PAEZ, Circuit Judge:
The regulations promulgated by the Department of Health and Human Services ("DHHS") to implement the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub.L. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of 42 U.S.C.), provide for an individual's broad access to his own health records. Under HIPAA, an individual has the right to obtain copies of his medical records for a reasonable, cost-based fee, while third parties who seek the same records may be charged at a higher rate. See 45 C.F.R. § 164.524(c)(4). In this case, Kirk Webb's lawyers—the law firm of Mann & Cook — requested Webb's records on his behalf from his treating hospital. That hospital in turn passed the request on to Smart Document Systems ("Smart"), which charged Mann & Cook at the higher rate. Because Mann & Cook bills their clients for the cost of obtaining medical records, Webb and Mann & Cook (collectively, "Plaintiffs") sued Smart for unfair competition under California Business and Professions Code section 17200 ("Section 17200"), asserting that the lower, cost-based fee should apply.
In a matter of first impression for the federal courts, we must determine whether the term "individual" in the DHHS regulations implementing HIPAA encompassed Mann & Cook when it acted as Webb's agent, thereby qualifying the law firm to obtain medical records at the lower rate. Although nothing in the regulations prevents a law firm from drafting or mailing the request for records on behalf of its clients, or from directing that the records be sent to its office, we hold nonetheless that the HIPAA regulations require the reduced rate only when the individual himself requests the records.
Before turning to the merits of Plaintiffs' claims, we also consider sua sponte whether the district court had jurisdiction over this case. Because HIPAA provides for no private right of action, Plaintiffs originally filed this case in the California Superior Court, invoking a California unfair competition statute to seek redress of the alleged HIPAA violations. Defendant removed the case to federal court. Although under certain circumstances concerns
Webb and Mann & Cook filed a class action in California Superior Court. According to the allegations in their complaint, which we "presume[ ] to be true" when reviewing a district court's dismissal pursuant to Federal Rule of Civil Procedure 12(b)(6), Holcombe v. Hosmer, 477 F.3d 1094, 1097 (9th Cir.2007), the following facts formed the basis of the lawsuit:
Smart is the "world's largest health document processor." It contracts with numerous health care providers and facilities for the "exclusive" right to copy and provide patients' records. When a provider contracts with Smart, patients have "no other means to obtain copies of [their] medical records except through Smart"; Smart "does not notify the patient that it will be accessing and viewing the patient's health care records in advance," nor does it "obtain the patient's consent to do so." Upon receiving a request, "Smart then accesses and copies the patient's health care records through an agent who maintains copying equipment on the health care provider's premises, sends the health care records to the patient or representative, and sends a bill for the copies of the health care records to the patient or his agent."
In exchange for this exclusive right, "Smart provides free copies and other benefits and services of value to health care providers." Smart makes a profit in spite of the HIPAA provision allowing patients to obtain their records at a cost-based fee in part by "charg[ing] more for providing copies of health care records to patients who request their records through their agents, such as their personal injury lawyers, than to patients who are not represented by attorneys."
Plaintiffs encountered Smart when Webb hired Mann & Cook to represent him in his civil rights claim for excessive force and, in furtherance of that litigation, Mann & Cook ordered copies of Webb's medical records. For that service, Smart charged Mann & Cook $.35 cents per page, in addition to more than $65 in various additional fees, including a "Base Fee," a "Basic Fee," and a "Retrieval Fee." Mann & Cook have a contingent fee arrangement with Webb, so it "advanced the cost of the health care records for its client to Smart, and charged him with repayment of the advance to be paid at the time of the resolution of the case." Because Webb is thus ultimately responsible for Smart's charges, the Plaintiffs alleged that Smart violated the HIPAA fee limitations by charging him—through his agent, Mann & Cook—more than a reasonable, cost-based fee.
HIPAA itself provides no private right of action. Accordingly, Plaintiffs brought suit in state court invoking a California unfair competition law that makes violations of other state and federal laws independently actionable. See Cal. Bus. & Prof.Code §§ 17200-210 (West 2005). Smart removed the case to federal court on the basis of diversity of citizenship in class actions, see 28 U.S.C. §§ 1332(d), 1453,
STANDARD OF REVIEW
We review de novo dismissals under Rule 12(b)(6), taking all allegations in the complaint as true. Holcombe, 477 F.3d at 1097.
This case presents an unusual situation. Generally, when we consider state law claims asserted in federal court after a diversity-based removal, we apply state substantive law, pursuant to Erie Railroad Co. v. Tompkins, 304 U.S. 64, 58 S.Ct. 817, 82 L.Ed. 1188 (1938). See, e.g., Kohlrautz v. Oilmen Participation Corp., 441 F.3d 827, 830-31 (9th Cir.2006); Conestoga Servs. Corp. v. Executive Risk Indem., Inc., 312 F.3d 976, 980-81 (9th Cir. 2002). Here, by contrast, the focus of our attention is directed at the proper interpretation of the regulations implementing a federal statute—HIPAA. This seems particularly incongruous because HIPAA itself does not provide for a private right of action, see 65 Fed.Reg. 82601 (Dec. 28, 2000) ("Under HIPAA, individuals do not have a right to court action."), so the federal courts would seldom have occasion to undertake such an analysis.
In fact, however, it is California law that directs, in this class action diversity case, that we examine federal law. Plaintiffs' California cause of action, Section 17200, is a broad statute designed to remedy violations of other laws, both state and federal. See People ex rel. Bill Lockyer v. Fremont Life Ins. Co., 104 Cal.App.4th 508, 128 Cal.Rptr.2d 463, 469 (2002) ("[V]irtually any state, federal, or local law can serve as the predicate for" a Section 17200 claim) (emphasis added). Section 17200 "establishes [and creates a private right of action to remedy] three varieties of unfair competition": the unlawful, the unfair, and the fraudulent. Id. (internal quotation marks omitted). Plaintiffs' claim is "based on" the allegedly unlawful and unfair conduct of Smart in violating HIPAA. Charging higher fees to lawyers thus must violate a law — here, the HIPAA regulations—in order for Plaintiffs to state a claim for relief under Section 17200's "unlawful" prong.
Similarly, if we determine that the agency responsible for implementing HIPAA intended to permit Smart's conduct, it cannot be "unfair" under Section 17200. The California Supreme Court has held that if the allegedly unfair conduct is that which "the Legislature has permitted . . . or considered
In some cases, federal jurisdictional requirements may preclude federal courts from entertaining a state law claim based on a violation of a federal statute.
This jurisdictional concern is not present here. Had Smart removed this case to federal court on the basis of federal question jurisdiction under § 1331, the lack of a private right of action to enforce HIPAA may have foreclosed Plaintiffs' Section 17200 claim. However, Smart invoked diversity jurisdiction pursuant to 28 U.S.C. § 1332(d) to justify the removal. See 28 U.S.C. § 1453; cf. Lockyer v. Dynegy, Inc., 375 F.3d 831, 841-42 (9th Cir.2004) (holding that removal was appropriate, and that the Merrell Dow/Utley rule did not apply where jurisdiction was not "predicated solely on 28 U.S.C. § 1331"); Ethridge v. Harbor House Restaurant, 861 F.2d 1389, 1393-94 & n. 4 (9th Cir.1988) (noting that the Merrell Dow/Utley rule does not apply to cases removed on the basis of diversity jurisdiction). Having satisfied ourselves that we have jurisdiction, therefore, in accordance with California substantive law, we must analyze the federal regulations that will decide whether Plaintiffs have stated a claim for relief.
HIPAA aims "to improve the . . . efficiency and effectiveness of the health information system through the establishment of standards and requirements for the electronic transmission of certain health information." HIPAA § 261,
In implementing this Congressional directive, DHHS has determined that, except in limited circumstances, "an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set." 45 C.F.R. § 164.524(a)(1) (emphasis added). Upon an "individual['s] request[ ]" to inspect or obtain his records,
Id. § 164.524(c)(4) (emphasis added). The question raised by this case is whether designated agents, such as personal attorneys, can count as the "individual" in order to obtain the reasonable, cost-based fee.
"As a general interpretive principle, the plain meaning of a regulation governs." Safe Air for Everyone v. U.S. Envtl. Prot. Agency, 488 F.3d 1088, 1097 (9th Cir.2007) (internal quotation marks omitted). DHHS defined "individual" as "the person who is the subject of the protected health information." 45 C.F.R. § 160.103. On their face then, the regulations restrict the fee limitations to requests made by the individual and concretely define "individual" in a way that excludes others acting on that individual's behalf. Plain meaning thus favors Smart.
The canon of statutory construction expressio unius est exclusio alterius, which "creates a presumption that when a statute designates certain persons, things, or manners of operation, all omissions should be understood as exclusions," Silvers v. Sony Pictures Entm't, Inc., 402 F.3d 881, 885 (9th Cir.2005) (en banc) (internal quotation marks omitted), further supports Smart's argument. DHHS has provided for one situation in which other persons may be "treat[ed] . . . as the individual"—when a "personal representative" is authorized to make healthcare-related decisions for an individual:
45 C.F.R. § 164.502(g). Application of this canon suggests that because DHHS explicitly defined "individual" to encompass "personal representatives," it was fully capable of writing in an even broader definition of the term. That it did not underscores the conclusion that "individual" should be afforded its plain meaning, and that we should therefore reject Mann & Cook's claim to the lower rate.
Notwithstanding that plain meaning, Plaintiffs urge us to read the term "individual" to include authorized attorneys because such an interpretation would be more consistent with the purpose of HIPAA. Plain meaning is not the end of the inquiry. "The plain language of a regulation . . . will not control if clearly expressed administrative intent is to the contrary or if such plain meaning would lead to absurd results." Safe Air, 488 F.3d at 1097 (internal quotation marks and alterations omitted). We invoke this exception to the plain meaning canon, however, only when "some indication of the regulatory intent that overcomes plain language . . . [is] referenced in the published notices that accompanied the rulemaking process." Id. at 1098. Without this safeguard, "interested parties would not have the [requisite] meaningful opportunity to comment on proposed regulations." Id.
We are not persuaded that regulatory intent overcomes plain meaning in this case. Plaintiffs have not directed us to any part of the original notice of proposed rulemaking ("proposed rules"),
On the contrary, a review of relevant regulatory history makes clear that DHHS did not intend for private attorneys to receive the reduced fees. Most notably, in the proposed rules, DHHS explicitly considered adopting a broader definition of "individual" that would have included legal representatives, but in the final rule ultimately decided against it. As explained in the final commentary, DHHS had previously
65 Fed.Reg. 82492. However, "[i]n the final rule, [DHHS] eliminate[d] from the definition of `individual' the provisions designating a legal representative as the `individual.'" Id. The agency chose "[i]nstead" to "include in the final rule a separate
Because of this regulatory history, even if we believed the meaning of "individual" was ambiguous on its face, we would be compelled to agree with Smart. An "agency's interpretation [of a regulation] must be given controlling weight unless it is plainly erroneous or inconsistent with the regulation." Thomas Jefferson Univ. v. Shalala, 512 U.S. 504, 512, 114 S.Ct. 2381, 129 L.Ed.2d 405 (1994) (internal quotation marks omitted). Plaintiffs argue with some force that the regulations implementing HIPAA are designed in general to allow individuals access to their own records at a limited cost, see 45 C.F.R. § 164.524, and that interpreting "individual" in a way that denies the reduced rate to authorized agents decreases accessibility to critical personal information. However, because privacy and efficiency of processing are also important statutory and regulatory goals, we cannot say that DHHS's interpretation—which allows for the imposition of higher costs on anyone other than the individual or personal representative, and provides for the development of an efficient document copying system in part by allowing document companies to make a profit—is "plainly erroneous or inconsistent" with those aims.
Plaintiffs also urge that neither the final commentary nor the subsequent clarification, which appear to foreclose Plaintiffs' argument, is directly on point. They argue that the "legal representatives" and "attorneys" to which the regulatory materials refer do not necessarily include "attorneys at law for individuals"; the final commentary and subsequent clarification, according to Plaintiffs, address only "true third party situations [such as attorneys for insurers], not situations where a `legal representative' is acting `to exercise the person's rights' in a `context' where the `applicable law permits' them to so act." This argument is not convincing. The DHHS final commentary and subsequent clarification clearly preclude both third party attorneys and private legal representatives from obtaining the reduced fees. First, as discussed, the agency considered, but decided against defining "individual" to include legal representatives, instead creating the narrower category of "personal representatives." Second, DHHS stated explicitly that "[t]he fee limitations . . . do not apply to disclosures that are based on an individual's authorization that is valid under [45 C.F.R.] § 164.508." 67 Fed.Reg. 53254.
Plaintiffs' case ultimately distills down to their argument that because Mann & Cook acts as Webb's agent, for HIPAA purposes the lawyer who makes the request is the individual, and thus should be charged the reduced fees for the medical records. They rely on California agency law, which provides that "an attorney, appearing and acting for a party to a cause, has authority to do so, and to do all other acts necessary or incidental to the proper conduct of the case." Clark Equip. Co. v. Wheat, 92 Cal.App.3d 503, 154 Cal.Rptr. 874, 884 (1979). They cite California state law because the HIPAA savings clause provides that its "regulation[s] . . . shall not supercede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent" than HIPAA's. 42 U.S.C. § 1320d-2 note. "More stringent" laws are defined, inter alia, as those that "permit[ ] greater rights of access" for the "individual, who is the subject of the individually identifiable health information."
In fact, however, California law does not support Plaintiffs' claim. In the only case—federal or state—to address directly a claim based on the HIPAA fee limitation at issue in this case, the California Court of Appeal analyzed the same agency argument, advanced by the same law firm — Mann & Cook — on behalf of a different client, and rejected it:
Bugarin v. Chartone, 135 Cal.App.4th 1558, 38 Cal.Rptr.3d 505, 510 (2006). We must defer to the California court's interpretation of its own agency law as not granting the rights Plaintiffs assert.
Bugarin, 38 Cal.Rptr.3d at 509. It is possible to reconcile this seeming conflict; privacy concerns increase when anyone other than the individual requests medical records, and because privacy is a primary HIPAA goal, it makes sense to make it more difficult for third parties to obtain records, even with authorization. Still, it is "circuitous," if not downright silly, to require an individual "to request his own medical records . . . and having received them, hand them to his lawyer." Id. at 510.
We therefore echo the concurrence in Bugarin by emphasizing that in affirming the district court's judgment, we only
Id. at 511 (Rubin, J., concurring). In the end, then, we may not be "free to deviate from the text" of the HIPAA regulations, id. at 509, but we may nonetheless recognize that there is ample room for attorneys to provide important services for their clients.
45 C.F.R. § 164.508(c).