- HHS Provides Guidance Regarding the Disclosure of Protected Health Information ("PHI") in Litigation Context
- February 24, 2005
- Law Firm: Winston & Strawn LLP - Chicago Office
For many clients, compliance with the HIPAA privacy requirements on a day to day basis has not been much of an issue. They were, even prior to HIPAA, cognizant of the potentially sensitive nature of an employee's medical history, and in fact made efforts to distance themselves from such information beyond what was required by applicable law. However, even for these clients, litigation that involves PHI presents issues under the HIPAA privacy rules. Recently, the Department of Health and Human Services posted a series of questions and answers on this subject on its website. Among the issues addressed:
- a health plan may disclose PHI to comply with a court order, including an order of an administrative tribunal although such disclosures must be limited to the PHI expressly authorized by the order;
- a plan that is not a party to a legal proceeding may disclose PHI in response to a subpoena, discovery request or other lawful process (or a copy of any of the foregoing), that is not accompanied by a court order, if the plan receives satisfactory assurances that the requesting party has made reasonable efforts either (1) to ensure that the individuals who are the subject of the information have been given sufficient notice of the request, or (2) to secure a qualified protective order (which may be provided to the individual's attorney).
With respect to the notice requirement, the documentation must demonstrate:
- that a good faith attempt was made to locate the individual (or, if the individual's location is unknown, to mail a notice to the individual's last known address);
- the notice included sufficient detail to permit the individual to raise an objection with the court or administrative tribunal;
- the time for the individual to raise objections under the rules of the court or tribunal has lapsed and no objections were filed or all objections filed by the individual have been resolved by the court and are consistent with the resolution.
The plan should obtain a copy of the notice to the individual that includes instructions for raising an objection with the court and the deadline for so doing. It should also obtain a written statement or other documentation demonstrating that no objection was raised, or all objections raised were resolved and the request is consistent with the resolution.
With respect to the qualified protection order, the party requesting the information must provide a written statement and documentation that demonstrates either that the parties to the dispute have agreed to a qualified protective order and presented it to the court or tribunal (in which case a copy of the order should be provided to the plan), or the party seeking the PHI has requested a qualified protective order from the court or tribunal, in which case the plan should receive a copy of the motion filed with the court or administrative tribunal, as applicable.
Where a covered entity is party to a legal proceeding, whether as plaintiff or defendant, it may issue or disclose PHI for purposes of the litigation as part of its health care operations. However, the covered entity must make reasonable efforts to limit such uses and disclosures to the minimum necessary for the stated purpose. For this rule, the plan may reasonably rely on the representations of its attorney, either in-house or business associate attorney, that the information requested is the minimum necessary for the stated purpose. Because disclosures of PHI are limited to the minimum necessary, these disclosures may be less than a "relevance" standard would require.
A covered entity must account to an individual with respect to PHI that is disclosed pursuant to a subpoena, court order or legal process in a litigation to which the plan is not a party. However, a plan need not account for disclosure of PHI in a litigation if the individual has authorized the disclosure or, if the plan is a party to the litigation and the disclosure is part of the plan's health care operations.
A lawyer business associate must ensure that anyone assisting the lawyer in providing legal services to a plan, such as co-counsel, jury experts, document or file managers, investigators, and litigation support personnel will abide by and comply with the privacy restrictions that apply to the lawyer.