Attorney General Opinion No.

Don Scott Seward County Attorney 415 N. Washington, Suite 107 Liberal, Kansas 67901

Dear Mr. Scott:

As Seward County Attorney, you request our opinion regarding the applicability of the federal Health Insurance Portability and Accountability Act (HIPPA) privacy regulations in relation to Kansas' care and treatment proceedings pursuant to K.S.A. 59-2945 et seq. In this context you raise two questions:

• Are entities covered by the HIPAA privacy regulations required by law to disclose protected health information when called to testify in care and treatment proceedings?

• If the exception found in 60-427(c) [physician-patient privilege] forms the legal basis of requiring this testimony, does this mean that only physicians would be required to testify and that nurses and other medical staff are still bound not to testify by HIPAA because they are not physicians?

K.S.A. 2003 Supp. 59-2945 et seq., the Kansas Care and Treatment Act

The Kansas Care and Treatment Act,¹ provides the legal procedures for the involuntary commitment of persons.² The ultimate issue that a court or jury must determine in such a proceeding is whether the proposed patient is a mentally ill person subject to involuntary commitment for care and treatment.³

Various statutes within the Act address the kind of evidence that a court should receive in an involuntary commitment proceeding, which presumably would include health information concerning the proposed patient. The statute that addresses the procedure for a temporary custody order,⁴ the statute that addresses the procedure for a hearing in noncustodial circumstances⁵ and the statute that addresses the procedure for a trial upon the petition⁶ all contain the following provision:

"The court shall receive all relevant and material evidence which may be offered."

Additionally, under the Act such evidence is not privileged for the purpose of the involuntary commitment trial.⁷

The "relevant and material evidence" would presumably include a report of and testimony concerning the court-ordered evaluation required by K.S.A. 2003 Supp. 59-2961, as well as other testimonial and/or documentary evidence. This evaluation is required to be conducted by a physician, psychologist or qualified mental health professional⁸ and may also include "such other physical or other evaluations as may be ordered by the court." The statute further requires that the examiner "submit to the court a report, in writing, of the evaluation." The report must also be made available to counsel for the parties and to the proposed patient, unless for good cause the court orders otherwise. Besides testimony of the court-ordered examiner, other health care professionals may also be called as witnesses to testify in an involuntary commitment proceeding and asked to disclose physical and mental health information.

Health Insurance Portability and Accountability Act (HIPAA)

Pursuant to the authority granted by the Health Insurance Portability and Accountability Act of 1996, the Health Care Financing Administration, a division of the Department of Health and Human Services, has issued final regulations related to the security and privacy of health care information.⁹ Although the regulations became effective April 16, 2001, the Department of Health and Human Services gave entities covered by HIPAA two years to achieve compliance. The two year compliance date has passed and the regulations, collectively often called the Privacy Rule, are thus now in effect.

The obligations of these broad regulations apply to covered entities, "health plans, health care clearinghouses, and health care providers,"¹⁰ who transmit health information in electronic form in connection with certain transactions.¹¹ Health care is broadly defined to include "preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment or procedure with respect to the physical or mental condition or functional status of an individual or that affects the structure or function of the body."¹² Physicians, psychologists and other qualified mental health professionals are considered covered health care providers under HIPAA's privacy regulations.¹³

The general privacy rule established by these regulations provides that "a covered entity may not use or disclose protected health information, except as permitted or required" by the regulations.¹⁴ Under the HIPAA regulations, health information includes:

"Any information, whether oral or recorded in any form or medium, that:

"(1) Is created or received by a health care provider, . . .; and

"(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual."¹⁵

Six general categories of permitted uses and disclosures are specified by HIPAA's privacy regulation:

"(1) to the individual,

(2) with a consent that complies with specified requirements,

(3) without consent under certain conditions, except with respect to psychotherapy notes,

(4) with an authorization that complies with specified requirements,

(5) pursuant to an agreement as specified by the regulations and

(6) as permitted by and in compliance with the section titled "Uses and disclosures for which consent, an authorization, or opportunity to agree or object is not required.¹⁶

It is this last disclosure category with which we are concerned. This category specifies a number of situations in which a health care provider may use and/or disclose health information without consent, without authorization and without opportunity for the individual to agree or object. Within this category are found twelve such authorized disclosure situations, two of which merit discussion in relation to your question:45 C.F.R. § 164.512(a), uses and disclosures required by law, and § 164.512(e), disclosures for judicial and administrative proceedings.

45 C.F.R. § 164.512(a), Uses and Disclosures Required by Law 45 C.F.R. § 164.512(a) provides:

"(1) A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.

"(2) A covered entity must meet the requirements described in paragraph (c),¹⁷ (e),¹⁸ or (f)¹⁹ of this section for uses or disclosures required by law."

The HIPAA regulations define "required by law" as "a mandate contained in a law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law."²⁰ HIPAA's definition of "required by law" goes on to provide a non-exclusive list of examples:

"Court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits."²¹

The court-ordered evaluation required by K.S.A. 2003 Supp. 59-2961 appears to be a mandate contained in a specific law that compels the evaluating physician, psychologist or qualified mental health professional to disclose otherwise protected health information. Further, since disclosure of the evaluative report is due to a court order grounded in statute, such disclosure would be enforceable in a court of law. Thus, we believe that under 45 C.F.R. § 164.512(a), a health care provider would be permitted to disclose protected health information contained in a report of an evaluation ordered by a court pursuant to K.S.A. 2003 Supp. 59-2961 if the disclosure is limited to evidence that is relevant and material to the issue of whether the proposed patient is a mentally ill person subject to care and treatment under the Act. However, as seen from paragraph (2) of 45 C.F.R. § 164.512(a), even when the court ordered evaluation may disclose protected health information by virtue of HIPAA's "required by law" provision in a care and treatment proceeding, this health care provider may nevertheless be required to comply with another HIPAA section, i.e., paragraph (e) of45 C.F.R. § 164.512, regarding disclosures in judicial proceedings.²²

Additionally, as mentioned, other health care professionals who qualify as covered entities under HIPAA may also be called as witnesses to testify in an involuntary commitment proceeding and asked to disclose protected health information. We assume that such persons would appear to give testimony at the hearing by virtue of a subpoena issued pursuant to K.S.A. 2003 Supp. 60-245.²³ The question to be resolved thus becomes whether a subpoena issued pursuant to K.S.A. 2003 Supp. 60-245 may be considered a "subpoena issued by a court" for purposes of HIPAA's "required by law" provision, 45 C.F.R. § 164.512(a).

Under Kansas law "a subpoena commanding attendance at a trial or hearing shall issue from the district court in which the hearing or trial is to be held."²⁴ Further, "every subpoena issued by the court shall be issued by the clerk under the seal of the court or by a judge."²⁵ While the statute provides two mechanisms for the issuance of a subpoena, it does not establish any higher degree of scrutiny for a subpoena issued "by a judge" over a subpoena "issued by the clerk under the seal of the court." Both are considered to be "issued by the court" and both are enforceable through a contempt proceeding.²⁶

The language of the statute as well as the cases of Bond v. Albin²⁷ and Sebelius v. LaFaver,²⁸ support the proposition that a K.S.A. 2003 Supp. 60-245 subpoena — whether issued by a clerk under the seal of the court, by a judge, by an officer before whom a deposition is pending, or by an administrative officer with appropriate statutory authority — would be considered a "subpoena issued by a court" under HIPAA's "required by law" provision. Thus, in our opinion, under 45 C.F.R. § 164.512(a) a health care provider (other than a court-ordered evaluator) who is subpoenaed to testify at a care and treatment proceeding may disclose protected health information if the disclosure is limited to evidence that is relevant and material to the issue of whether the proposed patient is a mentally ill person subject to care and treatment under the Act.

Nevertheless, as seen from paragraph (2) of 45 C.F.R. § 164.512(a), the analysis cannot conclude at this point. Even when a disclosure is allowed under the "required by law" provision in a care and treatment proceeding, a health care provider may still need to meet the requirements of 45 C.F.R. § 164.512(e) that pertain to disclosures for judicial proceedings.

45 C.F.R. § 164.512(e), Disclosures for Judicial and AdministrativeProceedings 45 C.F.R. § 164.512(e) provides:

"(1) A covered entity may disclose protected health information in the course of any judicial or administrative proceeding:

"(i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or

"(ii) in response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal if: . . ."²⁹

The "if" in the second provision is followed by requirements concerning specific "satisfactory assurances" that must be received by a health care provider that "reasonable efforts" have been made regarding notice to the person who is the subject of the protected health information or that a qualified protective order has been sought.45 C.F.R. § 164.512(e)(1)(iii), (iv) and (v) specify in detail what those reasonable efforts and satisfactory assurances from the party seeking disclosure of health information are required to involve.³⁰ An alternative to those procedures is also available for health care providers to utilize in 45 C.F.R. § 164.512(e)(1)(vi).³¹

Initially, we note that the first provision,45 C.F.R. § 164.512(e)(1)(i), as well as the "required by law" authority of 45 C.F.R. § 164.512(a), would permit an examiner who is court-ordered pursuant to K.S.A. 2003 Supp. 59-2961 to disclose the written report of the evaluation to the court.³² As explained by Health and Human Services, "[w]hen a request is made pursuant to an order from a court or administrative tribunal, a covered entity may disclose information requested without additional process."³³ Thus the report and testimony of a court-ordered examiner would not be subject to the procedural requirements of the second provision of 45 C.F.R. § 164.512(e).

For other health care providers who may be subpoenaed to testify at a care and treatment proceeding, the issue for determination under45 C.F.R. § 164.512(e) is whether a subpoena issued by a court pursuant to K.S.A. 2003 Supp. 60-245 is "an order of a court" that requires no additional process,³⁴ or "a subpoena . . . that is not accompanied by an order of a court" that requires HIPAA's "satisfactory assurances."

The former position finds support in Bond v. Albin³⁵ in which the Court considered the status of a court reporter-issued deposition subpoena that Mr. Albin had disregarded. The Court made short shrift of his argument that there was no underlying order that if violated would trigger a contempt proceeding:

"[T]he fact that the subpoena was issued by a certified shorthand reporter who was to record the deposition did not detract from the subpoena being an order. K.S.A. 1999 Supp. 60-245(a)(2) authorizes a subpoena for taking depositions to be issued by the officer before whom the deposition is to be taken. K.S.A. 1999 Supp. 60-245(e) permits a finding of contempt of court for failure to obey a subpoena to appear for a deposition. Albin has failed to cite authority that would support an argument that K.S.A. 1999 Supp. 60-245(e) would be applicable only to a subpoena issued by a judge."³⁶

Additional support is provided by Sebelius v. LaFaver,³⁷ in which the Court considered the effect of a subpoena issued by the Director of Workers Compensation. The Court noted that the Workers Compensation Act gave the Director the power to issue subpoenas and compel the attendance of witnesses and production of documents to the same extent as is conferred on Kansas district courts, including the power to punish refusal to obey a subpoena through a contempt proceeding. Additionally, the Court said, "[i]n the code of civil procedure, a subpoena duces tecum is an order of the court to produce specific items or records."³⁸ The Court held that this administrative subpoena was a "proper judicial order"³⁹ for purposes of the proceeding at hand.

According to Bond v. Albin and Sebelius⁴⁰ v. LaFaver,⁴¹ a subpoena issued by a court is an order of the court, one that is enforceable through a contempt proceeding. This position also finds support in the Health and Human Services' commentary on45 C.F.R. § 164.512(e):

"In § 164.512(e) of the final rule, we permit covered entities to disclose protected health information in a judicial or administrative proceeding if the request for such protected health information is made through or pursuant to an order from a court or administrative tribunal or in response to a subpoena or discovery request from, or other lawful process by a party to the proceeding. When a request is made pursuant to an order from a court or administrative tribunal, a covered entity may disclose the information requested without additional process. For example, a subpoena issued by a court constitutes a disclosure which is required by law as defined in this rule, and nothing in this rule is intended to interfere with the ability of the covered entity to comply with such subpoena."⁴²

Under this line of thinking, a K.S.A. 60-245 subpoena issued by a court would also be considered an order of a court; and pursuant to 45 C.F.R. § 164.512(e)(1) no further process would be required.

However, three federal district courts that have addressed this issue in the context of HIPAA have found otherwise. In United States v.Sutherland,⁴³ a United States Attorney obtained a subpoena pursuant to Federal Rule of Criminal Procedure 17 without complying with the assurance requirements of HIPAA's 45 C.F.R. § 164.512(e). The Court held that "in response to a subpoena not accompanied by an order of a court, as in this case, a covered entity may disclose protected health information only after receiving satisfactory assurances."⁴⁴ Additionally, in a footnote the Court made this observation:

"Although issued by the clerk of court, the subpoena did not constitute an order of the court because the rules provide that the clerk may issue a blank subpoena to be completed later by the party seeking documentary evidence."⁴⁵

Like K.S.A. 60-245, a Rule 17 of the Federal Rules of Criminal Procedure subpoena is issued over the seal of the court. Additionally, because such a subpoena "orders" and "commands" persons, the federal rule, like K.S.A. 60-245, authorizes the court to hold in contempt a witness who, without adequate cause, disobeys "a subpoena issued by a federal court."

In Hutton v. City of Martinez,⁴⁶ the Court strongly implied that in the context of 45 C.F.R. § 164.512(e), a court order is distinguishable from a subpoena issued by a court:

"Section 164.512 subsection (e) of HIPAA allows disclosure of information in the course of judicial and administrative proceedings. Disclosure may be compelled in response to a court order or to a subpoena, discovery request, or other lawful process, even if not accompanied by a court order, if the party seeking the information makes reasonable efforts to secure a qualified protective order."⁴⁷

In the more recent case of Law v. Zuckerman,⁴⁸ in addressing45 C.F.R. § 164.512(e), the Court stated that "disclosure is permitted ``in response to an order of a court . . . provided that the covered entity discloses only the protected health information expressly authorized by such an order.'"⁴⁹ Further,

"A trial or deposition subpoena is appropriately treated differently from an order of the Court. When medical information is to be released in response to a subpoena or discovery request, the health care provider must receive satisfactory assurance that: (1) there have been good faith attempts to notify the subject of the protected health information in writing of the request and that subject has been given the opportunity to object; or (2) reasonable efforts have been made by the requesting party to obtain a qualified protective order."⁵⁰

If a subpoena issued by a court were considered the same as an order of a court, there would be no need for the differentiation between paragraphs (i) and (ii) of 45 C.F.R. § 164.512(e). All subpoenas issued in any sense "from a court," such as all K.S.A. 60-245 subpoenas, regardless whether actually issued by a judge, by a clerk in blank under seal of the court or by an officer before whom a deposition is pending, would fall within HIPAA's paragraph (i) of 45 C.F.R. § 164.512(e). No further process would be required, which means the subject of the subpoena to a third party would not be provided with any of the procedural protections afforded by HIPAA's paragraph (ii) of that regulation. Additionally, the "not accompanied by an order of a court" language in paragraph (ii) in reference to a subpoena would be rendered meaningless in all situations where blank subpoenas may routinely issue from a clerk's office under statutory authority "of a court."

K.S.A. 60-245 does provide for circumstances when an actual order of a court would accompany a subpoena. If an objection is made to a subpoena for production and inspection, "the party serving the subpoena shall not be entitled to inspect and copy the materials or inspect the premises except pursuant to an order of the court by which the subpoena was issued."⁵¹ The party serving such a subpoena may also move for an "order to compel the production."⁵² Additionally, upon the filing of a quash or motion, the court may issue an order modifying a subpoena for a number of statutory reasons.⁵³ In any of these scenarios, an actual order of a court would be issued to accompany the subpoena.

In our opinion, in the context of HIPAA the federal district court case law supports the more reasonable position: that a subpoena, even though considered an order of the court that is enforceable through a contempt proceeding, is not the same as an actual order of a court. Such subpoenas, though issued under seal of the court, are routinely issued in blank signed by the clerk or a facsimile of the clerk's signature, without receiving any judicial consideration. It would not be until an objection to a subpoena is lodged or a motion to quash or modify is filed that an actual order of the court would issue expressly authorizing (or prohibiting) disclosure of health information.

Thus, in the absence of an actual order of a court that expressly authorizes disclosure of protected health information, under45 C.F.R. § 164.512(e), a health care provider who has been subpoenaed to testify in an involuntary commitment proceeding must have received HIPAA's requisite "satisfactory assurances" in order to disclosure HIPAA protected health information. However, if a court expressly orders such a disclosure, pursuant to 45 C.F.R. § 164.512(e)(1)(ii) a health care provider may disclose otherwise protected health information as authorized by the order.

HIPAA Preemption Issue Unfortunately, this analysis is not complete without consideration of the preemption issue under HIPAA. And more unfortunately, what few court decisions exist are not particularly consistent in their analyses or application of the HIPAA preemption provision.⁵⁴ Nevertheless, we would be remiss in ignoring the preemption provision completely.

Preliminarily, as one court explained:

"HIPAA and the related provisions established in the Code of Federal Regulations expressly supercede any contrary provisions of state law except as provided in 42 U.S.C. § 1320d-7(a)(2). Under the relevant exception, HIPAA and its standards do not preempt state law if the state law relates to the privacy of individually identifiable health information and is ``more stringent' than HIPAA's requirements."⁵⁵

A state privacy standard is more stringent if "the state law prohibits or restricts a use or disclosure in circumstances upon which such use or disclosure otherwise would be permitted" under HIPAA privacy regulations.⁵⁶ Thus, at least in a state court lawsuit,⁵⁷ if a state law is more restrictive than a HIPAA regulation regarding privacy of medical information, the state law supercedes. However, if a state law is less restrictive, then the HIPAA regulation preempts the state law. "More stringent" means that the state law meets any one of six criteria.⁵⁸ These criteria have been collectively referred to as meaning "[state] laws that afford patients more control over their medical records."⁵⁹ This concept may also be understood as the HIPAA's privacy regulations setting forth "the baseline for the release of health information."⁶⁰ Thus, in a state court lawsuit, if a state law relating to the privacy of health information is more restrictive (i.e., "more stringent") than the applicable HIPAA privacy regulation, the state law supercedes and thus controls the matter; however, if the state law is less restrictive, the applicable HIPAA privacy regulation controls the matter. However, it should still be borne in mind that:

"All that 45 C.F.R. § 164.512(e) should be understood to do, therefore, is to create a procedure for obtaining authority to use medical records in litigation. Whether the records are actually admissible in evidence will depend among other things on whether they are privileged."⁶¹

With this understanding of preemption pursuant to HIPAA, we turn to the following state privilege laws.⁶²

• K.S.A. 2003 Supp. 59-2979. "The district court records, treatment records or medical records of any patient or former patient that are in the possession of any district court or treatment center shall be privileged and shall not be disclosed except: . . . (4) in a proceeding under this [care and treatment] act, upon the oral or written request of any attorney representing the patient, or former patient.

• K.S.A. 2003 Supp. 65-5603(a)(1). "The privilege established by K.S.A. 65-5202 and amendments thereto [diagnosis and treatment of patients of a treatment facility; required to be claimed by treatment center personnel absent a written waiver by the patient] shall not extend to any communication relevant to an issue in proceedings to involuntarily commit to treatment a patient for mental illness, alcoholism or drug dependency if the treatment personnel in the course of diagnosis or treatment has determined that the patient is in need of treatment."

• K.S.A. 60-427(c). "There is no privilege under this section as to any relevant communication between the patient and the patient's physician: (1) Upon an issue of the patient's condition in an action to commit the patient or otherwise place the patient under the control of another or others because of alleged incapacity or mental illness, in an action in which the patient seeks to establish the patient's competence."⁶³

• K.S.A. 74-5232(a). "The confidential relations and communications between a licensed psychologist and the psychologist's patient are placed on the same basis as provided by law for those between an attorney and the attorney's client."

• K.S.A. 74-5372(a). "The confidential relations and communications between a licensed master psychologist and such psychologist's patient are placed on the same basis as provided by law for those between an attorney and the attorney's client."

• K.S.A. 74-5372(b). "The confidential relations and communications between a licensed clinical psychotherapist and such psychotherapist's patient are placed on the same basis as provided by law for those between an attorney and the attorney's client."

• K.S.A. 65-6410(a). "A person licensed under the marriage and family therapists licensure act and employees and professional associates of the person shall not be required to disclose any information that the person, employee or associate may have acquired in rendering marriage and family therapy services, unless: (1) Disclosure is required by other state laws; . . ."

• K.S.A. 65-5810(a). "The confidential relations and communications between a licensed professional counselor and such counselor's patient are placed on the same basis as provided by law for those between an attorney and the attorney's client."

• K.S.A. 65-5810(b). "The confidential relations and communications between a licensed clinical professional counselor and such counselor's patient are placed on the same basis as provided by law for those between an attorney and the attorney's client."

• K.S.A. 65-6315(b). "The confidential relations and communications between a licensed master social worker's or a licensed specialist clinical social worker's client are placed on the same basis as provided by law for those between an attorney and the attorney's client."

• K.S.A. 2003 Supp. 59-2965(c). "Such [all relevant and material] evidence shall not be privileged for the purpose of this [care and treatment] hearing."

Each of the above privileges granted by statute are suspended in the context of a care and treatment proceeding either by virtue of the privilege statute itself and/or by virtue of K.S.A. 59-2965(c). This suspension of a privilege is accomplished as a matter of law, without an express order of a court or any alternative procedural safeguards, i.e., without any procedures for notice to the person who is the subject of the health information, opportunity to object or opportunity to seek a protective order.⁶⁴ Consequently, in our opinion 45 C.F.R. § 164.512(e) is procedurally "more stringent" than any of the foregoing privilege statutes and the applicable suspension of such privileges, and thus preempts each of them in relation to the procedure required before a patient's health information may be disclosed. Thus, HIPAA's procedural "baseline" pursuant to 45 C.F.R. § 164.512(e), as discussed herein, must be reached before a health care provider becomes authorized under the applicable Kansas privilege law suspension to disclose health information in a care and treatment proceeding. Once any requisite procedures pursuant to 45 C.F.R. § 164.512(e) have been complied with, any relevant and material evidence may be admitted in a care and treatment proceeding by virtue of K.S.A. 59-2003 Supp. 2965(c) and by virtue of the suspension of a privilege pursuant to an applicable Kansas privilege statute.

In conclusion, the "disclosures required by law" provision of the Health Insurance Portability and Accountability Act in45 C.F.R. § 164.512(a) permits a health care provider to disclose protected health information contained in a report of an evaluation ordered by a court pursuant to K.S.A. 2003 Supp. 59-2961 in a care and treatment proceeding if the disclosure is limited to evidence that is relevant and material to the issue of whether the proposed patient is a mentally ill person subject to care and treatment under the Act. Additionally, under 45 C.F.R. § 164.512(a) a health care provider (other than a court-ordered evaluator) who is subpoenaed to testify at a care and treatment proceeding may disclose protected health information if the disclosure is limited to evidence that is relevant and material to the issue of whether the proposed patient is a mentally ill person subject to care and treatment under the Act. However, even when a disclosure is allowed under the "required by law" provision in a care and treatment proceeding, a health care provider may still need to meet the requirements of 45 C.F.R. § 164.512(e) that pertain to disclosures for judicial proceedings.

The "disclosures for judicial and administrative proceedings" provision in 45 C.F.R. § 164.512(e)(1)(i) also permits a health care provider to disclose protected health information contained in a report of an evaluation ordered by a court pursuant to K.S.A. 2003 Supp. 59-2961 in a care and treatment proceeding without further process, provided that only the health information expressly authorized by the court's order is disclosed. In the absence of an actual order of a court that expressly authorizes disclosure of protected health information, under45 C.F.R. § 164.512(e), a health care provider who has been subpoenaed to testify in an involuntary commitment proceeding must have received HIPAA's requisite "satisfactory assurances" in order to disclosure HIPAA protected health information. However, if a court expressly orders such a disclosure, pursuant to 45 C.F.R. § 164.512(e)(1)(ii) a health care provider may disclose otherwise protected health information as authorized by the order.

45 C.F.R. § 164.512(e) is procedurally "more stringent" than any of the Kansas privilege statutes and the applicable suspension of such privilege in the context of a care and treatment proceeding, and thus preempts each of them in relation to the procedure required before a patient's health information may be disclosed. Thus HIPAA's procedural "baseline" pursuant to 45 C.F.R. § 164.512(e) must be reached before a health care provider becomes authorized under the applicable Kansas privilege suspension statute to disclose health information in a care and treatment proceeding. Once any requisite procedures pursuant to45 C.F.R. § 164.512(e) have been complied with, any relevant and material evidence may be admitted in a care and treatment proceeding.

Sincerely,

PHILL KLINE Attorney General of Kansas

Camille Nohe Assistant Attorney General

PK:JLM:CN:jm

¹ K.S.A. 2003 Supp. 59-2945 et seq.

² While the Act also establishes the legal process regarding voluntary admissions (K.S.A. 2003 Supp. 59-2949), this opinion addresses only involuntary commitments.

³ K.S.A. 2003 Supp. 59-2966. See K.S.A. 59-2946 for definition of "mentally ill person subject to involuntary commitment for care and treatment."

⁴ K.S.A. 2003 Supp. 59-2959(c).

⁵ K.S.A. 2003 Supp. 59-2962.

⁶ K.S.A. 2003 Supp. 59-2965(c).

⁷ K.S.A. 59-2965(c).

⁸ "``Qualified mental health professional' means a physician or psychologist who is employed by a participating mental health center or who is providing services as a physician or psychologist under a contract with a participating mental health center, a licensed masters level psychologist, a licensed clinical psychotherapist, a licensed marriage and family therapist, a licensed clinical marriage and family therapist, a licensed professional counselor, a licensed clinical professional counselor, a licensed specialist social worker or a licensed master social worker or a registered nurse who has a specialty in psychiatric nursing, who is employed by a participating mental health center and who is acting under the direction of a physician or psychologist who is employed by, or under contract with, a participating mental health center." K.S.A. 2003 Supp. 59-2946(j).

⁹ 42 C.F.R. § 160 et seq. and 45 C.F.R. § 164 et seq.

¹⁰ "Health care provider" includes any person or organization who furnishes, bills, or is paid for health care in the normal course of business. 42 C.F.R. § 160.502.

¹¹ 45 C.F.R. § 164.104.

¹² 45 C.F.R. § 160.103.

¹³ 45 C.F.R. § 160.103.

¹⁴ 45 C.F.R. § 164.502.

¹⁵ 45 U.S.C. § 160.103.

¹⁶ 45 C.F.R. § 164.502.

¹⁷ Disclosures about victims of abuse, neglect or domestic violence.

¹⁸ Disclosures for judicial and administrative proceedings.

¹⁹ Disclosures for law enforcement purposes.

²⁰ 45 C.F.R. § 164.501.

²¹ Id. (emphasis added).

²² See discussion herein regarding 45 C.F.R. § 165.512(e).

²³ "The rules governing evidentiary and procedural matters athearings under this section shall be applied in a manner so as to facilitate informal, efficient presentation of all relevant, probative evidence and resolution of issues with due regard to the interests of all parties." K.S.A. 2003 Supp. 59-2965(d).

²⁴ K.S.A. 2003 Supp. 60-245(a)(2) (emphasis added).

²⁵ K.S.A. 2003 Supp. 60-245(a)(3) (emphasis added).

²⁶ K.S.A. 2003 Supp. 60-245(e).

²⁷ 29 Kan. App. 2d 262 (2000).

²⁸ 269 Kan. 918 (2000).

²⁹ Emphasis added.

³⁰ See Appendix regarding these specific requirements.

³¹ See Appendix regarding these specific requirements.

³² "[T]he provisions of this paragraph [45 C.F.R. § 164.512(e)] do not supersede or otherwise invalidate other provisions of this rule that permit uses or disclosures of protected health information."65 Fed. Reg. 82530 (Dec. 28, 2000) Health and Humans Services Commentary on HIPAA final privacy rule.

³³ 65 Fed. Reg. 82529 (Dec. 28, 2000), Health and Humans Services Commentary on HIPAA final privacy rule.

³⁴ 65 Fed. Reg. 82529 (Dec. 28, 2000), Health and Humans Services Commentary on HIPAA final privacy rule.

³⁵ 29 Kan. App. 2d 262 (2000).

³⁶ Id. at 263 (emphasis added).

³⁷ 269 Kan. 918 (2000).

³⁸ Id. at 924.

³⁹ Id. at 924.

⁴⁰ Supra.

⁴¹ Supra.

⁴² 65 Fed. Reg. 82529 (Dec. 28, 2000), Health and Human Services Commentary on HIPAA final privacy rule.

⁴³ 143 F. Supp. 2d 609 (W.D.Virginia 2001).

⁴⁴ Id. at 612.

⁴⁵ Id. at 612, n. 3.

⁴⁶ 291 F.R.D. 164 (N.D.Calf. 2003).

⁴⁷ Id. at 167

⁴⁸ 307 F. Supp. 2d 705 (D.Md.So.Dst. 2004).

⁴⁹ Supra at 708.

⁵⁰ Supra at 708.

⁵¹ K.S.A. 60-245(c)(2)(B).

⁵² Id.

⁵³ K.S.A. 60-245(c)(3).

⁵⁴ National Abortion Federation v. Ashcroft, 2004 WL 292070 (N.D.Ill 2004) (Illinois substantive law concerning nonparty patient medical records more stringent than HIPAA's disclosure requirements under45 C.F.R. § 164.512(e); thus Illinois' nonparty patient privacy laws not preempted by HIPAA and subsequent regulations in federal court proceeding); but see appellate decision of case, Northwestern MemorialHospital v. Ashcroft, 362 F.3d 923 (7th Cir. 2004) (Illinois free to enforce more stringent medical-records privilege in state court suits to enforce state law, but Illinois privilege does not govern in federal-question suits); Law v. Zuckerman, 307 F. Supp. 705 (D.Md.S.D. 2004) (HIPAA procedural disclosure requirements under45 C.F.R. § 164.512(e) provide greater patient control over disclosure of records than Maryland confidentiality of medical records law which allows disclosure without court order or patient consent); NationalAbortion Federation v. Ashcroft, 2004 WL 555701 (S.D.N.Y 2004) (New York law requiring patient consent before disclosure in judicial proceedings more stringent than HIPAA's 45 C.F.R. § 164.512(e), but New York law not applicable within federal domain); United States v. The Louisiana Clinic, 2002 WL 3189130 (E.D.La. Dec. 12, 2002) (Louisiana procedure that requires consent or court determination that release of medical information is proper less stringent than HIPAA because does not address form, substance or need for consent; thus Louisiana law preempted by HIPAA in federal case proceeding); In re: PPA, 2003 WL 22203734 (N.J. Super.L. 2003) (unpublished) (New Jersey procedural safeguard for disclosure less stringent than HIPAA standards in 45 C.F.R. § 164.512(e) for judicial proceedings, thus HIPAA preempts New Jersey law in federal court proceeding); Lemieux v. Tandem Health Care of Florida, 886 So. 2d 745 (Fl. 2004) (because Florida's substantive provisions more stringent than HIPAA, Florida law controls even though HIPAA's procedural requirements more stringent than Florida).

⁵⁵ Law v. Zuckerman, supra at 708-09; see also42 U.S.C. § 1320d-7(a)(2)(B) (referring back to the Historical and Statutory notes to 42 U.S.C. § 1320d-2); 45 C.F.R. § 160.203.

⁵⁶ 45 C.F.R. § 160.202

⁵⁷ See Northwestern Memorial Hospital v. Ashcroft, supra at 925 ("Illinois is free to enforce its more stringent medical-records privilege — there is no comparable federal privilege — in suits in state court to enforce state law . . .); National Abortion Federal v. Ashcroft (S.D.N.Y), supra ("]New York law] remains the law in areas in which New York State has the authority to regulation, but is has not become the law in areas within the federal domain").

⁵⁸ "More stringent means, in the context of a comparison of a provision of State law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, a State law that meets one or more of the following criteria: (1) With respect to a use or disclosure, the law prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted under this subchapter, except if the disclosure is: (i) required by the Secretary in connection with determining whether a covered entity is in compliance with this subchapter; or (ii) to the individual who is the subject of the individually identifiable health information; (2) With respect to the rights of an individual, who is the subject of the individually identifiable health information, regarding access to or amendment of individually identifiable health information, permits greater rights of access or amendment, as applicable; (3) With respect to information to be provided to an individual who is the subject of the individually identifiable health information about a use, a disclosure, rights, and remedies, provides the greater amount of information; (4) With respect to the form, substance, or the need for express legal permission from an individual, who is the subject of the individually identifiable health information, for use or disclosure of individually identifiable health information, provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as expanding the criteria for), or reduce the coercive effect of the circumstances, surrounding the express legal permission, as applicable; (5) With respect to recordkeeping or requirements relating to accounting of disclosures, provides for the retention or reporting of more detailed information or for a longer duration; (6) With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information."45 C.F.R. § 160.202.

⁵⁹ Law v. Zuckerman, 307 F. Supp. at 709 (emphasis original).

⁶⁰ Law v. Zuckerman, 307 F. Supp. at 708.

⁶¹ Northwestern Memorial Hospital, 362 F.3d at 925.

⁶² This list of privilege statutes is not intended to be exhaustive.

⁶³ We note the absence of a statutory nurse-patient privilege; however, such a privilege may extend the physician-patient privilege to a nurse working under the supervision, direction or delegation of a physician.

⁶⁴ K.S.A. 60-245(e) allows a person on whom a subpoena is served to object or to file a motion to quash or modify, but does not have any comparable provision for the person about whom the subpoena requests testimony or records.