Moreland v. Austin

Thompson, Justice. We granted a writ of certiorari to the Court of Appeals in Austin v. Moreland, 288 Ga. App. 270 (653 SE2d 347) (2007), to determine whether, in a medical malpractice case, the Privacy Rule of the Health Insurance Portability and Accountability Act (“HIPAA”) precludes defendant’s attorneys from informally interviewing plaintiffs prior treating physicians. The short answer is “yes.” Following the death of her husband, Jimmy Lee Moreland, plaintiff Amanda Moreland brought this malpractice action against Dr. Michael Austin in the State Court of Bibb County. Plaintiff produced her husband’s medical records, including documents pertaining to his treatment by Dr. Jose Rodriguez, Dr. Juan Esnard, and Dr. Edward Young. Each of these physicians treated Mr. Moreland before defendant treated him. Thereafter, defense counsel contacted each of the physicians and asked them to assess Mr. Moreland’s “cardiovascular status and his prognosis.” Plaintiff objected to these “ex parte” contacts, asserting they violated HIPAA. When the trial court disagreed, plaintiff dismissed her complaint and refiled in the Superior Court of Bibb County. In that forum, in addition to her medical malpractice claims, plaintiff sought injunctive relief to prevent defendant from “inducing any healthcare provider to divulge protected health information concerning [Mr.] Moreland” except in compliance with HIPAA. The trial court granted injunctive relief, ruling that defendant could interview Mr. Moreland’s prior treating physicians, but only after giving plaintiff notice to enable her attorneys to be present during the interviews. Defendant appealed and the Court of Appeals reversed and remanded, holding that as long as a physician discloses protected health information in compliance with HIPAA and Georgia law, defense counsel can continue to communicate with the physician in an ex parte fashion. Austin v. Moreland, supra at 275. The Court of Appeals remanded to the superior court, however, to determine whether plaintiff consented to the disclosure of Mr. Moreland’s protected health information prior to April 14, 2003 (the effective date of the HIPAA privacy provisions), in which case the physicians can be contacted and interviewed by defendant without restriction; or whether the physicians possess any protected health information that has not been disclosed already, in which case “the trial court may issue an order restricting the ability of the prior treating physicians to disclose such information to [defendant] except in accordance with the HIPAA privacy rule and the Georgia Civil Practice Act.” Id. at 275-276. *731 HIPAA With the advent of digital technology and digital record keeping came the fear that electronically maintained medical records could be disseminated without the consent of patients. Congress responded to that fear by enacting HIPAA. The act authorized the Secretary of the Department of Health and Human Services to promulgate rules and regulations which would ensure the privacy of patients’ medical information. 42 USCA § 1320d-2 (d) (2) (A). The Secretary used his authority to prohibit healthcare providers from disclosing protected health information, whether “oral or recorded in any form or medium,” 1 unless the providers comply with the Secretary’s rules and regulations. One of the regulations authorizing disclosure provides that a “covered entity may disclose protected health information in the course of any judicial. . . proceeding” either in response to an order of a court or in response to a subpoena, a request for discovery, “or other lawrful process.” 2 Of course, the information can be disclosed without a court order, if the patient signs a valid authorization. 3 In the absence of a patient’s consent, a healthcare provider cannot disclose protected health information unless it receives “satisfactory assurance . . . that reasonable efforts have been made [either] (A).. . to ensure that the individual who is the subject of the [requested] protected health information . . . has been given notice of the request” and an opportunity to object or “(B) ... to secure a qualified protective order” prohibiting the litigants from disclosing the information outside of the proceeding and requiring the destruction or return of the information following the termination of the proceeding. 4 Once these steps are taken, a healthcare provider can choose 5 to disclose the protected health information; but it must take *732 reasonable steps to ensure that it only discloses the “minimum necessary” to accomplish the intended purpose of the disclosure. 8 The Opinion of the Court of Appeals The Court of Appeals ruled that “HIPAA does not preclude ex parte communications between defense counsel and a plaintiffs prior treating physicians.” Austin v. Moreland, supra at 275. It reasoned that “in the context of a judicial proceeding, the Georgia Civil Practice Act places more stringent requirements than HIPAA does on requests for documents from a third-party health care provider” and that, therefore, “OCGA § 9-11-34 (c) is not preempted by HIPAA.” Id. at 274. This analysis misses the mark. We are not concerned here with the disclosure of protected health information pursuant to a request for production of documents. Rather, the question centers on whether, after Mr. Moreland’s medical records were requested and produced pursuant to discovery, defense counsel could then engage in ex parte communications with Mr. Moreland’s treating physicians. That is because the proper focus of this case is on the methods used to discover evidence of plaintiffs medical condition; it is not on the “discoverability” of that evidence. Waiver of Right to Privacy in Medical Records Under Georgia Law Georgia law is clear that a plaintiff waives his right to privacy with regard to medical records that are relevant to a medical condition the plaintiff placed in issue in a civil or criminal proceeding. OCGA § 24-9-40 (a); Orr v. Sievert, 162 Ga. App. 677 (292 SE2d 548) (1982). Therefore, under Georgia law, once a plaintiff puts his medical condition in issue, defendant can seek plaintiffs protected health information by formal discovery, or informally, by communicating orally with a plaintiffs physicians. 6 7 The question then is whether ex parte communications between defense counsel and plaintiffs physicians violate the HIPAA privacy rule. They do if HIPAA preempts state law in this area. HIPAA Preempts Georgia Law This Court recently held: *733 HIPAA and the related provisions established in the Code of Federal Regulations expressly supercede any contrary provisions of State law except as provided in 42 U.S.C. § 1320d-7 (a) (2). Under the relevant exception, HIPAA and its standards do not preempt state law if the state law relates to the privacy of individually identifiable health information and is “more stringent” than HIPAA’s requirements. “More stringent” means laws that afford patients more control over their medical records. (Citations, punctuation and emphasis omitted.) Allen v. Wright, supra at 12. After reviewing HIPAA, Georgia law, and the case law of other jurisdictions, we find that HIPAA preempts Georgia law with regard to ex parte communications between defense counsel and plaintiffs prior treating physicians because HIPAA affords patients more control over their medical records when it comes to informal contacts between litigants and physicians. Under Georgia law, once a patient files suit and puts his medical condition in issue, his treating physicians can then disclose his medical records and defendant’s lawyer can informally contact those physicians and orally communicate with them about plaintiffs medical condition. HIPAA, on the other hand, prevents a medical provider from disseminating a patient’s medical information in litigation, whether orally or in writing, without obtaining a court order or the patient’s express consent, or fulfilling certain other procedural requirements designed to safeguard against improper use of the information. See 45 CFR § 164.512 (e). In other words, HIPAA requires a physician to protect a patient’s health information, unless the patient is given reasonable notice and an opportunity to object. Georgia law stands in sharp contrast: it facilitates and streamlines the litigation process; it was not designed to protect a patient’s private health information in the course of oral communications between the patient’s physicians and defense counsel. It follows that HIPAA is more stringent and that it governs ex parte communications between defense counsel and healthcare providers. Allen v. Wright, supra. This is not to say that all oral communications between defense counsel and a plaintiffs prior treating physicians are forbidden. Certainly, counsel can contact a physician and make inquiries which are not intended to elicit protected health information. Such contact could include discussion of many benign topics, including but not limited to, the best methods for service of a subpoena, determining convenient dates to provide trial testimony, or the most convenient location for *734 the anticipated deposition of the physician. However, HIPAA clearly regulates the methods by which a physician may release a patient’s health information, including “oral” medical records. Law v. Zuckerman, 307 FSupp.2d 705, 708 (D. Md. 2004). See also Bayne v. Provost, 359 FSupp.2d 234 (N.D. N.Y. 2005) (ex parte contacts with medical provider are permissible if HIPAA requirements are satisfied). These methods include a subpoena, discovery request or other lawful process with assurances pertaining to notification or a protective order. 45 CFR § 164.512 (e) (1). See Arons, supra at 415 (privacy rule does not prohibit informal discovery, “it merely superimposes procedural prerequisites”). See also McCloud v. Bd. of Directors of Geary Community Hosp., Case No. 06-1002-MLB (D. Kan. 2006) (defendants complied with HIPAA by seeking court order permitting production of medical records and ex parte contact with treating physicians); Holmes v. Nightingale, 158 P3d 1039 (Okla. 2007) (ex parte communication with physician may be sought pursuant to a court order issued in compliance with HIPAA). Thus, in order for defense counsel to informally interview plaintiffs treating physicians, they must first obtain a valid authorization, or court order or otherwise comply with the provisions of 45 CFR § 164.512 (e). See Crenshaw v. MONY Life Ins. Co., 318 FSupp.2d 1015, 1029 (S.D. Cal. 2004) (“HIPAA does not authorize ex parte contacts with healthcare providers”). In this case, service of a request for production of documents is insufficient because, although it gave plaintiff notice and an opportunity to object to the production of written documents, it did not give plaintiff an opportunity to object to the ex parte oral contact and the discovery of the physicians’ recollections and mental impressions. Remedies for HIPAA Violations The remedies for HIPAA violations are set forth in 42 USCA § 1320d-5. That code section merely authorizes the Secretary to impose a fine not to exceed $100 for each violation. It does not authorize a remedy or penalty in the context of a civil lawsuit. In our view, the appropriate remedy to be fashioned in cases of this kind is best left to the discretion of the trial court. See generally OCGA § 9-11-37. Where, as here, defense counsel contacted plaintiffs prior treating physicians at a time when the applicability of HIPAA to ex parte communications was uncertain, a trial court would be well-advised to avoid an extreme sanction. See Law v. Zuckerman, supra at 713 (court remedied HIPAA violation by ordering that either party *735 could speak to physician before trial and if physician “strayed in his testimony from the medical records and offered any opinions beyond his experience as [pjlaintiffs treating physician such testimony would be prohibited”); Crenshaw, supra at 1030 (court remedied HIPAA violation by ordering defendant to produce physician for deposition at its expense and prohibiting further ex parte contacts). The remedy fashioned by the trial court in this case, permitting defense counsel to interview Mr. Moreland’s prior treating physicians, but only after giving plaintiff notice and enabling her attorneys to be present when the physicians are interviewed, lies well within a trial court’s discretion. Decided November 3, 2008 Reconsideration denied December 15, 2008. Don C. Keenan, Allan L. Galbraith, Charles H. Allen, for appellants. Green & Sapp, Henry D. Green, Jr., for appellees. Conclusion HIPAA protects a patient from the unauthorized disclosure of protected health information and it is applicable to ex parte oral communications between defense counsel and a plaintiffs prior treating physicians. Accordingly, defense counsel cannot contact a plaintiffs prior treating physicians to discuss his or her medical history without complying with HIPAA regulations. Although defense counsel can engage in such discussions if a plaintiff gives his or her consent, 8 it must be clear that the plaintiff consented to ex parte oral communications. We will not presume a plaintiff consented to such communications simply because the plaintiff did not object when defendant sought plaintiffs medical records pursuant to a subpoena or request for production of documents. Judgment reversed. All the Justices concur. *736 O’Neal, Brown & Sizemore, Jarome E. Gautreaux, Lee T. Wallace, Arnall, Golden & Gregory, Tracy M. Field, Ashley S. Kelly, Robert T Strang III, amici curiae. Footnotes [1] 45 CFR § 160.103. Health information is protected whether it lies within a physician’s memory or a written record. See Arons v. Jutkowitz, 9 NY3d 393, 415, 416 (880 NE2d 831) (N.Y. 2007) (citing 65 Fed. Reg. 82462, 82620, which explained the “rationale for treating verbal communications the same as paper and electronically based information”). [2] 45 CFR § 164.512 (e) (1). [3] 45 CFR § 164.508 (c). See also Allen v. Wright, 282 Ga. 9, 12 (644 SE2d 814) (2007). [4] 45 CFR § 164.512 (e) (1) (ii)-(v). [5] Healthcare providers are free to decide whether or not to cooperate with defense counsel. HIPAA-compliant authorizations and HIPAA court orders cannot force a health care professional to communicate with anyone; they merely signal compliance with HIPAA and the Privacy Rule as is required before any use or disclosure of protected health information may take place. Arons v. Jutkowitz, supra at 416. [6] 45 CFR § 164.508. [7] Courts have encouraged informal contacts as a way to minimize the high costs of medical malpractice litigation. See, e.g., Arons v. Jutkowitz, supra at 406-408; Stempler v. Speidell, 495 A2d 857, 859-864 (N.J. 1985). But see Givens v. Mullikin, 75 SW3d 383 (Tenn. 2002) (ex parte interviews of patients’ physician improper without authorization). [8] We agree with the Court of Appeals that if, as defendant claims, plaintiff consented to the disclosure of all protected health information prior to the effective date of the HIPAA privacy rule, and if the authorization “specifically permits [the intended] use or disclosure and there is no agreed-to restriction in accordance with 45 CFR § 164.522 (a),” the physicians may continue to disclose the information without violating HIPAA. See 45 CFR § 164.532 (a), (b); Austin v. Moreland, supra at 275. This is a matter for the trial court’s determination.