Full text
PACIFIC RADIATION ONCOLOGY, LLC, a Hawai'i Limited Liability Corporation, Et Al., Plaintiffs-Appellants, v. the QUEEN’S MEDICAL CENTER, a Hawai'i Non-Profit Corporation, Et Al., Defendants-Appellees
Opinions in this case
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
Electronically Filed Supreme Court SCCQ-15-0000300 13-JUN-2016 08:04 AM IN THE SUPREME COURT OF THE STATE OF HAWAII
---oOo--- ________________________________________________________________
PACIFIC RADIATION ONCOLOGY, LLC, a Hawaii Limited Liability Corporation, et al., Plaintiffs-Appellants,
vs.
THE QUEEN’S MEDICAL CENTER, a Hawaii Non-Profit Corporation, et al., Defendants-Appellees. ________________________________________________________________
SCCQ-15-0000300
CERTIFIED QUESTION FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF HAWAII (CIVIL NO. 12-00064 LEK-KSC)
JUNE 13, 2016
RECKTENWALD, C.J., NAKAYAMA, McKENNA, POLLACK, AND WILSON, JJ., WITH RECKTENWALD, C.J., CONCURRING SEPARATELY
OPINION OF THE COURT BY McKENNA, J. I. Introduction
This court has been asked to provide guidance to the United States District Court for the District of Hawaii (“District Court”) on questions of Hawaii law. At issue is whether the parties may use, or be compelled to produce, the confidential medical records of over 100 cancer patients, in an effort to
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** prosecute or defend against claims that the Plaintiff doctors steered these patients away from treatment at Defendant Queens Medical Center. The patients are not parties to the underlying lawsuit, although 19 of them have been granted intervenor status. All of them have intervened solely to assert their right to privacy and seek a prohibition on the use and production of their medical records.
The District Court1 certified the following questions to this court:
1. May a third party who is in lawful possession of a patient’s confidential medical records use, or be compelled to produce, these records in litigation where the patient is not a party? 2. If a third party may use and/or produce a patient’s confidential medical records in litigation, is a de- identification process sufficient to protect the patient’s privacy interests where the third party already allowed its agents access to the patient’s records and its agents inadvertently made part of the patient’s medical information public?
This court may “reformulate the relevant state law questions as it perceives them to be, in light of the contentions of the parties.” Allstate Ins. Co. v. Alamo Rent-A-Car, Inc., 137 F.3d 634, 637 (9th Cir. 1998) (citations and quotation marks omitted). To avoid confusion, we reformulate the certified questions to clarify that the term “party” refers to the parties to the litigation, not to the parties to the physician-patient relationship. We believe that the “parties” in this case are
the plaintiffs and defendants, and the “third parties” in this 1 The Honorable Leslie E. Kobayashi, United States District Judge, presided.
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** case are the patient intervenors. We also reformulate the question so that a negative answer to the first certified question will not preclude us from answering the second certified question to the extent we can. Therefore, the reformulated certified questions are:
1. May a party who is in lawful possession of a patient’s confidential medical records use, or be compelled to produce, these records in litigation where the patient is not a party? 2. Is a de-identification process sufficient to protect the patient’s privacy interests where the party already allowed its agents access to the patient’s records and its agents inadvertently made part of the patient’s medical information public?2
Hawaii Rules of Appellate Procedure (“HRAP”) Rule 13 (2000) governs certified questions. It provides, in relevant part, “When a federal district . . . court certifies to the Hawaii Supreme Court that there is involved in any proceeding before it a question concerning the law of Hawaii that is determinative of the cause and that there is no clear controlling precedent in the Hawaii judicial decisions, the Hawaii Supreme Court may answer the certified question by written opinion.” We therefore confine our answer to the “law of Hawaii that is determinative
2 Defendant urges us to reformulate the certified questions to include the following “threshold question”: “Does [Hawaii Revised Statutes (“HRS”) § 431:10C-]308.7(c) apply to all self-referral involving insured services covered by H.R.S. Chapter 431 or only to those involving no-fault auto- related services?” We decline to do so. We note that the District Court has already concluded that that statute does not apply to health care provider referrals and is “limited to the context of motor vehicle insurance” in an Order Granting in Part and Denying in Part Plaintiffs’ Motion for Summary Judgment on the Counterclaim. The present certified question is not the proper vehicle through which Defendant may challenge that order.
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** of the cause,” namely article I, section 6 of the Hawaii Constitution. That constitutional provision states, in relevant part, “The right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest.”
We answer the first certified question in the negative. Article I, section 6 of the Hawaii Constitution protects the health information of patient intervenors to this case. Pursuant to that provision, and under the facts of this case, the parties cannot use, or be compelled to produce, confidential patient medical records in litigation where the patient is not a party, absent a compelling state interest.
As to the second certified question, we do not address whether sufficient de-identification is possible where one party already allowed its agents access to the patient’s records and its agents inadvertently made part of the patient’s medical information public. The de-identification process and requirements are set forth under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Pub L. No. 104-191, 110 Stat. 1936 (1996), and its corresponding regulations; therefore, the sufficiency of de-identification does not “concern[] the law of Hawaii that is determinative of the cause.” HRAP Rule 13. Whether the use and production of
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** de-identified medical records is “sufficient to protect the patient’s privacy interests,” however, is a question this court can address under article I, section 6. We hold that the use and production of de-identified medical information of patients who are not parties to the litigation violates those patients’ right to privacy under article I, section 6 of the Hawaii constitution, as no compelling state interest has been shown in this case. II. Background
The Plaintiffs in this case are Pacific Radiation Oncology, LLC; PRO Associates, LLC; John Lederer, M.D.; Vincent Brown, M.D.; Paul DeMare, M.D.; Thanh Huynh, M.D.; Laeton Pang, M.D.; and Eva Bieniek, M.D. (collectively, “PRO”). The Plaintiffs filed an Amended Complaint for Declaratory and Injunctive Relief and for Damages (“Amended Complaint”) against Defendants Queens Medical Center and Queens Development Corporation (collectively “QMC”).3 The Amended Complaint alleged that the Plaintiffs “had a long-standing, 40-year relationship with QMC to provide professional radiation oncology therapy services to PRO patients at facilities owned by QMC, using equipment, technician support, and other services provided by QMC.” QMC is the only Nuclear Regulatory Commission-approved hospital at which radiation
3 The Plaintiffs also named as defendants the individual members of the Queens Medical Center Board of Trustees. The parties later stipulated to dismiss, without prejudice, these individuals.
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** oncologists can operate on patients. Plaintiffs also acknowledged that they had “a one-third interest in The Cancer Centers of Hawaii [‘TCCH’],” a competitor of QMC.
According to the Amended Complaint, QMC notified Plaintiffs that the QMC Board had decided to convert QMC to a “closed radiation therapy department,” meaning that only physicians employed by QMC could exercise clinical privileges to provide professional radiation oncology services at QMC. QMC explained that it arrived at its decision to terminate PRO’s privileges after determining that PRO had “transferr[ed] patients to other facilities for no medical reason or patient request. . . .” Plaintiffs alleged in their Amended Complaint that QMC’s action was intended to destroy their ability to treat patients at facilities competing with QMC.
Plaintiffs’ Amended Complaint raised ten claims for relief: a claim of denial of procedural and substantive due process; a claim of violation of QMC bylaws and governing regulations; three separate claims of intentional and tortious interference; four separate claims of unfair, deceptive, anti-competitive and illegal trade practices in violation of HRS Chapter 480; and a claim of breach of fiduciary duty and bad faith owed to a partner.
QMC filed an Answer and Counterclaim. Relevant to this certified question, QMC counterclaimed that Plaintiffs Lederer,
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** Brown, DeMare, Huynh, and Pang “consulted with and/or began treatment of patients referred to them at QMC and then induced the patients to receive treatment at TCCH without making timely written disclosure of their ownership interests in TCCH,” which constituted unfair competition in violation of HRS § 480-2.
During the course of the litigation, QMC’s law firm publicly filed a list naming 132 patients PRO was alleged to have diverted to TCCH; also included were the patients’ QMC identification numbers and the PRO doctors who consulted and treated each patient. The list was attached as an exhibit to (1) a subpoena to TCCH’s custodian of records and (2) a discovery request to PRO. The filing was subsequently sealed.
Plaintiffs then moved for a temporary restraining order or preliminary injunction to prevent further violations of patient privacy. In their moving papers, they alleged that QMC had accessed the electronic medical records of 133 cancer patients, without consent, to determine if Plaintiffs were directing patients to TCCH, and, if so, how much revenue QMC lost as a result. Plaintiffs argued that cancer patient medical records would likely include “history and physicals” information regarding “the most confidential and sensitive inquiries, including prior pregnancies, abortions, sexual activities, potency, drug use, psychological issues, depression, AIDS info, family history, prior diseases, substance dependency, etc.,
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** etc.” QMC’s alleged breach of patient privacy culminated in the disclosure of 132 of the patients’ names in the exhibits to the subpoena and discovery request. Plaintiffs sought to enjoin “QMC, its attorneys, and its consultants from reviewing and more importantly from publishing the highly confidential information including the names of these many, many cancer patients.”
The District Court granted in part, and denied in part, the Plaintiffs’ motion. Construing the Plaintiffs’ pleading as a discovery motion, the District Court granted it, in part, and sanctioned defense counsel for publicly filing the list naming the 132 cancer patients, in willful violation of the parties’ Amended Stipulated Protective Order. The District Court denied the motion for a TRO and/or preliminary injunction, in part, because the Plaintiffs’ Amended Complaint alleged no claims of improper review and use of confidential patient information.4 As to whether the Plaintiffs could prevent Defendants from obtaining or using confidential patient information, the District Court concluded that “the parties must address these issues through the normal discovery process.”
The Magistrate Judge, in turn, issued his Order Regarding Discovery Issues. He found the 132 cancer patients’ confidential medical records to be relevant to the parties’
4 The United States Court of Appeals for the Ninth Circuit affirmed the denial. Pacific Radiation Oncology, LLC v. Queen’s Medical Center, 810 F.3d 631 (9th Cir. 2015).
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** claims and counterclaims. He ordered the records discoverable as follows:
Although the patient medical records contain protected health information (“PHI”), this does not preclude their discovery. As noted by Judge Kobayashi in the TRO Order, “[o]nce health information has been deidentified, it is no longer protected by HIPAA” or state law. TRO Order at 29. It reasonably follows that PHI is discoverable if de- identified. Accordingly, the 132 patient medical records shall be de-identified. Upon de-identification, the medical records will be discoverable and shall be produced.
The Plaintiffs appealed the Magistrate Judge’s decision to the District Court. After granting 19 affected patients’ motion to intervene, the District Court reserved ruling on the Plaintiffs’ appeal and certified the instant questions to this court. III. Discussion
Article I, section 6 of the Hawaii Constitution is entitled “Right to Privacy,” and it provides, “The right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest. The legislature shall take affirmative steps to implement this right.” In the context of patient medical records, this court has issued three decisions construing article I, section 6 on petitions for writ of mandamus: Brende v. Hara, 113 Hawaii 424, 153 P.3d 1109 (2007) (per curiam); Naipo v. Border, 125 Hawaii 31, 251 P.3d 594 (2011) (per curiam); and Cohan v. Ayabe, 132 Hawaii 408, 322 P.3d 948 (2014).
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
Each of the mandamus petitioners in these cases sought to compel the respondent judges to issue orders limiting and/or prohibiting the use of patient medical records. The mandamus petitioners in Brende and Cohan were both plaintiffs in tort litigation in which their medical condition and treatment were at issue. The petitioner in Naipo, on the other hand, was not a party to the litigation. Rather, in Naipo, the parties to a dog-bite lawsuit sought discovery of a non-party’s patient medical records. This distinction is key in the instant proceedings, which involve patient intervenors who are not parties to the lawsuit between Plaintiffs and QMC. Each of these cases will be discussed in turn, below.
Brende, Cohan, and Naipo all provide strong privacy protection over patient medical records. In Brende, this court held, “Petitioners’ health information is ‘highly personal and intimate’ information that is protected by the informational prong of article I, section 6. The constitutional provision protects the disclosure outside of the underlying litigation of petitioners’ health information produced in discovery.” 113 Hawaii at 430, 153 P.3d at 1115 (footnote omitted). This holding was reaffirmed in Cohan. See 132 Hawaii at 410, 322 P.3d at 950 (“[T]he privacy provision of the Hawaii Constitution, article I, section 6, protects [the petitioner’s]
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** health information against disclosure outside the underlying litigation.”)
The holding in Brende and Cohan applies to situations in which a party to litigation seeks to limit and/or prohibit the disclosure, outside of discovery, of his or her own patient medical records. While that is not the situation in the present case (where non-parties seek to prohibit the use and disclosure of their patient medical records), we turn to Brende and Cohan for their exploration of the constitutional history behind article I, section 6.
Brende noted that the framers viewed the Hawaii constitutional right to privacy as follows:
[T]he [article I, section 6] right of privacy encompasses the common law right of privacy or tort privacy. This is a recognition that the dissemination of private and personal matters, be it true, embarrassing or not, can cause mental pain and distress far greater than bodily injury. For example, the right can be used to protect an individual from invasion of [the individual’s] private affairs, public disclosure of embarrassing facts, and publicity placing the individual in a false light. In short, this right of privacy includes the right of an individual to tell the world to “mind your own business.”
113 Hawaii at 430, 153 P.3d at 1115 (quoting Stand. Comm. Rep. No. 69, in Proceedings of the Constitutional Convention of Hawaii of 1978 (“Proceedings”), Vol. 1, at 674).
So inviolable is this right that the framers sought to shield individuals from “possible abuses in the use of highly personal and intimate information in the hands of government or private parties. . . .” Comm. Whole Rep. No. 15, in
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** Proceedings, at 1024 (emphasis added). In this way, article I, section 6 provides Hawaii’s people with powerful protection against any infringement of their right to privacy, by state and private actors. In fact, we have previously noted that the framers “equated privacy in the informational sense” with the “common law right of privacy,” so that “[o]ne who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of his [or her] privacy, if the matter publicized is of a kind that (a) would be regarded as highly offensive to a reasonable person, and (b) is not of legitimate concern to the public.” State of Hawaii Organization of Police Officers (“SHOPO”) v. Soc’y of Prof’l Journalists, 83 Hawaii 378, 398, 927 P.2d 386, 406 (1996) (citing Stand. Comm. Rep. No. 69, Proceedings, at 674; and Restatement (Second) of Torts § 652D, 383 (1977)). There is no requirement that the one invading another individual’s privacy be a state actor. See, e.g., SHOPO, 83 Hawaii 378, 927 P.2d 386 (analyzing whether a non-state actor’s, e.g., an organization of journalists, access to police officer disciplinary records would violate the officers’ constitutional privacy rights).
Article I, section 6 generally provides greater privacy to Hawaii’s people than its federal analogs. The Hawaii constitutional right to privacy is a “fundamental right for
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** purposes of constitutional analysis.” Cohan, 132 Hawaii at 415, 322 P.3d at 955 (quoting Comm. Whole Rep. No. 15, in Proceedings, at 1024). We view article I, section 6 as “afford[ing] much greater privacy rights than the federal right to privacy. . . .” Janra Enters., Inc. v. City & Cty. of Honolulu, 107 Hawaii 314, 320, 113 P.3d 190, 196 (2005) (citation omitted).
Article 1, section 6 also provides more stringent protection5 over patient medical records than does HIPAA.6 This conclusion was implicit in Cohan, where a provision in a Stipulated Qualified Protection Order that provided that the
5 45 C.F.R. § 160.202(6) provides More stringent means, in the context of a comparison of a provision of State law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, a State law that meets one or more of the following criteria: . . . . With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information. That regulation also defines “state law” to include a state’s constitution and common law. Id. 6 We therefore are not persuaded by QMC’s contention that “Hawaii’s constitutional right of privacy is coextensive with HIPAA.” In support of this argument, QMC points to HRS Chapter 323B, Hawaii’s Health Care Privacy Harmonization Act, specifically section 3(a) in that chapter, which states in relevant part that a covered entity or business associate’s use or disclosure of individually identifiable health information that complies with HIPAA “shall be deemed to comply with all state laws relating to the use, disclosure, or confidentiality of such information.” HRS § 323B-4(6) (2010 & Supp. 2012), however, provides, “Nothing in this chapter shall be construed to . . . [l]imit or otherwise affect any evidentiary privilege, limitation on discovery, or confidentiality protection provided by any state law, decision, or order in relation to individually identifiable health information sought, used, or produced in any judicial or administrative proceeding.” Therefore, the intervenors’ constitutional right to privacy in their confidential medical records is unaffected by Chapter 323B. In other words, honoring an individual’s right to privacy in his or her protected health information requires more than bare compliance with HIPAA.
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** defendant hotel could use a tort plaintiff’s health information in its internal reviews was invalidated under article I, section 6, yet we noted that “[a]n analysis under HIPAA arguably may lead to a different result.” 132 Hawaii at 419, 419 n.18, 322 P.3d at 959, 959 n.18.
The right to privacy is absolute where, as here, the individuals seeking to protect patient medical records, in discovery and beyond, are not parties to the litigation, have not consented to the use of their patient medical records in relation to the present lawsuit, and no compelling state interest has been shown. Naipo is a case “on all fours” with the instant case. In Naipo, plaintiff Eshell Mitchell sued the Yuen family in state court for multiple leg injuries she sustained when the Yuens’ dog, Braddah, bit her. 125 Hawaii at 33, 251 P.3d at 596. As part of her negligence claim, Mitchell sought to establish that Braddah had previously bitten Jennifer Naipo. See id. Mitchell issued a subpoena duces tecum to Wahiawa General Hospital for production of Naipo’s medical records. See id. The respondent judge denied Naipo’s motion to quash the subpoena and ordered the hospital to turn over Naipo’s medical records for an in camera inspection. 125 Hawaii at 34, 251 P.3d at 597.
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
Naipo then petitioned this court for a writ of mandamus, arguing that her health information was protected by, inter alia, her right to privacy under article I, section 6 of the Hawaii constitution. Id. We granted Naipo’s petition for mandamus relief and ultimately directed the respondent judge to quash the subpoena duces tecum. 125 Hawaii at 37, 251 P.3d at 600. We unequivocally held, “Petitioner Jennifer Naipo is not a party to Eshell Mitchell’s lawsuit against the Yuens. Her health information in her medical records at Wahiawa General Hospital is protected by her constitutional right to privacy.”7 125 Hawaii at 35, 251 P.3d at 598.
Naipo’s holding provides our answer to the first certified question, which is, “May a party who is in lawful possession of a patient’s confidential medical records use, or be compelled to produce, these records in litigation where the patient is not a party?” We hold that, pursuant to article I, section 6 of the Hawaii Constitution, and under the facts of this case, the parties cannot use, or be compelled to produce, confidential patient medical records in litigation where the patient is not a party, where no compelling state interest has been shown.
7 Our decision also rested on the twin holding that Naipo’s confidential medical records “deserve[d] the protection of the physician-patient privilege of [Hawaii Rules of Evidence] Rule 504,” which Naipo had not waived. 125 Hawaii at 35, 36, 251 P.3d at 598, 599. We therefore are not persuaded by QMC’s argument that Naipo “held that the medical records were protected from disclosure to the trial judge on physician patient privilege grounds rather than privacy.”
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
The second certified question is, “Is a de-identification process sufficient to protect the patient’s privacy interests where the party already allowed its agents access to the patient’s records and its agents inadvertently made part of the patient’s medical information public?” We doubt, under the circumstances of this case where there has been an egregious breach of patient confidentiality by QMC both internally and publicly, that de-identification is possible. However, the question of the sufficiency of de-identification where one party already allowed its agents access to the patient’s records and its agents inadvertently made part of the patient’s medical information public, is ultimately a matter of compliance with HIPAA, which is a federal question we need not answer. We can address under Hawaii law, however, that part of the second certified question asking if de-identification could sufficiently protect the patients’ privacy rights. We answer that part of the second certified question in the negative.
In Cohan, we held, “To allow [a party’s medical] information to be used outside the litigation, regardless of whether it is de-identified or not, would reach beyond what the Hawaii Constitution permits in the absence of a showing of a compelling state interest.” 132 Hawaii at 419, 322 P.3d at 959.
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** In Cohan, we noted that the de-identification process under HIPAA is “extremely complex and problematic,” and that, “[a]part from these technical considerations, there is the very complicated issue as to whether a patient has a legitimate basis for being concerned about what happens to their personal health information once it is de-identified.” 132 Hawaii at 417, 418, 322 P.3d at 957, 958 (footnote omitted). We quoted the following observation from the Seventh Circuit Court of Appeals with approval: “Even if there were no possibility that a patient’s identity might be learned from a redacted medical record, there would still be an invasion of privacy.” Cohan, 132 Hawaii at 418, 322 P.3d at 958 (citing Nw. Mem’l Hosp. v. Ashcroft, 362 F.3d 923, 929 (7th Cir. 2004)). Such an invasion could produce undesirable effects upon patient health care, including “social and psychological harm through embarrassment, economic harm through job discrimination and job loss, patient difficulty in obtaining health insurance, health care fraud, and patient reluctance to share sensitive information with their doctors or pharmacists.” 132 Hawaii at 418, 322 P.3d at 958 (quoting Christopher R. Smith, Somebody’s Watching Me: Protecting Patient Privacy in Prescription Health Information, 36 Vt. L. Rev, 931, 943 (2012)).
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
Further, we observed that “the risk of re-identification remains, as there is ‘no national, uniform standard governing the level of identifier-stripping necessary to guarantee that de-identified data cannot be re-identified.” 132 Hawaii at 418 n.16, 322 P.3d at 958 n.16 (quoting Smith, supra, at 935). The risk of re-identification poses “subjective privacy concerns” for some patients, who object to the “dehumanization [in] having one’s most intimate information circulated by an indifferent and faceless infrastructure without any control over the process or content.” Id. (quoting Will Thomas DeVries, Protecting Privacy in the Digital Age, 18 Berkeley Tech. L.J., 283, 298 (2003)).
We believe the same concerns underlying the use of de-identified medical records beyond litigation for parties to a lawsuit exist for individuals who are not parties to litigation and who have therefore not put their medical condition and/or treatment at issue in the first instance. Just as article I, section 6 protects parties from the use and production of their de-identified information outside of litigation, we conclude that article I, section 6 protects individuals from the use and production of their de-identified information in litigation to which they are not parties. Thus, the use and production of even sufficiently de-identified medical records, under the circumstances of this case, will not adequately protect the patients from an invasion of their privacy.
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
We acknowledge that Cohan also stated the following:
Once health information has been de-identified, it is no longer protected by HIPAA. Further, because HIPAA allows “more stringent” state law to preempt federal law only when it relates to the privacy of “individually identifiable health information,” 45 C.F.R. § 160.203(b), this leads to the conclusion that state law also does not protect de- identified information. Nw. Mem’l Hosp., 362 F.3d at 926.
132 Hawaii at 417, 322 P.3d at 957 (latter emphasis added). We consider the last statement to be an accurate summary of the holding in Nw. Mem’l Hosp., which was, more specifically, that Illinois’ medical-records privilege, while providing “more stringent” state law protection of “individually identifiable health information,” was no barrier to the discovery of de-identified health information. See also Zyprexa Prods. Liab. Litig., 254 F.R.D. 50, 52 (E.D.N.Y. 2008) (similarly concluding, “the States’ [physician-patient] privilege laws pose no obstacle to the discovery of [patient] medical records, provided those records are de-identified.”).
By contrast, our express holding in Cohan was, “To allow [a party’s medical] information to be used outside the litigation, regardless of whether it is de-identified or not, would reach beyond what the Hawaii Constitution permits in the absence of a showing of a compelling state interest.” 132 Hawaii at 419, 322 P.3d at 959. Extending Cohan to cases in which parties seek to use and produce the medical records of non-parties, we hold that to allow an individual’s medical information, even if de-
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER *** identified, to be used in litigation to which that individual is not a party, would reach beyond what the Hawaii Constitution permits in the absence of a showing of a compelling state interest. In this case, QMC has made no such showing, and we do not believe that a compelling state interest exists in infringing upon the Hawaii state constitutional privacy rights of over 100 cancer patients in order to resolve what is essentially a contract dispute between competing cancer treatment providers. IV. Conclusion
We answer both certified questions in the negative. Article I, section 6 of the Hawaii Constitution protects the health information of patient intervenors to this case. Pursuant to that provision, the parties cannot use, or be compelled to produce, confidential patient medical records, even if sufficiently de-identified, in litigation where the patient is not a party, as no compelling state interest has been shown.
/s/ Mark E. Recktenwald
/s/ Paula A. Nakayama
/s/ Sabrina S. McKenna
/s/ Richard W. Pollack
/s/ Michael D. Wilson