The suit, brought by the South Carolina Medical Association, claimed that the law is so vaguely worded that it fails to provide an intelligible standard for its compliance; that because the statute covers only electronic communications, the regulations—which apply to all forms of communication—exceed the authority that Congress delegated to HHS; and that HIPAA’s requirement that "more stringent" state privacy laws take precedence is "impermissibly vague."

In its ruling, the three-judge panel said that Congress did indeed lay out an "intelligible principle" sufficient to guide agency action. The court also rejected the contention that HHS exceeded its authority in regulating all types of communication, not just that in electronic form. "Regulating nonelectronic as well as electronic forms of health information effectuates HIPAA’s intent to promote the efficient and effective portability of health information and the protection of confidentiality," the court wrote in its ruling. And the court concluded that the regulations are "sufficiently definite to give fair warning as to what will be considered a ‘more stringent’ state privacy law." The court said that while the state law preemption provision will require covered entities to make some commonsense evaluations and comparisons between state and federal laws, this does not mean they are either vague or constitutionally infirm.

Contact: CMA’s legal information line, 415/882-5144 or legalinfo@cmanet.org.