Summary
explaining that in 2009, the statute changed to allow both Health and Human Services and state attorneys general to enforce HIPAA
Summary of this case from Carpenter v. ArredondoOpinion
No. 20090011-CA.
June 10, 2010.
Appeal from the District Court, Third District, Salt Lake Department, L.A. Dever, J.
Roger H. Hoole, Salt Lake City, for Appellants.
Alan L. Sullivan and Amber M. Mettler, Salt Lake City, for Appellee.
Before Judges DAVIS, McHUGH, and VOROS.
OPINION
¶ 1 Plaintiffs Dianna Espinoza and Paige Hunsaker challenge the district court's grant of summary judgment in favor of Gold Cross Services, Inc. Plaintiffs allege that, under the federal Health Information Portability and Accessibility Act (HIPAA), see 42 U.S.C. §§ 1320d to 1320d-9 (2006); see also 45 C.F.R. §§ 164.500-.534 (2009), Gold Cross overcharged them to produce copies of their medical records. We affirm.
The two plaintiffs' cases were consolidated in the district court.
BACKGROUND
¶ 2 Gold Cross provides ambulance services in Salt Lake County, Utah. It provided ambulance services to Espinoza on October 21, 2003, and to Hunsaker on January 5, 2004, after which it compiled medical records related to each plaintiff's transport. Each plaintiff submitted a form to Gold Cross requesting her medical records. The form, entitled "Patient's Authorization to Release Health Information to Patient," stated the plaintiffs name, was written in the first person, requested that the documents be sent to the plaintiff in care of her lawyer, and was signed and dated by the plaintiff.
¶ 3 Gold Cross does not charge a fee when an individual requests that her own records be released to her. Here, because Plaintiffs requested that their medical records be sent to their lawyer, Gold Cross charged a $30.00 fee for retrieving, copying, and producing the records. Plaintiffs objected to the fee but paid it "under protest."
¶ 4 Plaintiffs sued Gold Cross, asserting that (1) the copies of the records should have cost no more than $0.75 plus postage, and therefore the $30.00 fee violated HIPAA and its implementing federal regulations; (2) the $30.00 fee violated the Utah Consumer Practices Act; and (3) Gold Cross was unjustly enriched because it overcharged Plaintiffs. The district court granted summary judgment in favor of Gold Cross, denying Plaintiffs' claim under the Utah Consumer Sales Practices Act and determining that the $30.00 fee was lawful under HIPAA. This ruling also had the effect of negating an essential element of Plaintiffs' unjust enrichment claim, i.e., that Gold Cross's enrichment was in fact unjust. On appeal, Plaintiffs continue to press their unjust enrichment claim with its subsidiary HIPAA analysis. They do not appeal the district court's denial of their claim under the Utah Consumer Sales Practice Act.
ISSUES AND STANDARD OF REVIEW
¶ 5 Plaintiffs raise two issues on appeal. First, they contend that the district court erred in determining that Gold Cross did not violate HIPAA when it charged them each $30.00 for providing their medical records. Second, they contend that the district court erred in denying summary judgment on their unjust enrichment claim. We review a district court's denial of summary judgment for correctness. See Anderson Dev. Co. v. Tobias, 2005 UT 36, ¶ 19, 116 P.3d 323.
ANALYSIS
¶ 6 Plaintiffs concede on appeal that they have no private right of action under HIPAA. However, they contend that the $30.00 Gold Cross charged them to produce copies of their medical records was excessive. Its excessiveness, they contend, is demonstrated by the fact that $30.00 exceeds the amount Gold Cross was entitled to charge them under HIPAA.
¶ 7 HIPAA is federal legislation that, among other things, governs individuals' access to their medical records. See 42 U.S.C. §§ 1320d to 1320d-9 (2006); see also 45 C.F.R. §§ 164.500-.534 (2009). With a few narrowly defined exceptions, HIPAA mandates that individuals be allowed to view and obtain copies of their health care records from their health care provider. See 45 C.F.R. § 164.524(a). When an individual requests her own medical records, the health care provider may charge only "a reasonable, cost-based fee":
If the individual requests a copy of the protected health information or agrees to a summary or explanation of such information, [the health care provider] may impose a reasonable, cost-based fee, provided that the fee includes only the cost of:
(i) Copying, including the cost of supplies for and labor of copying, the protected health information requested by the individual; [and]
(ii) Postage, when the individual has requested the copy, or the summary or explanation, be mailed. . . .
Id. § 164.524(c)(4). HIPAA does not regulate the fee a health care provider may charge for providing medical records to a third party. See Access of Individuals to Protected Health Information, 65 Fed. Reg. 82,554, 82,557 (Dec. 28, 2000) ("We do not intend to affect the fees that [health care providers] charge for providing protected health information to anyone other than the individual.").
For a lengthier explanation of these provisions, see Bugarin v. Chartone, Inc., 135 Cal.App.4th 1558, 38 Cal.Rptr.3d 505, 506-509 (2006).
¶ 8 HIPAA does not create a private right of action; "[u]nder HIPAA, individuals do not have a right to court action." Compliance and Enforcement, 65 Fed. Reg. 82,600, 82,601 (Dec. 28, 2000); see also Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1082 (9th Cir. 2007). States may, however, create their own HIPAA-related causes of action. For example, in California, section 17200 of the Business and Professions Code, also known as the Unfair Competition Law, is "designed to remedy violations of other laws, both state and federal. . . . [It] `establishes [and creates a private right of action to remedy] three varieties of unfair competition': the unlawful, the unfair, and the fraudulent." Webb, 499 F.3d at 1082 (quoting People ex rel. Lockyer v. Fremont Life Ins. Co., 104 Cal.App.4th 508, 128 Cal. Rptr.2d 463, 469 (2002)); see also Cal. Bus. Prof. Code §§ 17200- 17210 (2008). Thus, California has statutorily created a private right of action to redress HIPAA violations. Utah has not.
At the time Plaintiffs' cause of action arose, an individual who wished to voice a complaint concerning an alleged violation of HIPAA could file a complaint with the Secretary of Health and Human Services. See 42 U.S.C. § 1320d-5 (2006); see also Acara v. Banks, 470 F.3d 569, 571 (5th Cir. 2006) ("HIPAA limits enforcement of the statute to the Secretary of Health and Human Services."). Thereafter, in 2009, a provision was added to HIPAA that allows for state attorneys general to enforce HIPAA violations. See American Recovery and Reinvestment Act of 2009, Pub.L. No. 111-5, § 13410(e), 123 Stat. 115, 274 (to be codified at 42 U.S.C. § 1320d-5(d)(1)-(3)).
¶ 9 While conceding they have no independent private right of action under HIPAA, Plaintiffs have devised a claim that incorporates HIPAA's fee schedules. They inferentially rely on federal fee schedules to argue that they are entitled to recover from Gold Cross under the equitable doctrine of unjust enrichment.
¶ 10 "A claim for unjust enrichment is an action brought in restitution, and a prerequisite for recovery on an unjust enrichment theory is the absence of an enforceable contract governing the rights and obligations of the parties relating to the conduct at issue." Ashby v. Ashby, 2010 UT 7, ¶ 14, 227 P.3d 246 (footnote omitted). To recover on a claim for unjust enrichment, a plaintiff must establish three elements:
(1) a benefit conferred on one person by another; (2) an appreciation or knowledge by the conferee of the benefit; and (3) the acceptance or retention by the conferee of the benefit under such circumstances as to make it inequitable for the conferee to retain the benefit without payment of its value.
Jeffs v. Stubbs, 970 P.2d 1234, 1248 (Utah 1998) (internal quotation marks omitted). The measure of damages in an unjust enrichment action is "the reasonable value of the services . . . provided." Emergency Physicians Integrated Care v. Salt Lake County, 2007 UT 72, ¶ 29, 167 P.3d 1080 (citation and internal quotation marks omitted).
¶ 11 Plaintiffs contend that they meet this three-element test. First, they conferred a benefit on Gold Cross by each paying $30.00; second, Gold Cross knowingly retained the benefit of the $30.00 payments; and, third, Gold Cross retained that benefit "even though the benefit was conferred by its patients under protest and under such circumstances as to make retaining the benefit inequitable."
¶ 12 Plaintiffs rely on HIPAA's fee schedule to demonstrate that Gold Cross reaped an inequitable benefit. They argue that because they personally requested the records, Gold Cross should have charged them "the reasonable cost-based fee contemplated by [HIPAA]" when individuals request their own records. Specifically, they argue that a reasonable fee for copying their records was approximately $0.12 per page. They derive this number from the federal government's formulation of a rate for copies in the context of Medicare. See Medicare Program; Photo-copying Reimbursement Methodology, 68 Fed. Reg. 67,955, 67,957 (Dec. 5, 2003) (setting the photocopy rate at $0.12 per page for prospective payment system hospitals that photocopy medical records in Medicare-related cases). Using these calculations, Plaintiffs assert that Gold Cross was entitled to "$0.75, or less, plus postage," and conclude that Gold Cross was unjustly enriched by the remainder of the $30.00 it charged.
¶ 13 Gold Cross acknowledges that it charged Plaintiffs the higher third-party rate. It contends that this was lawful under the HIPAA regulations because the records were sent to Plaintiffs' lawyer, rather than to Plaintiffs themselves. It further maintains that, under the circumstances, $30.00 was a reasonable fee for retrieving, copying, and producing the records.
We note again that Gold Cross does not charge individuals any per-page fee when releasing an individual's medical records directly to that individual. Thus, had Plaintiffs requested that the records be sent to them at their personal residences, rather than to them in care of their lawyer, they would not have had to pay even the $0.12 per page that they advocate.
¶ 14 On appeal, the parties continue to dispute whether, under the HIPAA regulations, it was the individuals or their lawyer who requested the records. They point us to two cases originating in California, Webb v. Smart Document Solutions, LLC, 499 F.3d 1078 (9th Cir. 2007), and Bugarin v. Chartone, Inc., 135 Cal.App.4th 1558, 38 Cal. Rptr.3d 505 (2006), and urge us to follow California's lead in interpreting HIPAA's provisions. However, these cases were both brought under California's Unfair Competition Law. See Webb, 499 F.3d at 1082; Bugarin, 38 Cal.Rptr.3d at 507; see also Cal. Bus. Prof. Code §§ 17200- 17210 (2008). Because Utah has no equivalent statute, these cases are unhelpful. We have no basis in state or federal law to enforce federal regulations promulgated under HIPAA, either directly or as a component of a state cause of action. Accordingly, we need not resolve whether Plaintiffs' records were requested by them personally or by their lawyer. We thus arrive at the same conclusion as the district court but by a slightly different route. Plaintiffs' unjust enrichment claim fails not because Gold Cross complied with HIPAA — a question on which we express no opinion — but because HIPAA has no application here.
¶ 15 Gold Cross requests damages on the grounds that Plaintiffs' appeal was frivolous. If an appellate court determines that an appeal "is either frivolous or for delay, it shall award just damages . . . and/or reasonable attorney fees." Utah R.App. P. 33(a). "[A] frivolous appeal . . . is one that is not grounded in fact, not warranted by existing law, or not based on a good faith argument to extend, modify, or reverse existing law." Id. R. 33(b). In Maughan v. Maughan, 770 P.2d 156 (Utah Ct.App. 1989), we wrote,
The "sanction" for bringing a frivolous appeal is applied only in egregious cases, "lest there be an improper chilling of the right to appeal erroneous lower court decisions." Egregious cases may include those obviously without merit, with no reasonable likelihood of success, and which result in the delay of a proper judgment.
Id. at 162 (quoting Porco v. Porco, 752 P.2d 365, 369 (Utah Ct.App. 1988)). Although we hold that Plaintiffs' claims on appeal lack merit, they are not egregious or frivolous. We accordingly award no costs or fees on appeal.
CONCLUSION
¶ 16 There is no private right of action under HIPAA, and Plaintiffs have presented us with no state statute establishing a remedy for HIPAA violations. We therefore have no basis to review their claim that Gold Cross violated HIPAA or was thereby unjustly enriched. Affirmed.
¶ 17 WE CONCUR: JAMES Z. DAVIS, Presiding Judge and CAROLYN B. MeHUGH, Associate Presiding Judge.