Case: 13-14637     Date Filed: 10/10/2014   Page: 1 of 36


                                                                         [PUBLISH]


               IN THE UNITED STATES COURT OF APPEALS

                        FOR THE ELEVENTH CIRCUIT
                          ________________________

                                 No. 13-14637
                           ________________________

                    D.C. Docket No. 4:13-cv-00378-RH-CAS

GLEN MURPHY,


                                                                   Plaintiff-Appellee,

                                       versus

ADOLFO C. DULAY,
ADOLFO C. DULAY, M.D., P.A.,
STATE OF FLORIDA,


                                                            Defendants-Appellants.
                           ________________________

                   Appeals from the United States District Court
                       for the Northern District of Florida
                          ________________________

                                (October 10, 2014)

Before HULL, MARCUS, and HILL, Circuit Judges.

HULL, Circuit Judge:

      This appeal involves a federal preemption challenge to a Florida statute

requiring presuit actions by an individual plaintiff before he may bring a medical
               Case: 13-14637    Date Filed: 10/10/2014   Page: 2 of 36


negligence claim in Florida state court. The district court held that one of those

presuit requirements in Florida Statute § 766.1065—that the plaintiff execute a

written authorization form for release of protected health information—is

preempted by a federal statute, the Health Insurance Portability and Accountability

Act (“HIPAA”), and its accompanying regulations, see 45 C.F.R. §§ 164.508,

164.512. That authorization form—required by § 766.1065 as a pre-condition to

filing a medical negligence claim—allows the prospective defendant to obtain

documents and conduct ex parte interviews of the prospective plaintiff’s medical

providers on matters pertinent to the medical negligence claim. Fla. Stat.

§ 766.1065.

       After oral argument and careful review of the record and the parties’

submissions, we conclude that the written authorization form, required by Florida

statute § 766.1065, is fully compliant with the HIPAA statute and its regulations

and the state and federal law are not in conflict. Accordingly, there is no federal

preemption of § 766.1065, and the district court’s entry of judgment in favor of the

plaintiff is reversed.

                         I. FACTUAL BACKGROUND

       In this declaratory judgment action, the facts are straightforward and not in

dispute. Plaintiff-appellee Glen Murphy is a Florida resident who received

medical treatment from defendant-appellant Dr. Adolfo C. Dulay. Murphy was not


                                          2
              Case: 13-14637     Date Filed: 10/10/2014    Page: 3 of 36


satisfied with Dr. Dulay’s care and therefore contemplated suing the doctor in state

court for medical negligence. As required by Florida law, Murphy retained experts

who were ready to opine that Dr. Dulay’s treatment of Murphy fell below the

prevailing standard of care and injured Murphy. See Fla. Stat. § 766.203(2).

      Murphy was ready to file his lawsuit but first had to comply with Florida’s

numerous presuit requirements. We review the presuit requirements in § 766.106

not challenged here in order to place the challenged statute, § 766.1065, in context.

                             II. FLA. STAT. § 766.106

      Florida law requires a prospective plaintiff to give a 90-day notice of the

“intent to initiate litigation for medical negligence.” See Fla. Stat. § 766.106(2)(a)-

(3)(a). No suit may be filed for 90 days after notice is mailed. 

Along with this presuit notice, the plaintiff must provide “a verified written

medical expert opinion from a medical expert” to corroborate his “reasonable

grounds to initiate medical negligence litigation.” 

      The presuit notice also must include: (1) a list, “if available,” of “all known

health care providers” seen by the plaintiff “for the injuries complained of

subsequent to the alleged act of negligence”; (2) a list, “if available,” of “all known

health care providers” who treated or evaluated the plaintiff “during the 2-year

period prior to the alleged act of negligence”; (3) copies of all medical records the

plaintiff’s experts relied upon in forming their opinions; and (4) an “executed


                                           3
              Case: 13-14637     Date Filed: 10/10/2014   Page: 4 of 36


authorization form” permitting the release of medical information. 

      Florida law imposes requirements on the prospective defendant as well.

During the 90-day period, Florida law requires the defendant or his insurer to

conduct a prompt investigation, review, and evaluation to determine the liability of

the defendant. 

At or before the end of the 90-day period,

Florida law requires the defendant or his insurer to provide the plaintiff with a

response, rejecting the negligence claim, making a settlement offer, or offering to

arbitrate. 

The purpose of this procedure is to encourage

resolution of medical negligence actions without the expense and drawn out

process of formal discovery.

      The plaintiff’s attorney has 30 days to advise his client regarding the

defendant’s response and the attorney’s evaluation thereof. 

      This Florida statute includes some procedural safeguards for parties in this

presuit-screening process. For example, the statute of limitations is tolled during

the 90-day period as to all potential defendants. 

No statements,

discussions, documents, or reports generated in this presuit-screening process are

discoverable or admissible in any civil action. 

We now examine

the Florida statute challenged here, which is § 766.1065.




                                          4
                Case: 13-14637         Date Filed: 10/10/2014        Page: 5 of 36


                                III. FLA. STAT. § 766.1065

       Section 766.1065 took effect on July 1, 2013. See 2013 Fla. Sess. Law Serv.

Ch. 2013-108, § 7 (S.B. 1792) (West). Section 766.1065 governs all causes of

action accruing before, on, or after that date. 

       Section 766.1065 requires that an “authorization for release of protected

health information” accompany the 90-day presuit notice required by § 766.106(2),

and the authorization must be in the written form specified by § 766.1065. Fla.

Stat. § 766.1065(1). The form authorizes “the disclosure of protected health

information that is potentially relevant to the claim of personal injury or wrongful

death.” 

notice is void if the plaintiff does not provide the

authorization form. 1 

includes the precise language that a valid, written

authorization must contain. The Florida legislature expressed its intent to make the

presuit authorization form consistent with HIPAA. Specifically, § 766.1065(3)

mandates that the authorization “shall be construed in accordance with the

‘Standards for Privacy of Individually Identifiable Health Information’ in

45 C.F.R. parts 160 and 164”—HIPAA’s Privacy Rule. 

In

addition, the authorization must inform the plaintiff that signing the form “is not a



       1
        If, after giving the authorization, a plaintiff revokes the authorization, the presuit notice
“is deemed retroactively void from the date of issuance.” 

                                                  5
              Case: 13-14637      Date Filed: 10/10/2014    Page: 6 of 36


condition for continued treatment, payment, enrollment, or eligibility for health

plan benefits.” 

      On the statutorily prescribed form, the plaintiff must include a list of all the

names and addresses of “all health care providers” known who either:

(1) “examined, evaluated, or treated the Patient in connection with injuries

complained of after the alleged act of negligence,” or (2) “examined, evaluated, or

treated the Patient during a period commencing 2 years before the incident” giving

rise to the claim. 

This authorization, however, does not

apply to health care providers or information that the plaintiff certifies “is not

potentially relevant” to the injury “that is the basis of the accompanying presuit

notice.” 

Accordingly, the plaintiff can exclude from the list

of the treating health care providers whom the defendant may contact, those who

have no information potentially relevant to the injury. For those providers who

have no relevant information, the plaintiff must supply “the inclusive dates of

examination, evaluation, or treatment to be withheld from disclosure.” 

form must expressly allow ex parte interviews, stating:

“This authorization expressly allows the persons or class of persons

listed . . . above to interview the health care providers listed . . . above, without the

presence of the Patient or the Patient’s attorney.” 

Those

“persons or class of persons” include the doctor defendant, his insurer, adjuster,


                                            6
                Case: 13-14637        Date Filed: 10/10/2014       Page: 7 of 36


experts or attorneys. 

Thus, the doctor defendant’s

attorney would be able to interview ex parte the treating physician of a plaintiff. 2

However, the statute does not require the treating provider to submit to a request

for an interview. See 

(“This subparagraph does not require

a claimant’s treating health care provider to submit to a request for an interview.”).

       The authorization form must provide that the authorization “expires upon

resolution of the claim or at the conclusion of any litigation instituted in connection

with the matter . . . , whichever occurs first.” 

Further, the

authorization form must note that: (1) the plaintiff “has the right to revoke this

authorization” but doing so renders the presuit notice retroactively void, and (2) the

plaintiff “understands that signing this authorization is not a condition for

continued treatment, payment, enrollment, or eligibility for health plan benefits.”

       Importantly, the last paragraph in the authorization form must warn the

plaintiff “that information used or disclosed under this authorization may be

       2
         Section 766.106(6)(b)(5) provides that when the doctor defendant gives notice of his
intent to conduct an ex parte interview, the plaintiff’s attorney must arrange the interview within
15 days after the request is made. For subsequent interviews, the defendant must notify the
plaintiff only 72 hours before the subsequent interview. And if the plaintiff fails to arrange an
interview, the defendant may attempt to conduct an interview “without further notice” to the
plaintiff. The fact remains, however, that the treating provider is not required to consent to a
request for an interview.
        Further, if a defendant takes an unsworn statement from one of the plaintiff’s treating
providers, “[r]easonable notice and opportunity to be heard” must be given to the plaintiff, and
the plaintiff “has the right to attend the taking of such unsworn statements.” 

                                                 7
               Case: 13-14637      Date Filed: 10/10/2014      Page: 8 of 36


subject to additional disclosure by the recipient and may not be protected by

federal HIPAA privacy regulations.” 

This paragraph is

consistent with other provisions in which the plaintiff authorizes the defendant

doctor, his insurer, his attorney, and his consulting expert to share information

among themselves for the limited purposes set forth above.

                             IV. MURPHY’S LAWSUIT

       Murphy feared that signing the requisite authorization form would allow ex

parte interviews about his health care and would result in an invasion of privacy.

Murphy testified that his decision to sue Dr. Dulay in state court depended in part

on whether he must submit such authorization form allowing ex parte interviews of

his health care providers.

       To determine whether compliance was necessary, Murphy filed a complaint

against Dr. Dulay in federal district court seeking “a declaration that the presuit

authorization of ex parte communications with his physicians and other health-care

providers and the scope of information authorized for release . . . violates his

federal rights under [HIPAA].” 3 Murphy’s complaint contended that: (1) HIPAA’s

Privacy Rule protects “personal health and medical information from uses not

related to medical and health care”; (2) Florida’s § 766.1065 “authorizes


       3
        The complaint also named as a defendant “Adolfo C. Dulay, M.D., P.A.,” the entity
through which Dr. Dulay practices medicine. For ease of reference, we refer to these two
defendants collectively as “Dr. Dulay.”
                                              8
             Case: 13-14637     Date Filed: 10/10/2014    Page: 9 of 36


procedures at variance from, and in derogation of, what is authorized by federal

law” under the Supremacy Clause; and (3) therefore, “HIPAA expressly preempts

these contrary procedures.”

      The complaint requested: (1) a declaratory judgment that HIPAA preempted

§ 766.1065’s presuit authorization requirement and (2) an injunction against forced

compliance with § 766.1065 in the event Murphy sued Dr. Dulay.

      The State of Florida intervened to defend the Florida statute. Both Dr.

Dulay and the State filed motions to dismiss.

      After oral argument, the district court granted Murphy’s request for

declaratory and injunctive relief and denied Dr. Dulay’s and the State’s motions to

dismiss. The district court found that Murphy had retained experts already and his

decision to give presuit notice depended on whether he had to authorize ex parte

interviews. The district court also found that Dr. Dulay and his representatives

wanted to conduct the ex parte interviews allowed by § 766.1065.

      The district court held that “consent given only in an authorization that is

required by Florida law as a presuit condition is not voluntary.” Because the

§ 766.1065 authorization form was not voluntary, the district court concluded that

§ 766.1065 would result in disclosure of Murphy’s HIPAA-protected health

information without his consent and without other safeguards in HIPAA and its

regulations. Thus, § 766.1065 was contrary to the HIPAA provisions and


                                          9
               Case: 13-14637       Date Filed: 10/10/2014       Page: 10 of 36


preempted. The district court enjoined Dr. Dulay from obtaining any of Murphy’s

health information through ex parte interviews, unless Dr. Dulay complied with

HIPAA or Murphy voluntarily consented outside the Florida statutory scheme. 4

       Dr. Dulay and the State timely appealed.

                             V. STANDARD OF REVIEW

       We review de novo the district court’s decision that a federal law preempts a

state statute. See Pace v. CSX Transp., Inc., 

, 1068 (11th Cir. 2010);

Conn. State Dental Ass’n v. Anthem Health Plans, Inc., 

, 1343 (11th

Cir. 2009).

                           VI. PREEMPTION PRINCIPLES

       Our preemption analysis must begin with “the bedrock principle that the

Constitution designates the laws of the United States as the supreme law of the

land, requiring that ‘all conflicting state provisions be without effect.’” OPIS

Mgmt. Res., LLC v. Sec’y, Fla. Agency for Health Care Admin., 

,

1294 (11th Cir. 2013) (quoting Maryland v. Louisiana, 

, 746, 101 S.

Ct. 2114, 2128-29 (1981)); see U.S. Const. art. VI, cl. 2 (“This Constitution, and

       4
        In the district court, the State and Dr. Dulay argued: (1) that Murphy lacked standing to
challenge the statute; (2) that the controversy, to the extent there was one, was not ripe for
adjudication; and (3) that there was no valid federal cause of action for Murphy to bring his
declaratory judgment claim. The district court rejected these arguments and the defendants do
not renew them on appeal. Although these arguments raise jurisdictional questions which we
must consider sua sponte, see Region 8 Forest Serv. Timber Purchasers Council v. Alcock, 

, 807 n.9 (11th Cir. 1993), we agree with the district court’s cogent analysis and
conclusion that Murphy has standing and that his claims present a case or controversy that is ripe
for adjudication.
                                               10
             Case: 13-14637     Date Filed: 10/10/2014   Page: 11 of 36


the Laws of the United States which shall be made in Pursuance thereof . . . shall

be the supreme Law of the Land . . . .”); Altria Grp., Inc. v. Good, 

, 76,

, 543 (2008) (“[W]e have long recognized that state laws that

conflict with federal law are without effect.” (quotation marks omitted)) .

      A state law conflicts with federal law when it is “impossible for a private

party to comply with both state and federal requirements.” PLIVA, Inc. v.

Mensing, 564 U.S. ___, ___, 

, 2577 (2011) (quotation marks

omitted). “‘Pre-emption may result not only from action taken by Congress itself;

a federal agency acting within the scope of its congressionally delegated authority

may pre-empt state regulation.’” Cliff v. Payco Gen. Am. Credits, Inc., 

, 1126 n.9 (11th Cir. 2004) (quoting La. Pub. Serv. Comm’n v. F.C.C., 

, 369, 

, 1898-99 (1986)).

      One circumstance in which preemption occurs is “where a federal statute

contains ‘explicit preemptive language,’” known as “express preemption.” This

That & Other Gift & Tobacco, Inc. v. Cobb Cnty., Ga., 

, 1322 (11th

Cir. 2002) (quoting Wisc. Pub. Intervenor v. Mortier, 

, 604-05, 111 S.

Ct. 2476, 2481-82 (1991)). As outlined below, both the HIPAA statute and its

regulations use preemptive language and plaintiff Murphy, as did the district court,

relies on only express preemption here.




                                          11
             Case: 13-14637     Date Filed: 10/10/2014   Page: 12 of 36


      When determining whether a federal statute’s preemption clause expressly

preempts state law, “we focus on the plain wording of the clause,” which

necessarily contains “the best evidence of Congress’ preemptive intent.” OPIS

(quoting Chamber of Commerce of U.S. v. Whiting, 563

U.S. ___, ___, 

, 1977 (2011)). If Congress’s intent is clear, “courts

should not strain to find ways to reconcile federal law with seemingly conflicting

state law.” PLIVA, 

. “[A] court need look no further than

‘the ordinary meaning’ of federal law, and should not distort federal law to

accommodate conflicting state law.” 

and alteration omitted).

      In areas traditionally regulated by the states, however, there is a presumption

against preemption. Medtronic, Inc. v. Lohr, 

, 485, 

,

2250 (1996). This presumption applies not only to whether Congress intends

preemption but also to “the scope of its intended invalidation of state law.” 

is consistent with both federalism concerns and the historic

primacy of state regulation of matters of health and safety.” 

terms of the

federal statute can be read sensibly not to preempt state law, the presumption

controls. Fla. E. Coast Ry. Co. v. City of W. Palm Beach, 

, 1328

(11th Cir. 2001). Accordingly, if the federal preemption clause is susceptible to

multiple plausible interpretations, we ordinarily should “accept the reading that

disfavors pre-emption.” OPIS 

(quotation marks omitted);


                                         12
             Case: 13-14637     Date Filed: 10/10/2014    Page: 13 of 36


see Altria 

, 129 S. Ct. at 543 (stating “when the text of a pre-

emption clause is susceptible of more than one plausible reading, courts ordinarily

‘accept the reading that disfavors pre-emption’”).

                VII. HIPAA STATUTE AND REGULATIONS

      Both the HIPAA statute and its regulations contain express preemption

provisions. The HIPAA statute itself provides that HIPAA requirements “shall

supersede any contrary provision of State law.” 42 U.S.C. § 1320d-7(a)(1). More

fully, the HIPAA statute provides that, subject to exceptions not at issue here, “a

provision or requirement under [HIPAA], or a standard or implementation

specification adopted or established under sections 1320d-1 through 1320d-3 of

[HIPAA], shall supersede any contrary provision of State law.” 

statute also allows the Secretary of Health and Human Services

to “promulgate such regulations as may be necessary or appropriate to carry out the

provisions of [HIPAA].” 

see 

1320d-2 & 1320d-3

(setting forth requirements governing the Secretary’s adoption of standards under

HIPAA). “One of Congress’s objectives in enacting HIPAA was to address

concerns about the confidentiality of patients’ individually identifiable health

information.” OPIS 

. Accordingly, Congress specifically

authorized the Secretary “to promulgate privacy regulations addressing

individuals’ rights to individually identifiable health information, procedures for


                                          13
              Case: 13-14637       Date Filed: 10/10/2014      Page: 14 of 36


exercising such rights, and the uses and disclosures of such information.” 

In turn, the Secretary promulgated comprehensive privacy and disclosure

regulations spanning hundreds of pages. See 45 C.F.R. pts. 160 & 164.

       Echoing the HIPAA statute, the HIPAA regulations also state that a HIPAA

requirement “that is contrary to a provision of state law preempts the provision of

state law,” subject to exceptions not at issue here. 45 C.F.R. § 160.203.5 The

Secretary also enacted a regulation to define further what is meant by “contrary” to

state law. The Secretary’s regulation states that a state law is contrary to HIPAA

if: (1) “[a] covered entity . . . would find it impossible to comply with both the

State and Federal requirements”; or (2) “[t]he provision of State law stands as an

obstacle to the accomplishment and execution of the full purposes and objectives

of [HIPAA], as applicable.” 45 C.F.R. § 160.202(1)-(2) (emphasis added).

       Dr. Dulay and the State do not contend (1) that the HIPAA regulations

relevant to this case—the privacy and disclosure regulations in parts 160 and

164—exceed the scope of the Secretary’s delegated authority, or (2) that the

Florida legislature could permissibly enact a statute contrary to those HIPAA

regulations. Rather, they argue that § 766.1065 is consistent with both the HIPAA

statute and the HIPAA regulations. Thus, we outline the relevant HIPAA

regulations and then analyze whether § 766.1065 is contrary to them.

       5
         HIPAA, however, does not preempt state laws that provide “more stringent” privacy
protections. See 45 C.F.R. § 160.203(b); see also Opis 

.
                                              14
              Case: 13-14637       Date Filed: 10/10/2014      Page: 15 of 36


           VIII. DISCLOSURE PERMITTED UNDER REGULATIONS

       The HIPAA regulations generally prohibit covered entities from using or

disclosing “protected health information.” 45 C.F.R. § 164.508(a)(1); see 

(“A covered entity . . . may not use or disclose protected health

information, except as permitted or required by [these regulations].”); 

(enumerating exceptions). Only health plans, health care clearinghouses, and

certain health care providers are “covered entities” under the HIPAA regulations.

       The regulations, however, permit covered entities to disclose protected

health information when certain requirements are met, two of which are pertinent

here.6 First, disclosure may be made through the judicial process. 

Second, disclosure is permitted if an individual expressly authorizes

release of his or her medical information in a valid authorization form. See 

(1)(iv) (allowing covered entities to disclose protected health

information “pursuant to and in compliance with a valid authorization”); 

(“Except as otherwise permitted . . . by [HIPAA], a covered entity may

not use or disclose protected health information without an authorization that is

valid . . . .”). We discuss each permitted disclosure avenue in turn.



       6
         There are numerous categories of permissive uses and disclosures in the HIPAA
regulations, only two of which we discuss here.
                                              15
               Case: 13-14637        Date Filed: 10/10/2014       Page: 16 of 36


A.     Disclosure by Judicial Process

       Section 164.512 provides that “[a] covered entity may use or disclose

protected health information without the written authorization of the individual, as

described in § 164.508 . . . in the situations covered by this section . . . .” 

One of the twelve situations covered in § 164.512 are “[d]isclosures for

judicial and administrative proceedings.” 

7 More precisely, even

without a written authorization, “[a] covered entity may disclose protected health

information in the course of any judicial or administrative proceeding.” 

But certain procedures must be followed. Information may be

released only in response to: (1) an “order of a court or administrative tribunal,” or

(2) a “subpoena, discovery request, or other lawful process, that is not

accompanied by an order of a court or administrative tribunal,” when certain

conditions are met. 

       For the latter, information may be disclosed only if the covered entity

receives satisfactory assurance from the party seeking the information that

reasonable efforts have been made to either (1) ensure that the individual whose

       7
          Section 164.512 also covers standards in these other situations involving disclosure
without a written authorization: (1) when required by law, (2) for public health activities,
(3) about victims of abuse, neglect, or domestic violence, (4) for health oversight activities,
(5) for law enforcement purposes, (6) about decedents, (7) for cadaveric organ, eye, or tissue
donation purposes, (8) for research purposes, (9) to avert a serious threat to health or safety,
(10) for specialized government functions, (11) for workers’ compensation. 

The provisions governing disclosure by judicial process “do not supersede other provisions of
[§ 164.512] that otherwise permit or restrict uses or disclosures of protected health information.”

                                                16
               Case: 13-14637        Date Filed: 10/10/2014       Page: 17 of 36


information is to be shared has been given notice of the request, or (2) secure a

qualified protective order. 

       The HIPAA regulations state additional requirements for each of these

processes to be valid. For example, to establish that reasonable efforts have been

made to give notice, the party requesting information must show by written

documentation that it has made a “good faith attempt to provide written notice,”

that such notice included sufficient information about the litigation to permit the

individual to raise an objection to the court, that the time for the individual to raise

objections to the court has elapsed, and that either no objections were filed or all

objections filed have been resolved by the court. 

If

instead the party seeks to proceed by protective order, it must show that the parties

to the dispute have agreed to a qualified protective order and presented it to the

court, or that the party seeking the protected health information has requested a

qualified protective order from the court. 

8

       Importantly for this case, § 164.512(e) provides an alternative avenue for

disclosure without a written authorization and does not replace or narrow the

provisions permitting disclosure by written authorization alone, which are

discussed below.

       8
         A qualified protective order means an order that prohibits the parties from using or
disclosing the protected health information for any purpose other than the litigation for which it
was requested and requires that the protected health information, at the end of the litigation, be
returned to the covered entity or destroyed. 

                                                17
             Case: 13-14637     Date Filed: 10/10/2014     Page: 18 of 36


B.    Disclosure by Express Authorization

      Disclosure of protected health information is also permissible when a person

signs a valid written authorization. 

A valid authorization, alone, is

sufficient to permit disclosure in compliance with HIPAA, so long as “such use or

disclosure [is] consistent with such authorization.” 

regulations specify that, to be valid, an authorization must

contain these elements: (1) “[a] description of the information to be used or

disclosed that identifies the information in a specific and meaningful fashion”;

(2) “[t]he name or other specific identification of the person(s), or class of persons,

authorized to make the requested use or disclosure”; (3) “[t]he name or other

specific identification of the person(s), or class of persons, to whom the covered

entity may make the requested use or disclosure”; (4) “[a] description of each

purpose of the requested use or disclosure”; (5) “[a]n expiration date or an

expiration event that relates to the individual or the purpose of the use or

disclosure”; and (6) the “[s]ignature of the individual and date.” 

      Further, “the authorization must contain statements adequate to place the

individual on notice of all of the following:” (1) the individual’s “right to revoke,”

the exceptions to the right to revoke, and “a description of how the individual may

revoke”; (2) that a covered entity “may not condition treatment, payment,


                                          18
             Case: 13-14637      Date Filed: 10/10/2014   Page: 19 of 36


enrollment or eligibility for benefits on whether the individual signs the

authorization,” subject to narrow exceptions; and (3) “the potential for information

disclosed pursuant to the authorization to be subject to redisclosure by the recipient

and no longer be protected by [HIPAA].” 

(b)(4).

      In short, the HIPAA regulations mandate that an authorization contain many

different elements in order to be a valid authorization. The authorization form

required by § 766.1065 must have those same HIPAA elements to be valid too.

      The HIPAA regulations also set forth circumstances when a written

authorization is invalid, specifically: (1) “[t]he expiration date has passed or the

expiration event is known by the covered entity to have occurred”; (2) “[t]he

authorization has not been filled out completely, with respect to [each element

required]”; (3) “[t]he authorization is known by the covered entity to have been

revoked”; (4) the authorization is a compound authorization or is a condition for

receiving treatment (and neither exception is applicable); or (5) “[a]ny material

information in the authorization is known . . . to be false.” 

      The HIPAA regulations explain that a “compound authorization,” subject to

exceptions not at issue here, is an authorization for the disclosure of protected

health information that is “combined with any other document to create a

compound authorization.” 

The Secretary gave this example

of a compound authorization: an authorization for the use or disclosure of


                                          19
             Case: 13-14637     Date Filed: 10/10/2014   Page: 20 of 36


protected health information “may be combined with an informed consent to

receive treatment, [or] a consent to assign payment of benefits to a provider.”

Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg.

82,462, 82,511 (Dec. 28, 2000).

      Further, as part of a larger modification of the HIPAA regulations, the

Secretary stated that a compound authorization is created when “an authorization

for the use and disclosure of protected health information is combined with any

other legal permission.” Modifications to the HIPAA Privacy, Security,

Enforcement, and Breach Notification Rules, 78 Fed. Reg. 5565, 5609 (Jan. 25,

2013). Citing the fact that the use of multiple authorization forms has confused

patients, the Secretary permitted the use of compound authorization forms under

certain circumstances. 

The Secretary’s statements elucidate the

HIPAA regulations’ circular definition of “compound authorization,” clarifying

that the regulation prohibits the combination of an authorization with another

“legal permission”—such as a consent to treatment or consent to assign payment—

not its combination with literally “any other document.”

      The exceptions to the compound authorization prohibition also inform this

conclusion. See 45 C.F.R. § 164.508(b)(3)(i)-(iii). The first exception permits an

authorization for disclosure of health information for a research study to be

combined with another authorization for the same or another study. 

13-14637      Date Filed: 10/10/2014    Page: 21 of 36


§ 164.508(b)(3)(i). The second exception authorizes a compound authorization for

the use or disclosure of psychotherapy notes. 

The third

exception allows an authorization—other than an authorization for use or

disclosure of psychotherapy notes—to be combined with any other such

authorization, unless the covered entity has conditioned treatment or enrollment in

a health care plan on the provision of an authorization. 

Notably, each exception discusses an authorization combined with another

authorization—not an authorization combined with a wholly different type of

document, such as a presuit notice.

                IX. CONDITIONING OF AUTHORIZATIONS

      The HIPAA regulations prohibit only the conditioning of medical treatment

or health care benefits on the execution of a HIPAA authorization. See 45 C.F.R.

§ 164.508(b)(4) (“A covered entity may not condition the provision to an

individual of treatment, payment, enrollment in the health plan, or eligibility for

benefits on the provision of an authorization[.]”). Even that limited prohibition has

rather broad exceptions.

      A covered entity may condition medical treatment on the signing of an

authorization when: (1) the treatment is research-related and the information to be

disclosed is to be used in the research; (2) a health plan conditions enrollment in

the health plan or eligibility for benefits on the signing of an authorization if the


                                           21
              Case: 13-14637     Date Filed: 10/10/2014     Page: 22 of 36


authorization is necessary for the health plan’s underwriting or risk rating

determinations and the authorization is not for the disclosure of psychotherapy

notes; or (3) “the provision of health care . . . is solely for the purpose of creating

protected health information for disclosure to a third party,” when the authorization

permits disclosure to that third party. 

      In responding to issues raised by public comments, the Secretary has

interpreted the HIPAA regulations to allow other benefits to be conditioned on the

signing of a HIPAA authorization. See 65 Fed. Reg. at 82,658. The Secretary

considered suggestions that it “prohibit the provision of anything of value” from

being conditioned on an authorization for disclosure of protected information. 

consideration, the Secretary acknowledged that, due to its limited

authority, it “cannot entirely prevent individuals from being coerced into signing

these [authorization] forms.” 

added that “[w]e do not, for

example, have the authority to prohibit an employer from requiring its employees

to sign an authorization as a condition of employment.” 

Secretary said “a program such as the Job Corps may make such an authorization a

condition of enrollment in the Job Corps program.” 

same comment section, the Secretary also recognized that many

states require state Medicaid agencies to obtain, for payment purposes, an

individual’s HIPAA authorization as a condition of enrolling an individual as a


                                           22
             Case: 13-14637     Date Filed: 10/10/2014   Page: 23 of 36


Medicaid recipient. “If state law requires a Medicaid agency to obtain the

individual’s authorization for providers to disclose protected health information to

the Medicaid agency for payment purposes, the agency may do so under

§ 164.508(e). This authorization must not be a condition of enrollment or

eligibility, but may be a condition of payment of a claim for specified benefits if

the disclosure is necessary to determine payment of the claim.” 

may

thus require a Medicaid agency to condition payment of a claim for benefits on an

individual’s signing an authorization if the disclosure of protected health

information is necessary to determine payment. See 

ANALYSIS

      With this background, we examine whether § 766.1065 is contrary to

HIPAA and its regulations.

A.    § 766.1065 Authorizations Meet HIPAA’s Requirements

      The HIPAA regulations expressly allow the release of protected health

information upon the signing of a valid authorization. Our first task is to determine

whether the presuit authorization form required by § 766.1065 meets the HIPAA

requirements for a valid, written authorization.

      As outlined above, the HIPAA regulations include explicit details about

what an authorization must contain to be valid under HIPAA. In turn, the Florida

statute, in § 766.1065, provides the precise form that a presuit authorization must


                                          23
              Case: 13-14637     Date Filed: 10/10/2014     Page: 24 of 36


take, ensuring that the form meets each of the required elements set forth in the

HIPAA regulations. To the extent that there remains any ambiguity, § 766.1065

explicitly states that presuit authorizations “shall be construed in accordance with

the [HIPAA requirements].” Fla. Stat. § 766.1065(3). Thus, the plain text of

§ 766.1065 makes clear that it requires presuit authorizations to meet HIPAA’s

requirements.

      Murphy argues that the § 766.1065 authorization fails to satisfy HIPAA’s

required elements for four reasons, each of which lacks merit.

      First, Murphy views the authorizations required by § 766.1065 as

irrevocable and, therefore, in conflict with the HIPAA regulations’ requirement

that an authorization be revocable. See 45 C.F.R. § 164.508(b)(5). This is not so.

Subsection (2) of § 766.1065 plainly contemplates a plaintiff’s ability to revoke the

required authorization. See Fla. Stat. § 766.1065(2) (“If the authorization required

by this section is revoked . . . .”). Further, subsection (3) explicitly requires that

the authorization include the phrase “the Patient has the right to revoke this

authorization in writing.” 

There is a consequence for

revocation, though—that the presuit notice is deemed retroactively void. As a

result, and if too much time passes, a plaintiff’s medical negligence claim may be

barred by the statute of limitations. See 

But, the HIPAA

regulations do not require that a person be able to revoke an authorization free of


                                           24
             Case: 13-14637     Date Filed: 10/10/2014    Page: 25 of 36


any consequences; they just require that an authorization be revocable. The

Florida statute requires the same.

      Second, Murphy argues that § 766.1065 authorizations are non-HIPAA

compliant because they require a plaintiff to list health care providers to whom the

presuit authorization does not apply, as well as those to whom it applies. He

contends that requiring a plaintiff to disclose other health care providers who do

not have information about the plaintiff’s medical negligence claim “cannot serve a

legitimate purpose.” We disagree. Requiring a plaintiff to name health care

providers whom a defendant may not contact for information does serve a

legitimate purpose—it protects a plaintiff’s privacy by resolving any ambiguity

about which providers a defendant may not contact. Furthermore, the HIPAA

regulations do not require that the scope of an authorization be commensurate to a

specific, legitimate purpose. Under HIPAA an individual may disclose his entire

medical history for any purpose. It is no defect, therefore, that the Florida presuit

authorization permits disclosure of some information that may be irrelevant to the

plaintiff’s medical negligence claim.

      Third, Murphy contends that the authorizations required by § 766.1065 do

not meet the HIPAA regulations’ specificity requirement. See 45 C.F.R.

§ 164.508(c)(1)(i). To meet the specificity requirement, an “authorization must

include a description of the information to be used or disclosed, with sufficient


                                          25
             Case: 13-14637     Date Filed: 10/10/2014    Page: 26 of 36


specificity to allow the covered entity to know which information the authorization

references.” 65 Fed. Reg. at 82,517. Importantly, “[t]here are no limitations on

the information that can be authorized for disclosure,” and an individual may

authorize a health care provider to release all of his medical records. 

authorization form in § 766.1065 specifically authorizes the release of health

information held by health care providers that the plaintiff identifies, including

those who have examined, evaluated, or treated him (or who will do so) in

connection with the complained-of injury; and those who have examined,

evaluated, or treated him two years prior to the injury. Fla. Stat. § 766.1065(3)(B).

Murphy may not like the breadth of the authorization required by § 766.1065, but

the HIPAA regulations do not require that authorizations be narrow, simply that

they be specific.

      And in accordance with HIPAA’s requirement that a valid authorization

form include “[a] description of each purpose of the requested use or disclosure,”

45 C.F.R. § 164.508(c)(1)(iv), § 766.1065’s authorization form states that

disclosure is authorized for the following “specific purposes”: (1) “[f]acilitating the

investigation and evaluation” of the claim; (2) “[d]efending against any litigation

arising out of” the claim; or (3) “[o]btaining legal advice or representation arising

out of” the claim. Fla. Stat. § 766.1065(3)(A).




                                          26
             Case: 13-14637     Date Filed: 10/10/2014   Page: 27 of 36


      The form’s limitation on how disclosed information may be used, however,

does not alter the form’s clear description of which information may be turned

over. Section 766.1065’s authorization form is clear that all information in the

listed doctors’ possession, both verbal and written, is subject to disclosure. The

form is also clear that disclosed information may be used only to investigate and

defend the medical negligence claim. Doctors will have no difficulty discerning

the obvious purpose of a defendant’s request when presented with a signed

authorization. Therefore, § 766.1065’s authorization form fully satisfies HIPAA’s

requirement that the information permitted for disclosure be identified “in a

specific and meaningful fashion.” 45 C.F.R. § 164.508(c)(1)(i).

      Fourth, Murphy argues that § 766.1065 requires a prohibited compound

authorization. See 45 C.F.R. § 164.508(b)(3). He reasons that a compound

authorization is an authorization combined “with any other document” and that

§ 766.1065 requires an authorization combined with a 90-day presuit notice.

However, as explained above, a compound authorization is created when “an

authorization for the use and disclosure of protected health information is

combined with any other legal permission.” 78 Fed. Reg. at 5609. The presuit

notice is not a legal permission, much less a consent to treatment or consent to

assign payment. The presuit notice is merely a condition precedent for filing a

medical negligence suit in Florida state court. The fact that the presuit notice


                                          27
             Case: 13-14637     Date Filed: 10/10/2014    Page: 28 of 36


document and the authorization form are submitted together does not alter our

analysis. Accordingly, the fact that the authorization must be sent out with the

presuit notice does not create an impermissible compound authorization.

      In summary, after reviewing the HIPAA regulations, we conclude that the

authorization form required in § 766.1065 complies with HIPAA. Indeed,

§ 766.1065 expressly requires that an individual execute a HIPAA-compliant

authorization before bringing a medical negligence claim. The Florida law

requires only that a prospective plaintiff act in accordance with a federal provision,

exactly as contemplated by Congress and the Secretary who promulgated the

regulations, before filing a medical negligence complaint in state court.

Conditioning the use of the state courts on compliance with a federal provision

(HIPAA) does not conflict with that federal provision (HIPAA).

      Because § 766.1065 is consistent with HIPAA’s requirements for disclosure

by written authorization, it is also irrelevant whether § 766.1065 calls for

procedures that satisfy the requirements of another HIPAA disclosure exception—

including the exception for disclosure by judicial process. See 45 C.F.R.

§ 164.512(e)(1)(i)-(ii). Clearly, § 766.1065 does not provide the same privacy

safeguards as those called for in the judicial-process exception. But when an

individual executes a valid HIPAA authorization, he waives all HIPAA protection

as to the health information covered by the authorization, including the protections


                                          28
             Case: 13-14637     Date Filed: 10/10/2014   Page: 29 of 36


against litigation-related disclosures. See 45 C.F.R. § 164.512 (noting that

additional privacy safeguards apply only where a covered entity seeks to “use or

disclose protected health information without the written authorization of the

individual” (emphasis added)). Accordingly, no other HIPAA exception for

disclosure needs to be satisfied once an individual signs a valid written

authorization.

B.    Mandatory Nature of § 766.1065

      Because § 766.1065’s authorization form meets HIPAA’s required elements

to be a valid authorization, Murphy is left to focus on the mandatory nature of

§ 766.1065. Because § 766.1065 requires HIPAA authorizations as a mandatory

pre-condition to filing a medical negligence claim in Florida court, Murphy argues

individuals are being coerced by the State of Florida to sign them. Murphy

contends that HIPAA requires all authorizations be signed voluntarily to be valid,

and thus § 766.1065 violates HIPAA. We disagree for several reasons.

      First, there is no explicit voluntariness requirement in the HIPAA statute or

its regulations. Rather, the HIPAA regulations contemplate that HIPAA

authorizations may be based on conditions. In fact, the comprehensive regulations

prohibit only conditioning medical treatment or health care benefits on execution




                                         29
               Case: 13-14637         Date Filed: 10/10/2014        Page: 30 of 36


of an authorization. 9 Notably, HIPAA does not state that any other types of

conditions are invalid. Additionally, the regulations’ explicit prohibition on only

conditioning treatment or benefits on executing a HIPAA authorization implies

that there are no implicit prohibitions on requiring HIPAA authorizations in other

circumstances. See Fla. Right to Life, Inc. v. Lamar, 

, 1327 (11th

Cir. 2001) (applying the canon of expressio unius est exclusio alterius—“under

which ‘the expression of one thing implies the exclusion of another’”—to conclude

that explicit statutory exceptions “imply the exclusion of all other possible

exceptions” (citation omitted)).

       Even the regulations’ sole prohibition is not absolute, allowing some

covered entities to condition the provision of medical treatment or other services

on signing an authorization. 45 C.F.R. § 164.508(b)(4)(i)-(iii). Had the drafters of

the HIPAA regulations wished to preclude a state legislature from conditioning a

public benefit—such as filing a lawsuit—on signing a HIPAA authorization, they

could have easily done so, just as they generally prohibited doctors from

conditioning medical treatment on signing a HIPAA authorization. The

regulations do not do so, and we must give effect to the regulations’ silence. See

a covered entity may not condition “treatment, payment, enrollment in the
health plan, or eligibility for benefits” on execution of an authorization, subject to three limited
exceptions. 45 C.F.R. § 164.508(b)(4).
                                                 30
               Case: 13-14637       Date Filed: 10/10/2014       Page: 31 of 36


       Second, Murphy, and others like him, voluntarily choose to seek redress for

grievances through Florida’s judicial system. By enacting § 766.1065, the State

conditioned an individual’s ability to use a state-provided resource to advance

medical negligence claims—the state judicial system—upon that individual’s

executing a limited HIPAA authorization in a form that complies with HIPAA’s

requirements. An individual retains the choice whether to file suit, and therefore

whether to sign the authorization form.

       Third, both times a statute like Florida’s has been challenged on the basis of

HIPAA preemption and the authorization being involuntary, courts have upheld

it.10 In 2009, the Texas Supreme Court upheld that state’s similar statute. See In

re Collins, 

(Tex. 2009). That court began its analysis by noting

that “HIPAA itself allows the disclosure of protected health information if the

patient has executed a valid, written authorization conforming to the requirements

of 45 C.F.R. § 164.508(c).” 

Rejecting the plaintiffs’ argument that the

presuit authorization they signed was invalid because it was involuntary, the court

held “while it is true that the [plaintiffs] could not have proceeded with their suit if



       10
          Both Texas and Tennessee have enacted statutes similar to § 766.1065. See Tex. Civ.
Prac. & Rem. Code Ann. § 74.052(a)-(c) (substantially identical to the Florida statute but
requiring the authorizations 60 days before filing, instead of 90 days); Tenn. Code Ann. § 29-26-
121(a)(2)(E) (requiring that, 60 days before filing a medical negligence suit, a prospective
plaintiff provide notice and, inter alia, “[a] HIPAA compliant medical authorization permitting
the [prospective defendant] to obtain complete medical records from each other provider being
sent a notice”).
                                               31
              Case: 13-14637      Date Filed: 10/10/2014   Page: 32 of 36


[one of the plaintiffs] had not executed the authorization, it was their choice to file

the suit in the first instance.” 

that, while portions of the HIPAA regulations governing privacy

and disclosure of protected information have been amended several times after the

Texas Supreme Court’s 2009 decision in Collins, the amendments have not

changed the circumstances under which HIPAA authorizations may be based on

conditions. See Breach Notification for Unsecured Protected Health Information,

74 Fed. Reg. 42,740, 42,767-70 (Aug. 24, 2009); Modifications to the HIPAA

Privacy, Security, Enforcement, and Breach Notification Rules, 78 Fed. Reg. 5566,

5692-5702 (Jan. 25, 2013); see also OPIS 

n.2; cf. Phillip

C. v. Jefferson Cnty. Bd. of Educ., 

, 696-97 (11th Cir. 2012)

(“Congress is presumed to be aware of [a] . . . judicial interpretation of a statute

and to adopt that interpretation when it re-enacts a statute without change.”

(quotation marks omitted)).

       Six years later, in 2013, the Tennessee Supreme Court reached the same

conclusion regarding Tennessee’s similar statute. See Stevens ex rel. Stevens v.

Hickman Comm. Health Care Servs., Inc., 

(Tenn. 2013). Echoing

the Texas Supreme Court, that court held that “although [the Tennessee statute]

requires that a plaintiff complete a HIPAA authorization as a pre-condition of




                                           32
               Case: 13-14637       Date Filed: 10/10/2014        Page: 33 of 36


filing suit, a plaintiff’s decision whether to file suit is still a voluntary one.” 

11

       Fourth, Florida’s § 766.1065 statute is not preempted even if we accept

Murphy’s argument that HIPAA contains an implicit requirement of voluntariness.

As outlined above, the HIPAA regulations set forth numerous core elements that

must be in an authorization form in order for that authorization to be valid. See

45 C.F.R. § 164.508. These elements help ensure that individuals make a knowing

and informed decision about what they are signing and to what extent they are

authorizing the release of protected health information about them. In that sense,

the Secretary is attempting to assure that an individual is making an informed and

thus voluntary decision. See, e.g., 65 Fed. Reg. at 82,657 (“We intend the

authorizations required under this rule to be voluntary for individuals, and,

therefore, they need to be separate from other forms of consent that may be a

condition of treatment or payment or that may otherwise be coerced.”); 

recognize that the Georgia Supreme Court held that HIPAA preempted a Georgia
statute requiring that a plaintiff file, contemporaneously with a medical negligence complaint, an
authorization allowing ex parte interviews of health care providers. See Allen v. Wright, 

, 818 (Ga. 2007); see Ga. Code Ann. § 9-11-9.2. In Allen, the Georgia statute did not
“expressly provide[] that the requisite authorization comply with the provisions of HIPAA” and
did not require that the authorization give notice of a plaintiff’s right to 

. Unlike the Georgia statute, Florida’s § 766.1065 requires that authorizations conform to
HIPAA’s requirements. See Fla. Stat. § 766.1065(3). Moreover, the Georgia Supreme Court’s
analysis suggests that, had the Georgia statute contained a provision like the § 766.1065(3)—
requiring that authorizations meet HIPAA’s requirements—the court would have upheld it. See

.
        Recently, a Florida circuit court in Escambia County ruled that HIPAA does not preempt
the presuit authorization requirement in § 766.1065. Weaver v. Myers, No. 2013 CA 001714,
slip op. at 3-6 (Fla. Cir. Ct. June 24, 2014).
                                                33
               Case: 13-14637    Date Filed: 10/10/2014   Page: 34 of 36


at 82,658 (stating that the right to revoke authorization at any time “is essential to

ensuring that the authorization is voluntary”); 

(“We have attempted to

create authorization requirements that make the individual’s decisions as clear and

voluntary as possible.”).

      At the same time, the Secretary acknowledges that some coercion is allowed

by expressly permitting Medicaid benefits, financial incentives, and even

employment to be conditioned on the execution of a HIPAA authorization. We do

not find the condition imposed by § 766.1065 to be categorically different from the

other conditions and incentives permitted under HIPAA. We cannot say that

requiring a HIPAA authorization as a condition of suing a health care provider for

medical negligence in state court is more coercive than requiring one as a condition

of employment or Medicaid-benefit payments, which HIPAA permits. The Florida

law does not rise to the level of duress that might somehow invalidate an otherwise

valid authorization.

      At a minimum, absent clear intent in the HIPAA regulations to prohibit

conditioning the filing of a medical negligence action on executing a valid

authorization, we must observe the strong presumption against preemption in areas

traditionally regulated by the states. See Medtronic, 

, 116 S.

Ct. at 2250.




                                          34
               Case: 13-14637       Date Filed: 10/10/2014       Page: 35 of 36


C.     § 766.1065 is “Not Contrary” to HIPAA

       In light of our above analysis, we conclude that Murphy has not shown

§ 766.1065 is contrary to HIPAA. 12

       First, it is patently clear that § 766.1065 does not make it “impossible” for a

covered entity, as defined by the HIPAA regulations, “to comply” with both

HIPAA and state law. See 45 C.F.R. § 160.202(1). Section 766.1065 requires the

authorization form to comply with HIPAA’s requirements. Once a plaintiff

executes a valid HIPAA authorization as part of his presuit obligations, his

physician can, consistent with HIPAA, convey relevant health information about

the plaintiff to the defendant. A medical provider can simultaneously comply with

state and federal requirements.

       Second, § 766.1065 does not stand “as an obstacle” to fulfilling “the full

purposes and objectives” of HIPAA. See 45 C.F.R. § 160.202(2). One of

HIPAA’s stated objectives is “reducing the administrative costs of providing and

paying for health care.” 42 U.S.C. § 1320d-1(b). Likewise, § 766.1065, by

allowing health care providers to investigate and potentially settle claims before

litigation commences, serves to reduce the overall cost that medical negligence

litigation places on Florida’s health care system. The Florida law, like HIPAA,


       12
         As Murphy’s counsel noted at oral argument, whether § 766.1065 violates the Florida
Constitution is a state law issue that is not before us. Our decision involves only the claimed
federal preemption of a state law.
                                               35
             Case: 13-14637     Date Filed: 10/10/2014   Page: 36 of 36


attempts to strike a balance between privacy protection and the efficient resolution

of medical negligence claims.

      Accepting arguendo that one of HIPAA’s goals is to ensure that waivers of

privacy protections are made knowingly and voluntarily, the Florida statute does

not interfere with that goal. The HIPAA regulations allow authorizations to be

based on conditions—such as employment, Medicaid benefits, and other

incentives—and prohibit only one type of condition. Even that condition is not

absolute but has exceptions. Further, an individual’s decision to sign an

authorization prior to bringing a medical negligence claim in state court is not an

involuntary one. If an individual does not wish to execute such an authorization,

he does not have to. He is, however, precluded from using the Florida courts to

obtain relief through a medical negligence lawsuit against a health care provider.

                                XI. CONCLUSION

      For the foregoing reasons, we vacate the district court’s declaratory

judgment order in favor of plaintiff Murphy, as well as the district court’s

injunction against the enforcement of Fla. Stat. § 766.1065. We remand for the

district court to enter final judgment in favor of the defendants on Murphy’s

federal preemption claim.

      VACATED and REMANDED.




                                          36