FOR PUBLICATION
  UNITED STATES COURT OF APPEALS
       FOR THE NINTH CIRCUIT

KIRK WEBB, individually and as             
class representative; MANN &
COOK, a legal partnership, for                    No. 05-56282
itself and as class representative,
                Plaintiffs-Appellants,             D.C. No.
                                                 CV-05-03373-R
                  v.                               OPINION
SMART DOCUMENT SOLUTIONS, LLC,
                Defendant-Appellee.
                                           
         Appeal from the United States District Court
            for the Central District of California
          Manuel L. Real, District Judge, Presiding

                   Argued and Submitted
             May 10, 2007—Pasadena, California

                      Filed August 27, 2007

      Before: Andrew J. Kleinfeld and Richard A. Paez,
      Circuit Judges, and William Hart,* Senior Judge.

                     Opinion by Judge Paez




   *The Honorable William Hart, Senior United States District Judge for
the Northern District of Illinois, sitting by designation.

                                10547
              WEBB v. SMART DOCUMENT SOLUTIONS             10549


                          COUNSEL

Barrett S. Litt and Paul J. Estuar, Litt, Estuar, Harrison, Miller
& Kitson, LLP, Los Angeles, California, for the plaintiffs-
appellants.
10550        WEBB v. SMART DOCUMENT SOLUTIONS
Martin D. Bern, Munger, Tolles & Olson, LLP, San Fran-
cisco, California, for the defendant-appellee.


                         OPINION

PAEZ, Circuit Judge:

   The regulations promulgated by the Department of Health
and Human Services (“DHHS”) to implement the Health
Insurance Portability and Accountability Act of 1996
(“HIPAA”), Pub. L. 104-191, 110 Stat. 1936 (codified as
amended in scattered sections of 42 U.S.C.), provide for an
individual’s broad access to his own health records. Under
HIPAA, an individual has the right to obtain copies of his
medical records for a reasonable, cost-based fee, while third
parties who seek the same records may be charged at a higher
rate. See 45 C.F.R. § 164.524(c)(4). In this case, Kirk Webb’s
lawyers—the law firm of Mann & Cook—requested Webb’s
records on his behalf from his treating hospital. That hospital
in turn passed the request on to Smart Document Systems
(“Smart”), which charged Mann & Cook at the higher rate.
Because Mann & Cook bills their clients for the cost of
obtaining medical records, Webb and Mann & Cook (collec-
tively, “Plaintiffs”) sued Smart for unfair competition under
California Business and Professions Code section 17200
(“Section 17200”), asserting that the lower, cost-based fee
should apply.

   In a matter of first impression for the federal courts, we
must determine whether the term “individual” in the DHHS
regulations implementing HIPAA encompassed Mann &
Cook when it acted as Webb’s agent, thereby qualifying the
law firm to obtain medical records at the lower rate. Although
nothing in the regulations prevents a law firm from drafting
or mailing the request for records on behalf of its clients, or
from directing that the records be sent to its office, we hold
               WEBB v. SMART DOCUMENT SOLUTIONS            10551
nonetheless that the HIPAA regulations require the reduced
rate only when the individual himself requests the records.1
Thus, we affirm the district court’s dismissal of Plaintiffs’
case for failure to state a claim for relief.

   Before turning to the merits of Plaintiffs’ claims, we also
consider sua sponte whether the district court had jurisdiction
over this case. Because HIPAA provides for no private right
of action, Plaintiffs originally filed this case in the California
Superior Court, invoking a California unfair competition stat-
ute to seek redress of the alleged HIPAA violations. Defen-
dant removed the case to federal court. Although under
certain circumstances concerns about federal question juris-
diction will preclude federal courts from hearing a case where
there is no federal private right of action, we conclude that the
district court correctly assumed diversity jurisdiction here.

                                  I.

                             OVERVIEW

   Webb and Mann & Cook filed a class action in California
Superior Court. According to the allegations in their com-
plaint, which we “presume[ ] to be true” when reviewing a
district court’s dismissal pursuant to Federal Rule of Civil
Procedure 12(b)(6), Holcombe v. Hosmer, 

,
1097 (9th Cir. 2007), the following facts formed the basis of
the lawsuit:

   Smart is the “world’s largest health document processor.”
It contracts with numerous health care providers and facilities
for the “exclusive” right to copy and provide patients’
records. When a provider contracts with Smart, patients have
“no other means to obtain copies of [their] medical records
except through Smart”; Smart “does not notify the patient that
it will be accessing and viewing the patient’s health care
  1
   We have jurisdiction pursuant to 28 U.S.C. § 1291.
10552         WEBB v. SMART DOCUMENT SOLUTIONS
records in advance,” nor does it “obtain the patient’s consent
to do so.” Upon receiving a request, “Smart then accesses and
copies the patient’s health care records through an agent who
maintains copying equipment on the health care provider’s
premises, sends the health care records to the patient or repre-
sentative, and sends a bill for the copies of the health care
records to the patient or his agent.”

   In exchange for this exclusive right, “Smart provides free
copies and other benefits and services of value to health care
providers.” Smart makes a profit in spite of the HIPAA provi-
sion allowing patients to obtain their records at a cost-based
fee in part by “charg[ing] more for providing copies of health
care records to patients who request their records through
their agents, such as their personal injury lawyers, than to
patients who are not represented by attorneys.”

   Plaintiffs encountered Smart when Webb hired Mann &
Cook to represent him in his civil rights claim for excessive
force and, in furtherance of that litigation, Mann & Cook
ordered copies of Webb’s medical records. For that service,
Smart charged Mann & Cook $.35 cents per page, in addition
to more than $65 in various additional fees, including a “Base
Fee,” a “Basic Fee,” and a “Retrieval Fee.” Mann & Cook
have a contingent fee arrangement with Webb, so it “ad-
vanced the cost of the health care records for its client to
Smart, and charged him with repayment of the advance to be
paid at the time of the resolution of the case.” Because Webb
is thus ultimately responsible for Smart’s charges, the Plain-
tiffs alleged that Smart violated the HIPAA fee limitations by
charging him—through his agent, Mann & Cook—more than
a reasonable, cost-based fee.

   HIPAA itself provides no private right of action. Accord-
ingly, Plaintiffs brought suit in state court invoking a Califor-
nia unfair competition law that makes violations of other state
and federal laws independently actionable. See Cal. Bus. &
Prof. Code §§ 17200-210 (West 2005). Smart removed the
                WEBB v. SMART DOCUMENT SOLUTIONS                      10553
case to federal court on the basis of diversity of citizenship in
class actions, see 28 U.S.C. §§ 1332(d), 1453,2 and filed a
motion to dismiss for failure to state a claim, see Fed. R. Civ.
P. 12(b)(6). It argued that Plaintiffs had not stated a claim
under Section 17200 because they had not adequately alleged
a violation of any law. Specifically, Smart argued that Plain-
tiffs’ allegations did not constitute a HIPAA violation because
the HIPAA fee limitations apply only to individual patients
who request records on their own behalf, and not to attorneys
who act as agents of their clients. The district court granted
Smart’s motion. Plaintiffs timely appealed.

                                     II.

                         STANDARD OF Review

   We review de novo dismissals under Rule 12(b)(6), taking
all allegations in the complaint as true. 

.

                                    III.

                               DISCUSSION

A.    Jurisdiction Over the Section 17200 Claim

  This case presents an unusual situation. Generally, when
we consider state law claims asserted in federal court after a
  2
    Under the Class Action Fairness Act of 2005, Pub. L. 109-2, 119 Stat.
4 (2005), except in certain circumstances not present here, “[a] class
action may be removed to a district court of the United States . . . without
regard to whether any defendant is a citizen of the State in which the
action is brought.” 28 U.S.C. § 1453(b); see also 

(“The
district courts shall have original jurisdiction of any civil action in which
the matter in controversy exceeds the sum or value of $5,000,000, exclu-
sive of interest and costs, and is a class action in which—[, inter alia,] (A)
any member of a class of plaintiffs is a citizen of a State different from
any defendant.”).
10554           WEBB v. SMART DOCUMENT SOLUTIONS
diversity-based removal, we apply state substantive law, pur-
suant to Erie Railroad Co. v. Tompkins, 

(1938).
See, e.g., Kohlrautz v. Oilmen Participation Corp., 

, 830-31 (9th Cir. 2006); Conestoga Servs. Corp. v. Exec-
utive Risk Indem., Inc., 

, 980-81 (9th Cir. 2002).
Here, by contrast, the focus of our attention is directed at the
proper interpretation of the regulations implementing a fed-
eral statute—HIPAA. This seems particularly incongruous
because HIPAA itself does not provide for a private right of
action, see 65 Fed. Reg. 82601 (Dec. 28, 2000) (“Under
HIPAA, individuals do not have a right to court action.”), so
the federal courts would seldom have occasion to undertake
such an analysis.

   In fact, however, it is California law that directs, in this
class action diversity case, that we examine federal law.
Plaintiffs’ California cause of action, Section 17200, is a
broad statute designed to remedy violations of other laws,
both state and federal. See People ex rel. Bill Lockyer v. Fre-
mont Life Ins. Co., 

, 469 (Cal. Ct. App.
2002) (‘[V]irtually any state, federal, or local law can serve
as the predicate for” a Section 17200 claim) (emphasis
added). Section 17200 “establishes [and creates a private right
of action to remedy] three varieties of unfair competition”: the
unlawful, the unfair, and the fraudulent. 

marks omitted). Plaintiffs’ claim is “based on” the allegedly
unlawful and unfair conduct of Smart in violating HIPAA.
Charging higher fees to lawyers thus must violate a law—
here, the HIPAA regulations—in order for Plaintiffs to state
a claim for relief under Section 17200’s “unlawful” prong.3
  3
    Plaintiffs’ complaint also referenced a claim under the California com-
mon law of unfair competition. Plaintiffs have not pursued that claim in
this appeal, so we consider it waived. See United States v. Gomez-Mendez,

, 606 n.10 (9th Cir. 2007) (“We will not ordinarily consider
matters on appeal that are not specifically and distinctly raised and argued
in an appellant’s opening brief.” (internal quotation marks omitted)).
                 WEBB v. SMART DOCUMENT SOLUTIONS                      10555
    Similarly, if we determine that the agency responsible for
implementing HIPAA intended to permit Smart’s conduct, it
cannot be “unfair” under Section 17200. The California
Supreme Court has held that if the allegedly unfair conduct is
that which “the Legislature has permitted . . . or considered
. . . and concluded no action should lie, courts may not over-
ride that determination . . . [and] use the general unfair com-
petition law to assault that [safe] harbor.” Cel-Tech
Commc’ns, Inc. v. Los Angeles Cellular Tel. Co., 

, 541 (Cal. 1999). To withstand a motion to dismiss under
Rule 12(b)(6) and state a claim under Section 17200, there-
fore, Plaintiffs must demonstrate that, in charging Mann &
Cook a higher fee, Smart violated the HIPAA regulations.4

   [1] In some cases, federal jurisdictional requirements may
preclude federal courts from entertaining a state law claim
based on a violation of a federal statute.5 “[A] complaint
alleging a violation of a federal statute as an element of a state
cause of action, when Congress has determined that there
should be no private, federal cause of action for the violation,
does not state a claim ‘arising under the Constitution, laws, or
treaties of the United States.’ ” Merrell Dow Pharm. v.
  4
     Plaintiffs also alleged a claim for relief under California Civil Code
section 52.1 (providing a cause of action for “interfere[nce] . . . by threats,
intimidation, or coercion, . . . with the exercise or enjoyment . . . of rights
secured by” state or federal statutes or constitutions). There is some ques-
tion whether section 52.1 covers violations of federal regulations at all,
even if a violation were adequately stated. Cf. Venegas v. County of Los
Angeles, 

, 14 (Cal. 2004) (“Civil Code section 52.1 does not
extend to all ordinary tort actions because its provisions are limited to
threats, intimidation, or coercion that interferes with a constitutional or
statutory right.” (emphasis added)). Because we determine that the
HIPAA regulations do not limit the fees that Smart may charge to attor-
neys, however, we need not reach that question.
   5
     Neither party challenges federal court jurisdiction over this removed
case. See 28 U.S.C. § 1332(d) (authorizing diversity jurisdiction over class
actions); 

(authorizing removal of class actions). Because of the
unusual procedural posture of this case, however, we discuss this issue to
ensure that we in fact have subject matter jurisdiction.
10556        WEBB v. SMART DOCUMENT SOLUTIONS
Thompson, 

, 817 (1986) (quoting 28 U.S.C.
§ 1331); see also Utley v. Varian Assoc., Inc., 

,
1282-83 (9th Cir. 1987). Therefore, where there is no federal
private right of action, federal courts may not entertain a
claim that depends on the presence of federal question juris-
diction under 28 U.S.C. § 1331.

   [2] This jurisdictional concern is not present here. Had
Smart removed this case to federal court on the basis of fed-
eral question jurisdiction under § 1331, the lack of a private
right of action to enforce HIPAA may have foreclosed Plain-
tiffs’ Section 17200 claim. However, Smart invoked diversity
jurisdiction pursuant to 28 U.S.C. § 1332(d) to justify the
removal. See 28 U.S.C. § 1453; cf. Lockyer v. Dynergy, Inc.,

, 841-42 (9th Cir. 2004) (holding that removal
was appropriate, and that the Merrell Dow/Utley rule did not
apply where jurisdiction was not “predicated solely on 28
U.S.C. § 1331”); Ethridge v. Harbor House Restaurant, 

, 1393-94 & n.4 (9th Cir. 1988) (noting that the
Merrell Dow/Utley rule does not apply to cases removed on
the basis of diversity jurisdiction). Having satisfied ourselves
that we have jurisdiction, therefore, in accordance with Cali-
fornia substantive law, we must analyze the federal regula-
tions that will decide whether Plaintiffs have stated a claim
for relief.

B.   HIPAA Statutory and Regulatory Framework

   [3] HIPAA aims “to improve the . . . efficiency and effec-
tiveness of the health information system through the estab-
lishment of standards and requirements for the electronic
transmission of certain health information.” HIPAA § 261,
Pub. L. 104-191, 110 Stat. 1936 (codified at 42 U.S.C.
§ 1320d notes). As the Fourth Circuit has noted, Congress
intended through this legislation to “recogniz[e] the impor-
tance of protecting the privacy of health information in the
midst of the rapid evolution of health information systems.”
S.C. Med. Ass’n v. Thompson, 

, 348 (4th Cir.
              WEBB v. SMART DOCUMENT SOLUTIONS             10557
2003). HIPAA, therefore, emphasizes privacy, efficiency, and
modernization. The statute itself, however, does not specify
either how to protect privacy or to transmit health records
efficiently and effectively. Instead, it authorizes the Secretary
of Health and Human Services to “adopt standards” that will
“enable health information to be exchanged electronically, . . .
consistent with the goals of improving the operation of the
health care system and reducing administrative costs,” and
that will “ensure the integrity and confidentiality of [individu-
als’ health] information [and protect against] . . . unauthorized
uses or disclosures of the information.” See 42 U.S.C.
§ 1320d-2. Some of the regulations containing those standards
are the focus of our inquiry. See 45 C.F.R. §§ 160.103,
160.202, 164.502, 164.508, 164.524.

   [4] In implementing this Congressional directive, DHHS
has determined that, except in limited circumstances, “an indi-
vidual has a right of access to inspect and obtain a copy of
protected health information about the individual in a desig-
nated record set, for as long as the protected health informa-
tion is maintained in the designated record set.” 45 C.F.R.
§ 164.524(a)(1) (emphasis added). Upon an “individual[’s]
request[ ]” to inspect or obtain his records,

    the covered entity may impose a reasonable, cost-
    based fee, provided that the fee includes only the
    cost of:

    (i) Copying, including the cost of supplies for and
    labor of copying, the protected health information
    requested by the individual;

    (ii) Postage, when the individual has requested the
    copy, or the summary or explanation, be mailed; and

    (iii) Preparing an explanation or summary of the
    protected health information, if agreed to by the indi-
    vidual as required by [the regulation].
10558        WEBB v. SMART DOCUMENT SOLUTIONS

(emphasis added). The question raised by
this case is whether designated agents, such as personal attor-
neys, can count as the “individual” in order to obtain the rea-
sonable, cost-based fee.

   [5] “As a general interpretive principle, the plain meaning
of a regulation governs.” Safe Air for Everyone v. U.S. Envtl.
Prot. Agency, 

, 1097 (9th Cir. 2007) (internal
quotation marks omitted). DHHS defined “individual” as “the
person who is the subject of the protected health information.”
45 C.F.R. § 160.103. On their face then, the regulations
restrict the fee limitations to requests made by the individual
and concretely define “individual” in a way that excludes oth-
ers acting on that individual’s behalf. Plain meaning thus
favors Smart.

   The canon of statutory construction expressio unius est
exclusio alterius, which “creates a presumption that when a
statute designates certain persons, things, or manners of oper-
ation, all omissions should be understood as exclusions,” Sil-
vers v. Sony Pictures Entm’t, Inc., 

, 885 (9th Cir.
2005) (en banc) (internal quotation marks omitted), further
supports Smart’s argument. DHHS has provided for one situa-
tion in which other persons may be “treat[ed] . . . as the
individual”—when a “personal representative” is authorized
to make healthcare-related decisions for an individual:

    As specified in this paragraph, a covered entity must,
    except [in limited circumstances], treat a personal
    representative as the individual for purposes of this
    subchapter. . . . If under applicable law a person has
    authority to act on behalf of an individual who is an
    adult or an emancipated minor in making decisions
    related to health care, a covered entity must treat
    such person as a personal representative under this
    subchapter, with respect to protected health informa-
    tion relevant to personal representation.
              WEBB v. SMART DOCUMENT SOLUTIONS             10559
45 C.F.R. § 164.502(g). Application of this canon suggests
that because DHHS explicitly defined “individual” to encom-
pass “personal representatives,” it was fully capable of writ-
ing in an even broader definition of the term. That it did not
underscores the conclusion that “individual” should be
afforded its plain meaning, and that we should therefore reject
Mann & Cook’s claim to the lower rate.

   Notwithstanding that plain meaning, Plaintiffs urge us to
read the term “individual” to include authorized attorneys
because such an interpretation would be more consistent with
the purpose of HIPAA. Plain meaning is not the end of the
inquiry. “The plain language of a regulation . . . will not con-
trol if clearly expressed administrative intent is to the contrary
or if such plain meaning would lead to absurd results.” Safe

(internal quotation marks and alter-
ations omitted). We invoke this exception to the plain mean-
ing canon, however, only when “some indication of the
regulatory intent that overcomes plain language . . . [is] refer-
enced in the published notices that accompanied the rulemak-
ing process.” 

Without this safeguard, “interested
parties would not have the [requisite] meaningful opportunity
to comment on proposed regulations.” 

not persuaded that regulatory intent overcomes
plain meaning in this case. Plaintiffs have not directed us to
any part of the original notice of proposed rulemaking
(“proposed rules”),6 the commentary accompanying the final
rules (“final commentary”),7 or the subsequent published clar-
ifications accompanying the publication of other rules
(“subsequent clarification”)8 that suggests that “individual”
means anything other than “the person who is the subject of
the protected health information,” and, when applicable, that
person’s personal representative.
  6
    See 64 Fed. Reg. 59918-60065 (Nov. 3, 1999).
  7
    See 65 Fed. Reg. 82462-82829 (Dec. 28, 2000).
  8
    See 67 Fed. Reg. 53254 (Aug. 15, 2002).
10560         WEBB v. SMART DOCUMENT SOLUTIONS
   [6] On the contrary, a review of relevant regulatory history
makes clear that DHHS did not intend for private attorneys to
receive the reduced fees. Most notably, in the proposed rules,
DHHS explicitly considered adopting a broader definition of
“individual” that would have included legal representatives,
but in the final rule ultimately decided against it. As explained
in the final commentary, DHHS had previously

    proposed that the term [individual] include, with
    respect to the signing of authorizations and other
    rights (such as access, copying, and correction), the
    following types of legal representatives: . . . With
    respect to adults and emancipated minors, legal rep-
    resentatives (such as court-appointed guardians or
    persons with a power of attorney), to the extent to
    which applicable law permits such legal representa-
    tives to exercise the person’s rights in such contexts.

65 Fed. Reg. 82492. However, “[i]n the final rule, [DHHS]
eliminate[d] from the definition of ‘individual’ the provisions
designating a legal representative as the ‘individual.’ ” 

chose “[i]nstead” to “include in the final rule a sepa-
rate standard for ‘personal representatives.’ ” 

2002, in response to a public comment asking whether the fee
limitations applied to “payers, attorneys, or entities that have
the individual’s authorization,” DHHS’s subsequent clarifica-
tion explained that “the Rule . . . limits only the fees that may
be charged to individuals or to their personal representatives.”
67 Fed. Reg. 53254 (emphasis added). The final commentary
and subsequent clarification extinguish any doubt that the
“personal representative” category constitutes the only class
of persons that may be treated as the “individual” other than
the individuals themselves. See Barnhart v. Peabody Coal
Co., 

, 168 (2003) (holding that where “it is fair
to suppose that [the drafters] considered the unnamed possi-
bility and meant to say no to it,” courts should “read the enu-
meration of one case to exclude another”).
              WEBB v. SMART DOCUMENT SOLUTIONS             10561
   Because of this regulatory history, even if we believed the
meaning of “individual” was ambiguous on its face, we would
be compelled to agree with Smart. An “agency’s interpreta-
tion [of a regulation] must be given controlling weight unless
it is plainly erroneous or inconsistent with the regulation.”
Thomas Jefferson Univ. v. Shalala, 

, 512 (1994)
(internal quotation marks omitted). Plaintiffs argue with some
force that the regulations implementing HIPAA are designed
in general to allow individuals access to their own records at
a limited cost, see 45 C.F.R. § 164.524, and that interpreting
“individual” in a way that denies the reduced rate to autho-
rized agents decreases accessibility to critical personal infor-
mation. However, because privacy and efficiency of
processing are also important statutory and regulatory goals,
we cannot say that DHHS’s interpretation—which allows for
the imposition of higher costs on anyone other than the indi-
vidual or personal representative, and provides for the devel-
opment of an efficient document copying system in part by
allowing document companies to make a profit—is “plainly
erroneous or inconsistent” with those aims.

   Plaintiffs also urge that neither the final commentary nor
the subsequent clarification, which appear to foreclose Plain-
tiffs’ argument, is directly on point. They argue that the “legal
representatives” and “attorneys” to which the regulatory
materials refer do not necessarily include “attorneys at law for
individuals”; the final commentary and subsequent clarifica-
tion, according to Plaintiffs, address only “true third party sit-
uations [such as attorneys for insurers], not situations where
a ‘legal representative’ is acting ‘to exercise the person’s
rights’ in a ‘context’ where the ‘applicable law permits’ them
to so act.” This argument is not convincing. The DHHS final
commentary and subsequent clarification clearly preclude
both third party attorneys and private legal representatives
from obtaining the reduced fees. First, as discussed, the
agency considered, but decided against defining “individual”
to include legal representatives, instead creating the narrower
category of “personal representatives.” Second, DHHS stated
10562            WEBB v. SMART DOCUMENT SOLUTIONS
explicitly that “[t]he fee limitations . . . do not apply to disclo-
sures that are based on an individual’s authorization that is
valid under [45 C.F.R.] § 164.508.” 67 Fed. Reg. 53254.9 The
  9
   A valid authorization under HIPAA is defined as follows:
      Implementation specifications: Core elements and requirements.
      —
      (1) Core elements. A valid authorization under this section
      must contain at least the following elements:
      (i) A description of the information to be used or disclosed that
      identifies the information in a specific and meaningful fashion.
      (ii) The name or other specific identification of the person(s),
      or class of persons, authorized to make the requested use or dis-
      closure.
      (iii) The name or other specific identification of the person(s),
      or class of persons, to whom the covered entity may make the
      requested use or disclosure.
      (iv) A description of each purpose of the requested use or dis-
      closure. . . .
      (v) An expiration date or an expiration event that relates to the
      individual or the purpose of the use or disclosure. . . .
      (vi) Signature of the individual and date. If the authorization is
      signed by a personal representative of the individual, a descrip-
      tion of such representative’s authority to act for the individual
      must also be provided.
      (2) Required statements. In addition to the core elements, the
      authorization must contain statements adequate to place the indi-
      vidual on notice of all the following:
      (i) The individual’s right to revoke the authorization in writing,
      and . . . :
      (A) The exceptions to the right to revoke and a description of
      how the individual may revoke the authorization;
      ****
      (ii) The ability or inability to condition treatment, payment,
      enrollment or eligibility for benefits on the authorization,
      ****
                WEBB v. SMART DOCUMENT SOLUTIONS                     10563
law firm of Mann & Cook, of course, must act pursuant to
Webb’s authorization.10 Therefore, DHHS has explicitly ruled
out Plaintiffs’ proposed interpretation.

C.    Plaintiffs’ Agency Argument

   [7] Plaintiffs’ case ultimately distills down to their argu-
ment that because Mann & Cook acts as Webb’s agent, for
HIPAA purposes the lawyer who makes the request is the
individual, and thus should be charged the reduced fees for
the medical records. They rely on California agency law,
which provides that “an attorney, appearing and acting for a
party to a cause, has authority to do so, and to do all other acts
necessary or incidental to the proper conduct of the case.”

     (3) Plain language requirement. The authorization must be writ-
     ten in plain language.
     (4) Copy to the individual. If a covered entity seeks an authori-
     zation from an individual for use or disclosure of protected health
     information, the covered entity must provide the individual with
     a copy of the signed authorization.
45 C.F.R. § 164.508(c).
   10
      To the extent that Plaintiffs suggest that, as an agent of Webb, Mann
& Cook acts as Webb and thus does not need a valid HIPAA authoriza-
tion, their argument lacks merit. Although § 164.508 is a general provision
requiring authorization, nothing in that section exempts private attorneys.
Moreover, the final commentary explicitly states that “[i]f the attorney [of
an individual] is not the personal representative under the rule, or if the
attorney wants a copy of more protected health information than that
which is relevant to his personal representation, the individual would have
to authorize such disclosure” of records. 65 Fed. Reg. 82651. Given
HIPAA’s concerns with the privacy of medical information, such a spe-
cific authorization requirement makes sense. Indeed, as the final commen-
tary makes clear, even personal representatives do not get carte blanche to
request medical records without specific authorization, but instead may
request only records relevant to that representation. There is therefore no
reason to think that a general attorney/client retainer form would be suffi-
cient, without specific authorization, to allow disclosure of medical
records.
10564        WEBB v. SMART DOCUMENT SOLUTIONS
Clark Equip. Co. v. Wheat, 

, 884 (Cal. Ct.
App. 1979). They cite California state law because the
HIPAA savings clause provides that its “regulation[s] . . .
shall not supercede a contrary provision of State law, if the
provision of State law imposes requirements, standards, or
implementation specifications that are more stringent” than
HIPAA’s. 42 U.S.C. § 1320d-2 note. “More stringent” laws
are defined, inter alia, as those that “permit[ ] greater rights
of access” for the “individual, who is the subject of the indi-
vidually identifiable health information.” 45 C.F.R.
§ 160.202. Plaintiffs argue that California agency law pro-
vides the individual with greater rights of access by allowing
attorney-agents to obtain the records at the limited cost, and
therefore trumps the HIPAA regulations to the extent they
require a contrary interpretation.

   [8] In fact, however, California law does not support Plain-
tiffs’ claim. In the only case—federal or state—to address
directly a claim based on the HIPAA fee limitation at issue in
this case, the California Court of Appeal analyzed the same
agency argument, advanced by the same law firm—Mann &
Cook—on behalf of a different client, and rejected it:

    We agree that the lawyer is the client’s agent, but we
    do not think that, for the purposes of protecting the
    privacy of medical records, a lawyer’s request is the
    same as the client’s personal request for his or her
    own medical records. The problem that appellant’s
    argument sidesteps is that a request by anyone other
    than the individual or his/her personal representative
    as defined in the regulations raises serious privacy
    concerns. DHHS considered but rejected giving law-
    yers the same status as personal representatives. This
    court is not empowered to redraft federal regulations,
    especially when the regulations do not impinge on
    fundamental rights. . . . [A]ll appellant has to do is
    to request a copy of his own records. We do not per-
                WEBB v. SMART DOCUMENT SOLUTIONS                     10565
       ceive that there is any “right” to have one’s lawyer
       ask for one’s records.

Bugarin v. Chartone, 

, 510 (Cal. Ct. App.
2006). We must defer to the California court’s interpretation
of its own agency law as not granting the rights Plaintiffs assert.11
See Mullaney v. Wilbur, 

, 691 (1975) (“[S]tate
courts are the ultimate expositors of state law, and we are
bound by their constructions except in extreme circum-
stances.” (citations omitted)). State law does not, therefore,
trump HIPAA in this case. Accordingly, because Plaintiffs
have not sufficiently alleged a HIPAA violation, they have
  11
     Some non-California state cases suggest that, in certain contexts,
attorney-agents may qualify as individuals for the purpose of requesting
medical records at a reduced, cost-based fee. However, none of these cases
involve HIPAA or, for that matter, any statute with comparable text or
commentary suggesting that the drafters intended to exclude private attor-
neys from benefitting from the fee limitations. Cf. Ford v. Chartone, Inc.,

, 92 (D.C. Ct. App. 2006) (relying on agency law to certify
a class of lawyers seeking to obtain client medical records at reduced fees
based on a state consumer protection statute, but not challenging Defen-
dant Chartone’s interpretation of the HIPAA regulation “as not imposing
its fee caps on transactions with attorney requestors”); Cruz v. All Saints
Healthcare Sys., Inc., 

(Wis. Ct. App. 2001) (certifying
class of lawyers seeking to obtain client medical records at reduced fees
where state statutory fee limitations explicitly applied to authorized repre-
sentatives); Mermer v. Med. Correspondence Servs., 

(Ohio Ct. App. 1996) (relying on agency law to hold that attorney’s
request counted as client’s, but not noting any contrary legislative intent
in the relevant state statute). Moreover, other state cases have come to the
opposite conclusion, so even apart from HIPAA, the issue is far from set-
tled. See Street v. Smart Corp., 

(N.C. Ct. App. 2003)
(holding that attorneys who had obtained medical records for clients had
no standing to sue document reproduction companies); Slobin v. Henry
Ford Health Care, 

, 634 (Mich. 2003) (holding that an
attorney’s request for client’s medical records was not subject to the fee
limitations because, inter alia, the state consumer protection statute “ap-
plies only to purchases by consumers”).
10566            WEBB v. SMART DOCUMENT SOLUTIONS
not stated a claim under Section 17200, and dismissal under
Rule 12(b)(6) was appropriate.12

   Our holding, however, in no way precludes attorneys from
assisting their clients in accessing and obtaining their medical
records without triggering the hefty fees. Although the plain
meaning of “individual,” as well as the DHHS final commen-
tary and subsequent clarification evidence a clear intent to
exclude attorney requests from the reduced fees, this intent
does create at least some conflict with DHHS’s statement that
“[t]he fee limitation . . . is intended to assure that the right of
access . . . is available to all individuals, and not just to those
who can afford to do so.” 67 Fed. Reg. 53254. As the Califor-
nia Court of Appeal noted,

     lawyers routinely request copies of their clients’
     medical records. The effect of such requests by law-
     yers is to increase the cost to the client, even though
     the intent of the legislation, and the regulations, is to
     minimize the cost of copying, at least when an “indi-
     vidual” requests his or her own records.

. It is possible to reconcile
this seeming conflict; privacy concerns increase when anyone
other than the individual requests medical records, and
because privacy is a primary HIPAA goal, it makes sense to
make it more difficult for third parties to obtain records, even
   12
      California’s statutory equivalent to the regulatory provision allowing
reduced fees under HIPAA also appears on its face to be inapplicable to
requests like Mann & Cook’s: The state statutory fee limitations apply to
the requests of a “patient” or “patient’s representative.” Cal. Health &
Safety Code § 123110(b). The definition of “patient’s representative” does
not include private attorneys unless they are guardians or agents empow-
ered to make healthcare decisions. 

It is possible that legis-
lative intent, or the policy and practices of the agency implementing this
statute might lead to a different conclusion. However, as neither party has
raised the significance of this state statute or its interpretation, we decline
to address it further.
                WEBB v. SMART DOCUMENT SOLUTIONS                  10567
with authorization. Still, it is “circuitous,” if not downright
silly, to require an individual “to request his own medical
records . . . and having received them, hand them to his law-
yer.” 

   We therefore echo the concurrence in Bugarin by empha-
sizing that in affirming the district court’s judgment, we only

       uphold[ ] the ability of copying services to charge
       higher rates when the attorney makes the request on
       behalf of his or her client than when the patient/
       client makes the request directly. . . . [We do] not
       address such presumably common scenarios in
       which the client signs the request and asks the docu-
       ments to be sent to the attorney, or the attorney pre-
       pares the documents on his or her letterhead and the
       client personally signs the request.

(Rubin, J., concurring). In the end, then, we may
not be “free to deviate from the text” of the HIPAA regula-
tions, 

but we may nonetheless recognize that there
is ample room for attorneys to provide important services for
their clients.13

  AFFIRMED.




  13
   In light of our disposition we need not reach the issue of whether
Smart is subject to HIPAA’s cost-based fee regulation in the first place.