By: Denise McWilliams, Esq. and Richard Juang, Esq.
The majority decision in Federal Aviation Administration et al v Cooper, 566 U.S. ____ (2012) (No 10-1024 ) marks another step forward in the relentless national erosion of privacy protections. In Cooper,the Supreme Court held that, under the Privacy Act of 1974, a cornerstone of federal privacy protections, mental anguish and humiliation for individual plaintiffs were not “actual damages.” Although the outcome was not unpredictable, Justice Alito’s decision is, nonetheless, starkly at odds with the long-standing principle that, fundamentally, the purpose of privacy protections is to prevent and redress “[t]he mental distress from having been exposed to public view.” Without recognition of that basic injury, privacy jurisprudence loses focus and purpose.
The facts of Cooper remind us of how complicated things get when medical information intersects with non-medical interests, cultural realities around stigma, and institutional information-sharing. Stanmore Cooper, a licensed pilot since 1964, was diagnosed with HIV in 1985. At that time, the Federal Aviation Administration would not issue a medical certificate, a prerequisite to obtaining a pilot’s license, for those with HIV. Medical certificates are not cursory, but include information about the applicant’s illnesses, surgeries and medications and are renewable every two to three years depending on age. Rather than apply and be rejected, Cooper let his license lapse, effectively grounding himself.
In 1995, Cooper’s health declined until he was no longer capable of working. Cooper applied for and received Social Security Disability Income (SSDI). Notably, 1995 also saw the first effective treatment for HIV. Cooper then experienced a significant recovery of health, voluntarily requested termination of his SSDI benefits, and returned to work.
In 1998, Cooper, investigating a return to flying, researched the FAA procedures for those with HIV. At that time the FAA still had not established a protocol for applicants with HIV and agency responses to such applicants varied considerably. Cooper simply withheld all information about his HIV status when he applied and, as a result, received his medical certificate. In subsequent renewals, Cooper continued to omit information regarding his HIV illness until his fraud was detected by Operation Safe Pilot in 2005.
Operation Safe Pilot began in 2002 and involved the FAA and the Social Security Administration (SSA) exchanging and comparing their respective records in an attempt to detect fraudulent medical certificates. Going well beyond a simple computer comparison, the exchange, at least in Cooper’s case, included a hard copy of Cooper’s complete disability file. After a review of Cooper’s SSA file, the FAA revoked his medical certificate and indicted him on three counts of making false statements to a government agency. Cooper ultimately pled guilty to one count of making and delivering a false official writing in violation of 18 U.S.C. §1018. He was fined $1,000.00 and sentenced to two years probation. (Cooper’s pilot license had since been reinstated.)
Subsequently, Cooper filed suit against the FAA, SSA, and the Department of Transportation under the Privacy Act. Enacted in the aftermath of the Watergate conspiracy, the Act details the requirements for the management of confidential records held by federal agencies. The Privacy Act requires agencies to establish mechanisms to avoid disclosure of confidential information which “[c]ould result in substantial harm, embarrassment, inconvenience, or unfairnesss to any individual on whom information is maintained.” In essence, federal agencies are permitted to exchange information only with the consent of the individual whose information is being held, or pursuant to a number of exceptions, none of which were relevant in Cooper’s case. The lower courts in Cooper consistently concluded that the agencies had wrongfully disclosed Cooper’s confidential information and had done so “in a manner which was intentional or willful.” Under such circumstances, a wronged individual can recover the “actual damages sustained by the individual.”
Cooper, however, ran into a countervailing legal matter: the question of whether Congress, in waiving sovereign immunity, had also consented to suits alleging only emotional and mental distress, absent clear pecuniary damages. The Supreme Court majority, in ruling against Cooper relied, in large part, on United States v Nordic Village, Inc. 503 U.S. 30 (1991) which held that “plausible” interpretations of a statue are sufficient to defeat a claimed waiver of sovereign immunity. Looking therefore, only to the statutory phrase “actual damages,” Justice Alito analogized the phrase to libel per quod and slander, both of which require “special damages” or actual pecuniary loss, instead of “general damages” which are not necessarily pecuniary in nature. Because of this parallel the Court concluded that the required “unequivocal expression” did not exist. The established and commonsensical principle that the “actual damage” inherent to a privacy violation is mental anguish was, then, defeated by a rigid and arguably unreachable requirement that damages be allowed only when there is an “unequivocal expression” of sovereign consent. In effect, Cooper demoted privacy from a fundamental individual interest to a statutory entitlement, to be conferred or revoked depending on the vagaries of statutory construction and fuzzy legislative compromises.
The Court’s retreat from expansive privacy protections warns us that the traditional tort-based and fundamental rights approaches to privacy are no longer viable ways of protecting people’s confidential information. On the one hand, Cooper signals to holders of personal data that the mental distress and humiliation of public exposure is no longer a protected interest. On the other hand, Cooper further signals to the public that the sole means for individuals to protect their personal information is to refuse to disclose it. The Court’s sharp restriction on individual enforcement of privacy interests suggests that, going forward, withholding personal information may well be the only tool available when interacting with misbehaving federal agencies.
At the same time, withholding information may no longer be an option for most individuals. The health care sector, both in Massachusetts and nationally, are decisively moving toward increasingly integrated database technologies. The main example (indeed the cornerstone) of this is the implementation of portable Electronic Medical Records (EMRs).
EMRs promise more efficient and accurate delivery of medical services. It is widely accepted that successful implementation of EMRs depends on the public’s belief that the information contained therein will be protected from unauthorized disclosures:
“Privacy and security are the bedrock of building trust, a must-have component that is essential to achieving meaningful use and realizing the value of health IT. Patients and providers must feel confident that laws, policies, and processes are in place to keep their health information private and secure, and that they will be enforced when violations occur.”
However, the reality of EMRs is rather more complicated than the ideal of teams of medical professionals seamlessly exchanging information on a common patient. Many diverse parties, completely unrelated to the treatment needs of the person whose information is contained in an EMR, such as insurers, researchers, law enforcement personnel, among many others, want access to that information, preferably without the consent of the individual — indeed, sometimes without alerting that individual. Their interests are as varied as quality assurance, health outcomes and fraud detection to name but a few. The single unifying theme in the promotion of EMRs is that all of these players seek unconsented access to individuals’ health information for some “greater good.”
Nonetheless, it is far from clear what, other than institutional restraint, will prevent or deter the misuse of individual information. Fear of misuse could easily drive people to withhold information, even when health and safety are at stake. Cooper should be read as a warning: we are, increasingly, legally unprepared for the growing conflicts between institutional power and individual privacy needs, which lay at the very heart of institutional changes in health care.
Denise McWilliams is General Counsel of AIDS Action Committee of Massachusetts, Inc., the Commonwealth’s largest AIDS service organization. She is a graduate of Northeastern University Law School.
Richard Juang is Assistant General Counsel of AIDS Action and a graduate of Northeastern University Law School.
 Times, Inc. v. Hill, 385 U.S. 374, 385, n. 9 (1967).
 5 U.S.C. §552a(e)(10).
 5 U.S.C. §552a(g)(4).
 5 U.S.C. §a(g)(4)(A).
 Cooper at 10.
 Federal Health Information Technology Strategic Plan 2011-2015 Goal III Inspire Confidence and Trust in Health IT, p. 29.