Court Opinion

ID: 9897914
Source: CourtListenerOpinion
Date Created: 2023-11-14 19:27:03.584037+00
Date Added: 2024-06-11T09:17:41.168250
License: Public Domain

IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON
                         DIVISION ONE

  STATE OF WASHINGTON,
                                                       No. 84140-8-I
                        Appellant,
                                                       ORDER GRANTING
        v.                                             MOTION TO PUBLISH

  JOHNSON & JOHNSON; JANSSEN
  PHARMACEUTICALS, INC.; ORTHO-
  MCNEIL-JANSSEN
  PHARMACEUTICALS, INC., n/k/a
  JANSSEN PHARMACEUTICALS, INC.;
  JANSSEN PHARMACEUTICA, INC. n/k/a
  JANSSEN PHARMACEUTICALS, INC.;
  and XYZ Corporations 1 through 20,

                        Respondents.

       The appellant, State of Washington, having filed a motion to publish opinion, and

the panel having considered the motion, and finding that the opinion dated July 31, 2023

will be of precedential value; now, therefore it is hereby

       ORDERED that the unpublished opinion filed July 31, 2023 shall be published.

       FOR THE COURT:
    IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON

 STATE OF WASHINGTON,
                                                    No. 84140-8-I
                      Appellant,
                                                    DIVISION ONE
       v.
                                                    UNPUBLISHED OPINION
 JOHNSON & JOHNSON; JANSSEN
 PHARMACEUTICALS, INC.; ORTHO-
 MCNEIL-JANSSEN
 PHARMACEUTICALS, INC., n/k/a
 JANSSEN PHARMACEUTICALS, INC.;
 JANSSEN PHARMACEUTICA, INC.
 n/k/a JANSSEN PHARMACEUTICALS,
 INC.; and XYZ Corporations 1 through
 20,

                      Respondents.

       COBURN, J. — The State sued Johnson & Johnson and Janssen

Pharmaceuticals (collectively Janssen), claiming that they violated the Consumer

Protection Act and created a public nuisance by contributing to the opioid crisis in

Washington. During discovery, the State produced data from a Medicaid claims

database consistent with the Health Insurance Portability and Accountability Act

(HIPAA) disclosure practices, which meant only the years of claims were included,

instead of full dates. Janssen moved to compel the production of the specific days and

months related to service and prescription dates. A Special Master agreed with the

State that releasing full dates created a risk of re-identifying Medicaid patients that was

     Citations and pincites are based on the Westlaw online version of the cited material.
No. 84140-8-I/2

not small enough to be acceptable under HIPAA. The trial court disagreed, overruled

the Special Master, added its own parameters related to the release of data, and

granted the motion to compel. A commissioner of this court granted the State’s request

for discretionary review. We reverse.

                                     BACKGROUND

      The State Attorney General filed this lawsuit against Janssen 1 and affiliated

defendants alleging that they violated the state’s Consumer Protection Act and created

a public nuisance regarding its manufacture and marketing of pharmaceutical opioids.

Discovery was presided over by a court-appointed Special Master. A Special Master is

permitted under CR 53.3 to provide independent assistance to the court in resolving

complex discovery issues. 4 ELIZABETH A. TURNER, W ASHINGTON PRACTICE: RULES

PRACTICE CR 53.3 author’s cmt. 1 (7th ed. 2021).

      During discovery, the State produced 11 years of data from a database of all

Medicaid claims in the state maintained by the Washington Healthcare Authority (HCA).

The database contains health information for millions of Washington residents. The

data provided to Janssen included the year in which Medicaid services were provided,

but not the month or the day of the service, in accordance with HCA’s typical disclosure

practices.

      In passing HIPAA in 1996, Congress recognized the need for strict privacy

protections for health information, authorizing the United States Department of Health

and Human Services (DHHS) to promulgate regulations to put protections in place,

      1
        The State alleges that Johnson and Johnson is the only company that owns more than
10 percent of Janssen Pharmaceuticals’ stock and corresponds with the Federal Drug
Administration regarding Janssen’s products.
                                            2
No. 84140-8-I/3

codified at 45 C.F.R. §§ 160 and 164. See Health Insurance Portability and

Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936. The regulations apply

to “covered entities,” including health plans and health care providers transmitting any

health information electronically. 45 C.F.R. § 164.104(a)(1), (3). The rule defines

protected health information to mean “individually identifiable health information”—that

is, health information “[t]hat identifies the individual” or “[w]ith respect to which there is a

reasonable basis to believe the information can be used to identify the individual.” 45

C.F.R. § 160.103. Covered entities are generally prohibited from using or disclosing

protected health information, with a limited number of exceptions outlined in 45 C.F.R. §

164.502.

       DHHS provides standards and requirements related to “[d]e-identification of

protected health information.” “Health information that does not identify an individual

and with respect to which there is no reasonable basis to believe that the information

can be used to identify an individual is not individually identifiable health information.”

45 C.F.R. § 164.514(a). Under “Implementation specifications: Requirements for de-

identification of protected health information,” a covered entity “may determine that

health information is not individually identifiable health information only” through two

methods: “Safe Harbor” or “Expert Determination.” 45 C.F.R. § 164.514(b).

       The Safe Harbor method requires removing 18 identifiers listed in 45 C.F.R. §

164.514(b)(2)(i). 45 C.F.R. § 164.514(b)(2). That list includes “[a]ll elements of dates

(except year) for dates directly related to an individual, including birth date, admission

date, discharge date, date of death.” 45 C.F.R. § 164.514(b)(2)(i)(C).

                                               3
No. 84140-8-I/4

       Under the Expert Determination method, a covered entity may determine that

health information is not individually identifiable health information only if

       (1) A person with appropriate knowledge of and experience with generally
       accepted statistical and scientific principles and methods for rendering
       information not individually identifiable:

       (i) Applying such principles and methods, determines that the risk is very
       small that the information could be used, alone or in combination with
       other reasonably available information, by an anticipated recipient to
       identify an individual who is a subject of the information; and

       (ii) Documents the methods and results of the analysis that justify such
       determination.

45 C.F.R. § 164.514(b)(1).

       The DHHS’s Office of Civil Rights (OCR) issues guidance on complying with de-

identification procedures, including the expert determination method. This guidance

notes that there is no certain degree or certification program for use in designating an

expert, but that expertise may be gained through relevant education and experience

generally in mathematics, statistics, or scientific domains. It also notes that

       There is no explicit numerical level of identification risk that is deemed to
       universally meet the “very small” level indicated by the [Expert
       Determination] method. The ability of a recipient of information to identify
       an individual (i.e., subject of the information) is dependent on many
       factors, which an expert will need to take into account while assessing the
       risk from a data set . . . As a result, an expert will define an acceptable
       “very small” risk based on the ability of an anticipated recipient to identify
       an individual.

The guidance also states “OCR does not require a particular process for an expert to

use to reach a determination that the risk of identification is very small. However, the

Rule does require that the methods and results of the analysis that justify the

determination be documented.” The guidance also observed general principles

(replicability, data source availability, distinguishability, assess risk) used by experts in

                                               4
No. 84140-8-I/5

the determination of the identifiability of health information and cited published research

by Dr. Latanya Sweeney, PhD, among others. Though not a definitive list, the principles

serve as a starting point and “experts are advised to consider how data sources that are

available to a recipient of health information . . . could be utilized for identification of an

individual.” The guidance explained that experts, when evaluating identification risk,

often consider the degree to which a data set can be linked to a data source that

reveals the identity of the corresponding individuals. To do so, experts consider 1) that

the de-identified data are unique or distinguishing, 2) the existence of a naming data

source, including publicly available databases, and 3) the existence of a mechanism to

relate the de-identified and identified data sources.

       After receiving the Medicaid data that included 1,835,136,898 distinct records,

Janssen moved the court to compel the State to supplement the Medicaid claims data

with the month and day of the services and prescriptions. Janssen argued that it

needed the data to determine the “extent to which prescriptions for Janssen opioid

medications preceded diagnoses for opioid use disorder” as part of its defense.

       The State objected. It submitted a declaration from the Privacy Officer of the

Washington Healthcare Authority (HCA) explaining that HCA is a covered entity subject

to the requirements of HIPAA and 42 C.F.R. part 2, which regulates the disclosure of

information related to federally subsidized substance use disorder treatment. The State

argued that there are two ways that Janssen can legally obtain information protected

under part 2: with individual patient consent, or under a court order finding good cause

for disclosure after every impacted patient receives notice and an opportunity to be

heard. See 42 U.S.C. § 290dd-2(b)(1),(b)(2)(C); 42 C.F.R. § 2.64(b), (d). The State

                                               5
No. 84140-8-I/6

argued that, despite having raised these issues with Janssen, Janssen had not offered

a plan for identifying the millions of impacted patients and obtaining their consent, nor

had it offered any proposal to give notice to these impacted patients. The State argued

that granting a motion to compel HCA to disclose full dates associated with individual

patients would cause HCA to violate federal law under HIPAA and 42 C.F.R. part 2.

       The Special Master held a hearing on the motion in October 2021 and

provisionally granted Janssen’s motion, subject to Janssen providing “expert

certification to the special master that the disclosure of this information does not have

the potential for re-identification or for reverse engineering to disclose the identity of the

individuals for whom the data is disclosed, and is HIPAA-compliant.”

       Janssen submitted a declaration from Dr. M. Laurentius Marais, PhD, which

stated that there was virtually no risk of re-identification of individuals should the data be

supplemented. The State submitted an expert report by Dr. Latanya Sweeney, PhD,

who refuted Dr. Marais’ declaration as containing incorrect statements. Dr. Sweeney

demonstrated how full dates in the Medicaid Dataset “would allow it to be joined with

other publicly available and privately held information, thus allowing sensitive

information on individuals in the Medicaid Dataset to be re-associated with named

individuals.”

                                 Janssen Expert Dr. Marais

       Dr. Marais works for a “consulting firm that specializes in applied mathematical

and statistical analysis” and holds “a PhD degree and master’s degrees in business

administration, mathematics, and statistics from Stanford University.” He has several

decades of experience in applying and reviewing mathematical and statistical theory

                                              6
No. 84140-8-I/7

and methods. He has taught and conducted scholarly research at the University of

Chicago and Stanford University. Dr. Marais lists his areas of expertise as “the uses of

biostatistical and epidemiological methods to draw conclusions from data concerning

the rates of and risk factors for health effects, including the analysis of data on the

efficacy of and adverse events associated with pharmaceutical drugs.” Janssen

retained Dr. Marais to conduct similar work he had previously performed for Janssen in

California – to statistically analyze the de-identified medical claims data by locating the

date of an opioid use disorder diagnosis for each patient and analyzing data prior to that

diagnosis to determine whether the corresponding pharmacy claims data reflected any

opioid prescription for the same patient. In response to the Special Master’s order,

Janssen submitted a declaration from Dr. Marais specifically addressing concerns about

re-identification.

       Dr. Marais declared he was “competent to testify about the matters set forth

herein because I have either personally observed such matters or have formed opinions

within my areas of professional expertise concerning such matters.” Dr. Marais

explained in his declaration:

               8. Assuming Plaintiff did not hold the same level of concern about
       its previous production of de-identified Medicaid data, Plaintiff’s current
       elevated concern must arise from some hypothetically increased
       vulnerability to re-identification based on month and day information in
       addition to the calendar-year information produced previously. Based on
       my education, pertinent experience, and pertinent background knowledge,
       it is my opinion that the re-identification risk associated with the production
       Janssen seeks, whether arising from the completed dates alone or in
       combination with other demographic information produced to date, or with
       other publicly accessible information, is de minimis, if indeed any nonzero
       risk exists at all.

               9. I base this opinion on the simple fact that any risk of re-
       identification from the additional month and day information Janssen is

                                              7
No. 84140-8-I/8

       seeking would have to arise from the purely hypothetical notion of using
       complete service and dispensing dates to link records from the de-
       identified Medicaid data disclosed by Plaintiff to dated records from
       another, complementary data source that could reveal the identities of
       individual patients (a so-called “naming data source”). But Janssen does
       not have access to identified versions of any such complementary data
       resources. Indeed, patient names and other identifying information have
       routinely been removed from analogous data sets in other opioid litigation,
       and I understand that, to the extent Janssen seeks any potentially
       identifying, supplementary information in this litigation, it has indicated it
       too would be produced in a de-identified form. Accordingly, there is simply
       no way that Janssen could use the complete date information that it seeks
       to re-identify the Medicaid claims data in this litigation.

       Dr. Marais went on to explain that there is no realistic prospect that Janssen

could re-identify patients using two data sets produced in the litigation provided by the

Washington Labor & Industries Workers Compensation (L&I) and Washington Public

Employees Benefits Board Program (PEBB). Dr. Marais reasoned that “neither the L&I

nor the PEBB data (nor any other data set produced in this litigation) include individually

identifying information.” Dr. Marais concluded that “the demographic descriptors

included in these data sets (year of birth, gender, race, marital status, and three-digit

ZIP code) are insufficient to establish that records drawn from different data sets but

having identical demographic descriptors actually represent the same individual patient,

even when these combinations of descriptors are unique in the data sets where they

appear.” He further opined that “even if [demographic indicators] did happen to

represent the same patient, this fact per se would still not identify that patient (because

the patient data sets produced in this proceeding simply do not contain a key to

individually identifying information, either individually or collectively, with or without the

complete service dates that Janssen seeks).” Dr. Marais said that this reasoning

“supports my opinion that the incremental re-identification risk associated with the

                                               8
No. 84140-8-I/9

production Janssen seeks is essentially nil.”

       Dr. Marais asserted that he needed the complete date of every medical service

and prescription fill event in order for him to conduct his analysis, but suggested that the

State could “re-produce” the Medicaid data without demographic variables such as birth

year, gender, marital status and race.

       Dr. Marais further concluded that “there is no basis for supposing” that full

Medicaid service dates would contain information that overlapped with service or

pharmacy claim records in the workers’ compensation or public employee benefits

program datasets available to Janssen. Dr. Marais did not document any method of

applying statistical and scientific principles and methods to support his opinion that the

risk of re-identification is essentially nil.

                                  State’s Expert Dr. Sweeney

       The State’s expert, Dr. Sweeney is the director and founder of the Data Privacy

Lab and Public Interest Technology Lab at Harvard University, where she is also a

professor. Prior to her current position she was a Chief Technology Officer at the

United States Federal Trade Commission, was a commissioner on the U.S. Evidence

Based Policy Making Commission, and a professor of Computer Science, Technology,

and Policy at Carnegie Mellon University. Dr. Sweeney earned a PhD in computer

science from the Massachusetts Institute of Technology. Alongside this experience, Dr.

Sweeney also lists extensive experience specific to data privacy in medical records,

including the identification of re-identification risks and privacy vulnerabilities in publicly

available medical data. Her work includes re-identification of Washington State health

data in 2015 using blotter stories from archived newspapers and publicly available

                                                9
No. 84140-8-I/10

health data. 2 Through this method, Dr. Sweeney was able to learn sensitive information

about patients, such as drug and alcohol abuse and sexually transmitted diseases,

none of which had anything to do with the news stories. Dr. Sweeney’s work is cited in

the preamble to HIPAA and in other federal regulations.

       The State retained Dr. Sweeney to review Janssen’s request for the creation of a

version of the de-identified Medicaid Dataset that has full dates for services and

prescription refills, and to assess privacy risks related to the disclosure of the Medicaid

Dataset. This work is consistent with many other projects she has worked on to

demonstrate privacy vulnerabilities. Dr. Sweeney cited her own work as well as

published papers reporting re-identification experiments. She also reviewed Dr. Marais’

declaration and noted that it did not provide any evidence or detailed analysis, and did

not address a large body of evidence contrary to his opinion.

       Dr. Sweeney conducted an analysis using the same information that had been

provided to Janssen, the Medicaid Dataset as well as the Death Dataset, which is from

the official death registry for the State of Washington. Dr. Sweeney explained that while

not all decedents who appear in the Death Dataset are in the Medicaid Dataset, almost

all decedents in the Medicaid Dataset should be in the Death Dataset. 3 Dr. Sweeney

described the Death Dataset as “semi-publicly available,” noting that the term is used

when there is an associated cost for acquisition that limits its availability or requires a

lengthy or involved review or application process that limits access. She first measured

the identifiability of the Death Dataset, because doing so “describes the overall ground

       2 Latanya Sweeney, Only You, Your Doctor, and Many Others May Know, TECH. SCI.

(Sept. 28, 2015), https://techscience.org/a/2015092903 [https://perma.cc/K3Q5-L3P2].
        3
          The Death Dataset is from the years 2007 through 2017.
                                             10
No. 84140-8-I/11

truth of the identifiability of death data in subsets that could link to it, such as the

Medicaid Dataset.” Dr. Sweeney started with the Death Dataset “because matches of

records in the Medicaid Dataset to records in the Death Dataset puts names and

addresses, as well as Social Security numbers, to the health data.” Dr. Sweeney further

explained:

       If each decedent record in the Medicaid Dataset matches lots of other
       records in the Death Dataset ambiguously, then the identifiability of the
       decedent records in the Medicaid Dataset is low. On the other hand, if
       decedent records in the Medicaid Dataset match one or few of the name-
       bearing records in the Death Dataset, then the identifiability of the
       Medicaid Dataset is high. The following experiment reports how low or
       high the identifiability can be based on the identifiability of the Death
       Dataset.

       Through progressive experiments Dr. Sweeney was able to demonstrate how

191 hospice patients in the Medicaid Dataset uniquely matched 191 named records in

the Death Dataset. Dr. Sweeney focused on hospice patients in the Medicaid claims

reasoning that patients who receive services at hospice facilities will soon decease and

can expect their claims for hospice to appear in the Medicaid Dataset and death to

appear in the Death Dataset. Dr. Sweeney compared the 23,013 records for distinct

patients who received hospice care that contained year of birth, gender, and the first

three digits of their zip code (3-digit zip code). Then by using the last year of hospice

service as a proxy for year of death, Dr. Sweeney, found 191 unique matches in the

Death Dataset. This constituted a .83 percent match of the 23,013 hospice records.

Observing that HIPAA allows health data to be shared that has more than a zero risk,

Dr. Sweeney stated “in the case of HIPAA, the risk was quantified experimentally to be

acceptable at 0.04% and 0.02% for [unique one to one matches] based on dates in

years and only the first three digits of the ZIP code.” When Dr. Sweeney added

                                               11
No. 84140-8-I/12

race/ethnicity data to the analysis, the unique matches increased to 1,275. Dr.

Sweeney opined that if Janssen were to obtain the full dates for service claims in the

Medicaid Dataset and if the full date of the last day of service for hospice patients

matched the date of death, then identifiability would increase further. When using

month, day, and year of death, year of birth, gender, 3-digit zip code and race/ethnicity,

Dr. Sweeney was able to identify 90 percent of the 574,058 records in the death

Dataset as unique. Dr. Sweeney opined that “Defendant’s request for complete dates in

the Medicaid Dataset would allow inferences that can put names to a substantial

number of records in the Medicaid Dataset.”

       Dr. Sweeney explained that the “risk is not limited to the Death Dataset alone.

There are a multitude of possibilities, especially considering publicly and privately held

data.” Dr. Sweeney concluded that

       Defendant’s request does not seem to understand the privacy risks
       involved in releasing personal health information under today’s standards.
       The fact is that grave risks exist in the data as proposed for release, even
       without lowering the standard to include complete and full dates of medical
       services and prescription refills. Lowering the standard would not even
       adhere to federal and best practices standards for the sharing of personal
       health.

Dr. Sweeney explained that it is not impossible to anonymize the data and that the

proper way requires the use of “scientifically proven methods, not ad hoc guess work

(see Declaration of Defendant’s expert). [Janssen]’s request comes nowhere close to

meeting those established standards or otherwise assuring individuals whose sensitive

health information is in the Medicaid Dataset cannot be re-identified.” 4

       4
          Dr. Sweeney’s report discussed two of methods of anonymizing data: k-anonymity and
differential privacy.
                                             12
No. 84140-8-I/13

         Alongside the submission of Dr. Sweeney’s report, the State submitted a

declaration from Christopher Purdy of Celerity Consulting Group explaining that an

alternative to providing Janssen with the full dates of service, it could provide a

“sequenced” dataset. Purdy explained that the sequenced dataset “would indicate the

sequence of [Medicaid claims] events within a given year without revealing any day and

month information for those events.” He explained that the group had previously

provided sequenced datasets of L&I data for use in discovery production in the State’s

litigation with other opioid manufacturers.

         The Special Master held another hearing in January 2022, allowing the parties to

argue their positions regarding the expert opinions. The Special Master ordered the

State to provide sequencing of the Medicaid Dataset, but denied Janssen’s request to

supplement the Medicaid Dataset with month and date of servicing and prescription

filling. The Special Master reasoned that it was persuaded from Dr. Sweeney’s opinion

that re-identification is a substantial risk if this additional information is produced by the

State.

         The Special Master held an additional hearing in February 2022 after Janssen

moved for reconsideration of his prior ruling denying the motion to compel the

production of full Medicaid service dates. The Special Master ruled that both Dr. Marais

and Dr. Sweeney were qualified experts under 45 C.F.R. § 164.514(b)(2). The Special

Master then concluded that it found “Dr. Marais’ conclusions stating such a risk is de

minimis if indeed any nonzero risk at all is ipse dixit” and that Janssen did not meet its

burden of showing the “risk is very small” under §164.514(b).

                                              13
No. 84140-8-I/14

       Janssen then filed an objection to the Special Master’s ruling and order denying

its motion to compel the supplemental Medicaid claims data. Janssen asserted in the

motion that Dr. Sweeney had incorrectly calculated the risk of re-identification stating,

       Dr. Sweeney’s analyses of DOH mortality data were limited to identifying
       potential matches (not reasonably accurate matches) in a limited subset of
       hospice patients’ Medicaid data. And she found that just 191 hospice
       patients in the Medicaid data had a birth year, gender, and a three-digit zip
       code that corresponded to the same demographic information for a
       decedent in the DOH death data. Even assuming those were true
       matches (an assumption unsupported by the record), Dr. Sweeney
       showed nothing more than a re-identification risk of 0.0004% (191 of over
       4.5 million Medicaid patients).

       The trial court, without oral argument, 5 sustained Janssen’s objection and

reversed the Special Master’s ruling. The trial court believed the State and Special

Master had applied an incorrect standard and each had suggested that “any risk of re-

identification is unacceptable.” The trial court noted that neither the State nor Special

Master had addressed “how the Court could minimize, if not entirely eliminate, the risk

of re-identification, and the burden to the State.” The trial court specifically found that

the expert opinion of Dr. Marais provided by Janssen “is compliant with the certification

requirement in 45 C.F.R. § 164.514” and that “the most probative portion of [Dr. Marais’]

analysis largely boiled down to one similar to the State’s expert’s, but with a different

denominator.” The court then concluded there was no justification of using the total

number of hospice patients as opposed to the total number of Medicaid patients,

followed the change in the formula proposed in Janssen’s brief and found that “the

resulting risk of re-identification is 0.004%, which this Court finds is acceptably a ‘very

small’ risk of identification pursuant to 45 C.F.R. § 164.514.” The record is devoid of

       5
           The parties did not request oral argument.
                                                14
No. 84140-8-I/15

any expert supporting the assertion that it was proper to substitute the entire Medicaid

patient population in a formula designed to match Medicaid patients in hospice whose

last date of service matched the date of death in the Death Database.

       The trial court granted Janssen’s motion and followed its recommendations to

further mitigate risk of re-identification. The court ruled:

           •   The State is ordered to produce the Medicaid claims data with full
               dates of service and dispensing, but without birth year, gender,
               marital status, and race/ethnicity variables.
           •   The Defendants are prohibited from making any effort whatsoever
               to take this data or any other data and link it up to any named data,
               permitting re-identification.
           •   The distribution of this data would be strictly restricted to
               Defendants’ counsel and Defendants’ expert and the fewest
               number of people from his office needed to assist him with the data
               analysis. The newly produced data will be maintained otherwise
               subject to the Protective Order entered in this matter.
           •   The Defendants are required to contemporaneously destroy, and
               certify the destruction of, the prior Medicaid dataset produced by
               the State and provided to the Defendants’ expert, prior to the
               provision of this data.
           •   The Defendants are prohibited from providing the DOH mortality
               data set or any other “naming data source” to the expert who will
               conduct this analysis.
           •   Defendants will pay for additional redaction and costs incurred as a
               result of providing this data.

The trial court denied the State’s motion for reconsideration. The State filed a notice of

discretionary review to this court. Interlocutory review under RAP 2.3(b)(2) requires a

showing of “probable error” in a trial court decision that “substantially alters the status

quo or substantially limits the freedom of a party to act.” Review may be granted where

the superior court has departed from the usual course of judicial proceedings. RAP

2.3(b)(3). A commissioner of this court granted discretionary review.

                                              15
No. 84140-8-I/16

                                       DISCUSSION

                                    Standard of Review

       It is within the trial court’s discretion to deny a motion to compel discovery and

we will not disrupt the ruling absent an abuse of discretion. Clarke v. State Att’y Gen.'s

Off., 133 Wn. App. 767, 777, 138 P.3d 144 (2006) (citing Shields v. Morgan Fin., Inc.,

130 Wn. App. 750, 759, 125 P.3d 164 (2005)). “A trial court abuses its discretion if its

decision is manifestly unreasonable or based on untenable grounds or untenable

reasons.” Marriage of Littlefield, 133 Wn.2d 39, 46-47, 940 P.2d 1362 (1997).

                                         Timeliness

       As a threshold matter, Janssen contends that the State failed to timely file a

notice for discretionary review, time barring review. Janssen claims that the State was

required under RAP 5.2(b)(1) to file a notice for discretionary review within 30 days after

the entry of the order granting Janssen’s motion to compel, on which the State seeks

review here. Respondent argues that review is time-barred because the State only filed

its notice for discretionary review 30 days after the trial court’s entry of the order

denying the State’s motion for reconsideration of the order to which the State assigns

error. Janssen asserts the State is limited to review of the denial of its motion for

reconsideration, not the underlying order.

       A timely motion for reconsideration will extend the 30-day deadline to appeal the

original order. Singleton v. Naegeli Reporting Corp., 142 Wn. App. 598, 603, 175 P.3d

594 (2008). Under CR 59, an aggrieved party may move for reconsideration of a

decision or order “not later than 10 days” after the entry of the order or decision. CR

59(b). Here, the trial court entered its order on April 13, 2022 sustaining Janssen’s

                                              16
No. 84140-8-I/17

objection to the special master’s ruling and order denying its request for the State to

produce the Medicaid claims database with supplemental data fields. The State moved

for reconsideration on April 29, 2022, outside the 10-day limit permitted under CR 59(b).

       In its response to the State’s motion for discretionary review, Janssen argued

that the State’s notice for discretionary review was barred under RAP 5.2(b) as untimely

because it was filed more than 30 days after entry of the trial court’s decision. The

commissioner of this court did not address the issue of timeliness in its Ruling Granting

Discretionary Review. Janssen did not move to modify the order.

       Consideration of a motion for discretionary review is governed by the regular

motion procedure, RAP 6.2(c), requiring an aggrieved party to object to a ruling only by

way of a motion to modify. RAP 17.7(a). See City of Spokane v. Marquette, 103 Wn.

App. 792, 797, 14 P.3d 832 (2000), rev’d on other grounds, 146 Wn.2d 124, 43 P.3d

502 (2002). Because Janssen did not move to modify the commissioner’s ruling, it has

waived any argument that the granting of discretionary review was improper because

the request was untimely.

                                  Expert Determination

       The State contends that the trial court erred in ordering it to produce the

supplemental Medicaid claims data to include the day and month in the date of service

field, rather than just the year. The State argues that Janssen’s expert failed to comply

with the requirements of the Expert Determination method of producing HIPAA

protected information. We agree.

       The parties agree that 45 C.F.R. § 164.514(b)(1) provides the requirements for

the Expert Determination method. Releasing the full dates in the Medicaid Dataset is

                                            17
No. 84140-8-I/18

contrary to 45 C.F.R. § 164.514(b)(2)(i)(C) under the Safe Harbor method. Thus, for the

court to be satisfied that the release of full dates would not create a “reasonable basis to

believe that the information can be used to identify an individual,” 45 C.F.R. §

164.514(a), a qualified expert, applying principles and methods for rendering

information not individually identifiable, had to document the methods and results of its

analysis that determined the “the risk is very small that the information could be used,

alone or in combination with other reasonably available information, by an anticipated

recipient to identify an individual who is a subject of the information.” 45 C.F.R. §

164.514(b)(1)(i) and (ii).

       It appears the trial court misread the record. First, it incorrectly found that the

State and the Special Master applied an incorrect risk level of “any risk” instead of the

correct standard of a “very small risk” under 45 C.F.R. § 164.514(b)(1)(i). The State

submitted Dr. Sweeney’s declaration where she acknowledged that HIPAA does not

require the risk to be zero before health data may be shared. The Special Master

expressly found that Janssen did not meet its burden of showing the “risk is very small”

under §164.514(b).

       Second, the trial court incorrectly attributed to Dr. Marais an analysis and formula

that he did not make or suggest. Nowhere does Dr. Marais propose replacing the

denominator of Medicaid hospice patients in Dr. Sweeney’s analysis with the entire

number of Medicaid patients in the Dataset. That suggestion instead came from the

Janssen attorneys in their brief.

       Janssen argues that “Dr. Marais considered all of the ‘data sets produced in this

proceeding’ and publicly available dataset.” First, Dr. Marais made no such claim. His

                                             18
No. 84140-8-I/19

declaration reveals that he did not review or consider the consequences of the Death

Dataset before opining that the risk was “nil.” He based his opinion on the “simple fact”

that Janssen does not have “another, complementary data source that could reveal the

identifies of individual patients” that could be compared to the Medicaid claims database

to provide identifying information. It is undisputed that the Death Dataset included

identifiable information, including names. Dr. Marais did not document having applied

principles and methods for rendering information not individually identifiable. Dr.

Marais’ declaration simply states “Based on my education, pertinent experience, and

pertinent background knowledge, it is my opinion that the re-identification risk

associated with the production Janssen seeks, whether arising from the completed

dates alone or in combination with other demographic information produced to date, or

with other publicly accessible information, is de minimis.”

       The trial court adopted the suggestion by Janssen’s attorneys that Dr. Sweeney’s

analysis should be changed to replace the denominator in her risk assessment formula

from the total number of hospice patients in the Medicaid Dataset to the entire 4.5

million people in the Dataset in order to get to a lower risk percentage. This is without

any support from any expert that doing so is a proper measurement of calculating the

risk of re-identifying the subset of hospice patients in the Medicaid Dataset.

       In contrast, Dr. Sweeney provided detailed explanations of the generally

accepted method she applied in making her determinations regarding the risk of re-

identification. Dr. Sweeney also demonstrated how the ability to identify unique

individuals increased as more datapoints were included in the analysis. She also

applied the methods in five separate applications and considered how the additional

                                            19
No. 84140-8-I/20

information requested could be compared with datasets previously provided to Janssen

in discovery and how such information is publicly available.

       It appears the trial court also reasoned that changing Dr. Sweeney’s analysis

was appropriate because there was no justification to looking at only hospice patients.

The trial court appeared to misunderstand why Dr. Sweeney focused on hospice

patients. The concern under HIPAA is whether there is a “reasonable basis to believe

that the information can be used to identify an individual.” 45 C.F.R. § 164.514(a)

(emphasis added). The question is whether “the risk is very small that the information

could be used . . . to identify an individual who is a subject of the information.” 45

C.F.R. § 164.514(b)(1)(i) (emphasis added). That is a different question than whether

the percentage of identifiable people out of the total number of people whose records

are released is very small. OCR’s guidance notes that “experts are advised to consider

how data sources that are available to a recipient of health information . . . could be

utilized for identification of an individual.” (Emphasis added.) Dr. Sweeney

demonstrated through her analysis that, even before using full dates, the data sources

could be used to identify 191 unique individuals. Janssen cites to no authority that

suggests an analysis under the Expert Determination method must calculate the risk of

identifying the entire population within the data set.

       Regardless, the trial court could not substitute its opinion or the opinion of the

Janssen attorneys for that of a qualified expert under 45 C.F.R. § 165.514(b)(1)(i) and

(ii). Because the record establishes that Dr. Marais’ expert opinion did not satisfy 45

C.F.R. § 165.514(b)(1)(i) and (ii), we hold that the trial court’s reliance on Dr. Marais’

opinion was untenable and that the court abused its discretion in determining that the

                                             20
No. 84140-8-I/21

Expert Determination method was satisfied under HIPAA as a basis to grant Janssen’s

motion to compel HCA, a covered entity, to disclose full dates in the Medicaid claims

database.

                               Release Under Court Order

       While HIPAA controls what a “covered entity” may release, it does allow

disclosure of protected health information in the course of a judicial proceeding if certain

requirements are met. 45 C.F.R. § 164.512(e)(1). Disclosures are permitted in

“response to an order of a court or administrative tribunal, provided that the covered

entity discloses only the protected health information expressly authorized by such

order” and that a “qualified protective order means” one that

       (A) Prohibits the parties from using or disclosing the protected health
       information for any purpose other than the litigation or proceeding for
       which such information was requested; and

       (B) Requires the return to the covered entity or destruction of the
       protected health information (including all copies made) at the end of the
       litigation or proceeding.

45 C.F.R. § 164.512(e)(1)(v). However, the parties do not dispute that because the

Medicaid Dataset includes substance use disorder patient records, 42 C.F.R. part 2 also

applies to the requested records.

       Records identifying any patient receiving treatment or rehabilitation for a

substance use disorder under a federally conducted or funded program, such as

Medicaid, are required to be “confidential”. 42 U.S.C. § 290dd-2(a); See Daybreak

Youth Servs. v. Clark County Sheriff's Off., 19 Wn. App. 2d 879, 892, 498 P.3d 571

(2021). Disclosure is only permitted through means expressly authorized under 42

U.S.C. § 290dd-2. The statute generally requires patient consent to disclose the

                                            21
No. 84140-8-I/22

records, but makes express exceptions for disclosure in limited circumstances. 42

U.S.C. § 290dd-2(b)(2)(A)-(D). One such exception is permitted “if authorized by an

appropriate order of a court of competent jurisdiction granted after application showing

good cause therefor.” 42 U.S.C. § 290dd-2(b)(2)(C); Daybreak Youth Servs., 19 Wn.

App. 2d at 889. A court granting such an order must “weigh the public interest and the

need for disclosure against the injury to the patient, to the physician-patient relationship,

and to the treatment services” in assessing good cause. 42 U.S.C. § 290dd-2(b)(2)(C).

Federal regulations further explain the process for disclosure of identifying information.

       The restrictions under 42 U.S.C. § 290dd-2 apply to any records which “would

identify a patient as having or having had a substance use disorder either directly, by

reference to publicly available information, or through verification of such identification

by another person.” 42 C.F.R. § 2.12(a)(i).

       Janssen does not attempt to argue that the trial court weighed the public interest

and need for disclosure or assessed good cause. Instead, Janssen contends the

information requested is de-identified so neither HIPAA nor part 2 prohibits disclosure. 6

The trial court imposed “conditions in compliance with 42 C.F.R. § 2.11” as part of its

order to compel. In addition to HIPAA concerns, a commissioner of this court granted

discretionary review to consider whether the trial court committed error by ordering

release of protected health information which could be further used to identify

       6
          Janssen also contends that the parties had entered into a qualifying protective order
that satisfies HIPAA for patients who did not have a substance use disorder. We granted
Janssen’s request to supplement the record with a copy of this protective order, but this order
was entered prior to Janssen’s motion to compel disclosure of the full service and prescription
dates and the trial court did not rule on whether the HIPAA-compliant Protective Order
previously entered by the court overrides the application of the Safe Harbor provision. That
issue is not before us.
                                               22
No. 84140-8-I/23

substance-use disorder patients in violation of 42 U.S.C. § 290dd-2(b)(1) and (b)(2)(C),

and implementing regulations at 42 C.F.R. §§ 2.1-2.67.

       As the trial court recognized, 42 C.F.R. § 2.11 defines patient identifying

information to include “information by which the identity of a patient, as defined in this

section, can be determined with reasonable accuracy either directly or by reference to

other information.”

       “42 C.F.R. § 2.61 defines the legal effect of a court order entered under the

regulations. The order’s ‘only purpose is to authorize a disclosure or use of patient

information which would otherwise be prohibited.’” Daybreak Youth Servs., 19 Wn.

App. 2d at 889 (quoting 42 C.F.R. § 2.61(a)).

       If the court decides to issue an order authorizing disclosure, the court must

determine that good cause for the disclosure exists. 42 C.F.R. § 2.64(d). To find good

cause, the court must determine that

       (1) Other ways of obtaining the information are not available or would not
           be effective; and

       (2) The public interest and need for the disclosure outweigh the potential
           injury to the patient, the physician-patient relationship and the
           treatment services.

42 C.F.R. § 2.64(d). Prior to an order authorizing disclosure, both the patient and the

record holder must be provided with

       (1) Adequate notice in a manner which does not disclose patient identifying
           information to other persons; and

       (2) An opportunity to file a written response to the application, or to appear in
           person, for the limited purpose of providing evidence on the statutory and
           regulatory criteria for the issuance of the court order as described in §
           2.64(d).

42 C.F.R. § 2.64(b).

                                             23
No. 84140-8-I/24

       In addition to the required findings and notice, the order itself must:

       (1) Limit disclosure to those parts of the patient’s record which are essential to
           fulfill the objective of the order;

       (2) Limit disclosure to those persons whose need for information is the basis for
           the order; and

       (3) Include such other measures as are necessary to limit disclosure for the
           protection of the patient, the physician-patient relationship and the treatment
           services; for example, sealing from public scrutiny the record of any
           proceeding for which disclosure of a patient’s record has been ordered.

42 C.F.R. § 2.64(e). 7

       Because the trial court ruled that Janssen’s expert satisfied the Expert

Determination method, 8 the court presumably believed the requested information under

the motion to compel was not individually identifiable health information as defined in 42

C.F.R. § 2.11. Because we conclude this record does not support the trial court’s

determination that the Expert Determination was satisfied, in order for the trial court to

order release of any identifiable health information otherwise protected under 42 C.F.R.

part 2, the trial court was required to find good cause under 42 C.F.R. § 2.64(d) and

require notice be provided under 42 C.F.R. § 2.64(b) before ordering disclosure and

imposing limitations and conditions under 42 C.F.R. § 2.64(e). It is undisputed that the

       7
          The court order alone does not compel disclosure, but must be accompanied by “a
subpoena or a similar legal mandate” in order to compel the disclosure. 42 C.F.R. § 2.61(a).
        8
          Though the trial court adopted Dr. Marias’ suggestion to grant Janssen’s request for full
dates in the Medicaid Dataset while limiting other data points, the record is absent of any Expert
Determination analysis as to whether release of such a combination of data satisfies HIPAA.
                                                24
No. 84140-8-I/25

court did not grant the motion to compel under 42 C.F.R. § 2.64.

      Accordingly, we reverse.

WE CONCUR:

                                          25