Opinion
Civil No. 06-4410-RBK-AMD, [Doc. No. 41].
August 15, 2008
ORDER
This matter comes before the Court by way of motion of Defendant, MedQuist Inc., seeking entry of a qualified protective order under the Health Insurance Portability and Accountability Act of 1996 (hereinafter, "HIPAA"). The Court has considered the parties' submissions, and this matter is decided without oral argument pursuant to FED. R. CIV. P. 78. For the reasons that follow, Defendant's motion for a qualified protective order is granted.
Defendant's motion also initially sought entry of a blanket confidentiality order governing the use and disclosure of its confidential business documents. However, in its reply brief, Defendant advised that it has withdrawn its request for a blanket confidentiality order. (See Rep. Br. in Further Supp. of Mot. of Def. MedQuist Inc. for Protective Order under Health Insurance Portability and Accountability Act 5.) Therefore, the Court shall dismiss without prejudice Defendant's motion to the extent it seeks entry of a blanket confidentiality order.
The facts of this case are set forth in the District Court's Opinion dated August 1, 2007. By way of brief background, Plaintiff Pro Se, Krishna Reddy, instituted this litigation by filing a complaint on September 19, 2006 alleging violations of the Racketeer Influenced and Corrupt Organizations Act, 18 U.S.C. § 1961 et seq., as well as state law claims for breach of contract, fraud, civil conspiracy, interference with an employment contract, and intentional and negligent infliction of emotional distress. Defendant moved to dismiss Plaintiff's complaint or, in the alternative, for a more definite statement. In addition, Plaintiff filed a motion for judgment on the pleadings. By Opinion and Order dated August 1, 2007, the District Court denied Plaintiff's motion for judgment on the pleadings and granted Defendant's motion to dismiss, dismissing all of Plaintiff's claims against Defendant except a claim for breach of contract. (Op. 12-13.) Plaintiff's sole remaining claim against Defendant MedQuist is based, in part, on the allegation that Plaintiff, while employed by Defendant, was underpaid for the transcriptionist work she performed, in that her "line counts" were allegedly "zapped" and that the number of characters composing a line for payroll purposes increased, thereby causing a decrease in Plaintiff's pay by 25% to 50%. (Op. 2; Compl. ¶¶ 22, 23.)
In the present motion, Defendant asserts that it requires a protective order pursuant to HIPAA because it may utilize documents transcribed by Plaintiff while she was employed by Defendant, including medical reports of third parties, in support of its defenses to Plaintiff's breach of contract claim. (Mem. of Law in Supp. of Mot. of Def. MedQuist Inc. for Confidentiality Order and Protective Order under Health Insurance Portability and Accountability Act (hereinafter, "Def. Br.") 2.) Anticipating that the medical records may contain the private health information of third parties, Defendant prepared and sent to Plaintiff a proposed protective order to ensure that such information remains confidential and is used only for purposes of the pending litigation. (Id. 1-2.) Plaintiff, however, has refused to sign the protective order. (Id. 3.) In her brief in opposition to the present motion, Plaintiff asserts that a protective order is unnecessary, because any medical records may be redacted to ensure the privacy of third parties. (Pl.'s Opp. to MedQuist's Mot. for Confidentiality Order and Protective Order (hereinafter, "Pl. Br.") 5, 6.) Plaintiff suggests that lower-case characters could be replaced with a lower-case "x," upper-case characters with an upper-case "X," and a "0" for any digits that must be redacted. (Id. 6.) Defendant objects to redaction of the medical records on two grounds. Defendant first contends that the provision of HIPAA relating to disclosure of confidential health information in judicial proceedings, 45 C.F.R. § 164.512(e), does not provide for disclosure of redacted protected health information. (Rep. Br. in Further Supp. of Mot. of Def. MedQuist Inc. for Protective Order under Health Insurance Portability and Accountability Act (hereinafter, "Def. Reply Br.") 1.) Defendant also contends that redaction of the medical records would be onerous and would preclude Defendant's ability to count the characters transcribed by Plaintiff to determine whether Plaintiff was correctly paid. (Id. 4.)
HIPAA and the rules promulgated pursuant thereto impose rules and procedures on health care providers regarding the disclosure of health information. See, e.g., 42 U.S.C. § 1320d-2(d); 45 C.F.R. § 164.500 et seq.. Generally, covered entities cannot disclose protected health information. 45 C.F.R. § 164.502(a). However, in judicial proceedings, a covered entity may disclose information without patient consent "[i]n response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order[.]" 45 C.F.R. § 164.512(e)(1)(I). Alternatively, a covered entity may disclose health information without patient consent in response to a "subpoena, discovery request, or other lawful process," provided that the party seeking the information makes "reasonable efforts" to notify the patient that his protected health information has been requested, or makes "reasonable efforts" to secure a "qualified protective order." 45 C.F.R. § 164.512(e)(1)(ii). A "qualified protective order" under HIPAA is an order "that prohibits the use or disclosure of the information outside the litigation and requires the return or destruction of the information at the end of the litigation." Northwestern Mem'l Hosp. v. Ashcroft, 362 F.3d 923, 925 (7th Cir. 2004) (citing 45 C.F.R. § 164.512(e)(1)(v)).
The Court notes that HIPAA applies only to those entities included in the statute's definition of a "health plan," a "health care clearinghouse," or a "health care provider," and only such information as is included in its definition of "health information." See 45 C.F.R. § 160.103. The parties do not assert in their briefs whether Defendant is a "covered entity" as defined by HIPAA. The proposed protective order states that "[w]ithout regard to whether any party to this action is a 'covered entity' under 45 C.F.R. § 160.102, the parties believe that discovery and document production in this action will likely involve Protected Health Information as defined by the Health Insurance Portability and Accountability Act ('HIPAA'), Pub.L. No. 104-191, 110 Stat. 1936 (1996), and/or the regulations promulgated under it, including but not limited to 45 C.F.R. § 160.103 ('Protected Health Information')." (Proposed Protective Order ¶ 1.) In her sur-reply, Plaintiff asserts that Defendant may not be permitted to maintain those records it transcribed without consent of the hospitals that ordered the transcription services. (Pl.'s Response to MedQuist's Reply in Opp. to MedQuist's Mot. for Protective Order (hereinafter, "Pl. Sur-Reply Br.") 2.) Defendant has not responded to Plaintiff's assertion. The Court does not address in the context of this motion whether Defendant may maintain or disclose medical records it transcribed for hospital clients without hospital client consent. Rather, this motion, and the requested relief, addresses the manner by which any documents containing protected health information shall be disclosed in this litigation. See Howard v. Rustin, No. Civ. A. 06-200, 2007 WL 2811828, at *3 (W.D. Pa. Sept. 24, 2007) (without deciding whether Defendant is "covered entity" under HIPAA, court stated that "in keeping with the spirit and purpose of HIPAA, the Court orders that the . . . information is subject to a qualified protective order. . . . '[E]ven if not required by HIPAA use of a protective order in conjunction with a court order advances the 'strong federal policy in favor of protecting the privacy of patient medical records.''") (quoting E.E.O.C. v. Boston Market Corp., No. Civ. A. 03-4227, 2004 WL 3327264, at *4 (E.D.N.Y. Dec. 16, 2004)). Entry of a protective order is also appropriate under FED. R. CIV. P. 26(c) to "prevent the dissemination to third parties of . . . medical information of nonparties." Williams v. Art Inst. of Atlanta, No. 1:06-CV-0285, 2006 WL 3694649, at *16 (N.D. Ga. Sept. 1, 2006).
Protected health information is defined as "individually identifiable health information" that, with certain exceptions not pertinent here, is "[t]ransmitted by electronic media," "[m]aintained in electronic media," or "[t]ransmitted or maintained in any other form or medium." 45 C.F.R. § 160.103.
The notice to the patient must contain "sufficient information about the litigation or proceeding in which the protected health information is requested to permit the individual to raise an objection to the court[.]" 45 C.F.R. § 164.512(e)(1)(iii)(B).
In light of the provisions in 45 C.F.R. § 164.512(e)(1), the Court rejects Plaintiff's assertion that the motion for a protective order "should be denied in its entirety" because Defendant must obtain patient consent before disclosing protected health information. (Pl.'s Sur-Reply Br. 1, 6.)
The proposed qualified protective order submitted by Defendant in this case satisfies the criteria of both 45 C.F.R. § 164.512(e)(1)(v)(A) and (B). As to the requirement of Paragraph 164.512(e)(1)(v)(A) that the protective order must "[p]rohibit the parties from using or disclosing the protected health information for any purpose other than the litigation," Paragraph 5 of Defendant's proposed protective order states that "[a]ny material containing Protected Health Information, shall be used solely for the purpose of the proceedings in this Litigation, and any hearings or appeals in this action." As to the requirement of Paragraph 164.512(e)(1)(v)(B) that the protective order must "[r]equire the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation," Paragraph 13 of the proposed protective order states that "[w]ithin sixty (60) days after the final conclusion of all proceedings in this matter by final judgment not subject to appeal or by settlement, all Material constituting or containing Protected Health Information, and copies thereof, shall be returned to counsel for the Producing Person or such Material shall be certified to have been destroyed." Because Defendant's protective order complies with HIPAA, the Court shall enter a protective order in the form submitted with this motion with certain modifications as noted in the order.
The Court notes Plaintiff's argument that a protective order is unnecessary because any concern for the potential disclosure of non-parties' protected health information may be addressed by redacting all "individually identifiable health information" from the medical records produced. (Pl. Br. 5-6.) Defendant, however, asserts that redaction of all medical records to be produced in discovery will impose an "unnecessary and onerous" burden on Defendant. (Def. Reply Br. 4.) To sufficiently redact a health record to remove "individually identifiable health information" under HIPAA, all of the following specific identifiers must be removed:
(A) Names;
(B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:
(1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and
(2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.
(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
(D) Telephone numbers;
(E) Fax numbers;
(F) Electronic mail addresses;
(G) Social security numbers;
(H) Medical record numbers;
(I) Health plan beneficiary numbers;
(J) Account numbers;
(K) Certificate/license numbers;
(L) Vehicle identifiers and serial numbers, including license plate numbers;
(M) Device identifiers and serial numbers;
(N) Web Universal Resource Locators (URLs);
(O) Internet Protocol (IP) address numbers;
(P) Biometric identifiers, including finger and voice prints;
(Q) Full face photographic images and any comparable images; and
® Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section[.]45 C.F.R. § 164.514(b)(2)(I). The Court finds no reason to impose upon Defendant the substantial burden of redacting all of the foregoing information from each medical record prior to production in discovery, particularly when HIPAA provides alternative, less onerous mechanisms for production of medical records for use in judicial proceedings, such as entry of a qualified protective order. Therefore, the Court rejects Plaintiff's argument that the Court should require Defendant to produce in discovery the medical records in redacted form rather than enter a protective order.
Plaintiff argues in her sur-reply that Defendant's position in its reply brief, in which Defendant objects to redaction of protected health information, is inconsistent with its proposed protective order, which provides for redaction of protected health information filed with the Court. (Pl.'s Response to MedQuist's Reply in Opp. to MedQuist's Mot. for Protective Order (hereinafter, "Pl. Sur-Reply Br.") 1.) As to this issue, the Court notes that although "there is a presumptive right of public access to pretrial motions of a nondiscovery nature, whether preliminary or dispositive, and the material filed in connection therewith," Leucadia v. Applied Extrusion Tech., Inc., 998 F.2d 157, 164 (3d Cir. 1993); see also In re Gabapentin Litig., 312 F. Supp. 2d 653, 663 (D.N.J. 2004); Republic of the Phillippines v. Westinghouse Elec. Corp., 139 F.R.D. 50, 58 (D.N.J. 1991), with respect to discovery motions and their supporting documents, there is no such presumptive right of public access. See Leucadia, 998 F.2d at 165. Moreover, discovery is "ordinarily conducted in private" and "stands on a different footing than does a motion filed by a party seeking action by the Court." Id. at 163 n. 9, 164 (quotingBank of America Nat'l Trust Savings Ass'n v. Hotel Rittenhouse Assocs., 800 F.2d 339, 343 (3d Cir. 1986)). The Court will not address in the context of this motion the redaction or filing under seal of documents filed with the Court. If a party seeks to "seal, or otherwise restrict public access to, any materials filed with the Court or utilized in connection with judicial decision-making," the party shall comply with Rule 5.3 of the Local Civil Rules of the District of New Jersey and redact, if appropriate, protected health information. L. CIV. R. 5.3(a). The parties should also comply with the redaction requirements set forth in FED. R. CIV. P. 5.2.
The Court also notes that even where there is a right of access to judicial records, it is not absolute. See Leucadia, 998 F.2d at 166; In re Gabapentin, 312 F. Supp. 2d at 663-64. The presumption of public access "does not trump all other interests and may be limited where there are important overriding interests." In re Gabapentin, 312 F. Supp. 2d at 664. "The presumption of access is subject to a balancing of factors that militate against access. . . ." Id. The party seeking to overcome the presumption of access bears the burden of demonstrating its need to keep the materials under seal. See id. This burden must be met separately with respect to "each and every document" sought to be sealed. See Pansy v. Borough of Stroudsburg, 23 F.3d 772, 786-87 (3d Cir. 1994) (citing Cippollone v. Liggett Group, Inc., 785 F.2d 1108, 1121 (3d Cir. 1986), cert. denied, 484 U.S. 976 (1987)).
Plaintiff also asserts in her sur-reply that because Defendant objects to redaction of the medical records, the "more stringent" clause in HIPAA applies, and Defendant must therefore obtain the permission of all non-parties whose protected health information may be disclosed in this case. (Pl. Sur-Reply Br. 4.) Plaintiff's reading of the "more stringent" clause in HIPAA is erroneous. HIPAA contains a preemption provision that the statute and the regulations promulgated thereunder should supersede "any contrary provision of State law" except as provided in 42 U.S.C. § 1320d-7(a)(2). See 42 U.S.C. § 1320d-7(a)(1). An exception to this provision is that HIPAA does not preempt or supersede state law if the state law relates to the privacy of "individually identifiable health information" and is "more stringent" than HIPAA's requirements. See 45 C.F.R. § 160.203(b). Plaintiff does not argue that state law is "more stringent" than HIPAA and should control here; therefore, the "more stringent" clause is inapplicable to the present motion. Likewise, Plaintiff's reference to the "crime-fraud" exception (see Pl. Sur-Reply Br. 7) is unavailing, as that exception applies to disclosure of attorney-client privileged information. See United States v. Doe, 429 F.3d 450, 454 (3d Cir. 2005).
The Court now turns to the request in Plaintiff's opposition brief that the Court "reconsider" the protective and sealing orders entered "in other cases" against MedQuist. (Pl. Br. 1, 9.) More specifically, Plaintiff asks the Court to "consider unsealing all of the documents filed in all the cases against MEDQUIST that were filed in this court." (Id. 9.) Plaintiff, however, has not filed a motion to intervene in the other action(s) pursuant to FED. R. CIV. P. 24(b) for the limited purpose of seeking modification of the protective or sealing order(s). See Pansy v. Borough of Stroudsburg, 23 F.3d 772, 780 (3d Cir. 1994) (holding that "'a district court may properly consider a motion to intervene permissively for the limited purpose of modifying [or vacating] a [confidentiality] order even after the underlying dispute between the parties has long been settled.'") (quoting Leucadia, 998 F.2d at 161 n. 5); see also Foltz v. State Farm Mut. Auto. Ins. Co., 331 F.3d 1122, 1132 (9th Cir. 2003) ("collateral litigant" requesting modification of protective order entered in main action "must demonstrate the relevance of the protected discovery to the collateral proceedings and its general discoverability therein. . . . The court that issued the [protective] order is in the best position to make the relevance assessment for it presumably is the only court familiar with the contents of the protected discovery."). Therefore, Plaintiff's request for a modification of the protective and sealing order(s) entered in other cases involving Defendant is denied without prejudice.
Defendant, in its reply brief, cites to the case filed in this District captioned Myers, et al. v. MedQuist Inc. and MedQuist Transcriptions Ltd., Civil No. 05-4608, and states that Defendant did not file any documents under seal in that case, thereby mooting Plaintiff's request here. (Def. Reply Br. 5.) Plaintiff's request is not moot, because she is not seeking to unseal only documents filed under seal by Defendant in the Myers case, but is seeking to unseal all documents filed under seal by any party in any case against Defendant in this District.
Plaintiff's request is also denied on the ground that it is not a properly filed cross-motion. Rule 7.1(h) of the Local Civil Rules for the District of New Jersey provides that a party may file a cross-motion "related to the subject matter of the original motion[.]" L. CIV. R. 7.1(h). Not only has Plaintiff failed to file a formal notice of cross-motion in accordance with the Local Rules, but the relief sought is not related to the subject matter of Defendant's motion.
CONSEQUENTLY, for the reasons set forth above and good cause shown,
IT IS on this 15th day of August 2008,
ORDERED that Defendant's motion for the entry of a protective order shall be, and is hereby, GRANTED ; and it is further
ORDERED that Defendant's motion for a blanket confidentiality order shall be, and is hereby, DISMISSED WITHOUT PREJUDICE ; and it is further
ORDERED that a protective order in the form submitted with Defendant's motion shall be entered herewith, with the provision regarding destruction of records having been removed; and it is further
ORDERED that Plaintiff's informal request that the Court vacate or modify the protective and sealing orders entered in all cases involving Defendant MedQuist Inc. shall be, and is hereby, DENIED WITHOUT PREJUDICE .