Opinion
(14456)
The plaintiffs, a hospital association and four general hospitals, among others, had sought a declaratory ruling by the defendant commission on hospitals and health care to determine the validity of its regulation ( 19a-165q-2) requiring the submission to it of certain allegedly confidential patient data for the purpose of administering a prospective payment system for hospitals. The commission sustained the validity of the regulation and the plaintiffs appealed to the trial court, which upheld the declaratory ruling. The trial court concluded that the specified information did not violate the state statute ( 52-146e) concerning the confidentiality rights of psychiatric patients, or the federal statutes ( 42 U.S.C. § 290dd-3, 290ee-3) governing confidentiality of records of patients with alcohol or drug abuse problems, and the plaintiffs further appealed. Held: 1. Contrary to the commission's claim, the plaintiffs' action was not rendered moot either by the legislature's repeal of the statutes that authorized the prospective payment system or by the commission's subsequent adoption of regulations that superseded 19a-165q-2; the commission's possession of the allegedly confidential material accumulated while the regulation was in force, and its refusal either to return the data to the plaintiffs or to purge the data from its computer files, subjected the plaintiffs to potential liability to prior patients for the release of confidential material to the commission. 2. Insofar as 19a-165q-2 required the submission to the commission of a patient's four digit ZIP Code suffix, the commission's determination of validity was clearly erroneous, it being possible to ascertain a patient's identity from that suffix in violation of the confidentiality mandates of existing law; the commission's conclusion that the remaining items contained in the patient data submitted pursuant to 19a-165q-2 were not descriptive and could not be linked to an ascertainable patient was not clearly erroneous.
Argued June 10, 1992
Decision released August 11, 1992
Appeal from a declaratory ruling by the defendant upholding the validity of its regulations concerning the collection of certain confidential patient and physician data, brought to the Superior Court in the judicial district of Hartford-New Britain at Hartford, where the court, Noren, J., stayed, in part, the defendant's decision and prohibited the defendant from releasing any of the data; thereafter, the case was tried to the court, Steinberg, J.; judgment for the defendant, from which the plaintiff Connecticut Hospital Association, Inc., et al. appealed. Reversed in part; judgment directed.
Jeanette C. Schreiber, with whom was Merton G. Gollaher, Jr., for the appellants (plaintiff Connecticut Hospital Association, Inc., et al.).
Thomas J. Ring, assistant attorney general, with whom, on the brief, were Richard Blumenthal, attorney general, and Richard J. Lynch and Heather J. Wilson, assistant attorneys general, for the appellee (defendant).
This is an administrative appeal from a declaratory ruling of the defendant, the Commission on Hospitals and Health Care (CHHC). The dispositive issue is whether 19a-165q-2 of CHHC's regulations required submission to CHHC of data that violated the privacy and confidentiality rights of patients as set forth in General Statutes 52-146e, 42 U.S.C. § 290dd-3, 290ee-3 (1985), and 42 C.F.R. § 2.11, 2.53 and 2.54 (1985). We conclude that this is so with respect to one item and, therefore, reverse, in part, the judgment of the trial court that held to the contrary.
Examination of the record discloses that on April 26, 1985, CHHC adopted 19a-165q-1 through 19a-165q-24 of the Regulations of Connecticut State Agencies. Thereafter, on June 14, 1985, the named plaintiff and others, filed a petition for a declaratory ruling, seeking invalidation of 19a-165q-2 of the newly adopted regulations on the ground that it required the submission of statutorily protected patient data. On September 3, 1986, after hearings, CHHC issued a declaratory ruling concluding that the regulation was valid. The plaintiffs subsequently commenced the instant administrative appeal in the Superior Court, seeking to vacate and set aside CHHC's declaratory ruling. The trial court, having found the plaintiffs aggrieved, rendered judgment for CHHC, concluding that the specified information did not violate the statutorily protected privacy and confidentiality rights of the plaintiffs and that the contested regulation was, therefore, valid. The Connecticut Hospital Association and the four general hospitals who were parties in the action below, appealed to the Appellate Court. We thereafter transferred the matter to ourselves pursuant to Practice Book 4023.
The original petitioners were the Connecticut State Medical Society, the Connecticut Hospital Association, Inc., Joseph C. Czarsty, M.D., William A. Whalen, M.D., Joseph P. Zeppieri, M.D., the Greenwich Hospital Association, the Hospital of St. Raphael, Rockville General Hospital, Saint Vincent's Medical Center and the Sharon Hospital. All of the petitioners, with the exception of Zeppieri, appealed from the agency's decision to the Superior Court. The Connecticut Hospital Association, Inc., the Greenwich Hospital Association, Rockville General Hospital, St. Vincent's Medical Center and the Sharon Hospital are the only parties to the present appeal.
General Statutes (Rev. to 1985) 4-176 provides: "Each agency may, in its discretion, issue declaratory rulings as to the applicability of any statutory provision or of any regulation or order of the agency, and each agency shall provide by regulation for the filing and prompt disposition of petitions seeking such rulings. If the agency issues an adverse ruling, the remedy for an aggrieved person shall be an action for declaratory judgment under section 4-175 unless the agency conducted a hearing pursuant to sections 4-177 and 4-178 for the purpose of finding facts as a basis for such ruling, in which case the remedy for an aggrieved person shall be an appeal pursuant to section 4-183. If the agency fails to exercise its discretion to issue such a ruling, such failure shall be deemed a sufficient request by the plaintiff for the purposes of section 4-175. Rulings disposing of petitions have the same status as agency decisions or orders in contested cases."
The history of the statutory enactments that served as the basis for the promulgation of 19a-165q-2 is as follows. On June 5, 1984, the General Assembly passed No. 84-315 of the 1984 Public Acts, which was thereafter codified as General Statutes (Rev. to 1985) 19a-165 through 19a-165q. The statutory scheme established a prospective payment system whereby general hospital rates were established in advance based upon a fixed charge per diagnosis or medical procedure. Section 19a-165a directed CHHC to "require hospitals to submit such data as it deems necessary for the development and implementation of the prospective payment system . . . ." Section 19a-165q directed CHHC to "adopt regulations, in accordance with the provisions of chapter 54 to implement, administer and ensure compliance with the prospective payment system established under sections 19a-165 to 19a-165q, inclusive." Thereafter, CHHC promulgated 19a-165q-2. Section 19a-165q-2 (b)(1) required all of Connecticut's general hospitals to file with CHHC a "hospital discharge data set for each patient discharged from the hospital after September 30, 1983." Each data set contained thirty items of information concerning a given patient.
In their application for a declaratory ruling, the plaintiffs challenged thirteen items in each data set, arguing that the information was unnecessary for purposes of the prospective payment system and, further, that disclosure of the material violated patient privacy and confidentiality rights. The challenged data included: (1) patient identification code; (2) Zip Code; (3) Zip Code suffix; (4) attending physician; (5) operating physician; (6) principal procedure day; (7) other procedure I day; (8) other procedure II day; (9) other procedure III day; (10) other procedure IV day; (11) admission status; (12) expected principal source of payment; and (13) race.
Section 19a-165q-2 (a) of the Regulations of Connecticut State Agencies then provided in part: "DEFINITIONS. For the purpose of this section and except as otherwise noted, the following words and phrases have the following meanings: * * * "(12) Procedures and days performed. "(A) `Procedure' means a significant procedure that carries an operative or anesthetic risk, requires highly trained personnel, or requires special facilities or equipment. Procedures will be reported in ICD-9-CM coding. For each procedure, the day in the length of stay on which the procedure was performed is also to be reported."
I
As a threshold consideration, we must address CHHC's claim that the issues presented are moot because of the legislature's repeal in 1989 of the statutes that authorized the prospective payments system and its enactment of a different method for determining hospital budgets. There is no dispute that CHHC, in response to the 1989 legislative changes, adopted 19a-167g-94 of the Regulations of Connecticut State Agencies, which superseded 19a-165q-2. Since there is no longer a requirement to submit data pursuant to 19a-165q-2, CHHC argues that there is no longer a justiciable controversy concerning this regulation before the court. CHHC argues that "[i]t is a well-settled general rule that the existence of an actual controversy is an essential requisite to appellate jurisdiction; it is not the province of appellate courts to decide moot questions, disconnected from the granting of actual relief or from the determination of which no practical relief can follow." Reynolds v. Vroom, 130 Conn. 512, 515, 36 A.2d 22 (1944). While we agree that this is a correct statement of the law, we conclude that it is not applicable in the present instance.
Section 19a-167g-94 (g)(7) of the Regulations of Connecticut State Agencies provides in part as follows: "Data elements and suppression thresholds for nonconfidential reports. "(A) To create a nonconfidential report, the following data elements collected under this section will be replaced by substitute data elements which have been modified for purposes of confidentiality as follows . . . "(iv) Zip code will be replaced by an aggregation of zip codes composed of at least two contiguous zip codes and subject to the provisions of subsection (7)(B) "(B) Thresholds for data suppression for nonconfidential reports "(iv) Any nonaggregated report which contains data elements by discharge shall not contain the data element `hospital code,' and shall contain a substitute for the data element `zip code.' This substitute shall be composed of an aggregation of zip codes equivalent to the health service areas created pursuant to the National Health Planning and Resources Development Act, Public Law 93-641."
The history of the statutory enactments that served as the basis for the promulgation of 19a-167g-94 of the Regulations of Connecticut State Agencies is as follows. On June 30, 1989, the General Assembly passed No. 89-371 of the 1989 Public Acts, which repealed, inter alia, General Statutes 19a-165q and its attendant regulation, 19a-165q-2 of the Regulations of Connecticut State Agencies. It was thereafter codified as General Statutes 19a-167g through 19a-167k. It provided for the establishment of net and gross revenue caps for each hospital as a means of determining a hospital's total revenues during a given fiscal year. General Statutes 19a-167g provides that the "commission shall adopt regulations . . . to implement, administer and ensure compliance with sections 19a-167 to 19a-167f, inclusive, and section 19a-167h and to establish hospital efficiency standards to be used in the budget review process pursuant to section 19a-167c." It was pursuant to this statute that CHHC promulgated 19a-167g-94.
It is undisputed that CHHC continues to maintain six years of data accumulated pursuant to 19a-165q-2 and that CHHC refuses either to return the data to the plaintiffs or to purge the data from CHHC's computer files. The plaintiffs' claim, meanwhile, remains the same, i.e., that CHHC cannot legally retain the data because of its confidential nature, and that it should be required to return the same or purge its computer files.
Although the repeal of an offending law or regulation or the cessation of a challenged activity can render an action to enjoin its enforcement moot; Roy v. Mulcahy, 161 Conn. 324, 328, 288 A.2d 64 (1971); the repeal will not render moot a claim for redress of an injury occurring while the enactment was in force. Hallas v. Windsor, 217 Conn. 689, 692, 587 A.2d 149 (1991); Gunther v. Dubno, 195 Conn. 284, 288, 487 A.2d 1080 (1985). The plaintiffs claim that while 19a-165q-2e was in force, they became prospectively liable to prior patients for the release to CHHC, over a six year period, of material that the plaintiffs argue is confidential. Until the regulation is either determined to have been valid because the requested material is not confidential or the offending material is ordered excised or, in the alternative, some other basis is determined for retaining the material, we conclude that a sufficient controversy exists to survive CHHC's claim of mootness occasioned by the legislature's subsequent enactments.
II
The plaintiffs' argument throughout these proceedings has been, inter alia, that the contested regulation required them to submit to CHHC data that is confidential and, therefore, exempt from disclosure by reason of both state and federal law. With respect to Connecticut statutes, the plaintiffs refer us specifically to General Statutes 52-146e (a), which prohibits the disclosure of records "which identify a patient to any governmental agency . . . ."
General Statutes 52-146e (a) provides in relevant part: "Except as provided in sections 52-146f to 52-146i, inclusive, no person may disclose or transmit any communications and records or the substance or any part or any resume thereof which identify a patient to any person, corporation or governmental agency without the consent of the patient or his authorized representative." (Emphasis added.) General Statutes 52-146d defines material that "identifies a patient" as follows: "PRIVILEGED COMMUNICATIONS BETWEEN PSYCHIATRIST AND PATIENT. DEFINITIONS. . . . "(4) `Identifiable' and `identify a patient' refer to communications and records which contain (A) names or other descriptive data from which a person acquainted with the patient might reasonably recognize the patient as the person referred to, or (B) codes or numbers which are in general use outside of the mental health facility which prepared the communications and records."
With respect to federal statutes, the plaintiffs rely upon 42 U.S.C. § 290dd-3 (a), which prohibits the disclosure of records concerning "any patient which are maintained in connection with the performance of any program or activity relating to alcoholism or alcohol abuse . . . ." An identical provision governing confidentiality of patients diagnosed or treated for drug abuse is found in 42 U.S.C. § 290ee-3 (a). Implementing federal regulations define "patient identifying information" to include, inter alia, "information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information." 42 C.F.R. § 2.11 (j) (1985).
Title 42 of the United States Code, 290dd-3(a) provides: "Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to alcoholism or alcohol abuse education, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b) of this section."
CHHC responds to these claims of an alleged breach of patient confidentiality by pointing out that, with respect to each data set, the actual name of the patient is not disclosed, but only a patient identifying number supplied by the hospital. This number serves only to show that a particular set of data relates to one patient's hospital stay, but does not link the data to the actual identity of the patient. CHHC argues that such a number is expressly excluded from the meaning of the term "patient identifying information" in the federal regulation, specifically, "[t]he term does not include a patient identifying number assigned by a program." 42 C.F.R. § 2.11 (1985).
Despite their objection before CHHC and the trial court to thirteen items of information in each data set, including the patient identifying number, the linchpin of the plaintiffs' claim to us that a breach of confidentiality has occurred, lies, not in the submission of a patient identifying number, but rather, in the requirement to supply the patient's ZIP Code including its four digit suffix. The plaintiffs argue that the ZIP Code constitutes "other descriptive data from which a person acquainted with the patient might reasonably recognize the patient as the person referred to." General Statutes 52-146d (4)(A). In its declaratory ruling, CHHC specifically rejected this essentially fact driven argument. Since this determination was one of fact, we will not reverse or modify such a holding unless we determine that the decision is clearly erroneous in view of the evidence and pleadings in the whole record. Practice Book 4061.
CHHC concluded that "[t]he data which is submitted, pursuant to Connecticut Regulations 19a-165q-2, (including the ZIP Code), does not contain descriptive data such that a person acquainted with the patient might reasonably recognize the patient as the person referred to in the data."
"`A finding is "clearly erroneous" when although there is evidence to support it, the reviewing court on the entire evidence is left with the definite and firm conviction that a mistake has been committed.'" Doyle v. Kulesza, 197 Conn. 101, 105, 495 A.2d 1074 (1985), citing United States v. United States Gypsum Co., 333 U.S. 364, 395, 68 S.Ct. 525, 92 L.Ed. 746 (1948). We conclude that CHHC's determination with respect to the ZIP Code information, and a person's inability to determine a specific patient's identity from it, was clearly erroneous.
On July 29, 1981, Section 122.6 of the Domestic Mail Manual was revised to define and describe a national ZIP Code system that included for the first time, a nine digit ZIP Code. It provided: "The ZIP Code system is a numbered coding system which facilitates efficient processing of mail. The most complete ZIP Code is a nine-digit number divided by a hyphen between the fifth and sixth digits. The Postal Service has adopted the term "ZIP + 4" as its trademark for the 9-digit ZIP Code. The first three digits identify the delivery area of the section center facility (SCF) or major city post office serving the area in which the address is located. The next two digits (the fourth and fifth digits) identify the delivery area of the associate post office or branch station of the major city post office serving the address. The sixth and seventh digits (the first two digits following the hyphen) identify an area known as a sector. The eight and ninth digits identify a smaller area known as a segment. The final four digits of the ZIP + 4 Code identify specific geographic units such as: a side of a street between intersections; individual buildings; a floor or group of floors in a large building; a firm within a building; a span of boxes on a rural route; or a group of post office boxes in which mail delivery will be made by a single postal employee." See United States Postal Service, Domestic Mail Manual, 122.612 (1992), incorporated by reference in 39 C.F.R. § 111.1, 111.5(c)(2) (iv) (1991).
In response to the introduction of this nine digit system, the United States Postal Service published a series of ZIP + 4 State Directories, excerpts of which were furnished to CHHC in connection with the plaintiffs' petition for a declaratory ruling. Examination of this directory discloses that a given four digit suffix refers to a very small number of postal addresses. Indeed, in numerous instances, this suffix identifies by name, just one person. Under such circumstances, we conclude that the four digit ZIP Code suffix constituted "other descriptive data from which a person acquainted with the patient might reasonably recognize the patient as the person referred to." General Statutes 52-146d (4)(A). That portion of the regulation requiring the submission of the ZIP Code suffix was contrary to the confidentiality mandates of existing law and was, therefore, invalid.
Once relieved, however, of their prospectively identifying four digit ZIP Code suffix, the remaining twelve items in the data set can no longer be linked to an ascertainable individual. Although the plaintiffs argued to CHHC that the remaining data constituted "information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available information"; 42 C.F.R. § 2.11 (1985); or, in the alternative, that it constituted a record "which identif[ies] a patient to any . . . governmental agency"; General Statutes 52-146e (a); CHHC rejected these arguments based upon its evaluation of the evidence in the record. Unlike the claim with respect to the ZIP Code suffix, we see nothing in this record that suggests that CHHC's rejection of these further factual claims was clearly erroneous.
The plaintiffs further argue that 19a-165q-2 violated their patients' constitutional rights to privacy and that the plaintiffs, as hospitals, have the right as third parties to advance the constitutional claims of their patients under the federal rule of jus tertii. The foundation of such an argument relies on the factual predicate that the hospitals had furnished CHHC confidential information pursuant to 19a-165q-2. In view of our determination that with the excision of the four digit ZIP Code suffix, there is no reasonable likelihood of correlating a given data set with a specific patient, confidential information within any constitutional sense was not accumulated. We, therefore, decline to address this issue.