Christopher Richard MURRAY, Appellant, v. The STATE of Texas, Appellee, 245 S.W.3d 37

OPINION JAN P. PATTERSON, Justice. Appellant Christopher Richard Murray was found guilty pursuant to a plea agreement to the class B misdemeanor offense of driving while intoxicated. See Tex. Penal Code Ann. § 49.04 (West 2003). Prior to his plea, appellant filed a motion to suppress evidence that the trial court denied. In one point of error, appellant contends the trial court erred in denying the motion to suppress. We overrule appellant’s point of error and affirm the judgment of conviction.

FACTUAL AND PROCEDURAL BACKGROUND Appellant was involved in a single vehicle collision in Travis County on January 28, 2004. An investigating officer at the scene of the collision placed appellant under arrest for DWI. Because appellant suffered injury from the collision, he was taken to a hospital for medical treatment. As part of his treatment, hospital staff drew a sample of appellant’s blood and tested it for, among other things, alcohol content. The test results showed a blood-alcohol content of .252.

While appellant was at the hospital, an officer requested a specimen of appellant’s blood, but appellant refused to provide one. By grand jury subpoena, the State obtained the results of the blood-alcohol test performed by hospital staff and issued a warrant for appellant’s arrest. Prior to trial, appellant filed a motion to suppress the medical records that the State obtained by grand jury subpoena.

Appellant contended that the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) restored an expectation of privacy in his medical records, that HIPAA overruled or preempted contrary state law, and that he had standing to complain that his medical records were obtained illegally. The trial court agreed that appellant had an expectation of privacy in his medical records under HIPAA.

The trial court, however, denied the motion to suppress because the court found that the grand jury subpoena that the State used to obtain appellant’s medical records was proper under the exceptions contained in HIPAA. After the trial court denied the motion to suppress, appellant entered into a plea agreement that preserved his right to appeal. This appeal followed. ANALYSIS In one point of error, appellant urges that the trial court erred in denying his motion to suppress the State’s medical record evidence, particularly the blood-alcohol test results.

Appellant contends that the State obtained the blood-alcohol test results by an unreasonable search under the Fourth Amendment — the grand jury subpoena — and that the test results, therefore, should be suppressed. See U.S. Const, amend. IV. Appellant contends, that by enacting HIPAA, Congress recognized society’s reasonable expectation of privacy in medical records. See Pub.L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended at 42 U.S.C. §§ 1320d to 1320d-8 (2007)); State v.

Hardy, 963 S.W.2d 516, 523 (Tex.Crim.App.1997) (“In determining whether an expectation of privacy is viewed as reasonable by ‘society,’ the proper focus, under the Fourth Amendment, is upon American society as a whole, rather than a particular state or other geographic subdivision.”). Appellant contends that because he had a reasonable expectation of privacy in his medical records, the blood-alcohol test results were protected under the Fourth Amendment.

We review a trial court’s ruling on a motion to suppress evidence under a bifurcated standard of review, giving almost total deference to the trial court’s determination of historical facts and reviewing de novo the court’s application of the law. Carmouche v. State, 10 S.W.3d 323, 327 (Tex.Crim.App.2000). “In considering a trial court’s ruling on a motion to suppress, an appellate court must uphold the trial court’s ruling if it is reasonably supported by the record and is correct under any theory of law applicable to the case.” State v. Steelman, 93 S.W.3d 102, 107 (Tex.Crim.App.2002).

Appellant urges that the court of criminal appeal’s decision in Hardy, that addressed and decided this precise issue unfavorably to appellant, is no longer binding on this Court after HIPAA’s enactment. See Hardy, 963 S.W.2d at 523-27. Appellant contends that HIPAA restores the expectation of privacy in medical records that the court of criminal appeals in Hardy declined to find. See id. at 527.

Appellant draws a distinction with Hardy and courts of appeals’ decisions that have followed Hardy because HIPAA did not apply to those cases — the blood-alcohol test results were obtained before the effective date of HIPAA, generally April 14, 2003. See 45 C.F.R. § 164.534 (2006) (compliance dates for initial implementation of the privacy standards); Ramos v. State, 124 S.W.3d 326, 330, 336-37 (Tex.App.-Ft. Worth 2003, pet. ref'd) (test results obtained in 2002); Tapp v. State, 108 S.W.3d 459, 460-62 (Tex.App.-Houston [14th Dist.] 2003, pet. ref'd) (test results obtained in 2001); Garcia v.

State, 95 S.W.3d 522, 523, 526-27 (Tex.App.-Houston [1st Dist.] 2002, no pet.) (test results obtained in 2000); see also Alvarez v. State, No. 03-01-00532-CR, 2002 WL 463278, 2002 Tex.App. LEXIS 2215, at *5-7 (Tex.App.-Austin 2002, no pet.) (not designated for publication) (test results obtained prior to HIPAA’s enactment). Appellant’s medical records in contrast were subpoenaed after the effective date of HIPAA. Pursuant to HIPAA, the federal Department of Health and Human Services promulgated privacy standards for individual medical information (the “Privacy Rule”).

See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462 (Dec. 28, 2000) (codified as amended at 45 C.F.R. §§ 160 & 164 (2006)). The Privacy Rule applies to health plans, health care clearinghouses, and health care providers who transmit health information in electronic form in connection with transactions covered by the regulations. 45 C.F.R. § 164.104 (2006).

The stated purposes for the regulations include the protection and enhancement of consumers’ rights of access to their health information and the control of the “inappropriate use of that information.” 65 Fed.Reg. at 82,463. The Privacy Rule establishes: ... for the first time, a set of basic national privacy standards and fair information practices that provides all Americans with a basic level of protection and peace of mind that is essential to their full participation in their [health] care.

The rule sets a floor of ground rules for health care providers, health plans, and health care clearinghouses to follow, in order to protect patients and to encourage them to seek needed care. The rule seeks to balance the needs of the individual with the needs of society. Id. at 82,464. A “standard, requirement, or implementation specification” adopted under the Privacy Rule generally preempts contrary state laws. 45 C.F.R. § 160.203 (2006). Appellant urges that because HIPAA and the Privacy Rule recognize a reasonable expectation of privacy in medical records, Hardy is no longer binding on this Court.

The issue before the court of criminal appeals in Hardy, however, was not whether society generally recognized a reasonable expectation of privacy in medical records. 963 S.W.2d at 523-27. The court faced a more specific and narrow issue — the expectation of privacy in blood-alcohol test results obtained after an accident solely for medical purposes.

The court held that a defendant did not have an expectation of privacy in blood-alcohol test results in that situation: We express no opinion concerning whether society recognizes a reasonable expectation of privacy in medical records in general, or whether there are particular situations in which such an expectation might exist.

We note only that, given the authorities discussed, whatever interests society may have in safeguarding the privacy of medical records, they are not sufficiently strong to require protection of blood-alcohol test results from tests taken by hospital personnel solely for medical purposes after a traffic accident. Id. at 527. Further, HIPAA and the Privacy Rule are not inconsistent with Hardy’s limited holding in the context of DWI.

HIPAA and the Privacy Rule do not create an absolute right to the protection of medical records from disclosure without consent, recognizing that a patient’s right to privacy in his medical records must be balanced with the needs of society. See 65 Fed.Reg. at 82,464. An entity covered by the regulations is expressly authorized to disclose health information that is otherwise protected under HIPAA without a patient’s consent in numerous situations, including for law enforcement purposes pursuant to a grand jury subpoena. See 45 C.F.R. § 164.512(f)(l)(ii)(B) (2006).

Accordingly, we cannot conclude that HI-PAA and the Privacy Rule overruled or preempted Hardy. Because we have concluded that Hardy remains binding on this Court, absent contrary guidance or instruction from the court of criminal appeals, we are compelled to follow the existing case law on this precise issue. See Ramos, 124 S.W.3d at 337. Appellant also cites to Ferguson v. City of Charleston, 532 U.S. 67, 78, 121 S.Ct. 1281, 149 L.Ed.2d 205 (2001), to support his position that the grand jury subpoena was an illegal search under the Fourth Amendment.

In Ferguson, the Supreme Court stated: The reasonable expectation of privacy enjoyed by the typical patient undergoing diagnostic tests in a hospital is that the results of those tests will not be shared with non-medical personnel without her consent. Id. At issue in Ferguson was a policy implemented by the police, a state hospital, and local officials to obtain evidence that could be used to prosecute women who bore children that tested positive for drugs at birth. Id. at 69-71, 121 S.Ct. 1281.

Under the policy, the state hospital, in connection with the police, tested urine samples of patients suspected of drug use without their consent or knowledge. Id. at 70-73, 121 S.Ct. 1281. The Supreme Court held that without the patient’s consent, a state hospital’s performance of diagnostic tests to obtain evidence of a patient’s criminal conduct for law enforcement purposes was an unreasonable search. Id. at 84-85, 121 S.Ct. 1281. Appellant does not contend, however, that the hospital performed the blood test on him at the State’s request or for law enforcement purposes.

Unlike in Ferguson, here, it is undisputed that hospital staff obtained appellant’s blood sample for medical treatment. In taking the sample, staff was not acting as an agent of law enforcement. The holding in Ferguson does not support the suppression of appellant’s blood-alcohol test results. Finally, appellant argues that the blood-alcohol test results should have been suppressed under

article 38.23 of the code of criminal procedure because the results were not obtained in compliance with the grand jury subpoena process. See Tex. Code Crim. Proc. Ann. art. 38.23 (West 2005). Having held that appellant did not have a reasonable expectation of privacy with respect to his blood-alcohol test results, appellant does not have standing to complain of any alleged defects in the subpoena process. See Ramos, 124 S.W.3d at 339; Tapp, 108 S.W.3d at 461. CONCLUSION We overrule appellant’s point of error, and we affirm the judgment of conviction. .

The State also subpoenaed appellant’s medical records in August 2004 by means of a subpoena duces tecum. The trial court ruled that this subpoena was not valid, and the August subpoena is not at issue on appeal. . Pub.L. No. 104-191, 110 Stat.1936 (1996) (codified as amended at 42 U.S.C. §§ 1320d to 1320d-8 (2007)). . The trial court agreed with appellant that he had a reasonable expectation of privacy in his blood-alcohol test results under HIPAA, but denied the motion to suppress on other grounds.

We disagree with the trial court’s conclusion concerning appellant's expectation of privacy, but uphold the trial court’s denial of the motion to suppress. See State v. Steel-man, 93 S.W.3d 102, 107 (Tex.Crim.App.2002). The ruling was correct under a “theory of law applicable to the case.” Id. . At least one court of appeals has addressed and rejected a Fourth Amendment expectation of privacy in blood-alcohol test results that were obtained after HIPAA’s effective date. See State v. Cupp, No. 05-05-00537-CR, 2006 WL 1738262, 2006 Tex.App.

LEXIS 5475, at *4 (Tex.App.-Dallas 2006, no pet.) (not designated for publication); see also Jacques v. State, No. 06-05-00244-CR, 2006 WL 3511408, 2006 Tex.App. LEXIS 10430, at *3 (Tex.App.-Texarkana 2006, no pet.) (not designated for publication) (defendant failed to preserve issue). .Congress contemplated that within a year of HIPAA’s enactment, the Secretary of the Department of Health and Human Services would submit detailed recommendations on standards with "respect to the privacy of individually identifiable health information” to Congress. Pub.L. No. 104-191, § 264(a)-(b), 110 Stat. at 2033.

Because Congress did not enact further legislation within three years of HIPAA's enactment, the Secretary promulgated final regulations containing such standards. Id. § 264(c), 110 Stat. at 2033. . The text of the exception for grand jury subpoenas reads: (

f) Standard: Disclosures for law enforcement purposes. A covered entity may disclose protected health information for a law enforcement purpose to a law enforcement official if the conditions in paragraphs (f)(1) through (f)(6) of this

section are met, as applicable....

(1) Permitted disclosures: Pursuant to process and as otherwise required by law. A covered entity may disclose protected health information: ... (ii) In compliance with and as limited by the relevant requirements of: ... (

B) A grand jury subpoena; ... 45 C.F.R. § 164.512(f)(l)(ii)(B) (2006).