Procedural and Substantive Requirements for Discovery of  HIPAA Information

The Georgia Supreme Court recently ruled that ex parte interviews with a plaintiff’s medical providers may be conducted under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).  However, procedural requirements for protecting information disclosed during such interviews must be satisfied.  See Baker v. Wellstar Health Systems, Inc., No. S10A0994 (June 1, 2010).  In Baker, after the plaintiff brought a medical malpractice action, Wellstar filed a motion for a qualified protective order allowing it to conduct ex parte interviews with the plaintiff’s medical providers.  The trial court granted Wellstar’s motion, ruling that such ex parte interviews were permissible under HIPAA if procedural safeguards to ensure privacy were followed.  See 45 C.F.R. 164.512.  The qualified protective order which was issued prohibited Wellstar from using or disclosing plaintiff’s protected health information for any purpose other than the pending litigation, and required Wellstar to return or destroy any protected health information at the conclusion of the litigation.  Notably, the qualified protective order also recognized that while the plaintiff’s medical providers were permitted to engage in ex parte communications, they were not required to do so.

The Georgia Supreme Court reviewed the matter on an interlocutory basis to consider whether the trial court’s ruling complied with prior rulings that after a plaintiff files suit putting his medical condition at issue, a defendant is permitted to formally or informally seek plaintiff’s protected health information.  See Moreland v. Austin, 284 Ga. 730, 670 S.E.2d 68 (2008).  Georgia statutory law contains a similar provision.  See O.C.G.A. 24-9-40.  However, although HIPAA provides for disclosure in connection with a court order or subpoena in a judicial proceeding, HIPAA gives patients more control over informal contacts regarding protected health information.  Under HIPAA, without a court order, subpoena, or a release from the plaintiff, the medical provider may only disclose protected health information if it is assured that reasonable efforts were made to notify the plaintiff of the request or to secure a qualified protective order.  See 45 C.F.R. 164.512.

The Georgia Supreme Court concluded that ex parte communications between defendant’s counsel and plaintiff’s medical providers is permissible under HIPAA if the foregoing safeguards are met.  The Court further concluded that the qualified protective order issued in Baker sufficiently protected HIPAA’s procedural safeguards.  However, the court noted that Georgia law provides that a plaintiff waives his privacy rights only with regard to a medical condition at issue in a civil or criminal proceeding.  As such, the Court concluded that the qualified protective order issued in Baker was over-broad because it permitted defendants to inquire as to past, present, and future care without regard to whether such inquiry was relevant to the medical condition at issue in the pending litigation.

Practice Tips:  Georgia courts recognize that ex parte communications with a plaintiff’s medical providers are valuable and permissible.  However, before seeking to engage in such communications, defendants should obtain a qualified protective order with the following provisions:

  • permitting defendant to discuss plaintiff’s protected health information only to the extent that it bears on a medical condition at issue in the subject litigation
  • prohibiting the defendant from using or disclosing plaintiff’s protected health information for any purpose other than the pending litigation
  • requiring defendant to return or destroy any protected health information at the conclusion of the litigation
  • recognizing that the plaintiff’s medical providers were permitted, but not required, to engage in ex parte communications