## Facts

- HHS issued the HIPAA Privacy Rule governing uses and disclosures of protected health information by covered entities.
- An initial version generally required patient consent for most uses and disclosures, subject to narrow exceptions.
- After industry objections about administrative burden and inefficiency, HHS adopted an amended rule permitting (but not requiring) disclosures without consent for “treatment, payment, and health care operations.”
- The amended regulation provided that a covered entity may use or disclose protected health information for these routine purposes and may obtain patient consent, but consent was not mandatory.
- A coalition of health-privacy advocacy groups, professionals, and individuals sued the HHS Secretary, challenging the amended rule on constitutional grounds (First and Fifth Amendments), statutory grounds (HIPAA authority), and administrative law grounds (APA).
- The district court entered summary judgment for HHS on all claims, and the plaintiffs appealed.

## Issues

1. Whether the amended Privacy Rule’s permissive authorization of routine disclosures without consent constituted sufficient governmental involvement (state action) to support Fifth Amendment due process and informational privacy claims.
2. Whether the rule violated the First Amendment by impairing confidentiality in physician–patient communications and allegedly chilling speech.
3. Whether HHS exceeded its delegated authority under HIPAA by allowing routine disclosures without a consent requirement.
4. Whether the amended rule was invalid under the APA as arbitrary and capricious or procedurally defective, including due to a shift from the earlier consent-based approach.

## Decision

- The Third Circuit affirmed summary judgment for HHS.
- The court held the Fifth Amendment claims failed because the amended rule did not require, compel, or command disclosures, and the challenged disclosures by private actors were not fairly attributable to the government.
- The court held HHS acted within its statutory authority under HIPAA in balancing privacy protections with administrative efficiency.
- The court held the rulemaking satisfied the APA because HHS used notice-and-comment procedures and provided a rational explanation for the policy change.
- The court rejected the First Amendment challenge because the rule did not restrict speech or compel speech in the constitutional sense.

## Legal Principles

- Fifth Amendment due process and informational privacy claims require governmental action; permissive regulatory authorization, without coercion or mandate, generally does not convert private conduct into state action.
- A regulation that allows disclosures does not itself violate constitutional privacy rights when it neither commands disclosure nor makes the government responsible for private disclosures.
- When a statute grants an agency discretion to implement competing objectives, courts will uphold reasonable agency choices that fit within the statutory framework.
- Under arbitrary-and-capricious review, an agency may change policy if it follows required procedures and offers a reasoned explanation responsive to identified practical problems.
- First Amendment scrutiny is not triggered by a rule that does not prohibit communications or compel expressive conduct, even if it may affect confidentiality expectations.

## Conclusion

The Third Circuit upheld HIPAA’s amended Privacy Rule permitting covered entities to disclose protected health information for treatment, payment, and health care operations without obtaining patient consent, concluding the rule involved no actionable state action for Fifth Amendment claims, did not violate the First Amendment, fell within HHS’s HIPAA authority, and satisfied APA requirements.


Citizens for Health v. Leavitt, 428 F.3d 167 (3d Cir. 2005)