Roy’s Trial Law “TIPS”—Tip #90
HIPAA No Match for Subpoena:
Debunking the Courthouse Legend
by Roy D. Wasson
Board Certified in Appellate Practice
Fellow of the Academy of Florida Trial Lawyers
It is time to put an end to the courthouse legend that medical records of non-parties are somehow protected from disclosure by the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191, 110 Stat. 1936, more commonly known as AHIPAA.@ Such records are fair game in civil litigation, as noted by the following court:
On appeal, Dr. Mezu emphasizes that her medical records are private and confidential, maintaining that disclosure should have been denied because her privacy concerns outweigh Defendants’ interests in the information. Dr. Mezu correctly notes that the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 42 U.S.C. ” 1320d-1320d-9, provides protections against disclosure of medical records. However, HIPAA also permits release of such records “in response to a subpoena, discovery request, or other lawful process.” 45 C.F.R. ‘ 164.512(e)(1)(ii).
Mezu v. Morgan State Univ., 495 Fed. Appx. 286, 289 (4th Cir 2012)(emphasis added).
The Code of Federal Regulations clearly provides for discovery of medical records of any patient otherwise subject to HIPAA, whether a party to the litigation, a non-party witness, or someone else whose medical condition or treatment is relevant to the proceeding. The exceptions to HIPAA protection for litigation matters are as follows:
(e) Standard: Disclosures for judicial and administrative proceedings.
(1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding:
(i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or
(ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if:
(A) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or
(B) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v) of this section.
Thus, there are two ways to obtain by subpoena or discovery request records that otherwise would be protected by HIPAA. One is to make sure that you serve a copy of the request upon the patient whose records you want. That is easy when the patient is the defendant, but sometimes records of non-parties are helpful, so the non-party patient should be served with notice that the subpoena is being served, to give them an opportunity to seek an order limiting the use of the records.
The other way is by agreeing to a protective order. The simple requirements of such an order are described as follows:
Defendants are correct that HIPAA, to the extent it applies, allows for disclosure of medical records for the purposes of litigation. HIPAA permits disclosure of protected health information in judicial proceedings in response to subpoenas or discovery requests if there is a protective order that both prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation and requires the return or destruction of the protected health information at the end of the litigation or proceeding. 45 C.F.R. ‘ 164.512(e)(1)(ii), (v).
Goldsmith v. Dutton, 2014 U.S. Dist. LEXIS 124552 at *4 (D. Mont. Sept. 5, 2014)(emphasis added).
This TIP should equip you to handle the next defense attorney=s false contention that you cannot obtain discovery of medical records protected by HIPAA. Those defense lawyers will likely try every trick in the book to prevent your rightful discovery of important medical records, but if you do not get them produced at first, this TIP should give you ammunition to: