Opinion
No. CV 03 0193491S
April 27, 2005
Memorandum of Decision
The plaintiff's claim that Leon Fliegelman ("Leon") was injured on August 29, 2001 at a facility named "Cardiac Rehabilitation Center," operated by defendant, Stamford Health System, Inc. The injuries allegedly occurred when another "patron," Patricia Mayor, caused a treadmill Leon had been using to reactivate after he had turned it off and while he was dismounting from the apparatus. Presently at issue is defendant, Stamford Health System's Motion for a Protective Order dated February 25, 2005 (#121). That motion asks that the court protect the defendant from disclosing the names of persons who might have been witnesses to the circumstances and events lending to the plaintiff's injury.
In its motion the defendant refers to certain discovery requests made by the plaintiffs which are "attached as Exhibit A." Unfortunately, the copy of the motion filed with the court has no "Exhibit A" attached. However, from the defendant's motion it appears that the plaintiffs have requested that the defendant disclose the name of all "patrons" enrolled at defendant's facility for the month of August 2001.
The defendant objects to disclosure on the ground that it is operating a health care facility. It claims that all persons who use the facility are "patients" whose privacy is inviolate under the provisions of HIPAA, 42 USC § 1320d et seq. "Disclosing records of other patients without a proper authorization undoubtedly violates HIPAA, exposes defendant to sanctions, and violates the privacy of other patients who are not parties to this action, and have not placed there (sic) medical condition in issue." On the same grounds the defendant seeks a protective order to avoid disclosing "attendance records and/or sign in sheets." To put it another way the defendant suggests that the plaintiff must learn the identity of the patient-witnesses, obtain HIPAA compliant authorizations from them before the defendant will disclose identifying information regarding these very witnesses.
The defendant has not provided the court with any Connecticut authority in support of this circular claim of privilege, but cites the decision of the Appellate Division of the Supreme Court of New York (Second Department) in a case arising out of virtually the same fact pattern. In Gunn v. Sound Shore Medical Center of Westchester, 5 A.D.3d 435, 772 N.Y.S.2d 714 (2004) the plaintiff claimed to have been injured on a treadmill at the cardiac rehabilitation center of a New York hospital. The plaintiff sought discovery of the names and addresses of the patients who were present at the center at the time of the injury. The court overruled the decision of the trial court to release the names of the patients, despite acknowledging its prior holding in Hirsch v. Catholic Medical Center of Brooklyn Queens, 91 A.D.2d. 1033 (1983) that the release of the names of patient witnesses in a medical malpractice case would not violate those patients' privacy rights under New York statutory law. The court based its ruling, not on a finding that the express provisions of HIPAA prohibited the release of the requested information but rather on "[t]he modern-day legislative trend to protect a medical patients' privacy" and the court's view that "the passage of HIPAA lends support to the conclusion that disclosure of the identity of the other patients at the Center would breach the physician-patient privilege and thus should not be permitted." 5 A.D.3d at 437.
This court declines to follow Gunn. The issue at hand involves the balancing of the rights to litigants to obtain possibly crucial evidence against the privacy rights of potential witness. Such decisions involve important public policy considerations which are better addressed by legislatures than by courts. In our system of checks and balances it is not the role of the courts to anticipate legislative trends and thus pre-empt the function of legislative bodies.
In their memorandum of law submitted in opposition to defendant's motion, the plaintiffs claim, without citing authority, that the identity of the patient-witnesses is not protected under HIPAA. This assertion is without merit. The definitions of "Health Information" and "Health Care Provider" under 42 U.S.C. § 1320d are quite broad and clearly include the information sought by the plaintiffs. However, contrary to the defendant's assertion, the fact that the identity of patients is confidential under HIPAA does not mean that the information is protected from discovery under all circumstances.
The regulations issued by the Secretary of Health and Human Services under HIPAA expressly contemplate the disclosure of the information sought by plaintiffs. 45 C.F.R. § 164.512(a)(1) provides: "A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use and disclosure complies with and is limited to the relevant requirements of such law." Subsection (e) of the same regulation provides, in relevant part:
"(e) Standard: Disclosure for judicial and administrative proceedings.
(1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding:
(i) In response to an order of a court . . . provided that the covered entity discloses only the protected health information expressly authorized by such order; or
(ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court . . . if:
(B) The covered entity receives satisfactory assurance . . . from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v) of this section.
(v) . . . a qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii) of this section, an order of a court . . . or a stipulation by the parties to the litigation . . . that:
(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation . . . for which such information was requested: and
(B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation . . ."
Since the disclosure of the information requested by the plaintiffs is authorized under these regulations, the court finds that the defendant is not entitled to a protective order on the grounds set forth in its motion.
However, the court will grant the protective order on other grounds. The parties are scheduled to commence trial on May 17, 2005. A scheduling order issued by the court (#119.0) on October 29, 2004 and signed by counsel for both parties required that all written discovery and responses be completed by February 15, 2005. The file does not show that the plaintiff moved for an extension of this time limit. Moreover, the record does not show the date on which the plaintiffs' discovery request was filed, the actual scope of the request or that the request was accompanied by either a qualified protective order or by a stipulation of the parties in compliance with the requirements of 45 C.F.R. § 164.512(e)(ii)(B). If the plaintiffs can demonstrate that the discovery request they submitted was, in fact, timely and HIPAA compliant they may move for reconsideration pursuant to P.B. § 11-12.
David R. Tobin, Judge