In Re Petition of Atty. Gen. for Investigative Subpoenas

736 N.W.2d 594 (2007) 274 Mich. App. 696

In re PETITION OF ATTORNEY GENERAL FOR INVESTIGATIVE SUBPOENAS.

Docket No. 263959.

Court of Appeals of Michigan.

Submitted February 6, 2007, at Lansing. Decided March 20, 2007, at 9:05 a.m. Released for Publication August 1, 2007.

Michael A. Cox, Attorney General, Thomas L. Casey, Solicitor General, and Amy L. Rosenberg and Susan Kay Balkema, Assistant Attorneys General, for the petitioner.

The Wolf Law Firm (by Allen M. Wolf) (Thomas M. Slavin, of counsel) and Robert Patrick George, Lake Orion, Mt. Clemens, for the respondent.

Before: WHITBECK, C.J., and BANDSTRA and SCHUETTE, JJ.

PER CURIAM.

Respondent appeals by leave granted an order granting petitioner's subpoena request, directing respondent to produce certain patient health information. We affirm.

I. FACTS

Respondent is a dentist. The Michigan Department of Community Health (MDCH) is conducting an investigation into allegations that respondent has engaged in insurance fraud. Acting on behalf of the MDCH, petitioner petitioned the circuit court for an investigative subpoena to procure "certain records, including but not by way of limitation all original dental charts and radiographs pertaining to" seven of respondent's patients. The court issued an order authorizing the subpoena. Respondent then moved to quash. The court granted the motion because of a facial defect, but allowed petitioner to reissue the subpoena under the existing order.

II. DISCLOSURE OF SUBPOENAED INFORMATION

Respondent first argues that the Health Insurance Portability and Accountability Act (HIPAA), 42 USC 1320d et seq., and regulations thereunder preclude disclosure of the subpoenaed information. We disagree.

A. Standard of Review

Statutory interpretation is a question of law we review de novo, Ayar v. Foodland Distributors, 472 Mich. 713, 715, 698 N.W.2d 875 (2005), as is the interpretation of administrative regulations, Lansing Mayor v. Pub. Service Comm., 470 Mich. 154, 157, 680 N.W.2d 840 (2004). This applies to the interpretation of federal statutes and regulations, see Andersen v. Director, Office of Workers' Compensation Programs, 455 F.3d 1102, 1103 (C.A.10, 2006), though reasonable administrative interpretations of regulations operating as statutory gap-fillers are entitled to deference, United States v. Mead Corp., 533 U.S. 218, 227-229, 121 S. Ct. 2164, 150 L. Ed. 2d 292 (2001). "Clear and unambiguous statutory language is given its plain meaning, and is enforced as written." Ayar, supra at 716, 698 N.W.2d 875.

B. Analysis

1. HIPAA

Subtitle F of Title II of HIPAA, PL 104-191, §§ 1171-1179, 110 Stat 2021-2034, 42 USC 1320d et seq., regulates patient information retained, used, and transferred by health care providers. In doing so, it authorizes regulations governing confidential patient information. See id., § 264, 110 Stat 2033-2034. Under this authority, regulations have been promulgated establishing procedures for the uses and disclosure of such information. See 45 CFR 164.502-164.534.

"Individually identifiable health information" (IIHI) is information "created or received by a health care provider" that "relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual," and that "identifies the individual" or regarding which "there is a reasonable basis to believe that the information can be used to identify the individual." 42 USC 1320d(6). "Protected health information" (PHI), with some exceptions not applicable here, is transmitted IIHI. 45 CFR 160.103.

Under federal regulations, a health care provider "may not use or disclose protected health information, except as permitted or required by" specified regulations. 45 CFR 164.502(a). 45 CFR 164.512(d) provides in part as follows:

(1) Permitted disclosures. A covered entity[^[1]] may disclose protected health information to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of:

(i) The health care system.

A "health oversight agency" is

an agency or authority of . . . a State, . . . a political subdivision of a State . . ., or a person or entity acting under a grant of authority from . . . such public agency, . . . that is authorized by law to oversee the health care system (whether public or private). . . . [45 CFR 164.501.]

Under the unambiguous language of § 512(d), the circuit court did not err in concluding that HIPAA does not preclude enforcement of the instant subpoena. The MDCH is a statutorily created entity that oversees public health policy and management, and in that capacity is responsible for overseeing licensed health care professionals in Michigan. See MCL 333.16221 (granting investigative authority to the Department of Commerce); Executive Reorganization Order Nos.1996-2(I), 2003-1(IV)(A)(1) (transferring duties, respectively, from the Department of Commerce to the Department of Consumer and Industry Services; then to the Department of Community Health); Health Care Ass'n Workers Compensation Fund v. Director of the Bureau of Worker's Compensation, 265 Mich.App. 236, 250, 694 N.W.2d 761 (2005) (citation omitted) (recognizing the authority of the Governor to reorganize and transfer executive power "``"within, among or across"' executive departments"). It is plainly an "entity acting under a grant of authority from" the state of Michigan "that is authorized by law to oversee the health care system," and is therefore a "health oversight agency" under HIPAA regulations. 45 CFR 164.501. Under MCL 333.16235(1), petitioner sought the instant subpoena on behalf of the MDCH. Petitioner requested the patient health information at issue incident to an insurance fraud investigation conducted by the MDCH. This information pertained to the MDCH's "oversight activities authorized by law," particularly a disciplinary investigation concerning respondent's provision of dental care, so respondent, as a health care provider, 42 USC 1320d(3),^[2] was authorized to release information under HIPAA regulations, 45 CFR 164.512(d)(1). See 65 Fed Reg 82462, 82529 (noting that "for the purposes of . . . [45 CFR 164.512(d)], we intend for investigations . . . to mean investigations of health care fraud").

Respondent argues that § 512(d) merely authorizes the disclosure of the information at issue, but does not require it. It is true that § 512(d) itself does not require disclosure of this information, but as we will explain, that is ultimately immaterial. "[I]t is well-settled that an agency's interpretation of its own regulation is ``of controlling weight unless it is plainly erroneous or inconsistent with the regulation.'" Secretary of Labor, Mine Safety & Health Admin. v. Western Fuels-Utah, Inc., 283 U.S. App DC 334, 337, 900 F.2d 318 (1990), quoting Bowles v. Seminole Rock & Sand Co., 325 U.S. 410, 414, 65 S. Ct. 1215, 89 L. Ed. 1700 (1945); see also Auer v. Robbins, 519 U.S. 452, 461; 117 S. Ct. 905, 137 L. Ed. 2d 79 (1997).^[3]

Respondent reasons that "the fact that . . . [he] was asked to respond to a subpoena must shift the analysis to 45 CFR 164.512(e) . . . which governs disclosures for judicial and administrative proceedings via court order or subpoena." In fact, respondent's claim is belied by the plain language of § 512(e), which states that "[t]he provisions of this paragraph do not supersede other provisions of this section that otherwise permit or restrict uses or disclosures of protected health information." 45 CFR 164.512(e)(2). Under this language, where one provision for disclosure of PHI is sufficient to allow the disclosure, it is unnecessary to invoke § 512(e). In this context, because the MDCH is a "health oversight agency," and the requested information pertained to the MDCH's "oversight activities authorized by law," respondent, as a health care provider, 42 USC 1320d(3), was authorized to release information under 45 CFR 164.512(d)(1). It was unnecessary for petitioner to seek the information under § 512(e). See 65 Fed Reg 82462, 82529-82530.

2. Dentist-Patient Privilege

We also reject respondent's argument that Michigan's dentist-patient privilege statute precludes disclosure of the subpoenaed information.

The MDCH is authorized to "investigate activities related to the practice of a health profession by a licensee," MCL 333.16221, and to "conduct an investigation necessary to administer and enforce" Article 15, Occupations, of the Public Health Code, MCL 333.16101 et seq., MCL 333.16233. Incident to this authority, MCL 333.16235(1) expressly authorizes the Attorney General to pursue investigative subpoenas on behalf of the MDCH, and to compel disclosure of patient records.

Part 166 of Article 15 of the Public Health Code, MCL 333.16601 et seq., provides for the licensing and regulation of dentistry. Incident to this regulation, MCL 333.16648(1) provides as follows:

Information relative to the care and treatment of a dental patient acquired as a result of providing professional dental services is confidential and privileged. Except as otherwise permitted or required under the health insurance portability and accountability act of 1996, Public Law 104-191, and regulations promulgated under that act, 45 CFR parts 160 and 164, . . . a dentist or a person employed by the dentist shall not disclose or be required to disclose that information.

Respondent argues that this provision expressly excepts dentist-patient records from the Attorney General's subpoena power under MCL 333.16235(1) because it directs that dentists "shall not disclose or be required to disclose" that information. This argument is refuted by the clear language of this section. Otherwise privileged "[i]nformation relative to the care and treatment of a dental patient" may be disclosed or required to be disclosed "as otherwise permitted or required under" HIPAA and regulations thereunder. MCL 333.16648(1). This effectively directs that where PHI may be disclosed under HIPAA or HIPAA regulations, it may be disclosed under Michigan's dentist-patient privilege statute. As we discussed, in the instant dispute, respondent was permitted to release the information under 45 CFR 164.512(d). Therefore, because respondent was permitted to release the information in compliance with HIPAA, this release necessarily complies with MCL 333.16648(1), and respondent's argument to the contrary is without merit.

III. PRIVACY AND DUE PROCESS CONCERNS

Respondent next argues that the circuit court's procedures for administering petitioner's subpoena requests violate federal and Michigan statutory privacy protections. Specifically, respondent contends that the court should require good cause before allowing petitioner to subpoena patient health information. We disagree.

A. Standard of Review

The cardinal rule of statutory interpretation is to determine legislative intent. See McClements v. Ford Motor Co., 473 Mich. 373, 385, 702 N.W.2d 166, amended 474 Mich. 1201, 704 N.W.2d 68 (2005). This is best discerned from the statutory language. Neal v. Wilkes, 470 Mich. 661, 665, 685 N.W.2d 648 (2004). "Clear and unambiguous statutory language is given its plain meaning, and is enforced as written." Ayar, supra at 716, 698 N.W.2d 875. We will read nothing into a statute that is not within the manifest intent of the Legislature. In re Marin, 198 Mich.App. 560, 564, 499 N.W.2d 400 (1993).

B. Analysis

As we discussed, HIPAA regulations permit the disclosure of PHI "to a health oversight agency for oversight activities authorized by law, including audits; [or] civil, administrative, or criminal investigations." 45 CFR 164.512(d)(1). Michigan's dentist-patient privilege statute permits such disclosure to the extent otherwise permitted under HIPAA and HIPAA regulations. MCL 333.16648(1). And MCL 333.16235 empowers petitioner to procure investigative subpoenas on behalf of the MDCH. But the HIPAA regulations, MCL 333.16648, and MCL 333.16235 do not impose the "good cause" threshold respondent urges this Court to adopt. Respondent asks that we read language into these provisions, in violation of a cardinal canon of statutory interpretation. In re Marin, supra at 564, 499 N.W.2d 400. Though respondent cites the policies of HIPAA, MCL 333.16648, and MCL 333.16235 in support of his position, general legislative policies cannot trump unambiguous statutory language. See Brown v. Loveman, 260 Mich.App. 576, 589, 680 N.W.2d 432 (2004) (legislative intent prevails over conflicting rule of statutory construction). We are not positioned to interpose a higher threshold in lieu of a policy determination made by the Legislature. See Calovecchi v. Michigan, 461 Mich. 616, 624, 611 N.W.2d 300 (2000). Moreover, the "good cause" threshold respondent urges upon this Court was effectively rejected in the promulgation of 45 CFR 164.512(d), see 65 Fed Reg 82462, 82672, 82676, and implicitly rejected by the Legislature in enacting MCL 333.16648(1).

Respondent also argues that the circuit court's procedures for administering petitioner's subpoena requests violate his due process rights, as they are effectively a "rubber stamp" on these petitions. We disagree.

The federal and Michigan constitutions guard against the deprivation of life, liberty, or property without due process of law. U.S. Const, Am XIV; Const 1963, art 1, § 17; see In re CR, 250 Mich. App. 185, 204, 646 N.W.2d 506 (2002) (noting that this Court has observed that the respective clauses are similarly defined). "The principle of fundamental fairness is the essence of due process," and this is embodied in the rights to notice and an opportunity to be heard. By Lo Oil Co. v. Dep't of Treasury, 267 Mich.App. 19, 29, 703 N.W.2d 822 (2005). But due process is also a flexible concept "``and calls for such procedural protections as the particular situation demands.'" Mathews v. Eldridge, 424 U.S. 319, 334, 96 S. Ct. 893, 47 L. Ed. 2d 18 (1976), quoting Morrissey v. Brewer, 408 U.S. 471, 481, 92 S. Ct. 2593, 33 L. Ed. 2d 484 (1972).

It is well established that due process rights are not invoked in the context of administrative investigations and investigatory subpoenas, where no legal rights are adjudicated. See, e.g., Securities & Exchange Comm. v. O'Brien, 467 U.S. 735, 742, 104 S. Ct. 2720, 81 L. Ed. 2d 615 (1984); Aponte v. Calderon, 284 F.3d 184, 193 (C.A.1, 2002). Again, the MDCH is a statutorily created entity that oversees public health policy and management. Article 15 of the Public Health Code, MCL 333.16101 et seq., authorizes the creation of various boards to directly govern and oversee the various individual health occupations within the state. See MCL 333.16621 (creating a board of dentistry). These boards are required to establish disciplinary subcommittees to address violations of the Public Health Code. MCL 333.16216.

In its general oversight capacity, the MDCH is statutorily authorized to conduct investigations into alleged violations of the Public Health Code. MCL 333.16221, 333.16231. After initiating an investigation, the MDCH is required to take one or more statutorily prescribed actions, including issuing a formal complaint, conducting a "compliance conference," summarily suspending a license, issuing a cease and desist order, or dismissing the complaint. MCL 333.16231(5). But except for dismissing a complaint, these actions require further action by an independent hearings examiner and disciplinary subcommittee. See MCL 333.16231(4), 333.16231a, 333.16232, and 333.16233(3). In any of these circumstances, an individual under investigation is provided with notice and an opportunity to be heard. If a formal complaint is filed, an appropriate disciplinary subcommittee is designated and has jurisdiction over the action. 1996 AC, R 338.1605. The individual under investigation is afforded notice and the right to a hearing. MCL 333.16232; 1996 AC, R 338.1614, 338.1615. A compliance conference may be held to resolve the allegations by agreement, and the failure to reach an agreement entitles the investigated party to a hearing. MCL 333.16231(4), 333.16231a; 1996 AC, R 338.1608. The summary suspension of an individual's license entitles that individual to a hearing, 1996 AC, R 338.1609(4), as does the issuance of a cease and desist order, MCL 333.16233(3); 1996 AC, R 338.1612.

In all cases involving a contested case hearing, a hearing referee presides over the dispute. 1996 AC, R 338.1626; see also 1996 AC, R 338.1615-338.1629. Depositions and written interrogatories may be taken. 1996 AC, R 338.1622. The parties may present argument and proofs. 1996 AC, R 338.1619. Upon conclusion of the hearing, the hearing referee submits proposed factual findings and conclusions of law to the assigned disciplinary subcommittee. 1996 AC, R 338.1629. The assigned disciplinary subcommittee reviews the hearing referee's recommendations and determines whether disciplinary action is appropriate. MCL 333.16226, 333.16237; 1996 AC, R 338.1630-338.1631. The subcommittee's final disposition may be appealed as of right to this Court. MCL 333.16237(6). The administrative regulations for investigations and contested case hearings expressly direct that

[a]ny member of the department, a board, or task force who takes an active part in the investigatory or allegation process shall not participate in deciding the contested case, unless necessary to assure the availability of the forum, in which event disclosure of the individual's participation in the investigatory or allegation process shall be made on the record. This prohibition may be waived by stipulation of the parties. [1996 AC, R 338.1604.]

In light of the foregoing, respondent's due process rights have not been violated. Due process principles are "not implicated" in circumstances where an administrative agency employs its subpoena power to investigate an individual subject to its regulatory authority "because an administrative investigation adjudicates no legal rights." O'Brien, supra at 742, 104 S. Ct. 2720. In the instant dispute, the MDCH is conducting an investigation into respondent's billing activities. Through petitioner, the MDCH employed its subpoena power to proceed with the investigation. But this investigation cannot result in an adjudication of respondent's legal rights. Any adjudication involving respondent's legal rights necessarily requires affording him due process protections, including notice and a hearing, under the Public Health Code. See MCL 333.XXXXX-XXX.16238; 1996 AC, R 338.1615-333.1631. No action may be taken against respondent without these procedures. And such action is conducted independently of the MDCH's investigation. See 1996 AC, R 338.1604. It is immaterial that subsequent action may be taken, because "investigations conducted by administrative agencies, even when they may lead to criminal prosecutions, do not trigger due process rights." Aponte, supra at 193. Respondent's due process rights therefore have not been implicated merely by virtue of the MDCH's investigation and subpoena request.

In sum, the court's procedures for approving or rejecting subpoenas incident to this investigation necessarily cannot violate respondent's due process rights because due process principles are not implicated in administrative investigations that adjudicate no legal rights.

Affirmed. This opinion is to have immediate effect pursuant to MCR 7.215(F)(2).

NOTES

[1] A "covered entity" includes a health care provider. 45 CFR 160.103.

[2] The parties do not dispute that respondent is a health care provider under HIPAA. In any event, a "health care provider" for purposes of HIPAA includes any "person furnishing health care services or supplies," 42 USC 1320d(3), which include "[p]reventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body," 45 CFR 160.103. This broad definition clearly encompasses respondent.

[3] Respondent implies that the failure of HIPAA to require disclosure of the subpoenaed information is fatal to the subpoena. This argument is without merit. MCL 333.16235(1) expressly grants petitioner the authority to subpoena health care investigation-related information on behalf of the MDCH, and, upon this authorization, the information is required by law to be disclosed. See Henry v. Detroit, 234 Mich.App. 405, 413, 594 N.W.2d 107 (1999). This is permitted in accordance with the MDCH's role as a health oversight agency. See MCL 333.16221; MCL 333.16233; MCL 333.16104(2); Executive Reorganization Order Nos.1991-9(3), 1996-2(I), 2003-18(IV)(A)(1). Under HIPAA, a health care provider "may disclose protected health information to a health oversight agency for oversight activities authorized by law, including . . . administrative . . . investigations." 45 CFR 164.512(d)(1); see also 65 Fed Reg 82462, 82671 ("We allow such disclosure for situations in which other laws require disclosure."). The information in the instant dispute was required by law to be disclosed, pursuant to MCL 333.16221, MCL 333.16233, and MCL 333.16235(1). It involved the MDCH's oversight of a Michigan licensed health care professional, respondent. It was therefore permissible to disclose the information under HIPAA. 45 CFR 164.512(d)(1).