Northwestern v. Ashcroft

The Respondent, the Attorney General of the United States, appealed a district court order quashing a subpoena that commanded Northwestern Memorial Hospital (NMH) to produce the medical records of certain patients. The records were to be used in an upcoming suit challenging the constitutionality of the Partial-Birth Abortion Ban Act of 2003. The records contained information on women who had undergone a controversial late-term abortion procedure at NHM. All information identifying the patients had been redacted from the records. The district court barred production of the records applying Illinois state disclosure law pursuant to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) supersession provision, which allowed for application of State law that provided “greater privacy protection for the individual.”

Section 264 of HIPAA directs the Secretary of Health and Human Services to promulgate regulations to protect the privacy of medical records. This provision is qualified by subsection (c)(2), which reads that such a regulation “shall not supercede a contrary provision of State law if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than [those . . .] imposed under the regulation.” A standard is “more stringent” if it “provides greater privacy protection for the individual who is the subject of the individually identifiable health information” than the standard in the regulation. § 160.202(6).

The appellate court rejected the district court’s application of State law pursuant to HIPAA’s supersession provision because, among other things, the case involved an issue of federal law in federal court. Instead, the appellate court considered the disclosure of the records under the Federal Rules of Civil Procedure (Fed.R.Civ.P.), Rule 45 (c)(3)(A)(iv), which allows for the quashing or modifying of subpoenas that subject a person to “undue burden.”

The court held that the disclosure of the medical records containing sensitive patient information pertaining to late-term abortion procedures was barred by the Fed.R.Civ.P.’s “undue burden” standard. It held that, due to the potential psychological cost to the hospital’s patients and a potential cost in lost goodwill to the hospital itself, “the balance of harms resulting from disclosure severely outweigh[ed] the loss to the government through non-disclosure.” The court noted the “fierce emotions [associated with] the long-running controversy over the morality and legality of abortion.”

The court considered both the potential costs to the hospital and its patients and the probative value of the records sought. The court held that even with redaction, “the natural sensitivity that people feel about the disclosure of their medical records — the sensitivity that lies behind HIPAA — is amplified when the records are of a procedure that Congress has now declared to be a crime.” Further, in the context of the enormous publicity and government inquiry generated by the debate and litigation surrounding abortion, the women were “bound to be skeptical that redaction [would] conceal their identity from the world.”

The court noted that the government’s assertion that redaction would ensure the confidentiality of the patients’ identities was “questionable at best,” given that the patients’ admit and discharge summaries, arguably containing histories of the patients’ past and present medical conditions, can cumulatively “make the possibility of recognition very high.” Moreover, the court held that “even if there were no possibility that a patient's identity might be learned from a redacted medical record, there would be an invasion of privacy.”

In relation to the potential costs to the hospital, the court held that the hospital would “lose the confidence of its patients if it [could not] shield the medical records of its abortion patients from disclosure in judicial proceedings.” It also noted that persons with sensitive medical conditions may be “inclined to turn elsewhere for medical treatment.”

The court held that the government “failed to demonstrate a use for the records it sought,” as no evidence was produced which questioned the health rationale for the procedure. The court pointed to the findings of the district court judge:

[T]he government seeks these records on the possibility that it may find something therein which would affect the testimony of Dr. Hammond adversely, that is, for its potential value in impeaching his credibility as a witness. What the government ignores in its argument is how little, if any, probative value lies within these patient records.

The court found no precedent in the large body of “first generation partial-birth cases” that indicated that patient records might contain information addressing whether the contested procedure was ever “medically necessary.” The court also noted that the government had not cited “any case before this one in which medical experts' patient records were used to impeach the expert.”

“The natural sensitivity that people feel about the disclosure of their medical records — the sensitivity that lies behind HIPAA — is amplified when the records are of a procedure that Congress has now declared to be a crime. Even if all the women whose records the government seeks know what ‘redacted’ means, they are bound to be skeptical that redaction will conceal their identity from the world. This is hardly a typical case in which medical records get drawn into a lawsuit. Reflecting the fierce emotions that the long-running controversy over the morality and legality of abortion has made combustible, the Partial-Birth Abortion Ban Act and the litigation challenging its constitutionality — and even more so the rash of suits around the country in which the Department of Justice has been seeking the hospital records of abortion patients — have generated enormous publicity. These women must know that, and doubtless they are also aware that hostility to abortion has at times erupted into violence, including criminal obstruction of entry into abortion clinics, the firebombing of clinics, and the assassination of physicians who perform abortions.” 362 F.3d, pp. 928-29.

“Some of these women will be afraid that when their redacted records are made a part of the trial record in New York, persons of their acquaintance, or skillful ‘Googlers,’ sifting the information contained in the medical records concerning each patient's medical and sex history, will put two and two together, ‘out’ the 45 women, and thereby expose them to threats, humiliation, and obloquy.” 362 F.3d, pp. 929.

“Even if there were no possibility that a patient's identity might be learned from a redacted medical record, there would be an invasion of privacy. Imagine if nude pictures of a woman, uploaded to the Internet without her consent though without identifying her by name, were downloaded in a foreign country by people who will never meet her. She would still feel that her privacy had been invaded. The revelation of the intimate details contained in the record of a late-term abortion may inflict a similar wound.” 362 F.3d, pp. 929.