The Security Scrutinizer with Howard Anderson

California Privacy Case: An Update

U.S. Supreme Court Helps Bolster State Law

Back in June, I wrote about a California Supreme Court ruling that a key provision of a state privacy law is not preempted by federal regulations (see: California Privacy Case Worth Watching).

See Also: Live Webinar | Embracing Digital Risk Protection: Take Your Threat Intelligence to the Next Level

Now that the U.S. Supreme Court has chosen not to review the case (Mortensen v. Brown), a Los Angeles lawyer can proceed with his lawsuit against a debt collector for allegedly disclosing his and his children's dental records and other personal information to credit reporting agencies without his permission, in violation of the state's medical privacy law.

This privacy battle is not yet over. It will be interesting to see the outcome of the lawsuit in this important case. 

The California Supreme Court justices, in a unanimous ruling, overturned a state appellate court decision that the lawsuit must be dismissed because a provision in the state law, The Confidentiality of Medical Information Act, was preempted by the federal Fair Credit Reporting Act.

The state Supreme Court ruling, and the U.S. high court's refusal to review it, could help ensure the privacy of Californian's medical records.

History of the Dispute

The privacy case began with a dispute over whether the LA lawyer, Robert Brown, owed his dentist $600 for a dental crown. Brown argued he never received the crown and refused to pay the bill. So the dentist referred the bill to the debt collector, Stewart Mortensen, who, over a period of time, sent various dental records and other information about Brown and his children to the nation's three major credit reporting agencies.

Brown sued Mortensen, alleging the debt collector violated the state medical privacy law, noting he made repeated requests to stop the disclosures to credit agencies. The state law, in most cases, requires patient authorization to disclose medical records to third parties and enables patients to sue anyone who discloses their health records without their permission.

The appellate court ruled that "all state law claims arising from the furnishing of information to consumer reporting agencies are preempted by the Federal Credit Reporting Act," the California Supreme Court noted in its decision. "Reasoning that Mortensen had acted as a furnisher of credit information when disclosing the Browns' medical information to various credit agencies," the appellate court rejected Brown's lawsuit, the court noted.

But the state Supreme Court disagreed with the appellate court's conclusion that the Federal Credit Reporting Act preempted the state law's provision requiring obtaining patient permission to share records with third parties. It also noted that the HIPAA Privacy Rule specifically favors "additional, more protective state legislation" on health information privacy.

This privacy battle is not yet over. It will be interesting to see the outcome of the lawsuit in this important case.

Brown told me he's now pursuing a class action lawsuit against Mortensen in Los Angeles Superior Court on behalf of all Californians who may have had their healthcare records inappropriately shared with credit reporting agencies by Mortensen. He's seeking $1,000 for each individual affected.



About the Author

Howard Anderson

Howard Anderson

News Editor, ISMG

Anderson is news editor of Information Security Media Group and was founding editor of HealthcareInfoSecurity and DataBreachToday. He has more than 40 years of journalism experience, with a focus on healthcare information technology issues. Before launching HealthcareInfoSecurity, he served as founding editor of Health Data Management magazine, where he worked for 17 years, and he served in leadership roles at several other healthcare magazines and newspapers.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing healthcareinfosecurity.com, you agree to our use of cookies.