Court Opinion

ID: 9798934
Source: CourtListenerOpinion
Date Created: 2023-08-31 05:35:43.754147+00
Date Added: 2024-06-11T09:11:58.507079
License: Public Domain

Concurring Opinion by
RECKTENWALD, C.J.,
in which NAEAYAMA, J., Joins.
I concur in the result reached by the majority and in much of its analysis, but write separately to address several issues. I agree that article I, section 6 of the Hawai'i Consti*424tution protects personal medical information that is produced in discovery from being disclosed outside of the underlying litigation. As the majority notes, this court has previously addressed this issue in Brende v. Hara, 113 Hawai'i 424, 153 P.3d 1109 (2007) (per curiam), which also specifically dealt with whether medical information produced to litigants in an underlying tort ease could then be used or disclosed for purposes outside the underlying litigation. Acknowledging the specific circumstances in which the ease was decided, we held in Brende that the constitutional right to privacy “protects the disclosure outside of the underlying litigation of petitioners’ health information produced in discovery.” 113 Hawai'i at 430, 153 P.3d at 1115 (footnote omitted).
However, a party may be able to compel the disclosure of personal medical information outside the litigation by the showing of a “compelling state interest,” pursuant to the plain language of article I, section 6, which provides that “[t]he right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest.” Disclosure required by law may be one such compelling state interest. I agree with the majority that paragraph 1(b)(3) of the stipulated qualified protective order in this case was overbroad to the extent that it did not limit re-disclosure of Cohan’s medical information in any way. However, a more precisely drafted provision could be upheld to the extent that it allowed for disclosure that would be required to comply with state or federal law, such as an inquiry from the Insurance Commissioner. See, e.g., HRS § 431:2-208(a) (2006) (“Every person and its officers, employees, and representatives subject to investigation or examination by the commissioner, shall produce and make freely accessible to the commissioner the accounts, records, documents, and files in the person’s possession or control relating to the subject of the investigation or examination, and shall otherwise facilitate the investigation or examination.”). Such a purpose would qualify as a “compelling state interest” in my view.
Finally, with regard to the disclosure of de-identified information under paragraph 1(b)(7), it is not necessary to apply a state constitutional right to privacy here since the paragraph is in any event invalid under the Health Insurance Portability and Accountability Act (HIPAA). See Rees v. Carlisle, 113 Hawai'i 446, 456, 153 P.3d 1131, 1141 (2007) (citation omitted) (“A fundamental and longstanding principle of judicial restraint requires that courts avoid reaching constitutional questions in advance of the necessity of deciding them.”); Lyng v. Nw. Indian Cemetery Protective Ass’n, 485 U.S. 439, 445, 108 S.Ct. 1319, 99 L.Ed.2d 534 (1988) (same). Paragraph 1(b)(7) states that it would allow Cohan’s health information to be used “for statistical or analytical purposes, provided that [Cohan’s] personal identification information (e.g., name, specific street address, specific birth date, Social Security number, driver’s license number) is not included in such review or use of Health Information^]” It is evident that this paragraph does not satisfy the minimum requirements under HI-PAA’s accompanying regulations to ensure that personal medical information is adequately de-identified. See 45 C.F.R. § 164.514 (2013). For example, regulations issued pursuant to HIPAA require that either a “person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable” apply such principles and methods to determine that the risk of re-identification is very small, 45 C.F.R. § 164.514(b)(l)(i), or, alternatively, that a list of eighteen identifiers be removed, see 45 C.F.R. §§ 164.514(b)(2)(i)(A)-(R). On its face, paragraph 1(b)(7) fails to comply with either method for de-identifying information under these regulations.
In addition, HIPAA could preempt our state constitutional right to privacy to the extent that our constitution is interpreted to prevent the disclosure of deidentified medical information. The majority opinion cites to HIPAA’s “supersession” clause, section 264 of HIPAA, which directs the Secretary of Health and Human Services to promulgate regulations to protect the privacy of medical records, but provides in subsection (c)(2) that such a regulation “shall not supercede a contrary provision of State law, if the provision *425of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation.” Majority opinion at 955 (citing HIPPA, Pub.L. No. 104-191, § 264, 110 Stat. 1936 (1996); 45 C.F.R. § 160.203(b)). A standard is “more stringent” if it “provides greater privacy protection for the individual who is the subject of the individually identifiable health information” than the standard in the regulation. Majority opinion at 957 (citing 45 C.F.R. § 160.202(6); Nw. Mem’l Hosp. v. Ashcroft, 362 F.3d 923, 924 (7th Cir.2004)).
However, as the Northwestern court was careful to note,
the “more stringent” clause applies only to “individually identifiable health information,” § 160.203(b), as opposed to “health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual.” § 164.514(a). Provided that medical records are redacted in accordance with the redaction requirements (themselves quite stringent) of § 164.514(a), they would not contain “individually identifiable health information” and the “more stringent” clause would fall away.
Nw. Mem’l Hosp., 362 F.3d at 926 (emphases added).
Thus, the “supersession” clause that the majority cites to as enabling it to apply a more protective state constitutional right to privacy, could “fall away” when the information at issue is not “individually identifiable health information,” i.e., is de-identified information. In such situations, HIPAA preempts any conflicting state law.1 To underscore this point, Judge Manion’s concurrence thus stated that, “In passing HIPAA, Congress recognized a privacy interest only in ‘individually identifiable medical records’ and not redacted medical records, and HI-PAA preempts state law in this regard.” Id. at 933 (Manion, J., concurring in part and dissenting in part).
Additionally, in In re Zyprexa Products Liability Litigation, 254 F.R.D. 50 (E.D.N.Y. 2008), the magistrate judge presiding over discovery concluded that HIPAA preempts state privilege laws that preclude the disclosure of de-identified medical records. There, several states sought damages stemming from the unlawful marketing of an anti-psy-chotie drug Zyprexa. Id. at 51. When the defendant company sought the medical records of a sampling of patients who took the medication, the states attempted to prevent disclosure of such records by asserting that their respective physician-patient privilege laws protected against the disclosure of such records. Id. When the issue arose as to whether the records would be discoverable if properly redacted based on HIPAA’s de-identification procedures, the states further contended that “their respective privilege laws are more stringent than HIPAA, and argue[d] that a HIPAA-compliant court order will not suffice to protect the privacy interests of the patients whose medical records [the defendant] seeks.” Id. at 54. However, the magistrate judge rejected this argument, concluding that,
Even assuming that state privilege laws afford greater protection to the records [the defendant] seeks—and it is not entirely clear that they do—HIPAA contains a supersession clause which makes clear that *426to the extent state privilege laws are more protective of de-identified health information than is HIPAA, those laws are preempted by HIPAA’s regulatory scheme.

Id.

Citing approvingly to Northwestern, the magistrate judge thus held that, “de-identi-fied health information is not protected under HIPAA, and that, to the extent state privilege laws offer protection to de-identi-fied medical records, HIPAA preempts those laws.” Id. Accordingly, the magistrate judge determined that more stringent state privilege laws did not prevent the discovery of de-identified medical records. Id.
Here, in rejecting paragraph 1(b)(7), the majority concludes that “the provision is not in accord with the Hawaii constitutional protection for health information” because the “de-identified information is for use outside of the present litigation.” Majority opinion at 29. In my view, the majority’s reliance on the state constitutional right to privacy to prevent the disclosure of de-identified information could run afoul of and thus be preempted by HIPAA, just as the state privilege laws were preempted by HIPAA in In re Zyprexa.
Accordingly, since paragraph 1(b)(7) clearly violates HIPAA’s protocols for de-identifi-cation, I would rely on HIPAA in rejecting that provision rather than relying on the state constitutional right to privacy.

. Although the majority cites to Northwestern for a passage in which the court stated that, “Even if there were no possibility that a patient's identity might be learned from a redacted medical record, there would be an invasion of privacy[,j” the Northwestern court made this statement within the context of affirming the district court’s quashing of a subpoena based on a balancing of the benefit and burden of complying with the subpoena, under Federal Rules of Civil Procedure Rule 45(c). Id., 362 F.3d at 929-33.
Notably, the court in Northwestern relied on this balancing analysis in reaching its holding because it rejected the district court’s other grounds for quashing the subpoena, that Illinois’s "more stringent” standard for disclosure trumped the HIPAA regulation by virtue of HI-PAA’s supersession provision. Id. at 925-26.
The majority in Northwestern did state in dictum that "Illinois is free to enforce its more stringent medical-records privilege (there is no comparable federal privilege) in suits in state court to enforce state law and, by virtue of an express provision in Fed.R.Evid. 501, in suits in federal court (mainly diversity suits) as well in which state law supplies the rule of decision.” Id. at 925. However, that statement was not made specifically with regard to de-identified information.