Opinion
CIVIL NO. 2002-0107.
June 5, 2009
MEMORANDUM OPINION
THIS MATTER comes before the Court on Plaintiff Idona Wallace's Appeal of the Magistrate Judge's Order Granting Defendant's Motion to Compel dated February 21, 2008. The Magistrate Judge's Order requires Plaintiff to authorize her health care providers to provide her health information to Defendant Kmart Corporation. The Magistrate Judge has placed restrictive conditions on Kmart's further disclosure of such information only as to any information that pertains to alcohol and drug abuse treatment, mental health, and AIDS or HIV-related condition, diagnosis and treatment.
Plaintiff does not contest the Magistrate Judge's Order to the extent that it requires her to authorize her health care providers to provide her health information to Kmart. Her concern is that the further dissemination of much of her health information is unlimited.
Any release of health information must conform with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub.L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of 29 U.S.C. and 42 U.S.C.). Title 42 U.S.C. § 1320d defines "health information" as "any information, whether oral or recorded in any form or medium, that — (A) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual."
Heath care providers may disclose health information for judicial proceedings in accordance with 45 C.F.R. § 164.512(e). Under § 164.512(e) "a health care provider may
Title 45 C.F.R. § 164.512(e) provides:
(e) Standard: Disclosures for judicial and administrative proceedings.
(1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding:
(i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or
(ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if:
(A) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or
(B) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v) of this section.
(iii) For the purposes of paragraph (e)(1)(ii)(A) of this section, a covered entity receives satisfactory assurances from a party seeking protecting health information if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:
(A) The party requesting such information has made a good faith attempt to provide written notice to the individual (or, if the individual's location is unknown, to mail a notice to the individual's last known address);
(B) The notice included sufficient information about the litigation or proceeding in which the protected health information is requested to permit the individual to raise an objection to the court or administrative tribunal; and
(C) The time for the individual to raise objections to the court or administrative tribunal has elapsed, and:
(1) No objections were filed; or
(2) All objections filed by the individual have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution.
(iv) For the purposes of paragraph (e)(1)(ii)(B) of this section, a covered entity receives satisfactory assurances from a party seeking protected health information, if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:
(A) The parties to the dispute giving rise to the request for information have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute; or
(B) The party seeking the protected health information has requested a qualified protective order from such court or administrative tribunal.
(v) For purposes of paragraph (e)(1) of this section, a qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii) of this section, an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that:
(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and
(B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.
(vi) Nothwithstanding paragraph (e)(1)(ii) of this section, a covered entity may disclose protected health information in response to lawful process described in paragraph (e)(1)(ii) of this section without receiving satisfactory assurance under paragraph (e)(1)(ii)(A) or (B) of this section, if the covered entity makes reasonable efforts to provide notice to the individual sufficient to meet the requirements of paragraph (e)(1)(iii) of this section or to seek a qualified protective order sufficient to meet the requirements of paragraph (e)(1)(iv) of this section.
(2) Other uses and disclosures under this section. The provisions of this paragraph do not supersede other provisions of this section that otherwise permit or restrict uses or disclosures of protected health information.
disclose medical information without violating HIPAA if served with (1) a court order authorizing the disclosure of such information or, alternatively, (2) a formal discovery request accompanied by certain required assurances and notices." Howard v. Rustin, 2007 WL 2811828, at * 2 (W.D. Pa. Sept. 24, 2007) (quotation omitted).
A "qualified protective order" is "an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that: (A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and (B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding." 45 C.F.R. § 164.512(e)(v). As the Court explained in Howard v. Rustin, such a protective order is not mandated under all circumstances:
The Court notes that the regulations do not appear to require a protective order when disclosure is made pursuant to court order under section 164.512(e)(1)(i) as opposed to disclosure pursuant to a subpoena or discovery request under section 164.512(e)(1)(ii), which expressly requires a protective order. See 45 C.F.R. § 164.512(e)(1)(i)-(ii). Nevertheless, "[e]ven if not required by HIPAA, use of a protective order in conjunction with a court order advances the `strong federal policy in favor of protecting the privacy of patient medical records.'" E.E.O.C. v. Boston Market Corp., 2004 WL 3327264, at *4 (E.D.N.Y. Dec. 16, 2004) (quoting Law v. Zuckerman, 307 F. Supp.2d 705, 711 (D. Md. 2004)).Howard, 2007 WL 2811828 at * 3.
Notwithstanding, the court in Howard v, Rustin considered it to be "in keeping with the spirit and purpose of HIPAA" to order the release of health information only in accordance with a qualified protective order. Id. The Court agrees that it would be in keeping with the spirit of purpose of HIPAA to allow the release of health information subject to a protective order "which: (1) prohibits the parties from using or disclosing the protected health information for any purpose other than the instant litigation for which such information was requested; and (2) to the extent that it applies here, requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding." Id.
Accordingly, the Magistrate Judge's Order Granting Defendant's Motion to Compel is MODIFIED so as to include these additional protections for all of Plaintiff's health information.