Harrold-Jones v. Drury

WINFREE, Justice. I. INTRODUCTION We granted this petition for review to consider how the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA)-establishing medical privacy standards with specific exceptions-affected our personal injury case law allowing a defendant ex parte contact with a plaintiff's doctors as a method of informal discovery. We requested that the parties specifically brief whether the federal law preempted our case law, or, if not, whether federal law otherwise required us to overrule or modify our case law. We conclude that the federal law does not preempt our existing case law. But we also conclude that we should overrule our case law because its foundations have been eroded by a cultural shift in views on medical privacy and new federal procedural requirements undermining the use of ex parte contact as an informal discovery measure. We therefore hold that-absent voluntary agreement-a defendant may not make ex parte contact with a plaintiff's treating physicians without a court order, which generally should not be issued absent extraordinary circumstances. We believe that formal discovery methods are more likely to comply with the federal law and promote justice and that such court orders rarely, if ever, will be necessary. II. FACTS AND PROCEEDINGS In August 2014 Tarri Harrold-Jones fractured her clavicle. She visited the emergency room and was referred to Denali Orthopedic Surgery. Dr. Tucker Drury, a Denali physician, later performed corrective surgery. Harrold-Jones experienced continued pain and discomfort following the surgical procedure and she returned to Denali, where Dr. William Pace evaluated her. Harrold-Jones ended treatment at Denali and transferred her care to another doctor. Harrold-Jones later retained counsel who sent Denali a letter in early 2015, attaching a draft complaint alleging Drs. Drury's and Pace's malpractice and seeking compensation. 1 Denali's counsel responded by requesting a medical release authorizing access to Harrold-Jones's "complete medical record or designated record set" and authorizing ex parte contact with her medical providers. *570 Harrold-Jones refused to sign the authorization. Denali's counsel responded by narrowing the request to a release for Harrold-Jones's new doctor's office and to allow counsel to make ex parte contact with the new doctor. 2 Harrold-Jones refused to sign this authorization and two similar requested authorizations in the following months. Harrold-Jones filed a medical malpractice suit against Denali and the two doctors in April 2016. Denali's counsel renewed the request for a release authorizing ex parte contact with Harrold-Jones's new doctor three more times. Harrold-Jones continued to refuse this authorization, and she sought a protective order prohibiting Denali from having ex parte contact with her new treating doctor. Denali opposed and moved to compel Harrold-Jones to authorize such contact. The superior court denied Harrold-Jones's motion and granted Denali's in August 2016, relying on Langdon v. Champion as the basis for its ruling. 3 Harrold-Jones petitioned for review, which we granted to decide whether HIPAA preempts our case law allowing ex parte contact with a plaintiff's treating physician or otherwise requires us to overrule or modify that case law. III. STANDARD OF REVIEW "Whether a defendant's counsel has the right to engage in informal ex parte interviews with a plaintiff's treating physician is a question of law." 4 The "interpretation of federal statutes" is a question of law. 5 "Whether a federal statute preempts a state court rule is also a question of law." 6 "We review questions of law de novo, 'adopting the rule of law most persuasive in light of precedent, reason, and policy.' " 7 IV. DISCUSSION We granted Harrold-Jones's petition for review primarily to decide HIPAA's effect on "our existing case law regarding a plaintiff's waiver of the patient/physician privilege and ex parte communications between defense counsel and the plaintiff's treating physicians." 8 Having reviewed HIPAA and the regulations promulgated under its authority, we conclude that federal law does not preempt our decisions allowing ex parte communications between defense counsel and a plaintiff's treating physicians. But new procedural requirements HIPAA imposes on ex parte contact-amidst a cultural shift emphasizing medical privacy-significantly undermine the reasoning behind our original decisions. Based on this change in circumstances, we overrule Langdon and hold that-absent agreement by the plaintiff-a defendant or defendant's counsel may not make ex parte contact with a plaintiff's treating physician unless authorized to do so by a court order, which we believe generally should be available only under extraordinary circumstances. A. HIPAA Provides Privacy Protections, With Relevant Exceptions. We begin our analysis with the federal law in question. Congress enacted HIPAA in 1996 to improve health insurance coverage, combat fraud, and simplify health insurance administration. 9 Subtitle F of HIPAA addressed *571 patient privacy by defining protected health information, defining entities who must protect health information, and requesting further privacy recommendations from the Department of Health and Human Services (HHS). 10 Congress instructed HHS to promulgate further privacy regulations if Congress failed to do so within three years of HIPAA's enactment. 11 After the three years passed without congressional action, HHS promulgated the "Privacy Rule," 12 a series of regulations governing permitted uses and disclosures of protected health information. Together, Subtitle F of HIPAA and the Privacy Rule form the federal law at issue in this case, which we will refer to collectively as HIPAA for ease of reference. 1. Overview of privacy protections HIPAA's privacy framework begins with express preemption. HIPAA preempts contrary state laws unless they are more stringent than HIPAA itself. 13 A state law is "contrary" to HIPAA if a covered entity would find it impossible to comply with both the state and federal requirements or if the state law is an obstacle to the accomplishment of the full purposes of HIPAA section 264. 14 HIPAA then protects a subject individual's privacy with a two-part rule regarding protected health information. 15 First, HIPAA broadly prohibits any covered entity 16 from using or disclosing 17 protected health information. 18 Denali does not dispute that ex parte contact with Harrold-Jones's treating physician would constitute use or disclosure of protected health information by a covered entity. Second, HIPAA provides specific exceptions to the prohibition for enumerated uses and disclosures. 19 Only two HIPAA exceptions require disclosure; 20 the remainder leave the choice of disclosure to the covered entity. 21 Two of these permissive exceptions are applicable here. First, a covered entity may disclose protected health information with a valid authorization from the subject individual (the authorization exception). 22 Second, a covered entity may disclose protected health information in the context of a judicial or administrative proceeding (the litigation exception). 23 2. The authorization exception The authorization exception allows permissive disclosure once the subject executes a valid authorization. 24 A valid authorization contains at minimum: (1) a statement of the *572 remuneration, if any is involved; (2) a description of the information to be used or disclosed identified in a specific and meaningful fashion; (3) "[t]he name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure"; (4) "[t]he name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure"; (5) "[a] description of each purpose of the requested use or disclosure"; (6) an expiration date or event related to the subject or the purpose of the use or disclosure; and (7) the date and the subject's signature. 25 An authorization must be written in plain language 26 and contain a statement informing the subject of the right to revoke the authorization. 27 The subject may revoke an authorization at any time. 28 Covered entities making disclosures under HIPAA normally "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose" of the disclosure. 29 But the minimum necessary standard does not apply to disclosures made under the authorization exception 30 because authorizations are "voluntary"; 31 the scope of disclosure is instead governed by the terms of the authorization. 32 3. The litigation exception The litigation exception contrastingly allows for permissive disclosure even against the subject's wishes. A covered entity may disclose protected health information if, and only to the extent that, the disclosure is otherwise required by law and the covered entity meets one of three litigation-related requirements. 33 First, the disclosure can be made in response to an authorizing court order, such as a court-issued subpoena. 34 HIPAA restricts such orders to "mandate[s] contained in law that compel[ ] an entity to make a use or disclosure of protected health information and that is enforceable in a court of law"; accordingly state court orders must also comply with state law under HIPAA. 35 Second, the disclosure can be made in response to a party's subpoena, discovery request, or other lawful process if the covered entity receives "satisfactory assurances" from the requesting party. 36 "Satisfactory assurances" means the requesting party either has provided the subject notice and opportunity to object 37 or has received a qualified protective order limiting disclosure to that relevant to the current proceeding. 38 Third, *573 the disclosure can be made in response to a party's subpoena, discovery request, or other lawful process if the covered entity itself provides the subject with notice and opportunity to object or seeks a qualified protective order. 39 As with the authorization exception, the covered entity is not obligated by HIPAA to make any disclosure under any of the three litigation exception avenues. 40 The scope of disclosure subtly differs between the authorization exception and the litigation exception, and within the litigation exception's different mechanisms. While the scope of disclosure under the authorization exception is determined by the authorization's language, the scope of disclosure under a court order is determined by the terms of that order-i.e., state law. 41 But the scope of qualified protective orders is defined by HIPAA itself; all qualified protective orders must contain a prohibition on the use or disclosure of protected health information for any purpose other than the current proceeding and a required return or destruction of the protected health information at litigation's end. 42 As with the authorization exception, HIPAA's minimum necessary requirements 43 do not apply to the litigation exception 44 because "the individual exercises the right to object before the court or other body having jurisdiction over the proceeding." 45 B. HIPAA Does Not Preempt Alaska Law Allowing Ex Parte Contact. Under the Supremacy Clause, "the Laws of the United States ... shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding." 46 This clause mandates federal preemption of state law when a federal law contains express preemptive language, conflicts with a state law, or displaces all state laws by occupying the entire regulated field. 47 HIPAA contains express preemptive language; therefore the express preemption doctrine governs this case. 48 HIPAA's preemption clause states: "A regulation promulgated under [HIPAA] shall not supercede a contrary provision of State law, if the provision of state law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation." 49 "Contrary ... means: (1) A covered entity or business associate would find it impossible to comply with both the State and Federal requirements; or (2) the provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of [HIPAA section 264]." 50 Applying the plain language of HIPAA's two-part test, the Langdon rule is not preempted *574 because it is not contrary to HIPAA. 51 First, a covered entity would not "find it impossible to comply with both the State and Federal requirements." 52 Though HIPAA broadly prohibits covered entities from disclosing health information without the subject's consent, 53 HIPAA expressly contemplates exceptions to this rule. Specifically, the authorization exception allows for "use or disclosure of protected health information" when "a covered entity obtains or receives a valid authorization for its use." 54 Harrold-Jones's treating physician could thus comply with "both the State and Federal requirements" if Harrold-Jones voluntarily consented to ex parte contact through HIPAA's authorization exception. 55 Similarly, the litigation exception provides that a "covered entity may disclose protected health information in the course of any judicial or administrative proceeding" in response to a court order. 56 Ex parte contacts under Alaska law are unquestionably "in the course of a[ ] judicial proceeding"; 57 Denali could therefore obtain a court order authorizing Harrold-Jones's treating physician's ex parte contact with Denali's counsel. Given these exceptions, a covered entity would not "find it impossible to comply with both the State and Federal requirements." 58 Second, the Langdon rule is not an "obstacle to the accomplishment and execution of the full purposes and objectives of [HIPAA section 264]." 59 HIPAA section 264 directed HHS to promulgate regulations addressing: (1) "rights that an individual who is a subject of individually identifiable health information should have"; (2) "procedures that should be established for the exercise of such rights"; and (3) "uses and disclosures of such information that should be authorized or required." 60 HHS responded by promulgating a rule that contained no mention of ex parte contact and did not explicitly prevent states from conditioning lawsuits on authorization waivers. 61 In fact, the rule allowed states to condition public benefits on the execution of an authorization. 62 HHS's allowance of public benefit conditions-while failing to preclude conditions on lawsuits and only specifically prohibiting conditions on providing treatment-suggests that compelling allowance of ex parte contact with a plaintiff's treating physician is not an "obstacle to the accomplishment and execution of the full purposes and objectives of [HIPAA]." 63 Therefore, because a plaintiff's treating physician can *575 make ex parte contact in Alaska without violating HIPAA or frustrating its full purposes and objectives, HIPAA does not preempt Langdon . Harrold-Jones argues that this conclusion cannot be correct because "[s]tate law is preempted unless state law provides for more stringent privacy protections than that provided by HIPAA." But Harrold-Jones misconstrues HIPAA. The threshold step in conducting HIPAA's preemption analysis is whether the state law is "contrary" to HIPAA; if the state law is not contrary, no stringency analysis is required. Harrold-Jones's stringency argument fails. We therefore conclude that HIPAA does not preempt our existing case law allowing ex parte contact between defense counsel and a plaintiff's treating physician. C. Ex Parte Contact Over The Plaintiff's Objection Is No Longer Appropriate Under Alaska Law. Our analysis does not end there. Although the Supremacy Clause may not forbid ex parte contact in Alaska, HIPAA embodies a cultural shift in how medical privacy is viewed and has created a new procedural framework for sharing medical information in litigation. Having considered HIPAA's underpinnings and reviewed this new framework, the legal basis for our ex parte contact jurisprudence, and how ex parte contact operates under this new framework, we no longer are convinced that unrestricted ex parte access to a plaintiff's treating physician over the plaintiff's objection should be allowed. Our decision is informed both by HIPAA and the original rationale of the Langdon rule. We first articulated the reasoning behind Langdon in Trans-World Investments v. Drobny , where we noted: "We find no legal impediments ... limit[ing] informal methods of discovery, such as private conferences with the attending physicians[;].... such informal methods are to be encouraged, for they facilitate early evaluation and settlement of cases, with a resulting decrease in litigation costs, and represent further the wise application of judicial resources." 64 We reaffirmed Drobny in Arctic Motor Freight, Inc. v. Stover , explaining that "the filing of a personal injury action by the plaintiff results in a waiver of his physician-patient privilege as to all information concerning his health and medical history relevant to the matters which he has placed in issue in the litigation." 65 The Langdon rule thus began with our recognition that waiver of the physician-patient privilege removed any barrier to informal contact between a plaintiff's treating physician and defense counsel. That rationale is no longer sound in light of HIPAA. As explained above, a plaintiff's treating physician could disclose protected information in compliance with HIPAA in one of two ways: either the plaintiff could sign an authorization allowing the physician to disclose protected health information 66 or the trial court could issue an order authorizing the physician to disclose protected health information. 67 But both options come with procedural barriers requiring trial court intervention, thus eroding any rule based on a lack of "legal impediments in existence which limit informal methods of discovery." 68 First, the authorization exception is limited by the plaintiff's federal right to revoke authorization at any time. 69 The right to revoke was specifically included to ensure that all authorizations are voluntary. 70 And because the scope of disclosure under this exception is determined by the language of the release *576 itself, 71 the trial court necessarily must-to make the release truly voluntary-limit the terms of a disputed release to those necessary to effectuate the litigation. The trial court must be active, understand the nature of the litigation, and hear the parties' arguments to craft an appropriate release; we decline to adopt a rule by judicial fiat requiring that a personal injury plaintiff submit a broad medical release that includes allowing ex parte contact with the plaintiff's doctors as a condition of bringing a lawsuit. 72 The authorization exception therefore cannot be relied on to preserve ex parte contact without judicial oversight. Second, the litigation exception is limited by the court order requirement. The litigation exception allows for disclosures either by court order or "[i]n response to a subpoena, discovery request, or other lawful process." 73 The latter category contemplates formal procedure: subpoenas, discovery requests, and lawful process are all mechanisms under court rules. 74 And HIPAA's satisfactory assurances requirement, requiring the requesting party or covered entity to obtain a qualified protective order or give notice so the plaintiff can do the same, 75 expressly contemplates court oversight of the discovery process. Ex parte interviews, which are defined by their informality and lack of court oversight, 76 cannot operate as "other lawful process" under HIPAA. This leaves the court order as HIPAA's last acceptable option, which necessarily requires court oversight of the ex parte contact process. But like a court dispute over the terms of a "voluntary" authorization, a court's time, expense, and energy to weigh the terms of an ex parte contact and to issue an appropriate order limiting the contact's scope completely undermine the original rationale for ex parte contact as a cost-saving mechanism. At that point the court is effectively issuing discovery orders, as with any other discovery dispute. The purpose of Langdon 's informal discovery was to "further the wise application of judicial resources," allowing parties to evaluate claims and defenses without involving the court. 77 But complying with HIPAA, at least when the parties do not agree, 78 necessarily involves court time and expense. These limitations make our current ex parte contact system, though compatible with HIPAA in the abstract, a poor discovery mechanism. 79 We therefore consider overruling Langdon under our traditional stare decisis analysis. "We will overrule a prior decision only when clearly convinced that the rule was *577 originally erroneous or is no longer sound because of changed conditions, and that more good than harm would result from a departure from precedent." 80 As explained, the Langdon rule no longer is sound because of changed conditions, namely Congress's enactment of HIPAA. Considering whether more harm than good would result from overruling Langdon , we conclude that it would be better to move forward with a rule that is more consistent with current views on medical privacy and that will ensure trial courts are more focused on complying with HIPAA. We also note other courts' view that ex parte contact undermines the fiduciary relationship between treating physician and patient-plaintiff and presents opportunities for abuse that must be curbed by judicial oversight. 81 We conclude that, absent agreement between the parties, medical discovery should be conducted through the formal discovery rules rather than ex parte contact. We therefore overrule Langdon 's general approval of defense ex parte contacts with a plaintiff's treating physicians as an informal discovery device in the normal course of litigation and agree that a plaintiff should not be compelled to authorize such ex parte contacts. We believe that formal discovery methods are more apt to comply with law and promote justice in the vast majority of cases and that there will be few, if any, extraordinary situations in which an ex parte contact authorization order is necessary under HIPAA's litigation exception. D. It Was Error To Grant The Motion To Compel The Medical Release In This Case. Applying this standard, the circumstances of this case are far from extraordinary. In fact, the only thing extraordinary is the breadth of Denali's requested release for medical review. Harrold-Jones is seeking compensation for medical malpractice in treating her clavicle fracture. In response Denali asked Harrold-Jones to execute an almost unrestricted release for her "complete medical record or designated record set, which includes any and all information which is relative to [her] past or current physical or mental medical condition." This expressly included records of psychiatric treatment, psychological treatment, and drug and alcohol treatment, and would have authorized Harrold-Jones's "physicians and other health care providers to discuss [her] history, care and treatment and prognosis" with Denali's counsel. There was no special showing of need for this request, nor did anything in the record suggest an ex parte interview with Harrold-Jones's treating physician was necessary for a just adjudication. It was error to grant the motion to compel Harrold-Jones to "voluntarily" execute the tendered release. Any further discovery of information within Harrold-Jones's new doctor's possession should proceed under the formal discovery rules and in strict compliance with HIPAA. V. CONCLUSION We REVERSE the superior court's order and REMAND for further proceedings consistent with this opinion. 82 Footnotes [1] Denali, Dr. Drury, and Dr. Pace are hereafter collectively referred to as "Denali" unless otherwise necessary for our discussion. [2] In this context, ex parte contact, also referred to as ex parte interview, ex parte communication, or ex parte conference, occurs when a defendant or defendant's counsel meets with a plaintiff's treating physician without the plaintiff or plaintiff's counsel present. We approved ex parte contact as an informal discovery measure in a series of decisions in the 1970s and 1980s, culminating in Langdon v. Champion , 745 P.2d 1371 , 1375 (Alaska 1987). [3] Id. ("We conclude that [our case law] authorize[s] defense counsel to engage in informal ex parte conferences with a plaintiff's treating physician."). [4] Id. at 1372 n.2. [5] Estate of Kim ex rel. Alexander v. Coxe , 295 P.3d 380 , 386 (Alaska 2013). [6] Catalina Yachts v. Pierce , 105 P.3d 125 , 128 (Alaska 2005). [7] Id. (quoting Kodiak Island Borough v. Roe , 63 P.3d 1009 , 1012 n.6 (Alaska 2003) ). [8] Harrold-Jones v. Drury , No. S-16436 (Alaska Supreme Court Order, Nov. 2, 2016). [9] Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. No. 104-191, 110 Stat. 1936 (codified in scattered sections of 18, 26, 29, and 42 U.S.C.). [10] Id. §§ 261-62, 264. [11] Id. § 264. [12] 45 C.F.R. §§ 160 , 164 (2017). [13] HIPAA § 264(c)(2). [14] 45 C.F.R. § 160.202 . Section 160.202 also provides that a state law is contrary to HIPAA if it is contrary to sections 13400 to 13424 of the American Recovery and Reinvestment Act of 2009, but these provisions are not relevant to this petition. [15] See 45 C.F.R. § 164.502 (a) ("A covered entity or business associate may not use or disclose protected health information, except as permitted or required by [HIPAA]."). [16] 45 C.F.R. § 160.103 defines a "[c]overed entity" as a health plan, health care clearinghouse, or health care provider who transmits any health information in electronic form in a HIPAA-covered transaction. [17] 45 C.F.R. § 160.103 defines "[u]se" as "the sharing, employment, application, utilization, examination, or analysis of [individually identifiable health information]" and "[d]isclosure" as "the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information." [18] 45 C.F.R. § 160.103 defines "[p]rotected health information" as "individually identifiable health information." [19] 45 C.F.R. § 164.502 (a). [20] The two mandatory exceptions, concerning an individual's right to information and HHS's enforcement of its regulations, are not at issue here. See id. § 164.502(a)(2). [21] Compare id. § 164.502(a)(1) ("A covered entity is permitted to use or disclose protected health information as follows...." (emphasis added) ), with id. § 164.502(a)(2) ("A covered entity is required to disclose protected health information...." (emphasis added) ). [22] Id. § 164.508. [23] Id. § 164.512(e). [24] Id. § 164.508(b)(1). [25] Id. §§ 164.508(a)(3)(ii), (a)(4)(ii), (c)(1). [26] Id. § 164.508(c)(3). [27] Id. § 164.508(c)(2)(i). [28] Id. § 164.508(b)(5). This right is subject to two exceptions not at issue in this case. See id. § 164.508(b)(5)(i)-(ii). [29] Id. § 164.502(b)(1). [30] Id. § 164.502(b)(2)(iii). [31] See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462 , 82,519 (Dec. 28, 2000). [32] 45 C.F.R. § 164.508 (a)(1) ("When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization."); see also Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82 ,513 -14 ("In the final rule, we clarify that covered entities are bound by the statements provided on the authorization; use or disclosure by the covered entity for purposes inconsistent with the statements made in the authorization constitute a violation of this rule."). [33] 45 C.F.R. § 164.512 (a). [34] Id. § 164.512(e)(1)(i) ; see also Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462 , 82,529 (Dec. 28, 2000) ("For example, a subpoena issued by a court constitutes a disclosure which is required by law as defined in this rule, and nothing in this rule is intended to interfere with the ability of the covered entity to comply with such subpoena."). [35] See 45 C.F.R. § 164.103 . For instance, it would violate HIPAA if, under Alaska law, a trial court's order constituted an abuse of discretion by being overly broad. Cf. Khalsa v. Chose , 261 P.3d 367 , 373 (Alaska 2011) (upholding order to sign medical waivers against challenge that order was overbroad). [36] 45 C.F.R. § 164.512 (e)(1)(ii). [37] Id. § 164.512(e)(1)(ii)(A). [38] Id. § 164.512(e)(1)(ii)(B). [39] Id. § 164.512(e)(1)(vi). [40] Id. § 164.502(a)(1). [41] Compare id. § 164.508(a)(1) ("When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization."), with id. § 164.512(e)(1), (1)(i) ("A covered entity may disclose protected health information in the course of any judicial or administrative proceeding ... provided that the covered entity discloses only the protected health information expressly authorized by such order."); see also supra note 35 . [42] 45 C.F.R. § 164.512 (e)(v). [43] See supra p. 572. [44] See 45 C.F.R. § 164.502 (b)(2)(v) ("This [minimum necessary] requirement does not apply to ... [u]ses or disclosures that are required by law, as described by § 164.512(a)...."). [45] See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462 , 82,530 (Dec. 28, 2000) ; see also id. at 82,531 ("Where a disclosure made pursuant to this paragraph is required by law, such as in the case of an order from a court or administrative tribunal, the minimum necessary requirements in § 164.514(d) do not apply."). [46] U.S. Const. art. VI, cl. 2. [47] Allen v. State, Dep't of Health & Soc. Servs., Div. of Pub. Assistance , 203 P.3d 1155 , 1161-62 (Alaska 2009). [48] See id. at 1161 ; HIPAA § 264(c)(2). [49] HIPAA § 264(c)(2). [50] 45 C.F.R. § 160.202 . [51] See Standards for Privacy of Individually Identifiable Health Information, 64 Fed. Reg. 59,918 , 59,996 (proposed Nov. 3, 1999) ("The term 'contrary' appears throughout [HIPAA] and is a precondition for any preemption analysis done under that section."). [52] 45 C.F.R. § 160.202 . [53] Id. § 164.502(a). [54] Id. § 164.508(a)(1). [55] See Murphy v. Dulay , 768 F.3d 1360 , 1374 (11th. Cir. 2014) ("Accordingly, no other HIPAA exception for disclosure needs to be satisfied once an individual signs a valid written authorization."); Arons v. Jutkowitz , 9 N.Y.3d 393 , 850 N.Y.S.2d 345 , 880 N.E.2d 831 , 842 (2007) ("After plaintiffs declined to sign [HIPAA-compliant] authorizations, defendants asked the trial courts for orders compelling them to do so, and the courts granted these requests. This was entirely proper."). [56] 45 C.F.R. § 164.512 (e)(1). [57] See Trans-World Invs. v. Drobny , 554 P.2d 1148 , 1152 n.15 (Alaska 1976) ("[T]he filing of the personal injury suit is the operative fact of waiver."); see also Proceeding , Black's Law Dictionary (10th ed. 2014) ("The regular and orderly progression of a lawsuit, including all acts and events between the time of commencement and the entry of judgment."). [58] See 45 C.F.R. § 160.202 . [59] Id. [60] HIPAA § 264(b)-(c). [61] See 45 C.F.R. § 164.508 (b)(4). [62] See Murphy v. Dulay , 768 F.3d 1360 , 1375 (11th Cir. 2014) ("Had the drafters of the HIPAA regulations wished to preclude a state legislature from conditioning a public benefit-such as filing a lawsuit-on signing a HIPAA authorization, they could have easily done so, just as they generally prohibited doctors from conditioning medical treatment on signing a HIPAA authorization. The regulations do not do so, and we must give effect to the regulations' silence."). [63] 45 C.F.R. § 160.202 . [64] 554 P.2d 1148 , 1151-52 (Alaska 1976). [65] 571 P.2d 1006 , 1008 (Alaska 1977). [66] See 45 C.F.R. § 164.508 (a)(1). [67] See id. § 164.512(e)(1). [68] See Drobny , 554 P.2d at 1151 . [69] See 45 C.F.R § 164.508 (b)(5). [70] See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462 , 82,657 -58 (Dec. 28, 2000) (explaining that HHS "intend[s] the authorizations required under this rule to be voluntary for individuals" and that "this right [to revoke an authorization at any time] is essential to ensuring that the authorization is voluntary"). [71] See supra p. 572 and n.32. [72] Some states' legislatures have enacted a standard release that a plaintiff must sign to bring a personal injury suit. See Murphy v. Dulay , 768 F.3d 1360 , 1375 (11th Cir. 2014) (Florida); Stevens ex rel. Stevens v. Hickman Cmty. Health Care Servs., Inc. , 418 S.W.3d 547 , 557-58 (Tenn. 2013) ; In re Collins , 286 S.W.3d 911 , 920 (Tex. 2009). As in these jurisdictions, Alaska's legislature could enact a law requiring a standard release that would not be preempted by HIPAA. But even were the legislature to do so, trial courts would have to interpret disputed language in the release, and the problem we have identified would remain unresolved. [73] 45 C.F.R. § 164.512 (e)(1)(i)-(ii). [74] See Caldwell v. Chauvin , 464 S.W.3d 139 , 151-53 (Ky. 2015) (holding ex parte interviews were available pursuant to court order but "do not come within the meaning of lawful process as used in 45 C.F.R. § 165.512 (e)(1)(ii)"). We agree with the Caldwell court that "lawful process" is best read as meaning a court procedure like a summons, and cannot simply mean "any action that is not illegal." Id. at 152 . Contra Holman v. Rasak , 486 Mich. 429 , 785 N.W.2d 98 , 106 (2010) ("[A] request for an ex parte interview is at least 'other lawful process' within the meaning of [HIPAA]."). [75] See supra p. 572-73. [76] See Langdon v. Champion , 745 P.2d 1371 , 1374 (Alaska 1987) (describing ex parte interviews as "informal private conferences"). [77] Id. at 1373 (quoting Trans-World Invs. v. Drobny , 554 P.2d 1148 , 1151-52 (Alaska 1976) ). [78] Nothing in this opinion should be construed as preventing a plaintiff from voluntarily executing an acceptable authorization allowing ex parte contact. We hold only that trial courts should abstain from compelling an authorization over a plaintiff's objections. [79] See Sorensen v. Barbuto , 177 P.3d 614 , 619 (Utah 2008) ("[A]ppropriately limiting the scope of a treating physician's disclosure requires judicial monitoring that cannot occur in the context of ex parte communications."). [80] Thomas v. Anchorage Equal Rights Comm'n , 102 P.3d 937 , 943 (Alaska 2004) (quoting State, Commercial Fisheries Entry Comm'n v. Carlson , 65 P.3d 851 , 859 (Alaska 2003) ). [81] See, e.g. , Duquette v. Superior Court , 161 Ariz. 269 , 778 P.2d 634 , 640 (App. 1989) ("We believe that ex parte communications between defense attorneys and plaintiffs' treating physicians would be destructive of both the confidential and fiduciary natures of the physician-patient relationship...."); Sorensen , 177 P.3d at 619 ("Allowing ex parte communications between a treating physician and opposing parties in litigation would undermine the physician-patient relationship because patients would lack adequate assurance that their candid responses to questions important to determining their appropriate medical treatment would remain confidential."). [82] We also granted review on what a plaintiff could require be included in a HIPAA-compliant release before agreeing to sign it and when under HIPAA a qualified protective order must be issued. Because we conclude that we should overrule our ex parte contact case law in light of HIPAA, we do not address these questions in this opinion.