A new court ruling could hinder the state's transition of the Medicaid home care program that allows elderly and disabled people to hire their own home health aides. 

A state Supreme Court judge in Livingston County on Tuesday issued a temporary restraining order that blocks one company from sending personal data of patients who use the Consumer Directed Personal Assistance Program (CDPAP) to a third party. 

The latest legal challenge alleges the Health Department's directive to obtain confidential patient information and give it to a third-party vendor to solicit services or employment violates federal HIPAA laws, freedom of speech and others.

"It makes sense, there was a lawsuit even two years ago when we tried to downsize it to 100 [companies]," Assembly Aging Committee chair Ron Kim said Wednesday. "We all knew this was going to get litigated and be stalled. I still have doubts how we can downsize to one fiscal intermediary overnight. It's highly problematic. This is not the right way to go and I look forward to working with the governor on the right solution going forward."

The state Health Department has sent several directives to nearly 700 smaller companies, known as fiscal intermediaries (FIs), that have managed payroll for CDPAP for years, and the 280,000 New Yorkers who rely on the home care program.

The Health Department has ordered FIs to send the state consumer data related to the program by Jan. 15 as the agency contacts program users, and their caregivers, about the change.

At least nine lawsuits have been filed challenging the quick transition, which takes effect April 1. 

The Health Department's directive remains in place under Tuesday's ruling and only applies to one fiscal intermediary.

"This is a strictly limited order that only applies to one fiscal intermediary and has no significant impact on the state's broader CDPAP transition, which remains well underway and on track for completion by April 1," a spokesperson with Gov. Kathy Hochul's office said Wednesday. "This limited order is based on invalid claims and the state looks forward to demonstrating that to the court. All personal data is and will always be protected throughout this transition, and we will continue working with all stakeholders to deliver a better, stronger CDPAP for home care users and all New Yorkers."

But the decision sets a precedent that could open the transition up to other legal challenges of companies transferring confidential patient data. 

The department has threatened sanctions against companies that do not comply. 

Various home care providers and health plans wrote a letter to the state Health Department expressing their concerns about the department's directive and the transition.

There's just under 12 weeks to transition about 280,000 New Yorkers who rely on CDPAP to Public Partnerships LLC — the company the state contracted with to be the programs sole fiscal intermediary in efforts to reduce fraud and abuse. The company launched a new hotline this week to register these consumers in their system and make sure there's no interruptions in care by the April 1 deadline.

Likewise, a spokesperson with PPL said the order does not impact the company's work in the transition.

"We are continuing with our transition activities and are supporting consumers and personal assistants through the process," PPL said in a statement. "We hope this is not being communicated as a stop order for the full program transition, which would be misleading and may cause consumers to unnecessarily stop taking action to complete their transition.

"PPL has been a trusted steward of consumer data for more than 25 years. We have always treated, and will continue to treat, personal consumer and personal assistant data with the utmost care, utilizing security and privacy protocols that exceed all applicable state and federal requirements."

CDPAP recipient Julie Farrar, who uses a wheelchair, publicly confronted Hochul about her concerns with the change last month, and was at the Capitol on Wednesday.

"I don't want my personal HIPAA-protected information floating around out there, and I don't know who has it," she told Spectrum News 1. "I don't know what's being done with it, and that's a very legitimate concern to have that the Department of Health doesn't have the right to share that information with PPL. I am very concerned about that."

Many lawmakers say they'll fight the current timeline mandated in the last budget. 

Proposed bipartisan legislation would delay the CDPAP transition, and Democrat and Republicans said they will work with Hochul and legislative leaders this session to find a solution. 

"We need to look at what is reasonable for our state, but what is not reasonable is that we're trying to transition, by April, thousands of our most vulnerable citizens to one for-profit company that does not have a good reputation," said Sen. Pam Helming, a Republican from Canandaigua, who co-sponsors the legislation to delay the change.

"We need to pause," she added. "...Right now, we're jeopardizing the care of the most vulnerable individuals and we're putting thousands and thousands of people out of work."

Assembly Speaker Carl Heastie on Wednesday told reporters the program needs fewer than 700 fiscal intermediaries and blasted for-profit insurance companies for abusing the program, but would not rule out changing the timeline in the upcoming budget fight.

"It's not the CDPAPs that's causing the Medicaid drain, it's the insurance companies who are not managing the money properly, so we should hold them accountable," Kim said.