. 1981, ch. 782, § 1, p. 3040 [declaring a patient's right to expect that medical information be maintained in confidentiality].)

B. The Third and Fourth Causes of Action

(15) As in Carlson v. Trans Union, LLC, supra, 259 F.Supp.2d at pages 521-522, we determine whether state law claims are preempted by section 1681t(b)(1)(F) by comparing whether "the substance of [the] claim" (Carlson, at p. 521)—its elements—overlaps with or is distinct from the matters regulated under section 1681s-2. (See also Cipollone v. Liggett Group, Inc., supra, 505 U.S. at pp. 524-530 [analyzing whether state claims impose a preempted requirement or prohibition by examining the duties underlying each cause of action].)

The third and fourth causes of action in the operative complaint allege, on behalf of Brown's two minor children and Brown himself, that Mortensen made unauthorized disclosures of the Browns' confidential medical information to three consumer reporting agencies. The Browns allege Mortensen disclosed to Experian, Equifax, and TransUnion their names, Social Security numbers, dates of birth, addresses, telephone numbers, and Brown's and his children's entire dental history with Dr. Reinholds, including alleged dental treatments. (See Civ. Code, § 56.05, subd. (g) [defining individually identifiable medical information as information "regarding a patient's medical history" in combination with a name, address, telephone number, or similar detail that "reveals the individual's identity"].) Brown never authorized Dr. Reinholds or Mortensen to disclose this information to any third party, including the three consumer reporting agencies.

Mortensen argues these claims are preempted because the operative complaint mentions Brown complained to the consumer reporting agencies that the disclosures were inaccurate and, alternatively, because the Browns' claims rest on the idea that Mortensen misled the consumer reporting agencies by implying either that Brown's children owed a debt or that their medical records were in some way relevant to Brown's disputed debt. According to Mortensen, this allegation and these theories bring the claims within section 1681s-2(a)'s regulation of furnisher accuracy and thus section 1681t(b)(1)(F)'s preemptive scope.

(16) This contention mistakes the nature of a Confidentiality Act claim, both in the abstract and as pleaded.^[16] As noted ante, that the information disclosed was inaccurate is not an element of a claim: the Confidentiality Act (Civ. Code, § 56 et seq.) requires only that the disclosure, whether true or not, occurred without authorization. The third and fourth causes of action repeatedly allege the disclosures occurred, were unauthorized, and injured the Browns. It will not be any part of Brown's required proof to show the disclosures were inaccurate or misleading as well.^[17] Nor does the complaint establish that any of Mortensen's disclosures were made in the course of responding to official notice of a credit information dispute, such that section 1681s-2(b) would apply. Accordingly, these claims as pleaded, having as their gravamen issues neither of accuracy nor of credit dispute resolution, do not involve the same subject matter as section 1681s-2 and are not preempted.

DISPOSITION

For the foregoing reasons, we reverse the Court of Appeal's judgment and remand this case for further proceedings consistent with this opinion.

Cantil-Sakauye, C. J., Kennard, J., Baxter, J., Chin, J., Corrigan, J., and Irion, J.,^[*] concurred.

NOTES

[1] Because plaintiffs appeal from the trial court's sustaining of a demurrer, we take the well-pleaded facts stated in the complaint as true. (Beal Bank, SSB v. Arter & Hadden, LLP (2007) 42 Cal.4th 503, 505, fn. 1 [66 Cal.Rptr.3d 52, 167 P.3d 666].)

[2] Dr. Reinholds, his professional corporation, a fellow dentist's professional corporation, and Reinholds's bookkeeper were all originally parties to this action, but have since been dismissed. For convenience, we refer to this group of defendants collectively as Dr. Reinholds.

[3] All further unlabeled statutory references are to title 15 of the United States Code.

[4] Former section 1681t provided: "This title does not annul, alter, affect, or exempt any person subject to the provisions of this title from complying with the laws of any State with respect to the collection, distribution, or use of any information on consumers, except to the extent that those laws are inconsistent with any provision of this title, and then only to the extent of the inconsistency." (FCRA, Pub.L. No. 91-508, § 622 (Oct. 26, 1970) 84 Stat. 1136.)

[5] The FCRA does not define the term "furnisher"; instead, its meaning is inferable from the context of its usage throughout the FCRA.

[6] Section 1681h(e) generally limits actions "in the nature of defamation, invasion of privacy, or negligence" against furnishers to instances where the defendant furnished false information "with malice or willful intent to injure such consumer."

[7] While the 1996 Reform Act subjected these preemption provisions to an eight-year sunset period (Pub.L. No. 104-208, § 2419 (Sept. 30, 1996) 110 Stat. 3009, 3009-453), Congress later made them permanent (Pub.L. No. 108-159, § 711 (Dec. 4, 2003) 117 Stat. 2011, amending 15 U.S.C. § 1681t(d)).

[8] The statute prohibits any person from "furnish[ing] any information relating to a consumer to any consumer reporting agency if the person knows or has reasonable cause to believe that the information is inaccurate." (§ 1681s-2(a)(1)(A).) Furthermore, if a furnisher receives statutory notice of a "dispute with regard to the completeness or accuracy of any information," the furnisher must investigate and correct incomplete or inaccurate information in a timely fashion. (§ 1681s-2(b)(1).)

[9] The one California case to take a position, Sanai v. Saltz, supra, 170 Cal.App.4th at pages 773-774, follows the total preemption line of cases. We express no view on Sanai's correctness.

[10] HIPAA section 264(c)(2) provides: "(2) PREEMPTION.—A regulation promulgated under paragraph (1) shall not supercede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation." (Pub.L. No. 104-191, § 264(c)(2) (Aug. 21, 1996) 110 Stat. 2033-2034.)

[11] Congress subsequently confirmed the FCRA's subordinate role to HIPAA on questions of medical privacy when it passed the Fair and Accurate Credit Transactions Act of 2003. (Pub.L. No. 108-159 (Dec. 4, 2003) 117 Stat. 1952.) It added the first protections for medical privacy to the FCRA, principally limiting the ability of consumer reporting agencies to disseminate confidential medical information. (See §§ 1681b(g)(1), 1681c(a)(6).) At the same time, Congress subordinated these new provisions to the requirements of HIPAA and the Privacy Rule. (See § 1681b(g)(3)(B), (6).)

[12] As the Ninth Circuit has cautioned, "[t]he legislative history surrounding § 1681t(b)(1)(F) is murky. . . ." (Gorman v. Wolpoff & Abramson, LLP (9th Cir. 2009) 584 F.3d 1147, 1172.)

[13] Technically, the report is on Senate Bill No. 650 (104th Cong., 1st Sess. (1995)), to which the substance of the Bryan-Bond bill was added by a December 1995 amendment.

[14] Unlike the Confidentiality Act, the two statutes saved by section 1681t(b)(1)(F) each specifically regulate furnishers and do so in a manner "nearly identical" to section 1681s-2. (Gorman v. Wolpoff & Abramson, LLP, supra, 584 F.3d at p. 1172.) Thus, in the absence of a savings clause, Congress might reasonably have been concerned that a court could find them preempted even under the narrower plausible understanding of the subject matter regulated by section 1681s-2.

[15] Contrary to anything Brown may have asserted at oral argument, nothing in the Confidentiality Act limits the procedural avenues available to medical professionals and their agents to pursue unpaid debts for their services. Nor are such professionals precluded from reporting the existence of a debt to consumer reporting agencies. (See 45 C.F.R. §§ 164.501, 164.506 (2010).) The act speaks only to limits on the disclosure of medical information.

[16] It also mistakes the nature of the preemption inquiry here. What matters are not extraneous allegations in a complaint, but whether the pleaded claims rest upon state law duties foreclosed by federal law. (See, e.g., Cipollone v. Liggett Group, Inc., supra, 505 U.S. at pp. 524-530.)

[17] Likewise, any relief Brown might obtain in this case will be confined to remedying harm from loss of privacy; remediation of any harm arising from alleged inaccuracies in the information Mortensen reported could come only from claims under laws governing the accuracy of furnished information (e.g., Civ. Code, § 1785.25, subd. (a); see Sanai v. Saltz, supra, 170 Cal.App.4th at pp. 776-778; Gorman v. Wolpoff & Abramson, LLP, supra, 584 F.3d at pp. 1169-1173), and no such claim has been pleaded here.

[*] Associate Justice of the Court of Appeal, Fourth Appellate District, Division One, assigned by the Chief Justice pursuant to article VI, section 6 of the California Constitution.