Opinion
Case No. 02-B02474, Jointly Administered.
October 25, 2005
MEMORANDUM OF LAW IN SUPPORT OF UNITED STATES' DEPARTMENT OF HEALTH AND HUMAN SERVICES' MOTION FOR A PROTECTIVE ORDER
Kmart Corporation ("Kmart") has requested that the United States Department of Health and Human Services ("HHS") produce documents that supports HHS' claim, no. 37637. The documents responsive to that request contain personal information about Medicare beneficiaries, the disclosure of which may violate the Privacy Act and/or HIPAA Privacy Rule. To prevent such violations, Rule 26(c) authorizes the entry of a protective order. Furthermore, since protecting those privacy interests does not deprive Kmart of any relevant document Kmart's Request to Produce has requested, HHS' motion demonstrates good cause exists for the entry of a protective order.
Background
On July 26, 2002, HHS filed a proof of unsecured claim in Kmart Corporation's (Kmart) case. The claim, number 37637, is an estimate of Kmart's liability arising under the Medicare Secondary Payer provisions, 42 U.S.C. § 1395y(b) et seq., that is owed HHS.
As a result of the continuing examination of Medicare beneficiaries' file, HHS has determined that total debt is $473,466.70, of which $99,589.93 represents pre-petition interest.
The Medicare Secondary Payer (MSP) provide that when a third party has made payment or can reasonably be expected to make payment under a primary plan, including a self-insured plan, then Medicare payment should not be made. 42 U.S.C. § 1395y(b)(2). However, if Medicare has already made payment for such expenses, Medicare is entitled to be reimbursed for these conditional payments if the third party insurer later makes payment with regard to the services. 42 U.S.C. § 1395y(b)(1) and(2) and 42 C.F.R. § 411.24(c).
On March 25, 2005, and in conjunction with Kmart's Nineteenth Omnibus Objection to Claim 37637, Kmart served upon HHS its First Request to the United States of America for Production of Documents ("Request"). HHS objected to certain of Kmart's Requests. In pertinent part, HHS objected to the Request for the production of documents that are protected from disclosure by the Privacy Act ( 5 U.S.C. § 552a, et seq.) and the Health Insurance Portability and Accountability Act Privacy Rule ( 45 C.F.R. Pt. 164, et seq.). Further, in accordance with Rule 33(d), Fed. Rules Civ. Proc., HHS provided Kmart with a Document Production Index and Privilege Log.
Accompanying its objection, HHS forwarded a proposed a protective order, substantially similar to the one attached. The protective order provides Kmart with the discoverable information the Request seeks while providing the Medicare beneficiaries with the privacy that those third parties are entitled to expect from federal law. Kmart has never complained that a protective order will deprive it of relevant information. Indeed, Kmart expressed its willingness to agree to a protective order. However, Kmart conditioned its agreement upon HHS waiving its discovery or accepting whatever Kmart produced. Clearly, HHS' waiver of discovery or blind acceptance of what Kmart produces is clearly not an interest that Rule 26 is intended to protect, Kmart's actions demonstrate that further good efforts to resolve this discovery dispute are unlikely to be productive.
Argument
I. The Balancing of Interests Under Rule 26.
While Rule 26(b)(1), Fed.R.Civ.P., provides that parties may obtain discovery regarding any matter, not privileged, that is relevant to the claim or defense of any party, Rules 26(b)(2) and 26(c) require that such right of discovery must be balanced against other interests. In Re: Sealed Case (Medical Records), 381 F.3d 1205, 1215 (D.C. Cir. 2004). For example, statutory confidentiality provisions, even if they do not create enforceable privileges, are required to be balanced against Rule 26(b)(1)'s right to obtain discovery. Id. at 1215-1216. Thus, although the Privacy Act, 5 U.S.C. § 552a, does not create a qualified discovery privilege, the fact that a document was subject to the Act was not "irrelevant to the manner in which discovery should proceed." Laxalt v. McClatchy 809 F.2d 885, 889 (D.C. Cir. 1997). In Laxalt, the D.C. Circuit held that "[w]here the actual content of the record has the potential to cause harm to the affected party, a court supervising discovery should consider this factor in determining how to exercise its traditional authority to limit disclosure." Id. at 890.
II. The Confidentiality Interests Preserved by the Privacy Act
The Privacy Act provides that "[n]o agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be . . . [among 12 established exceptions]." 5 U.S.C. § 552a(b). There are 12 exceptions to the no-disclosure-without-consent rule. In this case, two disclosure exceptions are potentially applicable, § 552a(b)(3) (routine uses) and § 552a(b)(11) (order of a court of competent jurisdiction). 1. The Routine Use Exception of the Privacy Act: § 552a(b)(3)
One exception to the non-disclosure provisions of the Privacy Act is through a routine use. Routine use means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected. 5 U.S.C. § 552a(a)(7). Release through a routine use contemplates dissemination of Medicare beneficiaries' private information information to insurance companies, third-party administrators, employers, self-insurers, etc. in the normal course of processing Medicare claims. However, the additional release to attorneys as part of litigation is not included as a routine use. Further, release pursuant to routine use may be made only after the receiving organization agrees to safeguard the confidentiality of data and prevent unauthorized access both as to the carrier and the intermediary. 67 Fed. Reg. 54428, 54431; 67 Fed. Reg. 65983, 65984.
Kmart's Request seeks the release of protected information to the scrutiny by Kmart's counsel and outside, private claims consultants, to whom federal regulations do not authorize routine use access. Moreover, Kmart's Request does not commit it to safeguards of confidentiality of data and prevent unauthorized access, as required by federal regulation. Id. at 54432 and 65985, respectively. Therefore, the routine use exemption is not applicable in this matter.
2. The Order-of-Court Exception of the Privacy Act: § 552a(b)(11)
Another exception to the non-disclosure provisions of the Privacy Act is disclosure pursuant to an order of a court of competent jurisdiction. In the context of litigation, protective orders are the traditional and appropriate means to protect confidential information. ". . . [S]uch traditional devices as protective orders . . . offer reliable means with which to give effect to liberal discovery principles without threatening the interests protected by statutory publication bans . . ." Laxalt v. McClatchy, 809 F.2d 885, 889 (D.C. Cir. 1987). Therefore, HHS's request for an agreed protective order pursuant to the Privacy Act exceptions found at 5 U.S.C. § 552a(b)(11), providing for disclosure pursuant to the order of a court of competent jurisdiction, is proper and complies completely with the overall intent of the law. See generally, Doe v. DiGenova, 779 F.2d 74 (D.C. Cir. 1985); Doe v. Stephens, 851 F.2d 1457 (D.C. Cir. 1988.) A protective order is a proper procedural device for protecting particularly sensitive Privacy Act-protected records when subsection (b)(11) court orders are sought. Laxalt, 809 F.2d. at 889-90.
III. The HIPAA Privacy Rule
Additionally, the requirements imposed by the Health Insurance Portability and Accountability Act Privacy Rule, ("the HIPAA Privacy Rule"), 45 C.F.R. Part 264, provides an another statutory confidentiality provisions that must be taken into consideration under Rule 26's balancing of interests. Under HIPAA Privacy Rule, Medicare may disclose protected health information only after receiving "satisfactory assurance" in the course of a judicial proceeding in response to a discovery request. 45 C.F.R. § 164.512(e)(1)(ii). Although the regulation also allows disclosure of protected information in proceedings `in response to a subpoena, discovery request, or other lawful process' § 164.512(e)(1)(ii), if the party seeking the information either notifies the patient (or at least makes a good faith effort to do so) or makes a `reasonable effort' to secure a qualified protective order, that is, an order that prohibits the use or disclosure of the information outside the litigation and requires the return or destruction of the information at the end of the litigation. 45 C.F.R. § 164.512(e)(1)(v)." Northwestern Memorial Hospital v. Ashcroft, 362 F.3d 923 (7th Cir. 2004). Further, paragraph (e)(1)(ii) disclosures, are further qualified by 45 C.F.R. § 164.512(e)(1)(v)(A) and (B) which require a qualified protective order that prohibit parties from using or disclosing the protected health information ("PHI") for any purpose other than the litigation and further requires either the return of or destruction of the PHI at the conclusion of the proceedings. HHS has included such safeguards in the attached proposed protective order.
IV. The Good Cause for a Protective Order Exists Under Rule 26(c).
In this case, the privacy interests of more than 100 Medicare beneficiaries whose names, addresses, dates of birth, medical diagnoses and Medicare numbers (which in some cases closely align with social security numbers) may become subject to scrutiny by parties never contemplated when the Medicare beneficiaries allowed their medical providers to bill an insurer like the Medicare program. These Medicare beneficiaries should not be subjected to such a broad invasion of their privacy and protected information. While Kmart has a right to examine the basis for HHS's proof of claim, these Medicare beneficiaries have a right to expect that Medicare and Kmart appropriately safeguard this protected information. Thus, the entry of a protective order pursuant to 5 U.S.C. § 552a(b)(11) provides the mechanism for the most consistent and appropriate means of compliance.
An order of a court of competent jurisdiction provides the means within which to frame appropriate safeguards for protecting these Medicare beneficiaries' personal information while at the same time relieving the parties of the need to either notify each beneficiary in writing of the release or redact the records. Written notification of the Medicare beneficiaries is unduly burdensome and the time it would take detracts from the timely resolution of this matter. Redacting the protected information contained in the records destroys the pertinent information necessary to resolve this dispute. Thus, as indicated at the outset, a protective order provides the most consistent and appropriate means for complying with the applicable law and protecting these Medicare beneficiaries' protected information.
The Medicare beneficiaries' protected information provides good cause for the entry of the attached proposed protective order. Moreover, because safeguarding that information does not deprive Kmart of the benefit of its Request, the balance of interests tilts towards entry of the protective order. Indeed, Kmart's condition its support for a protective order upon HHS' willingness to withdraw the government's discovery requests, suggests Kmart concurs with HHS' assessment that cause exists for entry of a protective order.
Conclusion
In consideration of the foregoing, the attached protective order should be entered.