MEMORANDUM AND ORDER

ROANNE L. MANN, United States Magistrate Judge.

Among the myriad discovery disputes in these related Zyprexa cases are objections by the States of Connecticut, Louisiana, Mississippi, Montana, and New Mexico (collectively " the States" ) to the production of non-party medical records sought by defendant Eli Lilly & Company (" Lilly" ). The States argue that the records are not relevant, are protected by physician-patient privileges grounded in state law, and present " as-yet-unknown burdens" regarding their production. For the reasons that follow, this Court rules that the records must be produced in de-identified form.

BACKGROUND

In these civil actions, the States seek damages, including reimbursement for Medicaid payments, stemming from the alleged unlawful marketing of Zyprexa, an atypical anti-psychotic drug manufactured by Lilly. With the exception of Connecticut, the States originally filed their claims in state courts, but the cases were removed to federal district courts and were thereafter transferred to this Court by the Judicial Panel on Multidistrict Litigation.

As part of its discovery demands, Lilly seeks a sampling of medical records for Medicaid patients who used Zyprexa, as well as records for patients who took other atypical anti-psychotic drugs during the relevant time period. The States contend that these records are irrelevant and privileged, and are not, in any event, obtainable without the issuance of subpoenas by Lilly. The parties have briefed these issues exhaustively, as part of their position statements regarding the discovery schedule, in letters accompanying the submission of the States' respective Medicaid application forms, and in response to an Order to Show Cause issued by this Court on August 14, 2008.

The Court is sensitive to the importance of the privacy interests of non-parties whose medical histories have become subject to scrutiny as a result of these Zyprexa cases. With that in mind, the Court addresses the States' various arguments against disclosure of the records.

DISCUSSION

I. Relevance

This Court has already ruled that " [t]he medical records for Medicaid beneficiaries taking Zyprexa are relevant to Lilly's defenses...." Case Management Order 1; see also Transcript of Proceedings Held on June 13, 2008 [" 6/13/08 Tr." ] at 78. Nevertheless, the States persist in arguing that the records are irrelevant, and therefore not discoverable. See 8/26/08 Pl. Reply to Order to Show Cause, at 12.

It bears repeating, then, that the records are in fact relevant to Lilly's defenses. For example, as Lilly notes, the use of a statistically significant sample of Medicaid patient records can help to explain information obtained from Medicaid databases, and may provide " information on potential confounding variables not found in the encounter[ ] data." 6/13/08 Tr. at 107. The text cited by Lilly explains that " [a]n approach to handling confounding by factors not recorded in encounter data is to perform medical record review within the cases to assess the relationship between the confounding factor and the exposure of interest." Brian L. Strom, Pharmacoepidemiology 289 (4th ed.2005).

It is plainly evident that, given the disputed issue of causation, disclosure of the medical records is " reasonably calculated to lead to the discovery of admissible evidence." Fed.R.Civ.P. 26(b)(1). Accordingly, the Court declines to modify its previous ruling on relevance.

II. Privilege

In addition to challenging disclosure on relevance grounds, the States argue that their respective physician-patient privilege laws prohibit discovery of the patient medical records. Cf. Fed.R.Civ.P. 26(b)(1) (" Parties may obtain discovery regarding any nonprivileged matter that is relevant to any party's claim or defense ...." ) (emphasis added). For the reasons that follow, this Court concludes that the States' privilege laws pose no obstacle to the discovery of the medical records, provided the records are de-identified.

A. Applicable Privilege Law

It is axiomatic that state privilege laws do not govern in federal question cases. See Nw. Mem'l Hosp. v. Ashcroft, 362 F.3d 923, 925-26 (7th Cir.2004); von Bulow v. von Bulow, 811 F.2d 136, 141 (2d Cir.1987); Nat'l Abortion Fed'n v. Ashcroft, No. 03-CV-8695 (RCC), 2004 WL 555701, at *6 (S.D.N.Y. Mar. 19, 2004) (citations omitted); EEOC v. Boston Market Corp., No. 03-CV-4227 (LDW) (WDW), 2004 WL 3327264, at *3-4 (E.D.N.Y. Dec. 16, 2004). And even where a federal question case contains pendent state law claims, the federal law of privileges still obtains. See von Bulow, 811 F.2d at 141; see also S. Rep. 93-1277, as reprinted in 1974 U.S.C.C.A.N. 7051, 7059 n. 16 (" It is ... intended that the Federal law of privileges should be applied with respect to pendent State law claims when they arise in a Federal question case." ). No physician-patient privilege exists under federal common law. See Nw. Mem'l Hosp., 362 F.3d at 926; Kunstler v. City of New York, No. 04-CV-1145 (RWS) (MHD), 2006 WL 2516625, at *6 & n. 7 (S.D.N.Y. Aug. 29, 2006) (citing Jaffee v. Redmond, 518 U.S. 1, 10, 116 S.Ct. 1923, 135 L.Ed.2d 337 (1996)) (noting federal courts' rejection of the physician-patient privilege); see generally Fed.R.Evid. 501.

In contrast to federal question cases, state privilege laws apply in suits in federal court-such as diversity cases-in " which State law supplies the rule of decision." Fed.R.Evid. 501; see also Application of Am. Tobacco Co., 880 F.2d 1520, 1527 (2d Cir.1989) (citing Dixon v. 80 Pine St. Corp., 516 F.2d 1278, 1280 (2d Cir.1975)); R.R. Salvage of Conn., Inc. v. Japan Freight Consolidators (U.S.A.) Inc., 97 F.R.D. 37, 39 (E.D.N.Y.1983) (citations omitted). In federal cases in which state privileges apply, those privileges " should be interpreted no more broadly than necessary." Am. Tobacco Co., 880 F.2d at 1527.

On this issue, Connecticut stands in a different position than the other States. Because Connecticut's complaint against Lilly involves a federal question-arising under the federal civil RICO statute-that case is not governed by Connecticut's statutory or common law privileges, including its physician-patient privilege. And because there is no physician-patient privilege under federal law, the non-party records Lilly seeks in Connecticut's case are discoverable pursuant to an order of this Court, with or without redaction. Cf. Nw. Mem'l Hosp., 362 F.3d at 924-26 (holding that state privileges do not apply to non-party hospital, because underlying litigation involved a federal question).

As to the remaining States, the identification of the applicable body of privilege law is less clear. Although none of the other States allege violations of federal law in their complaints, and each has vigorously challenged the basis for federal jurisdiction, Judge Weinstein has held that jurisdiction lies under Grable & Sons Metal Prods., Inc. v. Darue Eng'g & Mfg., 545 U.S. 308, 125 S.Ct. 2363, 162 L.Ed.2d 257 (2005). See, e.g., State of Montana v. Eli Lilly & Co., No. 07-CV-1933, 2008 WL 398378, at *4-7 (E.D.N.Y. Feb. 12, 2008); Hood v. Eli Lilly & Co., No. 07-CV-645, 2007 WL 1601482, at *1 (E.D.N.Y. June 5, 2007); State of West Virginia v. Eli Lilly & Co., 476 F.Supp.2d 230, 233-34 (E.D.N.Y.2007); Foti v. Eli Lilly & Co., 375 F.Supp.2d 170, 172-73 (E.D.N.Y.2005).

In Grable, the Supreme Court recognized that " in certain cases federal-question jurisdiction will lie over state-law claims that implicate significant federal issues[,]" even in the absence of claims arising directly under federal law. Grable, 545 U.S. at 312, 125 S.Ct. 2363. The Supreme Court explained: " [A] federal court ought to be able to hear claims recognized under state law that nonetheless turn on substantial questions of federal law, and thus justify resort to the experience, solicitude, and hope of uniformity that a federal forum offers on federal issues[.]" Id. In denying several States' motions to remand, Judge Weinstein ruled that " the substantial federal funding provisions involved and the allegations about the violation of federal law through improper off-label use [of Zyprexa] present a core of substantial [federally oriented] issues...." Foti, 375 F.Supp.2d at 172-73; see also McGraw, 476 F.Supp.2d at 234 (" At issue here is not simply a federal standard, but also the added factor of an intricate federal regulatory scheme including detailed federal funding provisions, requiring some degree of national uniformity in interpretation." ). Thus, whether state privilege law applies is informed by the fact that these cases involve federal question jurisdiction, as opposed to diversity jurisdiction.

Unfortunately, there is a paucity of case law on the issue of which body of privilege law applies in a Grable -type federal question case. Where, as here, federal interests are strong enough for Grable -type federal question jurisdiction to attach, the underlying rationale of Rule 501 of the Federal Rules of Evidence suggests that the federal law of privileges should apply. See S. Rep. 93-1277, as reprinted in 1974 U.S.C.C.A.N. 7051, 7058-59 & n. 17. However, except as to Connecticut, state law will determine if and to what extent Lilly is liable for the harm claimed by the States-a countervailing factor on the privilege issue. See id.

Although it may well be that none of the States' respective privilege laws should apply in these cases, that issue need not be definitively resolved; regardless of the resolution of that issue, federal statutes and regulations make clear that de-identified health information is discoverable in litigation in federal court, with or without patient consent.

B. HIPAA

Pursuant to the Health Insurance Portability and Accountability Act of 1996 (" HIPAA" ), Pub.L. No. 104-191, 110 Stat. 1936 (1996), there are many circumstances in which " [a] covered entity may use or disclose protected health information without the written authorization of the individual ... or the opportunity for the individual to agree or object[.]" 45 C.F.R. § 164.512. These include disclosures " [i]n response to an order of a court[,] ... provided that the covered entity discloses only the protected health information expressly authorized by such order[.]" Id. § 164.512(e)(1)(i). Under section 164.512, " it is evidently denudate that a purpose of HIPAA was that health information, that may eventually be used in litigation or court proceedings, should be made available during the discovery phase." Bayne v. Provost, 359 F.Supp.2d 234, 237 (N.D.N.Y.2005) (citing 45 C.F.R. § 164.512(e)(1)(ii)).

As previously discussed, Connecticut's physician-patient privilege does not apply in its case against Lilly because that case is grounded in a federal question. Accordingly, the protected health information (i.e., the medical records) of patients in Connecticut can be discovered pursuant to an order of this Court, so long as the covered entity (i.e., the State of Connecticut Department of Social Services) discloses only that information authorized in such an order. Cf. 45 C.F.R. § 164.512(e)(1)(i).

The other States contend that their respective privilege laws are more stringent than HIPAA, and argue that a HIPAA-compliant court order will not suffice to protect the privacy interests of the patients whose medical records Lilly seeks. This argument has some appeal, but ultimately misses the mark. Even assuming that state privilege laws afford greater protection to the records Lilly seeks-and it is not entirely clear that they do-HIPAA contains a supersession clause which makes clear that to the extent state privilege laws are more protective of de-identified health information than is HIPAA, those laws are preempted by HIPAA's regulatory scheme.

Under HIPAA, a provision of state law that is contrary to HIPAA's standards or requirements is preempted, unless " [t]he provision of State law relates to the privacy of individually identifiable health information and is more stringent than a [HIPAA] standard, requirement, or implementation specification...." 45 C.F.R. § 160.203(b); see also 42 U.S.C. § 1320d-7. " A standard is ‘ more stringent’ if it ‘ provides greater privacy protection for the individual who is the subject of the individually identifiable health information’ than the standard in the regulation." Nw. Mem'l Hosp., 362 F.3d at 924 (quoting 45 C.F.R. § 160.202(6)). Federal regulations further provide that " [h]ealth information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information." 45 C.F.R. § 164.514(a). To achieve de-identification, numerous identifiers must be redacted from the relevant medical records. See id. § 164.514(b)(2).

The Seventh Circuit's decision in Northwestern Memorial Hospital is instructive on the interplay between HIPAA and state privilege law. In that case, a non-party hospital challenged a Department of Justice subpoena seeking records of patients who underwent late-term abortions, in order to use those records in litigation surrounding the constitutionality of the Partial-Birth Abortion Ban Act, 18 U.S.C. § 1531. See Nw. Mem'l Hosp., 362 F.3d at 924. In the course of its decision, the Seventh Circuit held that HIPAA does not create a federal physician-patient privilege, but rather provides a procedure for the disclosure and use of medical records in litigation. See id. at 926. The court noted that any applicable privilege would be found outside of HIPAA regulations, and pointed to the supersession clause as supporting its conclusion. See id. The court declared: " Provided that medical records are redacted in accordance with the redaction requirements ... of § 164.514(a), they would not contain ‘ individually identifiable health information’ and the ‘ more stringent’ clause would fall away." Id. A concurring judge put the point succinctly: " In passing HIPAA, Congress recognized a privacy interest only in ‘ individually identifiable medical records' and not redacted medical records, and HIPAA preempts state law in this regard." Id. at 933 (Manion, J., concurring in part and dissenting in part).

In tandem, these statutory provisions and regulations compel the conclusion that de-identified health information is not protected under HIPAA, and that, to the extent state privilege laws offer protection to de-identified medical records, HIPAA preempts those laws. Accordingly, the States' physician-patient privilege laws do not prevent Lilly from discovering the de-identified records it seeks. C. State Physician-Patient Privilege Laws

In any event, even in the absence of HIPAA preemption, it appears that the States' respective privilege laws would not apply to de-identified information. While all of the States provide privilege protection to communications (including those reflected in medical records) by a patient to a physician for the purposes of treatment, see, e.g., Conn. Gen.Stat. § 52-146o; La.Rev.Stat. Ann. § 13:3734(A)(1); Miss.Code Ann. § 13-1-21; Mont.Code Ann. §§ 50-16-525, 50-16-535; La.Code Evid. Ann. art. 510(B); Miss. R. Evid. 503(b); N.M. R. Evid. 11-504(B), each State has also recognized that de-identified or redacted medical records simply do not fall within the ambit of their respective privilege laws. See, e.g., Mont.Code Ann. § 50-16-504(6) (" Health care information" under Montana's Uniform Health Care Information Act is limited to " information ... that identifies or can readily be associated with the identity of a patient and relates to the patient's health care." ); N.M. Stat. Ann. § 14-6-1 (providing that health information in the custody of government agencies is confidential, but only insofar as it " relates to and identifies specific individuals as patients" ) (emphasis added), together with N.M. R. Evid. 11-504(D)(4) (" There is no privilege ... for communications relevant to any information that the physician ... or patient is required by statute to report to a public employee or state agency." ); Fischer v. Hartford Hosp., No. CV-0569702, 2002 WL 237409, at *3 (Conn.Super. Jan. 23, 2002) (" The defendant [hospital] ... is ordered to disclose the information requested by plaintiff provided that all identifiable [non-party] patient information shall be deleted." ); Jackson v. Baptist Ret. Ctr. of Arcadia, 933 So.2d 131, 131 (La.2006) (permitting discovery of non-party medical records subject to redaction of identifying information); Speer v. Whitecloud, 744 So.2d 1283, 1284 (La.1999) (" Once any personal information which would identify the patients is redacted from the records, the requested discovery does not invade the physician patient privilege, and the need for [notice to the patient and a contradictory hearing] is eliminated." ); Baptist Mem'l Hosp. v. Johnson, 754 So.2d 1165, 1169-70 (Miss.2000) (requiring disclosure of non-party patient medical records without redaction).

This is precisely the point made in In re Rezulin Products Liability Litigation, 178 F.Supp.2d 412 (S.D.N.Y.2001), which provided a starting point for this Court's colloquy with the parties on the issue of redaction. See 8/14/08 Order to Show Cause. In Rezulin, a diversity case involving alleged deceptive marketing by a pharmaceutical company, the defendant company subpoenaed physicians to compel them to produce medical records pertaining to patients who had participated in clinical trials of the drug at issue. See Rezulin, 178 F.Supp.2d at 413. As in these Zyprexa cases, the defendant in Rezulin was amenable to production of redacted records. See id. Construing Texas law, Judge Kaplan concurred with the " heavy weight of authority" from across the country and held that " the discovery of [medical] records redacted to eliminate identifying information may be compelled consistent with the [physician-patient] privilege...." Id. at 416 & n. 16 (collecting cases). Here, as in Rezulin, the fact that the States afford protection to medical records containing identifying information is of no moment; production of de-identified records would offend none of the States' respective privilege laws.

Having taken into account the above considerations and arguments, this Court concludes that, provided the disputed medical records are de-identified in accordance with the requirements of 45 C.F.R. § 164.514(b)(2), they are not privileged and are thus discoverable pursuant to Rule 26(b) of the Federal Rules of Civil Procedure. See Fed.R.Civ.P. 26(b). For the same reason, the production of the records in de-identified form obviates the need for a mechanism to address the individual privacy objections of patients and health care providers. Cf. ACLU v. Dep't of Def., 543 F.3d 59, 63-64, 86-88 (2d Cir.2008) (referring, in the FOIA context, to the privacy interest in de-identified sexually graphic photographs as " de minimis." ).

III. Mechanism for Production

The remaining question to be decided is how the records are to be produced. The States vehemently resist having this Court order their respective agencies to compel providers to produce the records to the State Medicaid agencies. Instead, the States would have Lilly subpoena the records and provide each patient an opportunity to object.

At the outset, it is important to note that HIPAA provides for a subpoena process that does not require notice to patients. Pursuant to HIPAA regulations, Lilly could subpoena (de-identified) medical records without notifying the patient, so long as Lilly provided the physician with adequate assurance that it had made reasonable efforts to seek a HIPAA-qualified protective order. See 45 C.F.R. § 164.512(e)(1)(ii)(B). This Court is prepared to enter such a protective order. Thus, even absent a court order directing the State agencies to retrieve the records, patient notification would not be necessary.

Nevertheless, it does not follow from Lilly's legal authority to subpoena de-identified medical records that Lilly should be required to do so where another lawful, more efficient means of obtaining the records exists. These cases are subject to expedited discovery schedules, and cannot remain in the discovery phase indefinitely. The process for disclosure must be streamlined in order to complete discovery within the deadlines set forth in Case Management Orders 4(A) and 4(B). Requiring Lilly to subpoena the medical records would complicate and prolong the discovery process. Significantly, Lilly does not know the identities of the patients whose medical records it seeks. Moreover, the States are in a better position to ensure that the medical records produced are a randomly selected, statistically significant sample. If Lilly were constrained to subpoena the medical records, it would likely target only certain records, which would inevitably lead to protracted argument over whether the records subpoenaed represent a statistically significant sample, or, put otherwise, whether the parameters of the subpoena process are " reasonably calculated to lead to the discovery of admissible evidence." Fed.R.Civ.P. 26(b)(1).

For the reasons that follow, this Court concludes that the States' Medicaid agencies have the legal and practical ability to obtain the patient records, and that disclosure of the records in this manner will provide the most effective means of maintaining patient privacy while ensuring that Lilly receives in a timely fashion the discovery to which it is entitled.

Pursuant to 42 U.S.C. § 1396a(a)(25), states participating in the Medicaid program are required to make reasonable efforts to pursue third parties who might be liable for reimbursement of care and services provided under Medicaid plans. See 42 U.S.C. § 1396a(a)(25)(A)-(B). " Third party means any individual, entity or program that is or may be liable to pay all or part of the expenditures for medical assistance furnished under a State plan." 42 C.F.R. § 433.136(3) (emphasis added). This broad definition of " third party" includes tortfeasors. Cf. Arkansas Dep't of Health & Human Servs. v. Ahlborn, 547 U.S. 268, 280-82, 292, 126 S.Ct. 1752, 164 L.Ed.2d 459 (2006) (striking down statute allowing for lien against patient's recovery from tortfeasor, but only insofar as that statute permitted a lien in an amount exceeding the costs of medical care). And pursuant to 42 U.S.C. § 1396a(a)(27), participating states must maintain agreements with providers requiring the latter to " keep such records as are necessary fully to disclose the extent of the services provided to individuals receiving assistance under the State plan," and to furnish those records to the state agency upon request. 42 U.S.C. § 1396a(a)(27). The ability of the States to collect Medicaid patient records is confirmed by an implementing regulation, which parrots section 1396a(a)(27) in somewhat broader terms, and requires service providers to " [k]eep any records necessary to disclose the extent of services the provider furnishes to recipients[,]" and to furnish those records to the Medicaid agency upon request. 42 C.F.R. § 431.107(b) (emphasis added); see also United States ex rel. Woodard v. Tynan, 776 F.2d 250, 252 (10th Cir.1985) (" By participating in the Medicare and Medicaid programs [providers] expressly consented to [the State's] access to all of their relevant business records." ).

" Neither federal nor state law requires that any person participate in the Medicaid program as a patient or as a provider." In re Search Warrant for 2045 Franklin, Denver, Colo., 709 P.2d 597, 601 (Colo.App.1985). Courts thus have recognized that by voluntarily electing to participate in the Medicaid program, a Medicaid recipient implicitly waives the physician-patient privilege vis-à-vis the Medicaid agency, at least to the extent necessary for the state to verify the services billed and to investigate possible Medicaid fraud. See id.; see also People v. Ekong, 221 Ill.App.3d 559, 561-64, 164 Ill.Dec. 25, 582 N.E.2d 233 (1991); In re Grand Jury Investigation, 441 A.2d 525, 530-32 (R.I.1982). The physician-patient privilege simply is not implicated when a state agency compels production of Medicaid records for use in connection with the agency's lawful functions; and to the extent that state law provides otherwise, it is trumped by the Supremacy Clause and by the state's obligations under the Medicaid regulations.

The States' various arguments regarding the authority of their agencies to obtain patient records are ultimately unavailing. First, the States' contention that their right to collect Medicaid medical records arises only in the context of subrogation claims or suits against physicians who abuse the Medicaid system is inconsistent with the broad language of the provision that codifies that right and, indeed, obligation. See 42 U.S.C. § 1396a(a) (25); see also Ahlborn, 547 U.S. at 275-77, 126 S.Ct. 1752 (the States' obligation reasonably to pursue third parties who might be liable for Medicaid costs is mandatory pursuant to federal law). The States' complaints include demands for damages seeking reimbursement, through one theory of liability or another, for Zyprexa-related expenditures by their respective Medicaid plans. These demands are thus akin to subrogation claims, albeit cloaked in other language. As the States are seeking recovery of Medicaid monies from Lilly, a third party that they allege is responsible for their expenditure of Medicaid funds, the States' claims fall within the purview of 42 U.S.C. § 1396a(a)(25).

Second, with the exception of Louisiana, the States' Medicaid application forms notify applicants that their health information may be used as required by state and federal law. To be sure, some of these provisions are more explicit than others. But the Notices of Privacy Practices issued by the all of the States' respective agencies-including Louisiana's-make clear that health information obtained by the agencies may be disclosed pursuant to a court order.

All of these considerations compel the conclusion that the medical records Lilly seeks are within the control of the respective States for the purposes of Rule 34 of the Federal Rules of Civil Procedure. See Fed.R.Civ.P. 34(a)(1)(A); see also In re NTL, Inc. Sec. Litig., 244 F.R.D. 179, 195 (S.D.N.Y.2007) (" Under Rule 34, ‘ control’ does not require that the party have legal ownership or actual physical possession of the documents at issue; rather, documents are considered to be under a party's control when that party has the right, authority, or practical ability to obtain the documents from a non-party to the action." ) (internal quotation marks and citations omitted). Accordingly, resort to the subpoena process is not necessary.

Finally, protective measures are available to address the States' concern for patient privacy. Indeed, in discussing why Lilly should not have redacted patient names from call notes produced to the States, counsel for the State of Connecticut, apparently speaking on behalf of all plaintiffs, observed that " state attorneys general, if there's any litigant, are going to assure the privacy of those people's names." Transcript of Proceedings Held on May 28, 2008, at 25. In light of this assurance, the Court is confident that patient privacy will not be compromised by production of Medicaid patient records to the States' Medicaid agencies and in turn to Lilly, especially with a protective order in place.

CONCLUSION

For the foregoing reasons, the States are ordered to produce a randomly selected, statistically significant sample of patient medical records by the deadline set in Case Management Orders 4(A) and 4(B). The parties are directed to meet and confer in good faith as to what constitutes a statistically significant sample, to reach agreement on the language of a protective order, as well as to resolve any other logistical concerns they may have. A hearing will be held on October 1, 2008, at 9:30 a.m. in Courtroom 13C South, to finalize these matters. All States except Connecticut must de-identify the records in accordance with HIPAA regulations. See 42 C.F.R. § 164.514(b)(2). Connecticut may redact its records if it so chooses. In each record, the patient's name must be replaced with a unique identifier, and the States must supply information to Lilly that enables it to link each record with its corresponding claims data.

Any objections to this Memorandum and Order must be filed with the Honorable Jack B. Weinstein on or before September 29, 2008, or will be deemed waived. Absent further court order, the filing of an objection does not stay the parties' obligations hereunder.

SO ORDERED.

Though invited by the Court to narrow their claims in a similar fashion, see, e.g., 9/11/08 Order, State of Connecticut v. Eli Lilly & Co., No. 08-CV-955 (JBW) (E.D.N.Y.), D.E. # 81, at 3-4, the other States declined to do so.

Assuming arguendo that this issue were governed by Louisiana law, this Court would be obligated to follow a controlling decision of the State's highest court, or, in the absence of such a decision, to predict how the highest court would resolve this issue. See In re Rezulin Prods. Liab. Litig., 178 F.Supp.2d 412, 414 & nn. 8-9 (S.D.N.Y.2001) (collecting cases). In contrast to the intermediate appellate decision cited by the State, the Supreme Court of Louisiana has made clear that de-identified medical records are not privileged under Louisiana law. See Jackson, 933 So.2d at 131; Speer, 744 So.2d at 1284. Moreover, to the extent that the appellate court's decision would afford protection to de-identified records under Louisiana law, HIPAA preempts that state law. Accordingly, this Court is not persuaded that Louisiana law requires both waivers and de-identification of patient medical records.

Louisiana's Medicaid Application does not contain any notice provisions regarding use of health information. Instead, patients in Louisiana must sign a separate authorization form to permit release of their health information to the Louisiana Department of Health and Hospitals (" DHH" ). See State of Louisiana, Department of Health and Hospitals, Authorization to Release or Obtain Health Information For Eligibility in Program Enrollment, at 1 (Apr. 14, 2003), Foti v. Eli Lilly & Co., No. 05-CV-1455 (JBW) (E.D.N.Y), D.E. # 116, Ex. B. As a practical matter, patients are required to sign the waiver in order for eligibility determinations to be made. See id. at 2 (" If you do not agree to release of information required to determine your eligibility for enrollment in our health plan or to determine your entitlement to benefits we may not be able to make the required eligibility decisions." ). And once information is disclosed to DHH, that information " may be re-disclosed by [DHH] and will no longer be protected by DHH privacy policies." See id. Moreover, a patient who signs the waiver form acknowledges that her health information may be needed for disclosure to a third party, including disclosure for the purposes of litigation. See id.