The Seventh Circuit Court of Appeals has upheld a decision regarding the sharing of health data by Indiana health providers. This ruling affects patients and healthcare systems across the state, particularly those who may have had their data shared without consent. The court's decision emphasizes the limits of federal jurisdiction in cases involving state law claims related to health information technology.
In the case of Brian Elkins and Annie Elkins v. Southeastern Indiana Health Management Inc. (docket number 23-3159), the Elkinses alleged that Columbus Regional Health (CRH) shared their health data through a Facebook tracking tool called the Meta Pixel without their consent. The couple filed a class action lawsuit in Indiana state court, claiming violations of state laws, including the Indiana Deceptive Consumer Sales Act and the Indiana Wiretapping Act. CRH removed the case to federal court, arguing that it was acting under the authority of the Department of Health and Human Services (HHS) when it created its online patient portal.
The dispute arose when the district court rejected CRH's claim of federal jurisdiction and sent the case back to state court. CRH then appealed the decision, which led to the consolidation of their case with four similar lawsuits against other health care providers in Indiana and Illinois. Each of these cases involved similar claims about the sharing of health data and the question of whether the providers were acting under federal authority.
The Seventh Circuit's ruling, delivered by Circuit Judge Lee, affirmed the district court's decision. The court determined that the health care providers were not acting under a federal officer when they created their patient portals. The judges concluded that while the providers were regulated by federal law, this did not equate to them performing a basic governmental task. The court noted, "the patient portals are private websites designed by private actors. Once the patient portals are up and running, it is the providers and their patients who benefit from them most directly—not the federal government."
The court's opinion highlighted the distinction between compliance with federal regulations and acting under federal authority. The judges referenced previous Supreme Court cases, including Watson v. Philip Morris, which established that merely complying with federal regulations does not make a private entity a public actor. The court stated, "private firms retain their private character even when many aspects of their conduct are controlled by federal statutes and rules."
In its analysis, the court pointed out that the Meaningful Use regulations, which incentivized health care providers to create online patient portals, did not provide detailed specifications on how to maintain these portals. The court emphasized that the lack of a close relationship between the health providers and the federal government further supported the decision that the providers were not acting under federal authority.
The implications of this ruling are significant for both patients and health care providers. It clarifies that health care providers cannot claim federal jurisdiction under the federal officer removal statute simply because they are regulated by federal law. This decision reinforces the authority of state courts to handle cases involving alleged violations of state laws related to health data sharing.
As this ruling sets a precedent, it may influence how similar cases are handled in the future. Patients who feel their health data has been improperly shared may continue to pursue claims in state courts without the fear of cases being removed to federal court. This outcome could lead to increased scrutiny of health care providers' data-sharing practices and a push for stronger protections for patient privacy.
Looking ahead, it remains to be seen whether CRH or any of the other health care providers involved in the consolidated cases will seek to appeal the ruling. Legal experts suggest that while an appeal is possible, the court's clear reasoning may make it challenging to overturn the decision. Additionally, there may be other related cases pending that could further clarify the legal landscape surrounding health data sharing and patient privacy.