The Seventh Circuit Court of Appeals recently ruled against several healthcare providers, including the Board of Trustees of the Hancock Regional Hospital, in a case concerning the sharing of patient data. The court upheld a lower court's decision that the hospitals did not have the right to remove a lawsuit to federal court based on claims that they acted under federal authority. This ruling impacts how healthcare providers handle patient data and their obligations under federal regulations.
The case, Jennifer Fleece v. Board of Trustees of the Hancock Regional Hospital, was filed in 2023 when Jennifer Fleece and other plaintiffs alleged that the hospitals shared their health data without consent through a tracking software called Meta Pixel. The plaintiffs claimed that this action violated various state laws, including the Indiana Wiretapping Act and the Indiana Deceptive Consumer Sales Act. The healthcare providers sought to move the case to federal court, arguing they were acting under the federal government when they created their online patient portals.
The dispute arose from a broader context of healthcare regulations established by the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009. This federal law aimed to promote the adoption of electronic health records (EHRs) among healthcare providers. To comply with the HITECH Act, hospitals were incentivized to create patient portals that would allow patients to access their health information electronically. However, the plaintiffs argued that the hospitals' actions in sharing data through these portals were not authorized by federal law.
The Seventh Circuit's ruling came after the district court had previously rejected the hospitals' argument for federal jurisdiction. The district court determined that the hospitals were not acting under a federal officer when they created their patient portals, as the portals were not essential to the government's operations. The court noted that while the hospitals were heavily regulated, this did not equate to acting under federal authority.
The ruling was issued by Circuit Judge Lee, who emphasized that the healthcare providers did not meet the criteria for federal jurisdiction under the federal officer removal statute. The court stated, "The patient portals are private websites designed by private actors. Once the patient portals are up and running, it is the providers and their patients who benefit from them most directly—not the federal government." This statement clarifies that compliance with federal regulations does not automatically grant entities the status of acting under federal authority.
The court further explained that the relationship between the healthcare providers and the federal government was not sufficiently close to justify federal jurisdiction. The ruling highlighted that the Meaningful Use regulations did not provide detailed specifications for how hospitals should maintain their patient portals, indicating that the hospitals were not under direct federal control.
The implications of this ruling are significant for healthcare providers across the country. It reinforces the notion that merely complying with federal regulations does not transform a private entity into a public actor. The court's decision aligns with similar rulings from other circuits, indicating a consistent judicial interpretation of the federal officer removal statute.
This ruling may also impact how healthcare providers approach the development and management of patient portals and their obligations regarding patient data privacy. As healthcare technology continues to evolve, the legal landscape surrounding data sharing and patient consent remains a critical area of focus for both providers and patients.
Looking ahead, it is unclear whether the healthcare providers will seek further appeals in this case. The court's ruling is final unless challenged in a higher court. However, the healthcare industry will likely keep a close eye on any developments related to this case and similar lawsuits that may arise in the future.