Givens v. Department of Justice Services

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF MISSOURI EASTERN DIVISION BRENDA GIVENS, et al., ) ) Plaintiffs, ) ) vs. ) No. 4:18-CV-1732 SPM ) ) SAINT LOUIS COUNTY, et al., ) ) Defendants. ) MEMORANDUM AND ORDER This matter is before the Court on Plaintiffs Brenda and Gary Givens’ Motion to Quash and/or for Protective Order for certain of Defendants’ Supplemental Disclosures of Marie Walker, M.D. and Philomena Akoh, M.D. (Doc. 112.) This matter is pending before the undersigned United States Magistrate Judge, with consent of the parties, pursuant to 28 U.S.C. § 636 (c). Defendants Marie Walker, M.D. (“Walker”) and Philomena Akoh, M.D. (“Akoh”) (collectively “Defendants”) filed a memorandum in opposition to the motion to quash/for protective order (Doc. 114), Plaintiffs filed a reply (Doc. 118), and Defendants filed a sur-response1 (Doc. 122). For the reasons stated below, the motion to quash and/or for a protective order will be denied. I. Background In this lawsuit, Plaintiffs Brenda and Gary Givens (“Plaintiffs”) filed suit on behalf of their son, decedent Zachary Givens (“Decedent”), who was an inmate at the Buzz Westfall Justice 1 Defendants’ sur-response argues that Plaintiffs’ characterization of the production of Decedent’s records as unethical behavior “must be stricken.” Defendants have not filed a motion to strike or referenced the standard of relief in their pleading. Federal Rule of Civil Procedure 12(f) provides that “the court may strike from a pleading an insufficient defense or any redundant, immaterial, impertinent, or scandalous matter.” Such an action is “an extreme measure,” and such motions are disfavored and infrequently granted. Stanbury Law Firm v. I.R.S., 221 F.3d 1059, 1963 (8th Cir. 2000). Accordingly, the Court denies Defendants’ request to strike specific references in Plaintiffs’ briefing. Center in St. Louis County. Plaintiffs’ Second Amended Complaint alleges that while Decedent was incarcerated, Defendants failed to timely and appropriately treat and respond to Decedent’s complaints and requests for medical treatment, and as a result of Defendants’ substantial and deliberate indifference to Decedent’s health, safety and welfare, Decedent suffered injuries and ultimately death. (Doc. 32.) Decedent was incarcerated on November 21, 2016, and his death occurred on December 29, 2016. (Doc. 32, ¶¶ 8, 30.) In their responsive pleadings, Defendants Walker and Akoh assert affirmative defenses related to causation issues, including that Decedent’s own negligence and comparative negligence contributed or proximately caused his alleged injuries and damages, and that the intervening acts or omissions of other persons or entities caused Decedent’s injuries. (Docs. 56, 63.) On April 14, 2020, Defendants Walker and Akoh submitted supplemental Rule 26(a)(1) disclosures that included records of Decedent’s treatment at Saint Louis University (“SLU”) Hospital. Defendants obtained the records at issue2 without obtaining any prior authorization from Plaintiffs. Plaintiffs then brought the present motion, asserting Defendants obtained the records in violation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Plaintiffs now seek an order to prevent the disclosure or use of the records at issue, including use of or reliance on the records by any defendant, witness, or expert in this case. (Doc. 112.) II. Discussion A party may move for a protective order to protect themselves from annoyance, embarrassment, oppression, or undue burden or expense. Fed. R. Civ. P. 26(c). A district court has broad discretion to decide when a protective order is appropriate and what degree of protection is 2 The records at issue have not been made a part of the record, and the Court has not reviewed them. Based on representations made in the parties’ briefing, it appears the records pertain to Decedent’s treatment at the SLU Hospital Emergency Department on April 16, 2016, and on September 12-13, 2016, for accidental drug overdoses. [2] required. See Roberts v. Shawnee Mission Ford, Inc., 352 F.3d 358, 362 (8th Cir. 2003). The party moving for the protective order has the burden to demonstrate good cause for issuance of the order. Buehrle v. City of O’Fallon, MO, No. 4:10-cv-509 AGF, 2011 WL 529922 , at *2 (E.D. Mo. Feb. 8, 2011). For good cause to exist, the movant must demonstrate the specific prejudice or harm that would result if no protective order is granted. Id. Plaintiffs raise three arguments. First, Plaintiffs argue that Defendants should not be able to use the records because Defendants obtained them in violation of HIPAA. Second, assuming arguendo that Defendants obtained the records in compliance with HIPAA, the records are irrelevant and should not be used. Third, Defendants’ access to the records violates Missouri’s public policy protecting the physician-patient privilege. The Court considers each argument in turn. A. HIPAA HIPAA generally prohibits a “covered entity” from using or disclosing protected health information unless use or disclosure is permitted or required under HIPAA regulations. 45 C.F.R. § 164.502 . A “covered entity” includes “a health care provider3 who transmits any health information in electronic form,” and “disclosure” in this context means “the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.” 45 C.F.R. § 160.103 . HIPAA provides certain exceptions to the general rule against disclosure of protected health information without the individual’s4 prior written consent. 3 A health care provider is a provider of medical or health services or any other person or organization who furnishes, bills, or is paid for health care in the normal course of business. 45 C.F.R. § 160.103 . 4 Although the individual in this case is deceased, a covered entity must comply with the requirements discussed herein with respect to protected health information of a deceased individual for a period of fifty years following his death, and a covered entity must treat a personal representative (here, Plaintiffs) as the individual for purposes of these statutes. See 45 C.F.R. §§ 160.103 ,164.502(f), (g). [3] The parties agree that the records at issue are entitled to HIPAA protection. Their dispute lies in whether Defendants’ accessing and producing Decedent’s SLU Hospital visit records without a medical authorization constitutes a violation of HIPAA. Defendants argue that no authorization was required to obtain the records because Defendants and SLU Hospital can properly access each other’s records for treatment and “health care operations” purposes under HIPAA regulations 45 C.F.R. § 164.502 and § 164.506. Section 164.502 states a covered entity may use or disclose protected health information “for treatment, payment, or health care operations, as permitted by and in compliance with § 164.506.” 45 C.F.R. § 164.502 (a)(1)(ii). Section 164.506(a) states that a covered entity may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph 506(c). Health care operations includes “[c]onducting and arranging for medical review, legal services, and auditing functions.” 45 C.F.R. § 164.501 . Defendants assert two subsections of § 164.506(c) are applicable here: (c) Implementation specifications: Treatment, payment, or health care operations. (1) A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations. *** (5) A covered entity that participates in an organized health care arrangement may disclose protected health information about an individual to other participants in the organized health care arrangement for any health care operations activities of the organized health care arrangement. 45 C.F.R. § 164.506 (c). Plaintiffs assert, without further legal analysis, that Defendants’ reliance on these regulations is improper because the records at issue are SLU Hospital records, the Hospital is not a named party in the lawsuit, and Defendants Akoh and Walker were not employed as SLU physicians at the time of the incident. Thus, Plaintiffs claim that Defendants cannot state the disclosure was for the legal services of SLU Hospital. However, according to Defendants’ [4] discovery responses and correspondence between counsel, Defendant Akoh was a psychiatry resident with SLU, Defendant Walker was employed as a contract psychiatrist by SLU, and SLU staffed the Hospital with SLU physicians. Thus, Defendants were SLU physicians at the time of the incident. By way of their employment or affiliation with SLU, both Defendants were to provide services at the Saint Louis County Justice Center, where Decedent was in custody during the incidents alleged by Plaintiffs. Neither party directs the Court to cases applying the health care operations exceptions to HIPAA’s general rule against disclosure. The Court’s own research suggests that under the first exception, § 164.506(c)(1), Defendants and SLU Hospital can use or disclose patient medical records for their own legal services, such as Defendants’ defense in this litigation. See, e.g., Haines v. Metro. Gov't of Nashville, 2019 WL 3288475 , at *3 (M.D. Tenn. July 22, 2019) (defendant medical provider did not need a HIPAA-compliant authorization to obtain plaintiff’s medical records because a provider has access to its own records under 45 C.F.R. § 164.501 and § 164.506(a)); McDowell v. United States, 2019 WL 8750360 , at *1 (C.D. Cal. Dec. 11, 2019) (“a covered entity may disclose health records to defend itself in litigation as part of ‘health care operations’”). The Court’s own research has not located cases interpreting the organized health care arrangement exception. However, the plain meaning5 of this exception permits a hospital participating in an organized health care arrangement to disclose protected health information about an individual to other doctors in the organized health care arrangement for arranging or conducting legal services for the organized health care arrangement. See § 164.506(c)(5). 5 The plain language of the statute controls its interpretation. In re M & S Grading, Inc., 457 F.3d 898, 901 (8th Cir. 2006). [5] An organized health care arrangement (“OHCA”) includes “[a] clinically integrated care setting in which individuals typically receive health care from more than one health care provider.” 45 C.F.R. § 160.103 . Defendants state that Saint Louis University and SSM Health Care participate in an OHCA for the operation of SSM Saint Louis University Hospital. Saint Louis University and SSM Health Care hold themselves out to the public as jointly operating the Hospital, and the Hospital is “exclusively staffed by the SLUCare Physician Group.” The records at issue are SLU Hospital records, Defendants are SLU physicians, and they participate in an organized health care arrangement as defined by 45 C.F.R. § 160.103 . Thus, Defendants were permitted to access the records for health care operations activities, specifically, Defendants’ legal defense in this case. Defendants also correctly note that HIPAA provides for disclosure in federal cases where a qualified protective order has been entered. On February 1, 2019, the Court entered a HIPAA Qualified Protective Order pursuant to 45 C.F.R. § 164.512 (e)6 to prevent the unauthorized [6] 45 C.F.R. § 164.512 (e)(1) states in part: (1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding: (i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or (ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if: (A) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or (B) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v) of this section. *** (v) For purposes of paragraph (e)(1) of this section, a qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii) of this section, an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that: (A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and (B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding. (vi) Notwithstanding paragraph (e)(1)(ii) of this section, a covered entity may disclose protected health information in response to lawful process described in paragraph (e)(1)(ii) of this section without receiving satisfactory assurance under paragraph (e)(1)(ii)(A) or (B) of this section, if the covered entity makes reasonable efforts to provide notice to [6] disclosure and to direct the use of protected health information (PHI) during the litigation. (Doc. 52.) On February 18, 2020, the Court entered a Joint Protective Order pursuant to Federal Rule of Civil Procedure 26(c) and agreed to by the parties. (Doc. 89.) Under this second protective order, the parties set terms regarding use and disclosure of Confidential Information generally, which includes confidential medical records. (Doc. 89, ¶ 1.) Pursuant to both orders, the parties are not to disclose PHI for any purpose other than the litigation herein, and the protected information is to be destroyed or returned to the producing entity or provider at the end of the litigation. (Doc. 52, ¶ 3 (c)(2); Doc. 89, ¶ 7.) Defendants argue that the records at issue are already protected by the two protective orders which allow for the use of Decedent’s medical records in the litigation and set terms to protect the confidentiality of the records. Plaintiffs do not criticize the terms of the HIPAA Qualified Protective Order or the Joint Protective Order, nor do Plaintiffs explain why the terms of these orders are not sufficient to protect Decedent’s protected health information. Upon the Court’s review of the protective orders in place, the terms appear to satisfy the requirements of HIPAA and protect the records at issue from unauthorized use or disclosure. See 45 C.F.R. § 164.512 (e). Moreover, even if Defendants’ disclosure could be construed as a HIPAA violation, Plaintiffs have provided no authority to support exclusion of evidence based thereon. The Court’s own research suggests that at least in some cases, courts have declined to exclude records because HIPAA regulations do not provide for suppression of evidence as a remedy for a HIPAA violation. See, e.g., United States v. Yazzie, 998 F. Supp. 2d 1044, 1116 (D.N.M. 2014) (“HIPAA ‘provides for criminal and civil penalties against entities that fail to comply with its provisions,’ but the individual sufficient to meet the requirements of paragraph (e)(1)(iii) of this section or to seek a qualified protective order sufficient to meet the requirements of paragraph (e)(1)(v) of this section. [7] suppressing medical records does not appear to be an appropriate remedy for a HIPAA violation.” (quoting United States v. Elliott, 676 F.Supp.2d 431, 440-41 (D. Md. 2009))); Elder-Evins v. Casey, 2012 WL 2577589 , at *6 (N.D. Cal. July 3, 2012) (“As other courts have noted, HIPAA does not have a suppression remedy. And where this is the case, it is inappropriate for the court to exclude evidence on this basis.”); Smith v. Daniels, 2010 WL 4882950 , at *6 (N.D. Ga. Nov. 24, 2010) (denying plaintiff’s motion to strike a doctor’s affidavit, plaintiff’s deposition, and plaintiff’s medical records submitted by defendants because they were obtained in violation of HIPAA because plaintiff put his medical status at issue and HIPAA confers no private right of action). Additionally, where a plaintiff is not given prior notice or opportunity to object to a disclosure but the parties have a protective order in place, courts often decline to issue sanctions or otherwise order additional protections to safeguard the records. See, e.g., In re Hildenbrand, 2016 WL 4705106 , at *2 (Bankr. N.D. Iowa Sept. 8, 2016) (finding HIPAA did not provide grounds to quash a subpoena for medical records where the parties could secure a protective order prior to the release of records); Lobato v. Ford, 2007 WL 3342598 , at *5 (D. Colo. Nov. 9, 2007) (“Given the parties’ Protective Order, I find HIPAA does not mandate or warrant the non-monetary sanctions requested in Plaintiffs’ motion.”); Allen v. Woodford, 2007 WL 309485 , at *11 (E.D. Cal. Jan. 30, 2007) (“HIPAA does not create substantive rights that act as a bar on discovery.”); see also Northwestern Memorial Hospital v. Ashcroft, 362 F.3d 923, 925-26 (7th Cir. 2004) (HIPAA’s standard for disclosure is “purely procedural” and “[a]ll that 45 C.F.R. § 164.512 (e) should be understood to do, therefore, is to create a procedure for obtaining authority to use medical records in litigation.”). In light of the HIPAA Qualified Protective Order and Joint [8] Protective Order in place here, the Court finds no further safeguards are necessary to protect the records at issue. B. Relevance Plaintiffs argue that if the records were obtained in compliance with HIPAA, they should still be excluded because the only medical condition at issue under the pleadings is infective endocarditis, and Hospital records reflecting prior treatment are irrelevant to Decedent’s diagnosis and death. Defendants argue the records at issue reflect two accidental drug overdoses and contain Decedent’s statements and references to health care providers with whom Decedent was to follow up with for outpatient care, and so, they may contain information which has a tendency to make it more probable that Decedent’s infective endocarditis was caused by his IV drug use. Defendants argue this information is relevant to potential medical causation, factual background of the case, damages, and decedent’s life expectancy. Plaintiffs do not directly dispute the cause of Decedent’s infective endocarditis. Instead, Plaintiffs argue “the causation of the medical condition has never been put at issue,” and “it is [Defendants’] treatment or lack thereof that is at issue in this case.” The Court disagrees with Plaintiffs’ characterization of the issues. In their Second Amended Complaint, Plaintiffs claim that Defendants’ acts or omissions caused Plaintiffs’ injuries, including causing an undiagnosed infection in Decedent’s heart to spread, ultimately causing his death. (Doc. 32, ¶¶ 3, 46.) Plaintiffs have put Decedent’s medical condition at issue, and the Hospital records from April and September 2016 are reasonably calculated to lead to information regarding the cause of Decedent’s injuries and death in December 2016. Further, regardless of Plaintiffs’ allegations and theory of the case, Defendants have raised affirmative defenses relating to contributory or comparative negligence. Defendants are entitled to conduct discovery to investigate their defenses. See Fed. R. Civ. P. 26(b)(1) (a party may obtain discovery [9] regarding non-privileged matters relevant to any claim or defense); Kirk v. Schaeffler Grp. USA, Inc., No. 3:13-CV-05032-DGK, 2014 WL 2807681 , at *2 (W.D. Mo. June 20, 2014) (“[T]he fact that Defendants are seeking discovery on a theory of defense is irrelevant… [t]he Federal Rules of Civil Procedure do not provide different discovery rules for defendants’ theories and for plaintiffs’ theories.”). The cause of Decedent’s infective endocarditis is an issue of consequence in this case, as it may make Plaintiffs’ version of the facts or Defendants’ version of the facts more likely or less likely. The circumstances of Decedent’s presentation to the Hospital for care and his statements about those circumstances in the months prior to his death may be relevant to causation and damages, and Defendants are entitled to discovery on these issues. Plaintiffs also briefly argue that even if Decedent’s prior medical treatment is relevant, it should be prohibited because it would be prejudicial given the public’s general stigma against drug users. This is an evidentiary argument, and to address the admissibility of the records at this time would be premature. See Fed. R. Civ. P. 26(b)(1) (“Information within this scope of discovery need not be admissible in evidence to be discoverable.”). Thus, the Court rejects this argument. C. Missouri’s Physician-Patient Privilege and Public Policy Plaintiffs next briefly argue that Defendants’ unauthorized access to Decedent’s medical records was a violation of Missouri’s public policy protecting the physician-patient privilege. Defendants respond that physician-patient privilege does not preclude a defendant provider from using records to which it properly has access, and Plaintiffs have waived any applicable privilege to records which relate to conditions at issue in the case. The parties rely on cases relying on Missouri’s statutory physician-patient privilege. The Court finds no merit to these arguments because the state authorities upon which the parties rely are not relevant here. This Court has original jurisdiction in this matter pursuant to 28 10 U.S.C. § 1331 because Plaintiffs’ claims allege federal civil rights violations pursuant to 42 U.S.C. § 1983 . Thus, federal law applies, and federal common law does not recognize Missouri’s codified physician-patient privilege. See, e.g., Darden v. AT&T Corp., No. 4:14CV1198 RLW, 2015 WL 4993986 , at *2 (E.D. Mo. Aug. 19, 2015) (rejecting Plaintiffs’ claim medical records are protected by physician-patient privilege because “the Court is not required to recognize state law privileges”); Evantigroup, LLC v. Mangia Mobile, LLC, No. 4:11-CV-1328 CEJ, 2013 WL 141605 , at *1 (E.D. Mo. Jan. 11, 2013) (“[I]n a fundamentally federal proceeding, the court may not recognize a state-created privilege.”). The Court finds that Missouri’s physician-patient privilege does not control in this federal question case. Thus, any state authorities on which Plaintiffs rely are not relevant.7 The Court will not preclude use of the records at issue based on Missouri’s physician-patient privilege. III. Conclusion “Broad discovery is an important tool for the litigant.” WWP, Inc. v. Wounded Warriors Family Support, Inc., 628 F.3d 1032, 1039 (8th Cir. 2011). In this instance, the Court finds that Plaintiffs have failed to demonstrate that the records at issue do not come within the broad scope of relevance or that they would not be protected by the HIPAA Qualified Protective Order already in place. Thus, the Court will deny the motion to quash and/or for protective order. 7 Plaintiffs also suggest that allowing Defendants access to SLU Hospital’s records gives Defendants an “unfair advantage” because “Plaintiffs as non-medical personnel are not afforded the same opportunities.” Plaintiffs rely on state authority discussing the public policy evidenced by Missouri’s physician-patient privilege. See State ex rel. Woytus v. Ryan, 776 S.W.2d 389, 391 (Mo. 1989), abrogated by Brandt v. Pelican, 856 S.W.2d 658 (Mo. 1993). It is unclear what advantage Plaintiffs are referring to, as Plaintiffs are also entitled to Decedent’s medical records. Nevertheless, for the same reasons the Court rejects Plaintiffs’ physician-patient privilege argument, the Court finds no merit to Plaintiffs’ suggestion that the records must be excluded because their use would be against Missouri public policy. [11] Accordingly, IT IS HEREBY ORDERED that Plaintiffs’ Motion to Quash and/or for Protective Order (Doc. 112) is DENIED. Nib, AQ SHIRLEY PADMORE MENSAH UNITED STATES MAGISTRATE JUDGE Dated this 28th day of July, 2020.