Brown v. Mortensen

Filed 6/16/11

IN THE SUPREME COURT OF CALIFORNIA

ROBERT A. BROWN et al., )

)

Plaintiffs and Appellants, )

) S180862

v. )

) Ct.App. 2/1 B199793

STEWART MORTENSEN, )

) Los Angeles County

Defendant and Respondent. ) Super. Ct. No. BC289546

____________________________________)

In this case we address the remedies available to a patient when a debt

collector, acting on behalf of a medical professional, is asserted to have illegally

disclosed confidential patient medical information to various consumer reporting

agencies in the course of a dispute over an alleged medical debt.

Individuals, as patients, have a substantial interest in the privacy of their

medical information. (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th

1, 41.) As consumers, they have substantial interests as well in the privacy and

accuracy of their credit information. Recognizing the importance of these

interests, Congress has intervened on both fronts, enacting the Health Insurance

Portability and Accountability Act (HIPAA) (42 U.S.C. § 1320d et seq., inter alia)

and the Fair Credit Reporting Act (FCRA) (15 U.S.C. § 1681 et seq.) to protect

against the mishandling of medical information and credit information,

respectively. Our Legislature has been no less diligent, enacting the

Confidentiality of Medical Information Act (Confidentiality Act) (Civ. Code, § 56

1

et seq.) and the Consumer Credit Reporting Agencies Act (id., § 1785.1 et seq.),

inter alia, to address the same concerns.

Because of the dual state and federal responses to the protection of an

individual‟s privacy and accuracy interests, when the interests overlap, as in this

case, the question of what remedies are available is a federalism problem. As will

appear, we conclude that Congress did not intend the state remedies to be

preempted. Accordingly, we reverse the Court of Appeal, which held to the

contrary.

FACTUAL AND PROCEDURAL BACKGROUND1

Plaintiff Robert A. Brown and his two minor children were dental patients

of defendant Dr. Rolf Reinholds.2 In July 2000, Dr. Reinholds billed Brown $600

for a permanent dental crown. Brown never received a crown and never entered

into an agreement to pay for one. He thus declined to pay the bill.

Dr. Reinholds referred the debt to a collection agency, Credit Bureau

Services, the fictitious business name for defendant Stewart Mortensen.

Mortensen or his agents contacted Brown and attempted to collect the debt. When

Brown requested that Mortensen provide proof of the debt, Mortensen sent Brown

a copy of Brown‟s dental chart, as well as the charts of Brown‟s minor children.

In response, Brown informed Mortensen he did not owe any money to Dr.

1 Because plaintiffs appeal from the trial court‟s sustaining of a demurrer, we

take the well-pleaded facts stated in the complaint as true. (Beal Bank, SSB v.

Arter & Hadden, LLP (2007) 42 Cal.4th 503, 505, fn. 1.)

2 Dr. Reinholds, his professional corporation, a fellow dentist‟s professional

corporation, and Reinholds‟s bookkeeper were all originally parties to this action,

but have since been dismissed. For convenience, we refer to this group of

defendants collectively as Dr. Reinholds.

2

Reinholds and the dental charts contained his and his children‟s confidential

medical information.

Over the next two years, Mortensen repeatedly disclosed the contents of

Brown‟s and his children‟s dental charts to the three major national consumer

reporting agencies, Experian, Equifax, and Trans Union. Additionally, Mortensen

disclosed to the agencies the Browns‟ names, Social Security numbers, dates of

birth, addresses, telephone numbers, and Brown‟s and his children‟s entire dental

history with Dr. Reinholds, including alleged dental treatments. Mortensen made

these disclosures for purposes of verifying to the consumer reporting agencies that

a debt was owed, despite the facts that (1) no one contended Brown owed money

for dentistry performed on his children, and (2) Brown had never authorized Dr.

Reinholds or Mortensen to disclose this information to any third parties, including

the three consumer reporting agencies.

From 2001 to 2003, Brown repeatedly but unsuccessfully demanded that

Mortensen cease making unauthorized disclosures. Brown also contacted the

three consumer reporting agencies and informed them the disclosures made by

Mortensen were inaccurate and incomplete. This assertion prompted the agencies

to request that Mortensen provide additional information; in response, Mortensen

disclosed Brown‟s dental history dating back 10 years, despite the fact this history

included detailed information about Brown‟s dental treatments and was irrelevant

to the present dispute over whether Brown owed anything for a permanent dental

crown.

Brown contacted Dr. Reinholds in January 2003 and requested that he

submit signed written instructions to the three consumer reporting agencies

directing them to delete the disclosures of medical information. Dr. Reinholds

declined and instead ratified Mortensen‟s disclosures; Dr. Reinholds also made

further unauthorized disclosures to Equifax.

3

Brown and his wife, individually and as guardians ad litem for their minor

children, then sued Dr. Reinholds and Mortensen, alleging violations of the

Confidentiality Act (Civ. Code, § 56 et seq.), inter alia. Only the claims against

Mortensen for violation of the Confidentiality Act are at issue; all other claims and

parties have been voluntarily dismissed.

In the third and fourth causes of action of the operative complaint, the

fourth amended complaint, Brown alleges Mortensen‟s disclosure of his and his

children‟s medical information to consumer reporting agencies violated the

Confidentiality Act. Subject to certain exceptions, that act prohibits the

unauthorized dissemination of individually identifiable medical information and

provides for compensatory damages and other remedies. (Civ. Code, §§ 56.10,

56.26, 56.35.) The trial court sustained a demurrer with leave to amend and then,

when Brown elected not to amend, dismissed the action.

The Court of Appeal affirmed. While it rejected the trial court‟s conclusion

that Brown‟s Confidentiality Act claims were impermissibly vague, it accepted

Mortensen‟s alternative argument that the FCRA preempted them. The Court of

Appeal opined that all state law claims arising from the furnishing of information

to consumer reporting agencies are preempted by the FCRA. (See 15 U.S.C.

§ 1681t(b)(1)(F).)3 Reasoning that Mortensen had acted as a furnisher of credit

information when disclosing the Browns‟ medical information to various credit

agencies, the court affirmed dismissal.

We granted review to consider the interplay between state and federal laws

governing credit reporting and the confidentiality of medical information.

3 All further unlabeled statutory references are to title 15 of the United States

Code.

4

DISCUSSION

I. Preemption Principles

“The supremacy clause of the United States Constitution establishes a

constitutional choice-of-law rule, makes federal law paramount, and vests

Congress with the power to preempt state law.” (Viva! Internat. Voice for Animals

v. Adidas Promotional Retail Operations, Inc. (2007) 41 Cal.4th 929, 935, fn.

omitted; see U.S. Const., art. VI, cl. 2; Cipollone v. Liggett Group, Inc. (1992) 505

U.S. 504, 516.) Congress may exercise that power by enacting an express

preemption provision, or courts may infer preemption under one or more of three

implied preemption doctrines: conflict, obstacle, or field preemption. (See In re

Jose C. (2009) 45 Cal.4th 534, 550.) We consider here a single claim of express

preemption: Mortensen asserts section 1681t(b)(1)(F), a provision of the FCRA,

expressly preempts Brown‟s causes of action alleging violation of the

Confidentiality Act (Civ. Code, § 56 et seq.).

The United States Supreme Court has identified “two cornerstones” of

federal preemption analysis. (Wyeth v. Levine (2009) 555 U.S. 555, ___ [129

S.Ct. 1187, 1194].) First, the question of preemption “ „fundamentally is a

question of congressional intent.‟ ” (In re Tobacco Cases II (2007) 41 Cal.4th

1257, 1265, quoting English v. General Electric Co. (1990) 496 U.S. 72, 79; see

also Wyeth, 555 U.S. at p. ___ [129 S.Ct. at p. 1194] [“ „[T]he purpose of

Congress is the ultimate touchstone in every pre-emption case.‟ ”].) If a statute

“contains an express pre-emption clause, our „task of statutory construction must

in the first instance focus on the plain wording of the clause, which necessarily

contains the best evidence of Congress‟ pre-emptive intent.‟ ” (Sprietsma v.

Mercury Marine (2002) 537 U.S. 51, 62-63; see also Viva! Internat. Voice for

Animals v. Adidas Promotional Retail Operations, Inc., supra, 41 Cal.4th at

p. 939.) “ „Also relevant, however, is the “structure and purpose of the statute as a

5

whole,” [citation] as revealed not only in the text, but through the reviewing

court‟s reasoned understanding of the way in which Congress intended the statute

and its surrounding regulatory scheme to affect business, consumers, and the

law.‟ ” (Olszewski v. Scripps Health (2003) 30 Cal.4th 798, 816, quoting

Medtronic, Inc. v. Lohr (1996) 518 U.S. 470, 486.)

“Second, „[i]n all pre-emption cases, and particularly in those in which

Congress has “legislated . . . in a field which the States have traditionally

occupied,” . . . we “start with the assumption that the historic police powers of the

States were not to be superseded by the Federal Act unless that was the clear and

manifest purpose of Congress.” ‟ ” (Wyeth v. Levine, supra, 555 U.S. at p. ___

[129 S.Ct. at pp. 1194-1195]; see also Viva! Internat. Voice for Animals v. Adidas

Promotional Retail Operations, Inc., supra, 41 Cal.4th at p. 938.) The role of the

presumption against preemption is to “ „provide[] assurance that “the federal-state

balance” [citation] will not be disturbed unintentionally by Congress or

unnecessarily by the courts.‟ ” (Olszewski v. Scripps Health, supra, 30 Cal.4th at

p. 815, quoting Jones v. Rath Packing Co. (1977) 430 U.S. 519, 525.)

The presumption against preemption applies fully in cases considering

whether Congress intended by passage of the FCRA and subsequent amendments

to displace state law. (See, e.g., American Bankers Ass’n. v. Gould (9th Cir. 2005)

412 F.3d 1081, 1086.) State statutory and common law protection of interests in

informational privacy long predates federal regulation. (See Gormley, One

Hundred Years of Privacy (1992) 1992 Wis. L.Rev. 1335, 1353-1357; Prosser,

Privacy (1960) 49 Cal. L.Rev. 383, 386-388, 392-398; Warren & Brandeis, The

Right to Privacy (1890) 4 Harv. L.Rev. 193.) It thus comprises a field

traditionally occupied by the states and, accordingly, the presumption “applies

with particular force here.” (Farm Raised Salmon Cases (2008) 42 Cal.4th 1077,

1088.)

6

With these principles in mind, we turn to a consideration of preemption

under the FCRA.

II. The Scope of FCRA Preemption

A. The FCRA

“Congress enacted FCRA in 1970 to ensure fair and accurate credit

reporting, promote efficiency in the banking system, and protect consumer

privacy.” (Safeco Insurance Co. v. Burr (2007) 551 U.S. 47, 52; see also

§ 1681(a)(4) [the FCRA was designed to “insure that consumer reporting agencies

exercise their grave responsibilities with fairness, impartiality, and a respect for

the consumer‟s right to privacy”].) Specifically, the FCRA requires consumer

reporting agencies to adopt procedures for ensuring that consumer credit

information is collected, maintained, and dispensed “in a manner which is fair and

equitable to the consumer, with regard to the confidentiality, accuracy, relevancy,

and proper utilization of such information . . . .” (§ 1681(b); see also TRW Inc. v.

Andrews (2001) 534 U.S. 19, 23.)

As originally enacted, the FCRA contained a broad savings clause,

confirming Congress had no intention of displacing state law except to the extent

state law and the FCRA were in irreconcilable conflict.4 As well, the FCRA at

first focused solely on consumer reporting agencies and imposed no duties on

furnishers, i.e., those that provide information to a consumer reporting agency.5

4 Former section 1681t provided: “This title does not annul, alter, affect, or

exempt any person subject to the provisions of this title from complying with the

laws of any State with respect to the collection, distribution, or use of any

information on consumers, except to the extent that those laws are inconsistent

with any provision of this title, and then only to the extent of the inconsistency.”

(FCRA, Pub.L. No. 91-508, § 622 (Oct. 26, 1970) 84 Stat. 1136.)

5 The FCRA does not define the term “furnisher”; instead, its meaning is

inferable from the context of its usage throughout the FCRA.

7

(See Pulver v. Avco Financial Services (1986) 182 Cal.App.3d 622, 633.)

Consequently, consumers remained free to sue furnishers under state law, subject

only to a provision limiting certain state law tort claims to instances where a

defendant had acted maliciously or with the intent to injure. (§ 1681h(e).)6

The Consumer Credit Reporting Reform Act of 1996 (1996 Reform Act)

amended the FCRA in two ways significant to this case. For the first time,

Congress imposed affirmative duties on furnishers. (§ 1681s-2; see Sen.Rep. No.

104-185, 1st Sess., p. 49 (1995) [discussing proposed new section and noting that

“[c]urrently, the FCRA contains no requirements applying to those entities which

furnish information to consumer reporting agencies”].) Additionally, it amended

the savings clause by carving out from the general no-preemption rule a series of

discrete areas in which federal law henceforth would govern to the exclusion of

state law. (§ 1681t(b).)7 One such area is at issue here: that covered by section

1681t(b)(1)(F), relating to the preemption of claims against furnishers.

B. Section 1681t(b)(1)(F) and the Presumption Against Preemption

We begin with the text of section 1681t(b)(1)(F): “(b) No requirement or

prohibition may be imposed under the laws of any State— [¶] (1) with respect to

any subject matter regulated under— [¶] . . . [¶] (F) section 1681s-2 of this title,

relating to the responsibilities of persons who furnish information to consumer

reporting agencies, except that this paragraph shall not apply— [¶] (i) . . .

6 Section 1681h(e) generally limits actions “in the nature of defamation,

invasion of privacy, or negligence” against furnishers to instances where the

defendant furnished false information “with malice or willful intent to injure such

consumer.”

7 While the 1996 Reform Act subjected these preemption provisions to an

eight-year sunset period (Pub.L. No. 104-208, § 2419 (Sept. 30, 1996) 110 Stat.

3009, 3009-453), Congress later made them permanent (Pub.L. No. 108-159,

§ 711 (Dec. 4, 2003) 117 Stat. 2011, amending 15 U.S.C. § 1681t(d)).

8

[¶] (ii) with respect to section 1785.25(a) of the California Civil Code (as in effect

on September 30, 1996).” (Italics added.)

When analyzing an express preemption clause, our task is to “ „identify the

domain expressly pre-empted‟ ” by its language. (Medtronic, Inc. v. Lohr, supra,

518 U.S. at p. 484, quoting Cipollone v. Liggett Group, Inc., supra, 505 U.S. at

p. 517.) The scope of this preemption clause therefore hinges on an interpretation

of what the “subject matter regulated” under section 1681s-2 is.

As noted, section 1681s-2 was enacted to, for the first time, impose certain

affirmative duties on furnishers of information to consumer reporting agencies.

Broadly speaking, section 1681s-2 regulates the actions of furnishers in two areas:

it imposes a duty to provide accurate information (§ 1681s-2(a)), and it dictates

what furnishers must do upon receiving official notice from a consumer reporting

agency of a dispute concerning the completeness or accuracy of information they

have provided (§ 1681s-2(b)). (See Sanai v. Saltz (2009) 170 Cal.App.4th 746,

763-764; Stafford v. Cross Country Bank (W.D.Ky. 2003) 262 F.Supp.2d 776,

782-784.)8

The “subject matter regulated” under section 1681s-2 is ambiguous because

the level of generality at which one is to characterize that subject matter is unclear,

and thus, so is the domain expressly preempted by section 1681t(b)(1)(F).

Characterized most narrowly, section 1681s-2 regulates only two discrete areas:

8 The statute prohibits any person from “furnish[ing] any information

relating to a consumer to any consumer reporting agency if the person knows or

has reasonable cause to believe that the information is inaccurate.” (§ 1681s-

2(a)(1)(A).) Furthermore, if a furnisher receives statutory notice of a “dispute

with regard to the completeness or accuracy of any information,” the furnisher

must investigate and correct incomplete or inaccurate information in a timely

fashion. (§ 1681s-2(b)(1).)

9

what a furnisher must do to ensure the information it provides is accurate (a

subject covered in exhaustive detail by the many subparts of § 1681s-2(a)), and

what a furnisher must do upon receiving official notice that the accuracy or

completeness of its information is in dispute (covered in somewhat less detail by

§ 1681s-2(b)). The operative preemption provision could thus be read as

preempting only state laws that attempt also to regulate a furnisher‟s duties with

respect to accuracy or the handling of disputes after receiving official notice.

Numerous federal district courts have adopted this view. In Stafford v.

Cross Country Bank, supra, 262 F.Supp.2d at pages 785-787, for example, the

court rejected the argument that section 1681t(b)(1)(F) preempted all state law

furnisher claims, rather than only those arising out of the two furnisher duties

actually regulated by section 1681s-2. A contrary interpretation, in the court‟s

view, would “extend [section 1681t(b)(1)(F)] well beyond its express terms.”

(Stafford, at pp. 785-786.) In Pasternak v. Trans Union (N.D.Cal. 2008) 2008

U.S. Dist. Lexis 115442, the district court rejected section 1681t(b)(1)(F)

preemption of a claim that the defendant creditor had failed to properly investigate

and cease collection efforts upon being informed personally by the plaintiff that

she was the victim of identity theft. (See Civ. Code, § 1798.92 et seq.) The court

compared the duty asserted to the precise duties actually regulated by section

1681s-2 and, finding no overlap, allowed the plaintiff to proceed. (Pasternak, at

pp. *10-*12.) In Carlson v. Trans Union, LLC (N.D.Tex. 2003) 259 F.Supp.2d

517, 521-522, the district court rejected preemption of a defamation claim against

a furnisher because the “subject matter” of the claim was “significantly different”

from that regulated by section 1681s-2 (Carlson, at p. 522), reasoning that the duty

at issue in a defamation suit does not overlap with the duties actually addressed in

section 1681s-2. (See also Dornhecker v. Ameritech Corp. (N.D.Ill. 2000) 99

F.Supp.2d 918, 930-931 [on reasoning analogous to that in Carlson, concluding

10

common law claims involving duties not regulated by § 1681s-2 were not

preempted by § 1681t(b)(1)(F)].)

Alternatively, the subject matter of section 1681s-2 could be read more

broadly as encompassing all “[r]esponsibilities of furnishers of information to

consumer reporting agencies,” as the provision is captioned, and thus preempting

any attempt by the several states to enforce laws imposing on furnishers duties

additional to the two specific duties imposed by the section—that is, as embodying

a congressional determination to impose on furnishers these, and only these, duties

and to immunize them from any other legal obligations.

The Court of Appeal, apparently overlooking this ambiguity, assumed the

latter understanding of the subject matter regulated by section 1681s-2 was correct

and thus concluded that “[t]he plain language of section 1681t(b)(1)(F) preempts

state law relating to the duties of furnishers of information to consumer reporting

agencies,” i.e., laws relating to any furnisher duty, not just the two general duties

expressly regulated by the section. In light of the ambiguity, however, we are not

at liberty to assume this reading is correct; instead, we must determine which of

the two plausible readings of section 1681t(b)(1)(F) described above actually hews

most closely to congressional intent.

In making this determination, we are assisted by the strong presumption

against displacement of state law that applies in the preemption context. That

presumption applies not only to the existence, but also to the extent, of federal

preemption. (Farm Raised Salmon Cases, supra, 42 Cal.4th at p. 1088.) Because

of it, “courts should narrowly interpret the scope of Congress‟s „intended

invalidation of state law‟ whenever possible.” (Olszewski v. Scripps Health,

supra, 30 Cal.4th at p. 815, quoting Medtronic, Inc. v. Lohr, supra, 518 U.S. at

p. 485; see also Cipollone v. Liggett Group, Inc., supra, 505 U.S. at p. 518 [the

“presumption reinforces the appropriateness of a narrow reading” of an express

11

preemption provision]; id. at p. 533 (conc. opn. of Blackmun, J.) [“We do not,

absent unambiguous evidence, infer a scope of pre-emption beyond that which

clearly is mandated by Congress‟ language.”].) Indeed, the presumption against

preemption is sufficiently powerful to impose upon courts a “duty to accept the

reading that disfavors pre-emption” as among equally plausible interpretations of

an express preemption clause. (Bates v. Dow Agrosciences LLC (2005) 544 U.S.

431, 449; see also Altria Group, Inc. v. Good (2008) 555 U.S. 70, ___ [129 S.Ct.

538, 543] [“When the text of a pre-emption clause is susceptible of more than one

plausible reading, courts ordinarily „accept the reading that disfavors pre-

emption.‟ ”].)

It follows from the foregoing that absent persuasive evidence Congress

intended more expansive preemption, we must prefer the narrower reading of the

scope of section 1681t(b)(1)(F)‟s preemption clause, the reading that extends

preemption only to state laws relating to furnisher accuracy or dispute resolution.

Relying on certain federal “total preemption” cases, Mortensen argues that

section 1681t(b)(1)(F) preempts all state law claims against furnishers involving

the same general subject matter as section 1681s-2. (See, e.g., Roybal v. Equifax

(E.D.Cal. 2005) 405 F.Supp.2d 1177, 1181-1182; Howard v. Blue Ridge Bank

(N.D.Cal. 2005) 371 F.Supp.2d 1139, 1144; Davis v. Maryland Bank, N.A.

(N.D.Cal. 2002) 2002 U.S. Dist. Lexis 26468, *39-*47.) Although Mortensen has

the burden of establishing preemption (Bronco Wine Co. v. Jolly (2004) 33 Cal.4th

943, 956-957), and thus the burden of demonstrating a “clear and manifest”

congressional intent to preempt (id. at p. 957, italics omitted), his argument offers

little that would support a broader displacement of state law. The total preemption

cases he relies on represent but one of three approaches the federal courts have

taken to reconciling section 1681t(b)(1)(F) with the potentially overlapping sphere

of section 1681h(e), which partially bars and partially permits certain common law

12

claims against furnishers (see ante, fn. 6 and accompanying text), none of which

are at issue here. (Buraye v. Equifax (C.D.Cal. 2008) 625 F.Supp.2d 894, 898;

see, e.g., Carruthers v. Am. Honda Fin. Corp. (N.D.Fla. 2010) 717 F.Supp.2d

1251, 1257-1258 [total preemption approach]; Sites v. Nationstar Mortg. LLC

(M.D.Pa. 2009) 646 F.Supp.2d 699, 708-709 [statutory preemption approach];

Woltersdorf v. Pentagon Federal Credit Union (N.D.Ala. 2004) 320 F.Supp.2d

1222, 1225-1227 [temporal preemption approach].)9 Given the different

preemption question at issue here, we do not find these cases instructive. Nor, for

that matter, do we have occasion here to agree or disagree with either of the two

alternative approaches—statutory and temporal preemption—the federal courts

have taken to reconciling sections 1681t(b)(1)(F) and 1681h(e). Under any of

these approaches, a threshold issue is whether the state law claim involves the

same subject matter as that regulated by section 1681s-2. If the claim does not,

there is no preemption. It is on that point our analysis turns.

Our own inspection of the overall statutory scheme and the pertinent

legislative history reveals evidence suggesting Congress never intended in section

1681t(b)(1)(F) to preempt state laws regulating medical privacy and thereby to

relieve entities otherwise obligated to maintain confidentiality of the duty to do so

when reporting credit information. We find instructive both (1) Congress‟s

passage of HIPAA at the same time as the 1996 Reform Act and (2) the legislative

history of the 1996 Reform Act.

9 The one California case to take a position, Sanai v. Saltz, supra, 170

Cal.App.4th at pages 773-774, follows the total preemption line of cases. We

express no view on Sanai‟s correctness.

13

C. The Interplay Between the FCRA and HIPAA

“Recognizing the importance of protecting the privacy of health

information in the midst of the rapid evolution of health information systems,

Congress passed HIPAA in August 1996.” (South Carolina Medical Ass’n. v.

Thompson (4th Cir. 2003) 327 F.3d 346, 348; see Pub.L. No. 104-191 (Aug. 21,

1996) 110 Stat. 1936.) Portions of HIPAA were intended to facilitate information

exchange among participants in the health care system (42 U.S.C. §§ 1320d to

1320d-8 (HIPAA §§ 261-262, Pub.L. No. 104-191, § 261-262 (Aug. 21, 1996)

110 Stat. 2021-2031)), but Congress foresaw that with easier transmission of

intimate medical details would come a heightened risk of privacy loss (65

Fed.Reg. 82469 (Dec. 28, 2000); see also Northwestern Memorial Hosp. v.

Ashcroft (7th Cir. 2004) 362 F.3d 923, 928-929 [“the sensitivity that lies behind

HIPAA” is concern for the “natural sensitivity that people feel about the disclosure

of their medical records”]). Accordingly, Congress tasked the federal Department

of Health and Human Services (Department) with recommending privacy

standards for the handling of personal medical information (42 U.S.C. § 1320d-2

note (HIPAA, § 264(a), Pub.L. No. 104-191, § 264(a) (Aug. 21, 1996) 110 Stat.

2033)) and, if no legislation was forthcoming within a specified period, with

promulgating regulations setting forth national medical information privacy

standards (id. (HIPAA, § 264(c)(1), Pub.L. No. 104-191, § 264(c)(1) (Aug. 21,

1996) 110 Stat. 2033)). When Congress failed to agree on legislation, the

Department fulfilled its mandate and issued a wealth of detailed regulations,

commonly known as the “Privacy Rule.” (Stds. for Privacy of Individually

Identifiable Health Information, 65 Fed.Reg. 82462 (Dec. 28, 2000), codified at

45 C.F.R. §§ 160, 164 (2010) [original Privacy Rule]; Stds. for Privacy of

Individually Identifiable Health Information, 67 Fed.Reg. 53182 (Aug. 14, 2002),

14

codified at 45 C.F.R. §§ 160, 164 (2010) [final modifications to the Privacy

Rule].)

Three points about HIPAA and the Privacy Rule are germane here. First, at

the time of HIPAA‟s passage it was expressly contemplated that Congress or the

Department would closely regulate the obligations of health plans, medical

providers, and their agents to maintain patient confidences. (42 U.S.C. § 1320d-2

note (HIPAA, § 264(b), (c)(1), Pub.L. No. 104-191, § 264(b), (c)(1) (Aug. 21,

1996) 110 Stat. 2033); see id., § 1320d-1(a) [identifying entities to be covered by

new standards].) The Privacy Rule does so, defining and restricting the ability of

covered entities to divulge confidential medical information. (See 45 C.F.R.

§ 164.502(a) (2010) [prohibiting use or disclosure of personal health information

except as provided under the Privacy Rule].) The Department‟s regulations

expressly address such matters as the extent to which personal medical

information may be disclosed when seeking payment, including to consumer

reporting agencies. (See id., § 164.506 [permitting disclosure of personal health

information for purposes of payment]; id., § 164.501 [defining payment to include

certain limited disclosures of personal health information to consumer reporting

agencies].)

Second, both HIPAA and the Privacy Rule‟s implementation of it expressly

favor additional, more protective state legislation. Although HIPAA generally

preempts state laws (42 U.S.C. § 1320d-7(a)(1); see 45 C.F.R. § 160.203 (2010)),

Congress carved out a different rule for privacy regulation (42 U.S.C. § 1320d-

7(a)(2)(B)), directing that only conflicting or less stringent state law be preempted,

while more stringent state law be preserved (id., § 1320d-2 note (HIPAA,

§ 264(c)(2), Pub.L. No. 104-191, § 264(c)(2) (Aug. 21, 1996) 110 Stat. 2033-

15

2034); see 45 C.F.R. §§ 160.202, 160.203(b) (2010)).10 As the Department

explained when announcing the Privacy Rule: “It is important to understand this

regulation as a new federal floor of privacy protections that does not disturb more

protective rules or practices. . . . The protections are a mandatory floor, which

other governments and any covered entity may exceed.” (65 Fed.Reg. 82471

(Dec. 28, 2000).)

Third, HIPAA was enacted just one month before the 1996 Reform Act.

While in construing statutes we will always prefer interpretations that harmonize

them with other legislation (Lexin v. Superior Court (2010) 47 Cal.4th 1050,

1095), that canon is particularly appropriate here, where the very same Congress

within a few weeks passed both HIPAA and the 1996 Reform Act. Given their

contemporaneous nature and overlapping privacy concerns, we must when

possible interpret HIPAA and the 1996 Reform Act as a coherent whole.

The 104th Congress could have amended the FCRA to address the scope of

a medical provider‟s duties when furnishing information to a consumer reporting

agency, or it could have addressed it as part of HIPAA. It chose to address it as

part of HIPAA, authorizing the Department to adopt regulations on the subject,

while at the same time inviting the states to continue to regulate to the extent they

desired to enact more stringent, privacy-favoring legislation. (See 42 U.S.C.

§ 1320d-2 note (HIPAA, § 264(c)(1), (2), Pub.L. No. 104-191, § 264(c)(1), (2)

(Aug. 21, 1996) 110 Stat. 2033-2034).) We see no plausible basis for reading into

10 HIPAA section 264(c)(2) provides: “(2) PREEMPTION.—A regulation

promulgated under paragraph (1) shall not supercede a contrary provision of State

law, if the provision of State law imposes requirements, standards, or

implementation specifications that are more stringent than the requirements,

standards, or implementation specifications imposed under the regulation.”

(Pub.L. No. 104-191, § 264(c)(2) (Aug. 21, 1996) 110 Stat. 2033-2034.)

16

sections 1681t(b)(1)(F) and 1681s-2, which are silent on the duties of a furnisher

to preserve medical confidentiality, a clear and manifest congressional intent to

preempt state legislation on that topic, when the same Congress in HIPAA had just

authorized and encouraged further state regulation of such matters. Far more

credible is to assume Congress intended preemption only with respect to the

specific furnisher duties for which it adopted standards in section 1681s-2, while

leaving to other laws and their preemption provisions or savings clauses the task

of articulating additional, more general duties and identifying what the several

states‟ role might be in enacting supplemental legislation.11

D. The Legislative History of the 1996 Reform Act

Additionally, we consider whether anything in the sparse legislative history

of the 1996 Reform Act, of which section 1681t(b)(1)(F) is a part, supports

Mortensen‟s and the Court of Appeal‟s assumption that a broader reading of that

preemption provision clearly was intended.12 Nothing does.

The 1996 Reform Act was the product of years of discussion and

negotiations. (Wu et al., Fair Credit Reporting (7th ed. 2010) p. 16.) On April 6,

1995, Senators Bond and Bryan introduced the Consumer Reporting Reform Act

of 1995 (Sen. No. 709, 104th Cong., 1st Sess. (1995)), a bill based in large part on

11 Congress subsequently confirmed the FCRA‟s subordinate role to HIPAA

on questions of medical privacy when it passed the Fair and Accurate Credit

Transactions Act of 2003. (Pub.L. No. 108-159 (Dec. 4, 2003) 117 Stat. 1952.) It

added the first protections for medical privacy to the FCRA, principally limiting

the ability of consumer reporting agencies to disseminate confidential medical

information. (See §§ 1681b(g)(1), 1681c(a)(6).) At the same time, Congress

subordinated these new provisions to the requirements of HIPAA and the Privacy

Rule. (See § 1681b(g)(3)(B), (6).)

12 As the Ninth Circuit has cautioned, “[t]he legislative history surrounding

§ 1681t(b)(1)(F) is murky . . . .” (Gorman v. Wolpoff & Abramson, LLP (9th Cir.

2009) 584 F.3d 1147, 1172.)

17

earlier legislative efforts that had narrowly missed enactment. Senator Bond

described the measure as providing “limited Federal preemption to ensure that

there are uniform Federal standards to govern a number of procedural issues which

are part of credit reporting and which will reduce the burdens on the credit

industry from having to comply with a variety of different State requirements.”

(Remarks of Sen. Bond, 141 Cong. Rec. S5450 (daily ed. Apr. 6, 1995).) Senator

Bryan assured that the bill “tried to only preempt those areas of this law which

affect the operational efficiencies of businesses but do not harm consumers,” and

that it was not intended to “preempt States‟ rights in the area of liability.”

(Remarks of Sen. Bryan, 141 Cong. Rec. S5450 (daily ed. Apr. 6, 1995).)

Preemption was appropriate only in order to set “a national uniform standard” on

matters such as “disclosure forms or timetables”; such limited preemption would

“not set the consumer movement back, yet should help the business community

operate more efficiently.” (Ibid.)

The Senate Committee on Banking, Housing, and Urban Affairs‟s

subsequent report on the bill reflected the same understanding. (Sen.Rep. No.

104-185, 1st Sess. (1995).)13 The committee explained the new preemption

provisions were intended to ensure the FCRA stood “as the national uniform

standard in these [preempted] areas.” (Sen.Rep. No. 104-185, at p. 55.) The

committee made equally clear that broad field preemption was not intended:

“Additionally, the Committee understands that states have the power to protect

their own citizens, including protection from abuses in the credit reporting

industry. Therefore, the FCRA, as amended by the Committee bill[,] will not

13 Technically, the report is on Senate Bill No. 650 (104th Cong., 1st Sess.

(1995)), to which the substance of the Bryan-Bond bill was added by a December

1995 amendment.

18

infringe upon the rights of states to legislate more stringent requirements that fall

outside the scope of those areas specifically preempted to the extent such

requirements are not inconsistent with any provisions of the FCRA.” (Id. at p. 56.)

To the extent these remarks shed light on the intent behind section

1681t(b), they suggest Congress intended preemption only in a few discrete areas

where it had in fact adopted a standard intended to serve as a uniform national

standard. (See Watkins v. Trans Union, L.L.C. (N.D.Ala. 2000) 118 F.Supp.2d

1217, 1222 [the legislative history behind § 1681t(b) supports only “discrete” and

“sharply drawn” areas of preemption].) Given this history, it seems more

plausible that section 1681t(b)(1)(F) was intended to preempt only those areas

governing furnishers where Congress had adopted an actual standard, i.e., for

furnisher accuracy in submitting information and furnisher responsiveness in

reacting to disputes, than that the section was, in an act of mini-field preemption,

intended to preempt all state laws implicating any duty that could have been

regulated by section 1681s-2 but was not.

In short, nothing in the legislative history evinces a clear and manifest

congressional intent to displace state law more broadly.

E. The Import of Section 1681t(b)(1)(F)’s Express Exclusion

from Preemption of Specific State Statutes

Mortensen offers one textual argument in support of his construction of

section 1681t(b)(1)(F). The provision selects out two specific state statutes for

exclusion from preemption. (See § 1681t(b)(1)(F)(i), (ii) [saving Mass. Ann.

Laws ch. 93, § 54A(a) and Cal. Civ. Code, § 1785.25, subd. (a)].) It follows,

Mortensen argues, that under the principle of expressio unius est exclusio alterius

other state laws, including the Confidentiality Act (Civ. Code, § 56 et seq.), are

not saved from preemption.

19

The argument is flawed. That Congress saved two state statutes from

preemption evinces an intent to save those particular statutes in light of an

understanding that in the absence of an exemption the statutes would have been

subject to a colorable claim of preemption.14 As Mortensen correctly surmises,

other state statutes involving the same subject matter as section 1681s-2, but not

specially exempted, are preempted. But the argument begs the point. Congress

obviously did not need to, and did not, specially exempt from preemption any of

the thousands of state statutes further afield that do not touch on the same subject

matter as section 1681s-2. It is that issue—whether claims under the

Confidentiality Act involve the same subject matter as section 1681s-2—that is

dispositive here.

For all the foregoing reasons, we conclude section 1681t(b)(1)(F) preempts

state law claims only insofar as they arise out of a requirement or prohibition with

respect to the specific furnisher duties regulated by section 1681s-2, i.e., the duties

to provide accurate information and to take action upon being notified of a dispute.

We turn to whether the claims in Brown‟s operative complaint do so.

III. Application of Section 1681t(b)(1)(F) Preemption to Brown’s

Confidentiality Act Claims

A. Overview of the Confidentiality Act

The Confidentiality Act (Civ. Code, § 56 et seq.) “is intended to protect the

confidentiality of individually identifiable medical information obtained from a

14 Unlike the Confidentiality Act, the two statutes saved by section

1681t(b)(1)(F) each specifically regulate furnishers and do so in a manner “nearly

identical” to section 1681s-2. (Gorman v. Wolpoff & Abramson, LLP, supra, 584

F.3d at p. 1172.) Thus, in the absence of a savings clause, Congress might

reasonably have been concerned that a court could find them preempted even

under the narrower plausible understanding of the subject matter regulated by

section 1681s-2.

20

patient by a health care provider, while at the same time setting forth limited

circumstances in which the release of such information to specified entities or

individuals is permissible.” (Loder v. City of Glendale (1997) 14 Cal.4th 846,

859; see Heller v. Norcal Mutual Ins. Co. (1994) 8 Cal.4th 30, 38.)

Civil Code sections 56.10, subdivision (a) (applicable to health care

providers) and 56.26, subdivision (a) (applicable to third party administrators)

establish the basic prohibition against disclosure of a patient‟s medical

information. “The basic scheme of the [Confidentiality Act], as amended in 1981,

is that a provider of health care must not disclose medical information without a

written authorization from the patient.” (Pettus v. Cole (1996) 49 Cal.App.4th

402, 425.) “The „authorization‟ requirements, which are found in section 56.11,

are detailed and demanding, reflecting the Legislature‟s interest in assuring that

medical information may be disclosed only for a narrowly defined purpose, to an

identified party, for a limited period of time.” (Id. at p. 426.) Alternatively,

disclosure will be permitted if the provider “can show that the disclosure is

excepted either by the mandatory (§ 56.10, subd. (b)) or permissive (§ 56.10[,

subd. (c)]) provisions of the act, allowing disclosure of medical information under

specified circumstances.” (Heller v. Norcal Mutual Ins. Co., supra, 8 Cal.4th at

p. 38.)15

It follows that “in order to violate the [Confidentiality Act], a provider of

health care must make an unauthorized, unexcused disclosure of privileged

15 Contrary to anything Brown may have asserted at oral argument, nothing in

the Confidentiality Act limits the procedural avenues available to medical

professionals and their agents to pursue unpaid debts for their services. Nor are

such professionals precluded from reporting the existence of a debt to consumer

reporting agencies. (See 45 C.F.R. §§ 164.501, 164.506 (2010).) The Act speaks

only to limits on the disclosure of medical information.

21

medical information.” (Heller v. Norcal Mutual Ins. Co., supra, 8 Cal.4th at

p. 38.) Notably, the interest protected is an interest in informational privacy, not

informational accuracy; a plaintiff need not show the disclosure was false or

misleading. Indeed, the invasion of a privacy interest is all the more pronounced

precisely because the disclosed information is true and may accurately reveal

intimate details the patient had a right to expect were to be maintained in

confidence. (See Hill v. National Collegiate Athletic Assn., supra, 7 Cal.4th at

p. 41 [“ „A person‟s medical profile is an area of privacy infinitely more intimate,

more personal in quality and nature than many areas already judicially recognized

and protected.‟ ”]; Cutter v. Brownbridge (1986) 183 Cal.App.3d 836, 842 [“The

„zones of privacy‟ ” protected by Cal. Const., art. I, § 1 “extend to the details of

one‟s medical history.”]; Stats. 1981, ch. 782, § 1, p. 3040 [declaring a patient‟s

right to expect that medical information be maintained in confidentiality].)

B. The Third and Fourth Causes of Action

As in Carlson v. Trans Union, LLC, supra, 259 F.Supp.2d at pages 521-

522, we determine whether state law claims are preempted by section

1681t(b)(1)(F) by comparing whether “the substance of [the] claim” (Carlson, at

p. 521)—its elements—overlaps with or is distinct from the matters regulated

under section 1681s-2. (See also Cipollone v. Liggett Group, Inc., supra, 505 U.S.

at pp. 524-530 [analyzing whether state claims impose a preempted requirement or

prohibition by examining the duties underlying each cause of action].)

The third and fourth causes of action in the operative complaint allege, on

behalf of Brown‟s two minor children and Brown himself, that Mortensen made

unauthorized disclosures of the Browns‟ confidential medical information to three

consumer reporting agencies. The Browns allege Mortensen disclosed to

Experian, Equifax, and Trans Union their names, Social Security numbers, dates

of birth, addresses, telephone numbers, and Brown‟s and his children‟s entire

22

dental history with Dr. Reinholds, including alleged dental treatments. (See Civ.

Code, § 56.05, subd. (g) [defining individually identifiable medical information as

information “regarding a patient‟s medical history” in combination with a name,

address, telephone number, or similar detail that “reveals the individual‟s

identity”].) Brown never authorized Dr. Reinholds or Mortensen to disclose this

information to any third party, including the three consumer reporting agencies.

Mortensen argues these claims are preempted because the operative

complaint mentions Brown complained to the consumer reporting agencies that

the disclosures were inaccurate and, alternatively, because the Browns‟ claims rest

on the idea that Mortensen misled the consumer reporting agencies by implying

either that Brown‟s children owed a debt or that their medical records were in

some way relevant to Brown‟s disputed debt. According to Mortensen, this

allegation and these theories bring the claims within section 1681s-2(a)‟s

regulation of furnisher accuracy and thus section 1681t(b)(1)(F)‟s preemptive

scope.

This contention mistakes the nature of a Confidentiality Act claim, both in

the abstract and as pleaded.16 As noted ante, that the information disclosed was

inaccurate is not an element of a claim: the Confidentiality Act (Civ. Code, § 56

et seq.) requires only that the disclosure, whether true or not, occurred without

authorization. The third and fourth causes of action repeatedly allege the

disclosures occurred, were unauthorized, and injured the Browns. It will not be

any part of Brown‟s required proof to show the disclosures were inaccurate or

16 It also mistakes the nature of the preemption inquiry here. What matters

are not extraneous allegations in a complaint, but whether the pleaded claims rest

upon state law duties foreclosed by federal law. (See, e.g., Cipollone v. Liggett

Group, Inc., supra, 505 U.S. at pp. 524-530.)

23

misleading as well.17 Nor does the complaint establish that any of Mortensen‟s

disclosures were made in the course of responding to official notice of a credit

information dispute, such that section 1681s-2(b) would apply. Accordingly, these

claims as pleaded, having as their gravamen issues neither of accuracy nor of

credit dispute resolution, do not involve the same subject matter as section 1681s-

2 and are not preempted.

DISPOSITION

For the foregoing reasons, we reverse the Court of Appeal‟s judgment and

remand this case for further proceedings consistent with this opinion.

WERDEGAR, J.

WE CONCUR:

CANTIL-SAKAUYE, C. J.

KENNARD, J.

BAXTER, J.

CHIN, J.

CORRIGAN, J.

IRION, J.*

17 Likewise, any relief Brown might obtain in this case will be confined to

remedying harm from loss of privacy; remediation of any harm arising from

alleged inaccuracies in the information Mortensen reported could come only from

claims under laws governing the accuracy of furnished information (e.g., Civ.

Code, § 1785.25, subd. (a); see Sanai v. Saltz, supra, 170 Cal.App.4th at pp. 776-

778; Gorman v. Wolpoff & Abramson, LLP, supra, 584 F.3d at pp. 1169-1173),

and no such claim has been pleaded here.

* Associate Justice of the Court of Appeal, Fourth Appellate District,

Division One, assigned by the Chief Justice pursuant to article VI, section 6 of the

California Constitution.

24

See next page for addresses and telephone numbers for counsel who argued in Supreme Court.

Name of Opinion Brown v. Mortensen

__________________________________________________________________________________

Unpublished Opinion

Original Appeal

Original Proceeding

Review Granted XXX 181 Cal.App.4th 789

Rehearing Granted

__________________________________________________________________________________

Opinion No. S180862

Date Filed: June 16, 2011

__________________________________________________________________________________

Court: Superior

County: Los Angeles

Judge: Anthony J. Mohr

__________________________________________________________________________________

Counsel:

Law Offices of Robert A. Brown, Robert A. Brown, Law Offices of Lyle F. Middleton and Lyle F.

Middleton for Plaintiffs and Appellants.

Arielle Cohen, Chi Chi Wu; Seth E. Mermin; and Elizabeth De Armond for National Consumer Law

Center, Public Good, Privacy Rights Clearinghouse, Privacy Activism, The World Privacy Forum and

National Association of Consumer Advocates as Amici Curiae on behalf of Plaintiffs and Appellants.

Carlson & Messer, David J. Kaminski, Stephen A. Watkins and Charles R. Messer for Defendant and

Respondent.

Counsel who argued in Supreme Court (not intended for publication with opinion):

Robert A. Brown

Law Offices of Robert A. Brown

633 West 5th Street, 28th Floor

Los Angeles, CA 90071

(213) 596-5992

Charles R. Messer

Carlson & Messer

5959 West Century Boulevard, Suite 1214

Los Angeles, CA 90045

(310) 242-2200