DECISIONBefore the court is a dispute between plaintiffs and defendants concerning the proposed de-identification of claims data to be produced by plaintiffs in discovery. This issue was conferenced before the Special Masters, who ordered the parties to continue to meet and confer and report back as to the status on July 12, 2019. On July 12, 2019, Michael Reisman, Esq., Assistant Attorney General emailed the Special Masters and reported that the parties were at an impasse.Plaintiffs offered to produce over 20 years of Medicaid claims data in de-identified format, which would include unique identifiers to allow cross-referencing between opioid prescription claims and substance use disorder treatment claims within that data set. Plaintiff submitted a proposed order for consideration of the Court. Plaintiffs argue that their proposed order sufficiently ensures the privacy interests of non-party patients to protect patient health information in compliance with New York State and federal law, including CPLR 4504(a); Ferguson v. Laffer 149 A.D.3d 908, 52 N.Y.S.3d 394 (2d Dep’t 2017); and Education Law §6530 (23), as well as HIPAA, 45 CFR Parts 160 and 164; and 42 CFR Part 2.Plaintiffs point out that in similar circumstances in a case against many of the same defendants herein the District Court of Cleveland County of the State of Oklahoma entered a similar order authorizing de-identification of protected health information to be produced by plaintiffs therein, finding: “Defendants’ argument that this claims data is ‘relevant’ and discoverable I find to be insufficient to warrant discovery of personal patient and doctor/prescriber information in the scope sought to be compelled by Defendants.” State of Oklahoma v. Purdue Pharma L.P., Case No. CJ-2017-816 (Dist. Ct. Cleveland Cty), filed October 10, 2018, at 3.Defendants thereafter filed their response dated July 17, 2019, (NYSCEF numbers 1280-1284), objecting to the proposed de-identification of the claims data to be produced by plaintiffs. Defendants argue that it is critical that plaintiffs include personal identifying information for the claims data. Defendants argue that the personal identifying information is necessary so that they can search and cross-reference relevant outcome records (e.g., medical examiner, juvenile removal records, and crime records) to determine whether such individuals received a prescription for an opioid, the type thereof, whether it was manufactured or distributed by any defendant, who prescribed such medicine, whether the prescriber ever heard or saw misrepresentations alleged to have been made in the plaintiff’s complaints, the diagnosis code explaining why the prescription was written for the opioid, etc.Defendants point out that in the federal MDL pending in Ohio the court therein found “public interest and the need for disclosure of this information, subject to the restrictions set forth herein, outweigh the personal injury to the patient, the physician-patient relationship and the treatment services,” and the MDL court ordered only limited redaction for those records covered by Title 42, Part 2 of the CFR which provides further protection for the medical records of individuals treated for substance abuse disorders. Defendants thus submit their own proposed order similar to that entered in the MDL. Defendants also argue that plaintiffs lack standing to assert the physician-patient privilege under CPLR 4504. Defendants even argue that the claims against them should be dismissed if they cannot gain access to privileged information necessary to defend against them. Defendants also argue that the protected health information is authorized to be produced pursuant to the restrictions contained in the protective order previously entered in this action. Finally, defendants argue that plaintiffs have put the medical records of certain patients at issue and thus the medical records should be produced, privileged or not.HIPAAThe regulations implementing HIPAA provide standards for de-identification of protected health information. See, e.g., 45 C.F.R. §164.514. This is the procedure proposed by plaintiff with respect to its production of claims data. Defendants argue that permitting the claims data to be de-identified would violate their due process rights in the defense of this action, and contend that there is therefore good cause to require the documents to be produced without de-identification. 45 C.F.R. 164.512 (e)(1)(i) permits a covered entity to release protected health information when ordered to do so by a court. In the absence of a court order, in response to a subpoena or discovery request, notice to the patient of the request for the protected health information is required, 45 C.F.R. §164.512 (e)(1)(ii). Whether protected health information should be ordered produced in a case such as this without de-identification is a question which has been sparked with different answers. One only need to compare the decision in the Oklahoma state court opioid case, State of Oklahoma v. Purdue Pharma L.P., Case No. CJ-2017-816 (Dist. Ct. Cleveland Cty), with the decision of the federal court in the MDL pending in Ohio, In Re National Prescription Opiate Litigation, MDL No. 2804, Case No. 17-md-2804 (N.D. Ohio) (Polster, J.).NEW YORK STATE LAWThe disclosure of protected health information without de-identification would have to be consistent with not just HIPPA, but with applicable New York State law as well. See, e.g., CPLR §4504(a), Ferguson v. Laffer, 149 A.D.3d 908, 52 N.Y.S.3d 394 (2d Dep’t 2017); Education Law §6530 (23). HIPPA preempts inconsistent state law except to the extent: “the provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implement action specification adopted under subpart E of part 164 of this subchapter.” 45 C.F.R. §160.203(b).“However, even if disclosure is permitted under HIPAA, New York’s physician — patient privilege, which is more stringent than HIPAA, may bar disclosure. See In the Matter of Antonia E., 16 Misc.3d at 643-644, 838 N.Y.S.2d 872. With few exceptions, CPLR 4504 bars disclosure of medical records unless the patient has waived the privilege.” AOS v. RM, 21 Misc. 3d 686, 688-89, 865 N.Y.S.2d 835, 837 (Fam. Ct. Bronx Cty. 2008)The Appellate Division, Second Department has declined to apply HIPPA in the face of the more stringent CPLR 4504. For example, in Liew v. New York University Medical Center, 55 A.D.3d 566, 567 865 N.Y.S.2d 279, (2d Dep’t 2008) the court explained: “Moreover, the Health Insurance Portability and Accountability Act of 1996 (see Pub. L. 104-191, 110 U.S. Stat. 1936; hereinafter HIPAA) does not preempt state law with respect to the confidentiality of the donor’s records here inasmuch as it does not mandate disclosure under these circumstances and the confidentiality afforded the donor’s medical records by New York’s statutory physician-patient privilege is stricter than that provided by HIPAA (see Arons v. Jutkowitz, 9 N.Y.3d 393, 414-415, 850 N.Y.S.2d 345, 880 N.E.2d 831). Accordingly, the donor’s medical records may not be disclosed.” See also Ferguson v. Laffer, 149 A.D.3d 908, 52 N.Y.S.3d 394 (2d Dep’t 2017) (disclosure of medical records under CPLR 4504 is prohibited in the absence of a waiver of the physician-patient privilege by the patient).Defendants argue that plaintiffs lack standing to assert the physician-patient privilege on behalf of the non-party patients whose medical records are at issue. That the medical records may be in the possession of plaintiffs does not mean that the privilege has been waived. CPLR 4504(a) specifically provides that: “A patient, who for the purpose of obtaining insurance benefits, authorizes the disclosure of any such privileged communication to any person shall not be deemed to waive the privilege created by this subdivision.”Finally, defendants argue that plaintiffs have put the medical records at issue in this action, and thus should be required to produce them in unredacted form. Of course, the patients whose medical records are at issue are non-parties to this action, are not represented by plaintiffs’ counsel, and have not put their own medical records at issue in this action, which they may not even be aware is pending.New York law is more stringent than HIPPA and requires a waiver executed by the patient before the protected health information can be produced, unless de-identified. Accordingly, the procedure for the proposed de-identification of protected health information offered by plaintiff is approved, and the objections thereto by defendants are overruled. This decision is without prejudice with respect to any patients for whom defendants may be able to obtain duly executed authorizations or waivers.The de-identified documents are to be produced by plaintiffs forthwith.The parties are reminded that this is a decision concerning a discovery dispute and should not be construed by the parties as a comment upon, or endorsement of, plaintiffs’ aggregate theory of proof of liability or damages.Dated: July 24, 2019
