In re Antonia E.

OPINION OF THE COURT John M. Hunt, J. The presentment agency has moved for an order directing the issuance of a judicial subpoena duces tecum directing that the Jamaica Hospital Medical Center produce its records relating to the treatment of respondent’s brother, Christopher E., for inspection in connection with this juvenile delinquency proceeding. By petition filed on April 4, 2007, respondent, Antonia E., is alleged to have committed acts which, were she an adult, would constitute the crimes of assault in the second and third degrees, attempted assault in the second degree and criminal possession of a weapon in the fourth degree. The petition alleges that on April 3, 2007 the respondent assaulted her brother, Christopher E., with her hands and a screwdriver and attempted to hit him with a hammer, and that Christopher sustained physical injury as a result of the incident. On April 3, 2007 Christopher provided a written narrative of the incident to Police Officer Michael Carleo of the 113th Precinct. The written statement of Christopher as well as the supporting deposition of Officer Carleo are appended to the petition. Following a hearing pursuant to Family Court Act § 307.4 on April 4, 2007 and respondent’s initial appearance upon the petition on April 18, 2007, the case was adjourned for a fact-finding hearing on June 7, 2007. On May 4, 2007 the presentment agency filed this order to show cause seeking the issuance of a subpoena duces tecum directing Jamaica Hospital Medical Center to produce its records relating to its treatment of Christopher in relation to the incident alleged in the petition. In support of its application, the presentment agency alleges that production of the medical record from Jamaica Hospital relating to the treatment of the victim is required in order to allow the presentment agency to establish the commission of the charged crimes beyond a reasonable doubt, whether or not the victim is willing to cooperate further in the prosecution of this case involving alleged intrafamilial violence. The Family Court is authorized to issue a subpoena duces tecum in a proper case to order the production of materials — 639 — which are relevant to a pending judicial proceeding (Judiciary Law § 2-b [1]; Family Ct Act § 153; CPLR 2307; see, Matter of Terry D., 81 NY2d 1042, 1044 [1993]; Matter of Bernard C., 168 Misc 2d 813, 820 [1996]; Matter of Board of Educ. of City of N.Y. v Hankins, 294 AD2d 360 [2002], lv denied 99 NY2d 610 [2003]; People v Thurston, 209 AD2d 976, 977 [1994], lv denied 85 NY2d 915 [1995]; Matter of Constantine v Leto, 157 AD2d 376, 378 [1990], affd 77 NY2d 975 [1991]). However, in this case, because the presentment agency here seeks to compel the production of information which comes within the scope of the state’s physician-patient privilege and which also constitutes “protected health information,”1 as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 USC § 1320a — 1320d-8), the court is unable to simply issue an order or a subpoena directing the production of a hospital record which appears to be relevant to the issues in this proceeding. “The intent of HIPAA is to ensure the integrity and confidentiality of patients’ [medical] information and to protect against unauthorized uses or disclosures of the information” (Northlake Med. Ctr., LLC v Queen, 280 Ga App 510, 511, 634 SE2d 486, 489 [2006] [internal quotation marks omitted]; see, Arons v Jutkowitz, 37 AD3d 94, 98 [2006]; Allen v Wright, 282 Ga 9, 11, 644 SE2d 814, 816 [2007]; Gunn v Sound Shore Med. Ctr. of Westchester, 5 AD3d 435, 437 [2004]), and HIPAA and its regulations (the privacy rules) clearly supersede any contrary provisions of state law which are less stringent than HIPAA (45 CFR 160.203; Crenshaw v MONY Life Ins. Co., 318 F Supp 2d 1015, 1028 [SD Cal 2004]; Law v Zuckerman, 307 F Supp 2d 705, 708 [D Md 2004]; National Abortion Fedn. v Ashcroft, 2004 WL 292079, *3, 2004 US Dist — 640 — LEXIS 1701, *8 [ND Ill 2004]; United States ex rel. Stewart v Louisiana Clinic, 2002 WL 31819130, *3, 2002 US Dist LEXIS 24062, *8 [ED La 2002]; Allen v Wright, 282 Ga at 12, 644 SE2d at 816; Findley v Findley, 937 So 2d 912, 916 [La Ct App 2006], writ denied 938 So 2d 88 [La Sup Ct 2006]). 45 CFR 164.512 (e) sets forth the standards for disclosure of protected health information pursuant to an order in judicial and administrative proceedings.2- 3 The regulation reads as follows: “(e) Standard: Disclosures for judicial and administrative proceedings. “(1) Permitted Disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding: “(i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order.” HIPAA “clearly anticipates disclosures of protected health information pursuant to a court order” (Holmes v Nightingale, 158 P3d 1039, 1041 [Okla 2007]; e.g., Arons v Jutkowitz at 99; Northwestern Mem. Hosp. v Ashcroft, 362 F3d 923, 926 [7th Cir 2004]; Crenshaw v MONY Life Ins. Co. at 1028; Bayne v Provost at 237; Anderson v City of New York, 2006 WL 1134117, 2006 US Dist LEXIS 25805 [SD NY 2006]). In this proceeding, the presentment agency seeks court-ordered production of the Jamaica Hospital record relating to its postincident treatment of the alleged victim, which contains information which consti — 641 — tutes protected, health information covered by HIPAA and which is also protected by New York’s physician-patient privilege. HIPAA’s provisions (42 USC § 1320d-7 [a] [1]; 45 CFR 160.203) expressly preempt state law unless the state law relates to the privacy of individually identifiable health information and is more stringent than HIPAA’s requirements (45 CFR 160.203 [b]; see, Law v Zuckerman at 708-709; South Carolina Med. Assn. v Thompson, 327 F3d 346, 349 [4th Cir 2003], cert denied 540 US 981 [2003]; United States ex rel. Stewart v Louisiana Clinic, 2002 WL 31819130, *3, 2002 US Dist LEXIS 24062, *8; Allen v Wright, 282 Ga at 12, 644 SE2d at 816; North-lake Med. Ctr., LLC v Queen, 280 Ga App at 511-512, 634 SE2d at 488-489; National Abortion Fedn. v Ashcroft, 2004 WL 292079, *2-3, 2004 US Dist LEXIS 1701, *7-8), and the regulations state that “a state law is ‘more stringent’ than HIPAA if it ‘provides greater privacy protection for the individual who is the subject of the individually identifiable health information’ ” (South Carolina Med. Assn. v Thompson at 355, quoting 45 CFR 160.202).4 “To further clarify this standard, the regulation explains that a state law is more stringent where it meets one or more of the following criteria: the state law prohibits or restricts a use or a disclosure of information where HIPAA would allow it; the state law provides an individual with greater rights of access or amendment to his medical information than provided under HIPAA; the state law provides an individual with a greater amount of information about a use, a disclosure, rights, and remedies; the state law provides for the retention or reporting of more detailed information or for a longer duration; or the state law provides greater privacy protection for the individual who is the subject of the individually identifiable health information” (id. at 355, quoting 45 CFR 160.202 [internal quotation marks omitted]). The relevant provision of New York law is the physician-patient privilege, which is codified at Civil Practice Law and — 642 — Rules § 4504. Upon consideration of the physician-patient privilege and the broad provisions for court-ordered disclosure under HIPAA, this court finds that HIPAA provisions do not supersede New York law.5 New York’s physician-patient privilege (CPLR 4504), is entirely a creation of statute, as there was no common-law privilege preventing the disclosure of communications between a doctor and a patient (Williams v Roosevelt Hosp., 66 NY2d 391, 395 [1985]; Dillenbeck v Hess, 73 NY2d 278, 283-284 [1989]; Matter of Grand Jury Investigation in N.Y. County, 98 NY2d 525, 529 [2002]). “The modern codification of the privilege . . . serves three core policy objectives . . . [f]irst, the physician-patient privilege seeks to maximize unfettered patient communication with medical professionals, so that any potential embarrassment arising from public disclosure will not deter people from seeking medical help and . . . treatment . . . [s]econd, the privilege encourages medical professionals to be candid in recording confidential information in patient medical records, and thereby averts a choice between their legal duty to testify and their professional obligation to honor their patients’ confidences . . . [t]hird, the privilege protects patients’ reasonable privacy expectations against disclosure of sensitive personal information” (Matter of Grand Jury Investigation at 529 [internal quotation marks and citations omitted]; see, Williams v Roosevelt Hosp. at 395; Dillenbeck v Hess at 285). Civil Practice Law and Rules § 4504 (a) provides that “[u]n-less the patient waives the privilege, a person authorized to practice medicine . . . shall not be allowed to disclose any information which [s]he acquired in attending a patient in a professional capacity, and which was necessary to enable him [or her] to act in that capacity,” and courts have afforded the physician-patient privilege “a broad and liberal construction to carry out its policy” (People v Sinski, 88 NY2d 487, 492 [1996]; see, Mat — 643 — ter of Marie H., 25 AD3d 704, 709 [2006, Skelos, J., concurring]). In this context, “[t]he privilege applies not only to information communicated orally by the patient, but also to information obtained from observations of the patient’s appearance and symptoms, unless the facts observed would be obvious to laymen” (Dillenbeck v Hess at 284 [internal quotation marks omitted]). The privilege applies to information contained in a patient’s medical record (id.), and “it serves also to protect the patient from being compelled to disclose the substance of a communication made to the medical professional in an attempt to obtain treatment” (Williams v Roosevelt Hosp. at 396). In addition, a hospital may assert the privilege to maintain the confidentiality of patient medical records, including emergency room records because, as a matter of policy, “[p]atients should not fear that merely by obtaining emergency medical care they may lose the confidentiality of their medical records and their physicians’ medical determinations” (Matter of Grand Jury Investigation at 532). To interpret the rule differently “would discourage critical emergency care, intrude on patients’ confidential medical relationships and undermine patients’ reasonable expectations of privacy” (id.). Notwithstanding the broad scope of the physician-patient privilege, it is not absolute. For example, the privilege does not prevent disclosure of information concerning a condition which would be readily ascertainable by a layperson, as illustrated by the recent decision in People v Greene (36 AD3d 219, 226 [2006], lv granted 8 NY3d 922 [2007]), in which the Appellate Division held that there had been no violation of defendant’s physician-patient privilege where a hospital administrator divulged his name and address in response to a detective’s inquiry as to whether anyone had recently been treated for facial slash wounds. Similarly, it is well established that a litigant waives the privilege where in bringing or defending a personal injury action he or she affirmatively places his or her mental or physical condition in issue (Dillenbeck v Hess at 287; Green v Montgomery, 95 NY2d 693, 700 [2001]; Berger v Fornari, 12 AD3d 389, 390 [2004]; Bongiorno v Livingston, 20 AD3d 379, 381 [2005]; Palma v Harnick, 31 AD3d 406, 407 [2006]). However, under the circumstances of this case, the court cannot find that the alleged victim has expressly or impliedly waived his right to maintain the physician-patient privilege with respect to the hospital record relating to his postincident treatment. “Generally and excepting instances where there would be transgressions of public policy, all rights and privileges to which — 644 — one is entitled, ex contractu or ex debito justitiae, may be waived” (Hadden v Consolidated Edison Co. of N.Y., 45 NY2d 466, 469 [1978]). A “[w]aiver is an intentional relinquishment of a known right and should not be lightly presumed” (Gilbert Frank Corp. v Federal Ins. Co., 70 NY2d 966, 968 [1988]; see, Nassau Trust Co. v Montrose Concrete Prods. Corp., 56 NY2d 175, 184 [1982]; General Motors Acceptance Corp. v Clifton-Fine Cent. School Dist., 85 NY2d 232, 236 [1995]; Matter of McManus v Board of Educ. of Hempstead Union Free School Dist., 87 NY2d 183, 189 [1995]; Fundamental Portfolio Advisors, Inc. v Tocqueville Asset Mgt., L.P., 7 NY3d 96, 104 [2006]). “Generally, the existence of an intent to forgo ... a right is a question of fact” (Fundamental Portfolio Advisors, Inc. v Tocqueville Asset Mgt. at 104; see, Jefpaul Garage Corp. v Presbyterian Hosp. in City of N.Y., 61 NY2d 442, 446 [1984]), and in this case, there is no basis to presume that the alleged victim waived the physician-patient privilege based upon the fact that he obtained emergency medical treatment and provided a narrative of the event to the police. In that regard, it should be noted that the alleged victim did not initiate this litigation (see, Family Ct Act § 310.1), nor is he a party to the proceeding who has affirmatively placed his physical condition in issue. While the alleged victim did provide an oral and written narrative of the event to the police officer, it is the presentment agency which has placed the victim’s physical condition at issue in this case by filing the petition and pressing its prosecution although it appears that the alleged victim will not cooperate further in the prosecution of his sister. Accordingly, the court concludes that the statutory physician-patient privilege is more stringent than the HIPAA provisions which broadly allow a court to order discovery in a judicial proceeding, and that HIPAA does not supersede New York law. By way of example, the court notes that in National Abortion Fedn. v Ashcroft (supra), the District Court found that the Illinois physician-patient privilege statute (735 Ill Comp Stat Ann § 5/8-802), “is more stringent than HIPAA’s disclosure requirements” and it was therefore not superseded by HIPAA (2004 WL 292079, *3-4, 2004 US Dist LEXIS 1701, *8-12; see, Kraima v Ausman, 365 Ill App 3d 530, 533, 850 NE2d 840, 844 [1st Dist 20061). A comparison of the Illinois physician-patient privilege statute and Civil Practice Law and Rules § 4504 reveals that they are written in essentially similar language and that they share comparable histories (see, People ex rel. Dept. of Profes — 645 — sional Regulation v Manos, 202 Ill 2d 563, 575-576, 782 NE2d 237, 245 [2002]; Parkson v Central DuPage Hosp., 105 Ill App 3d 850, 852, 435 NE2d 140, 141-142 [1st Dist 1982]).6 Thus, if HIPAA would not allow less disclosure than the Illinois statute, it is unlikely that HIPAA is more stringent than Civil Practice Law and Rules § 4504 and that the New York physician-patient privilege is not preempted by HIPAA in this situation.7 Accordingly, the presentment agency’s application for the issuance of a judicial subpoena duces tecum directing the production of the alleged victim’s medical record from Jamaica Hospital is denied. Footnotes [1] 45 CFR 160.103 defines “protected health information” as “individually identifiable health information,” and “individually identifiable health information” is defined as health information that “is created or received by a health care provider, health plan, employer, or health care clearinghouse; and relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) that identifies the individual; or (ii) with respect to which there is a reasonable basis to believe the information can be used to identify the individual” (Coffie v City of Chicago, 2006 WL 1069132, *4, 2006 US Dist LEXIS 22061, *14-15 [ND Ill 2006] [internal quotation marks omitted], quoting 45 CFR 160.103; e.g., Bayne v Provost, 359 F Supp 2d 234, 236 [ND NY 2005]). [2] An order of a court or an administrative tribunal is not the exclusive method by which disclosure of protected health information may be obtained. Disclosure may be obtained where the person whose protected information is sought executes a valid authorization in accordance with 45 CFR 164.508, or where the party seeking disclosure serves a disclosure request or a subpoena for the protected health information which may or may not be accompanied by a judicial protective order limiting disclosure (45 CFR 164.512 [e] [1] [ii]; see, Arons v Jutkowitz at 98-99; Northwestern Mem. Hosp. v Ashcroft, 362 F3d 923, 925 [2004]; Northlake Med. Ctr., LLC v Queen, 280 Ga App at 514, 634 SE2d at 490 [2006]; Crenshaw v MONY Life Ins. Co. at 1028). [3] A valid authorization under 45 CFR 164.508 must, inter alia, describe the protected health information which is to be disclosed, the person or persons to whom the covered entity may make the requested use or disclosure and a description of each purpose of the requested use or disclosure. In addition, the authorization must contain an expiration date or event for disclosure and it must also notify the patient that he or she may revoke the authorization (45 CFR 164.508 [c] [1] [i]-[iv]). [4] 45 CFR 160.203 (b) provides that the general rule of preemption will not apply where “[t]he provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter.” [5] A comparative analysis between the provisions of HIPAA and state law will always be necessary where protected health information is sought in a state court action or in a diversity action in a federal court (e.g., South Carolina Med. Assn. v Thompson at 355 [comparison between state law and HIPAA is required]; Crenshaw v MONY Life Ins. Co. at 1028 [federal court must decide whether state law or HIPAA is more restrictive]; Northlake Med. Ctr., LLC v Queen, 280 Ga App at 513, 634 SE2d at 490 [two-step analysis required to determine whether state law preempted by HIPAA]). [6] 735 Illinois Compiled Statutes Annotated § 5/8-802 provides, in pertinent part, that “[n]o physician or surgeon shall be permitted to disclose any information he or she may have acquired in attending any patient in a professional character, necessary to enable him or her professionally to serve the patient.” [7] Under the common law of Illinois there was no privilege attaching to communications between a physician and a patient and the privilege is entirely a creation of legislation (Manos, 202 111 2d at 568, 782 NE2d at 241). The Illinois statute provides confidentiality for physician-patient communications that is equal to that provided by the New York statute as interpreted by the courts (202 Ill 2d at 575-576, 782 NE2d at 245-246).