N.D.Ill.: Hospital owners and doctors had no standing in its bank or patient records

The operator of a small hospital corporation with at most 25 employees had no standing in the bank records of the corporation. Because they might have standing in their own offices doesn’t translate into standing over bank records. As to patient records, HIPAA confidentiality requirements don’t translate into standing to contest search of those records by search warrant. United States v. Novak, 2015 U.S. Dist. LEXIS 499 (N.D. Ill. January 6, 2015), corrected 2015 U.S. Dist. LEXIS 19074 (N.D.Ill. January 6, 2015):

The court in SDI Future Health compared the case to United States v. Gonzalez, Inc., 412 F.3d 1102, 1117 (9th Cir. 2005), in which the owners of “a small-family run business housing only 25 employees at its peak” had “managerial control over its day-to-day operations” and “full access to the building.” Given these facts, the owners had a reasonable expectation of privacy in the entire premises. Id. Unlike the defendants in Gonzalez, however, the defendants in SDI Future Health “at most … managed and worked in the office of a business of which they were, together, controlling shareholders,” one that was “twice the size” of the office in Gonzalez. SDI Future Health, 568 F.3d at 697. Although they “owned and had authority to set policy” at the business, this rationale was “too broad and generalized” to support a finding of Fourth Amendment standing. Id. at 698. The Ninth Circuit remanded the case for further factfinding after fashioning a test from a Tenth Circuit case for determining an expectation of privacy in a search of workplace areas beyond one’s own office:

(1) whether the item seized is personal property or otherwise kept in a private place separate from other work-related material; (2) whether the defendant had custody or immediate control of the item when officers seized it; and (3) whether the defendant took precautions on his own behalf to secure the place searched or things seized from any interference without his authorization.

Id. at 698 (citing United States v. Anderson, 154 F.3d 1225, 1230-32 (10th Cir. 1998)).

Novak argues that SDI Future Health is inapposite, but he does so by creating something of a straw man. He contends the government and SDI Future Health state “that one who owns premises through a corporation cannot, as distinct from the corporation itself, assert Fourth Amendment rights with respect to those premises.” Novak Reply at 4. That is not what the government argues or what SDI Future Health holds. Rather, the case states that it is not sufficient for Fourth Amendment standing “merely to own a business, to work in a building, or to manage an office” and then goes on to establish the test outlined above. SDI Future Health, 568 F.3d at 697.

Novak further contends that Sacred Heart’s size indicates he had an expectation of privacy in all of its contents under SDI Future Health. He says the hospital qualifies as a small business, which means the holding of SDI Future Health finding a lack of standing does not apply to this case. Novak is correct that SDI Future Health excludes from its holding “the case of a small business over which an individual exercises daily management and control,” but the case does not define the term “small business.” Id. at 698. Yet Novak does not persuasively argue that Sacred Heart is a small business as SDI Future Health appears to use that term. He states that the hospital “was small when compared to other hospitals in Chicago and Cook County,” considering that Sacred Heart had 119 beds and the average was 151. Novak Reply at 8. Taken at face value, however, this comparison is meaningless; Novak does not explain why a hospital with thirty-two fewer beds than the average hospital in the area makes that hospital small even by comparison, let alone a “small business.” He further contends Sacred Heart was a small business on the scale of the business discussed in Gonzalez, where the Ninth Circuit held the business owners possessed an expectation of privacy in the business premises. This comparison does not withstand scrutiny. The office searched in Gonzalez “was a small, family-run business housing only 25 employees at its peak.” Gonzalez, 412 F.3d at 1116. Novak does not state how many employees Sacred Heart had; regardless, a functioning hospital with 119 beds cannot reasonably be considered a small business. It is a complicated operation, with multiple layers of staff. Further, unlike this case, the defendants in Gonzalez actually owned the building themselves, although they had leased it to their corporation. Id. at 1109. By contrast, as noted earlier, Novak owned a corporation that owned Sacred Heart’s real property.

Considering the size of Sacred Heart, the hospital does not qualify as the sort of “small business” considered in SDI Future Health, nor does its size alone mean that Novak had a reasonable expectation of privacy in the entirety of its contents. Under the circumstances, the Court considers SDI Future Health persuasive authority that an individual does not have Fourth Amendment standing to challenge a search of a business by virtue of corporate ownership of the business; he must show a more direct connection between himself or his work and the items seized.

The Court also finds parallels to Novak’s case in United States v. Chuang, 897 F.2d 646 (2d Cir. 1990). …

As to patient files:

Dr. Kuchipudi also contends he has standing to challenge the search of Sacred Heart, “including but not limited to files relating to his patients.” Kuchipudi Mot. to Join Novak’s Mot. at 2. He argues he had an expectation of privacy in the files and documents searched because of “custom and practice at Sacred Heart” as well as federal requirements for maintaining the privacy of patient files. Id. The government responds that Sacred [*25] Heart, not Dr. Kuchipudi, owned the items seized, and that his notes on patient charts did not create a privacy interest in the charts, considering the access other employees had to them. The government further contends that federal regulations do not create an expectation of privacy on Dr. Kuchipudi’s part sufficient to confer Fourth Amendment standing.

The regulation Dr. Kuchipudi cites is part of the Health Insurance Portability and Accountability Act (HIPAA). See 45 C.F.R. § 164.530(c). It requires “covered entit[ies]” to “have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.” Id. § 164.530(c)(1). Dr. Kuchipudi contends that in light of this regulation, he expected that “no one would access his patient files without his permission or the permission of another medical professional treating his patients on his behalf.” Kuchipudi Reply at 4. One element missing from Dr. Kuchipudi’s argument is what Sacred Heart did to comply with the regulation, let alone what Dr. Kuchipudi himself did. As noted earlier, a defendant has Fourth Amendment standing to challenge a search if he demonstrates a reasonable expectation of privacy in the area(s) searched or the items seized, an inquiry that encompasses “whether the individual, by his conduct, has exhibited an actual (subjective) expectation of privacy.” Carlisle, 614 F.3d at 756-57 (emphasis added). The Court doubts the HIPAA regulation can do that job for Dr. Kuchipudi.

This entry was posted in Reasonable expectation of privacy, Standing. Bookmark the permalink.

Comments are closed.