Opinion ID: 2741507
Heading Depth: 2
Heading Rank: 1

Heading: Disclosure by Judicial Process

Text: Section 164.512 provides that “[a] covered entity may use or disclose protected health information without the written authorization of the individual, as described in § 164.508 . . . in the situations covered by this section . . . .” Id. § 164.512. One of the twelve situations covered in § 164.512 are “[d]isclosures for judicial and administrative proceedings.” Id. § 164.512(e).7 More precisely, even without a written authorization, “[a] covered entity may disclose protected health information in the course of any judicial or administrative proceeding.” Id. § 164.512(e)(1). But certain procedures must be followed. Information may be released only in response to: (1) an “order of a court or administrative tribunal,” or (2) a “subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal,” when certain conditions are met. Id. § 164.512(e)(1)(i)-(ii). For the latter, information may be disclosed only if the covered entity receives satisfactory assurance from the party seeking the information that reasonable efforts have been made to either (1) ensure that the individual whose 7 Section 164.512 also covers standards in these other situations involving disclosure without a written authorization: (1) when required by law, (2) for public health activities, (3) about victims of abuse, neglect, or domestic violence, (4) for health oversight activities, (5) for law enforcement purposes, (6) about decedents, (7) for cadaveric organ, eye, or tissue donation purposes, (8) for research purposes, (9) to avert a serious threat to health or safety, (10) for specialized government functions, (11) for workers’ compensation. Id. § 164.512(a)-(l). The provisions governing disclosure by judicial process “do not supersede other provisions of [§ 164.512] that otherwise permit or restrict uses or disclosures of protected health information.” Id. § 164.512(e)(2). 16 Case: 13-14637 Date Filed: 10/10/2014 Page: 17 of 36 information is to be shared has been given notice of the request, or (2) secure a qualified protective order. Id. § 164.512(e)(1)(ii). The HIPAA regulations state additional requirements for each of these processes to be valid. For example, to establish that reasonable efforts have been made to give notice, the party requesting information must show by written documentation that it has made a “good faith attempt to provide written notice,” that such notice included sufficient information about the litigation to permit the individual to raise an objection to the court, that the time for the individual to raise objections to the court has elapsed, and that either no objections were filed or all objections filed have been resolved by the court. Id. § 164.512(e)(1)(iii). If instead the party seeks to proceed by protective order, it must show that the parties to the dispute have agreed to a qualified protective order and presented it to the court, or that the party seeking the protected health information has requested a qualified protective order from the court. Id. § 164.512(e)(1)(iv). 8 Importantly for this case, § 164.512(e) provides an alternative avenue for disclosure without a written authorization and does not replace or narrow the provisions permitting disclosure by written authorization alone, which are discussed below. 8 A qualified protective order means an order that prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation for which it was requested and requires that the protected health information, at the end of the litigation, be returned to the covered entity or destroyed. Id. § 164.512(e)(1)(v). 17 Case: 13-14637 Date Filed: 10/10/2014 Page: 18 of 36