Summary
holding that de-identified medical records "are not privileged and are thus discoverable pursuant to Rule 26(b) of the Federal Rules of Civil Procedure."
Summary of this case from Roth v. Sunrise Senior Living Mgmt., Inc.Opinion
MEMORANDUM AND ORDER
ROANNE L. MANN, United States Magistrate Judge.
Among the myriad discovery disputes in these related Zyprexa cases are objections by the States of Connecticut, Louisiana, Mississippi, Montana, and New Mexico (collectively " the States" ) to the production of non-party medical records sought by defendant Eli Lilly & Company (" Lilly" ). The States argue that the records are not relevant, are protected by physician-patient privileges grounded in state law, and present " as-yet-unknown burdens" regarding their production. For the reasons that follow, this Court rules that the records must be produced in de-identified form.
After the State of West Virginia narrowed its claims, this Court granted its motion for a protective order insofar as that motion sought to prevent Lilly from discovering the medical records of West Virginia Medicaid patients. The Court concluded that the records were irrelevant given the narrowed scope of West Virginia's case. See 7/31/08 Order, State of West Virginia v. Eli Lilly & Co., No. 06-CV-5826 (JBW) (E.D.N.Y.), ECF Docket Entry (" D.E." ) # 69, at 7. The Court's order was affirmed by Judge Weinstein on September 10, 2008. See 9/10/08 Order, State of West Virginia v. Eli Lilly & Co., No. 06-CV-5826 (JBW) (E.D.N.Y.), D.E. # 90. Accordingly, nothing in this Memorandum and Order shall be construed to apply to the West Virginia litigation.
BACKGROUND
In these civil actions, the States seek damages, including reimbursement for Medicaid payments, stemming from the alleged unlawful marketing of Zyprexa, an atypical anti-psychotic drug manufactured by Lilly. With the exception of Connecticut, the States originally filed their claims in state courts, but the cases were removed to federal district courts and were thereafter transferred to this Court by the Judicial Panel on Multidistrict Litigation.
Connecticut originally filed in this district.
As part of its discovery demands, Lilly seeks a sampling of medical records for Medicaid patients who used Zyprexa, as well as records for patients who took other atypical anti-psychotic drugs during the relevant time period. The States contend that these records are irrelevant and privileged, and are not, in any event, obtainable without the issuance of subpoenas by Lilly. The parties have briefed these issues exhaustively, as part of their position statements regarding the discovery schedule, in letters accompanying the submission of the States' respective Medicaid application forms, and in response to an Order to Show Cause issued by this Court on August 14, 2008.
The Court is sensitive to the importance of the privacy interests of non-parties whose medical histories have become subject to scrutiny as a result of these Zyprexa cases. With that in mind, the Court addresses the States' various arguments against disclosure of the records.
DISCUSSION
I. Relevance
This Court has already ruled that " [t]he medical records for Medicaid beneficiaries taking Zyprexa are relevant to Lilly's defenses...." Case Management Order 1; see also Transcript of Proceedings Held on June 13, 2008 [" 6/13/08 Tr." ] at 78. Nevertheless, the States persist in arguing that the records are irrelevant, and therefore not discoverable. See 8/26/08 Pl. Reply to Order to Show Cause, at 12.
It bears repeating, then, that the records are in fact relevant to Lilly's defenses. For example, as Lilly notes, the use of a statistically significant sample of Medicaid patient records can help to explain information obtained from Medicaid databases, and may provide " information on potential confounding variables not found in the encounter[ ] data." 6/13/08 Tr. at 107. The text cited by Lilly explains that " [a]n approach to handling confounding by factors not recorded in encounter data is to perform medical record review within the cases to assess the relationship between the confounding factor and the exposure of interest." Brian L. Strom, Pharmacoepidemiology 289 (4th ed.2005).
A confounding variable is " [a] variable that is correlated with the independent variable and the dependent variable. An association between the dependent and independent variables in an observational study may not be causal, but may instead be due to confounding." David H. Kaye & David A. Freedman, Reference Guide on Statistics, in Federal Judicial Center, Reference Manual on Scientific Evidence 83, at 162 (2d ed.2000).
It is plainly evident that, given the disputed issue of causation, disclosure of the medical records is " reasonably calculated to lead to the discovery of admissible evidence." Fed.R.Civ.P. 26(b)(1). Accordingly, the Court declines to modify its previous ruling on relevance.
II. Privilege
In addition to challenging disclosure on relevance grounds, the States argue that their respective physician-patient privilege laws prohibit discovery of the patient medical records. Cf. Fed.R.Civ.P. 26(b)(1) (" Parties may obtain discovery regarding any nonprivileged matter that is relevant to any party's claim or defense ...." ) (emphasis added). For the reasons that follow, this Court concludes that the States' privilege laws pose no obstacle to the discovery of the medical records, provided the records are de-identified.
A. Applicable Privilege Law
It is axiomatic that state privilege laws do not govern in federal question cases. See Nw. Mem'l Hosp. v. Ashcroft, 362 F.3d 923, 925-26 (7th Cir.2004); von Bulow v. von Bulow, 811 F.2d 136, 141 (2d Cir.1987); Nat'l Abortion Fed'n v. Ashcroft, No. 03-CV-8695 (RCC), 2004 WL 555701, at *6 (S.D.N.Y. Mar. 19, 2004) (citations omitted); EEOC v. Boston Market Corp., No. 03-CV-4227 (LDW) (WDW), 2004 WL 3327264, at *3-4 (E.D.N.Y. Dec. 16, 2004). And even where a federal question case contains pendent state law claims, the federal law of privileges still obtains. See von Bulow, 811 F.2d at 141; see also S. Rep. 93-1277, as reprinted in 1974 U.S.C.C.A.N. 7051, 7059 n. 16 (" It is ... intended that the Federal law of privileges should be applied with respect to pendent State law claims when they arise in a Federal question case." ). No physician-patient privilege exists under federal common law. See Nw. Mem'l Hosp., 362 F.3d at 926; Kunstler v. City of New York, No. 04-CV-1145 (RWS) (MHD), 2006 WL 2516625, at *6 & n. 7 (S.D.N.Y. Aug. 29, 2006) (citing Jaffee v. Redmond, 518 U.S. 1, 10, 116 S.Ct. 1923, 135 L.Ed.2d 337 (1996)) (noting federal courts' rejection of the physician-patient privilege); see generally Fed.R.Evid. 501.
In contrast to federal question cases, state privilege laws apply in suits in federal court-such as diversity cases-in " which State law supplies the rule of decision." Fed.R.Evid. 501; see also Application of Am. Tobacco Co., 880 F.2d 1520, 1527 (2d Cir.1989) (citing Dixon v. 80 Pine St. Corp., 516 F.2d 1278, 1280 (2d Cir.1975)); R.R. Salvage of Conn., Inc. v. Japan Freight Consolidators (U.S.A.) Inc., 97 F.R.D. 37, 39 (E.D.N.Y.1983) (citations omitted). In federal cases in which state privileges apply, those privileges " should be interpreted no more broadly than necessary." Am. Tobacco Co., 880 F.2d at 1527.
On this issue, Connecticut stands in a different position than the other States. Because Connecticut's complaint against Lilly involves a federal question-arising under the federal civil RICO statute-that case is not governed by Connecticut's statutory or common law privileges, including its physician-patient privilege. And because there is no physician-patient privilege under federal law, the non-party records Lilly seeks in Connecticut's case are discoverable pursuant to an order of this Court, with or without redaction. Cf. Nw. Mem'l Hosp., 362 F.3d at 924-26 (holding that state privileges do not apply to non-party hospital, because underlying litigation involved a federal question).
As to the remaining States, the identification of the applicable body of privilege law is less clear. Although none of the other States allege violations of federal law in their complaints, and each has vigorously challenged the basis for federal jurisdiction, Judge Weinstein has held that jurisdiction lies under Grable & Sons Metal Prods., Inc. v. Darue Eng'g & Mfg., 545 U.S. 308, 125 S.Ct. 2363, 162 L.Ed.2d 257 (2005). See, e.g., State of Montana v. Eli Lilly & Co., No. 07-CV-1933, 2008 WL 398378, at *4-7 (E.D.N.Y. Feb. 12, 2008); Hood v. Eli Lilly & Co., No. 07-CV-645, 2007 WL 1601482, at *1 (E.D.N.Y. June 5, 2007); State of West Virginia v. Eli Lilly & Co., 476 F.Supp.2d 230, 233-34 (E.D.N.Y.2007); Foti v. Eli Lilly & Co., 375 F.Supp.2d 170, 172-73 (E.D.N.Y.2005).
New Mexico's motion to remand to state court is still pending. See 8/25/08 Motion to Remand, Madrid v. Eli Lilly & Co., No. 07-CV-1749, D.E. # 42.
In Grable, the Supreme Court recognized that " in certain cases federal-question jurisdiction will lie over state-law claims that implicate significant federal issues[,]" even in the absence of claims arising directly under federal law. Grable, 545 U.S. at 312, 125 S.Ct. 2363. The Supreme Court explained: " [A] federal court ought to be able to hear claims recognized under state law that nonetheless turn on substantial questions of federal law, and thus justify resort to the experience, solicitude, and hope of uniformity that a federal forum offers on federal issues[.]" Id. In denying several States' motions to remand, Judge Weinstein ruled that " the substantial federal funding provisions involved and the allegations about the violation of federal law through improper off-label use [of Zyprexa] present a core of substantial [federally oriented] issues...." Foti, 375 F.Supp.2d at 172-73; see also McGraw, 476 F.Supp.2d at 234 (" At issue here is not simply a federal standard, but also the added factor of an intricate federal regulatory scheme including detailed federal funding provisions, requiring some degree of national uniformity in interpretation." ). Thus, whether state privilege law applies is informed by the fact that these cases involve federal question jurisdiction, as opposed to diversity jurisdiction.
Unfortunately, there is a paucity of case law on the issue of which body of privilege law applies in a Grable -type federal question case. Where, as here, federal interests are strong enough for Grable -type federal question jurisdiction to attach, the underlying rationale of Rule 501 of the Federal Rules of Evidence suggests that the federal law of privileges should apply. See S. Rep. 93-1277, as reprinted in 1974 U.S.C.C.A.N. 7051, 7058-59 & n. 17. However, except as to Connecticut, state law will determine if and to what extent Lilly is liable for the harm claimed by the States-a countervailing factor on the privilege issue. See id.
Although it may well be that none of the States' respective privilege laws should apply in these cases, that issue need not be definitively resolved; regardless of the resolution of that issue, federal statutes and regulations make clear that de-identified health information is discoverable in litigation in federal court, with or without patient consent.
B. HIPAA
Pursuant to the Health Insurance Portability and Accountability Act of 1996 (" HIPAA" ), Pub.L. No. 104-191, 110 Stat. 1936 (1996), there are many circumstances in which " [a] covered entity may use or disclose protected health information without the written authorization of the individual ... or the opportunity for the individual to agree or object[.]" 45 C.F.R. § 164.512. These include disclosures " [i]n response to an order of a court[,] ... provided that the covered entity discloses only the protected health information expressly authorized by such order[.]" Id. § 164.512(e)(1)(i). Under section 164.512, " it is evidently denudate that a purpose of HIPAA was that health information, that may eventually be used in litigation or court proceedings, should be made available during the discovery phase." Bayne v. Provost, 359 F.Supp.2d 234, 237 (N.D.N.Y.2005) (citing 45 C.F.R. § 164.512(e)(1)(ii)).
The term " covered entity" includes Medicaid plans and other government-sponsored health plans. See 45 C.F.R. §§ 160.102, 160.103; see also U.S. Dep't of Health and Human Servs., Summary of the HIPAA Privacy Rule, at 2 (May 2005) [hereinafter " HIPAA Privacy Rule Summary" ], available at www. hhs. gov/ ocr/ privacy summary. pdf. " Protected health information means any individually identifiable health information [.]" 45 C.F.R. § 160.103; see also HIPAA Privacy Rule Summary, at 3-4.
As previously discussed, Connecticut's physician-patient privilege does not apply in its case against Lilly because that case is grounded in a federal question. Accordingly, the protected health information (i.e., the medical records) of patients in Connecticut can be discovered pursuant to an order of this Court, so long as the covered entity (i.e., the State of Connecticut Department of Social Services) discloses only that information authorized in such an order. Cf. 45 C.F.R. § 164.512(e)(1)(i).
The other States contend that their respective privilege laws are more stringent than HIPAA, and argue that a HIPAA-compliant court order will not suffice to protect the privacy interests of the patients whose medical records Lilly seeks. This argument has some appeal, but ultimately misses the mark. Even assuming that state privilege laws afford greater protection to the records Lilly seeks-and it is not entirely clear that they do-HIPAA contains a supersession clause which makes clear that to the extent state privilege laws are more protective of de-identified health information than is HIPAA, those laws are preempted by HIPAA's regulatory scheme.
Under HIPAA, a provision of state law that is contrary to HIPAA's standards or requirements is preempted, unless " [t]he provision of State law relates to the privacy of individually identifiable health information and is more stringent than a [HIPAA] standard, requirement, or implementation specification...." 45 C.F.R. § 160.203(b); see also 42 U.S.C. § 1320d-7. " A standard is ‘ more stringent’ if it ‘ provides greater privacy protection for the individual who is the subject of the individually identifiable health information’ than the standard in the regulation." Nw. Mem'l Hosp., 362 F.3d at 924 (quoting 45 C.F.R. § 160.202(6)). Federal regulations further provide that " [h]ealth information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information." 45 C.F.R. § 164.514(a). To achieve de-identification, numerous identifiers must be redacted from the relevant medical records. See id. § 164.514(b)(2).
Although state patient privacy laws that are " more stringent" than HIPAA may survive HIPAA preemption, they do not apply in federal question cases such as that brought by Connecticut. See Nw. Mem'l Hosp., 362 F.3d at 925; Nat'l Abortion Fed'n, 2004 WL 555701, at *5.
The Seventh Circuit's decision in Northwestern Memorial Hospital is instructive on the interplay between HIPAA and state privilege law. In that case, a non-party hospital challenged a Department of Justice subpoena seeking records of patients who underwent late-term abortions, in order to use those records in litigation surrounding the constitutionality of the Partial-Birth Abortion Ban Act, 18 U.S.C. § 1531. See Nw. Mem'l Hosp., 362 F.3d at 924. In the course of its decision, the Seventh Circuit held that HIPAA does not create a federal physician-patient privilege, but rather provides a procedure for the disclosure and use of medical records in litigation. See id. at 926. The court noted that any applicable privilege would be found outside of HIPAA regulations, and pointed to the supersession clause as supporting its conclusion. See id. The court declared: " Provided that medical records are redacted in accordance with the redaction requirements ... of § 164.514(a), they would not contain ‘ individually identifiable health information’ and the ‘ more stringent’ clause would fall away." Id. A concurring judge put the point succinctly: " In passing HIPAA, Congress recognized a privacy interest only in ‘ individually identifiable medical records' and not redacted medical records, and HIPAA preempts state law in this regard." Id. at 933 (Manion, J., concurring in part and dissenting in part).
In tandem, these statutory provisions and regulations compel the conclusion that de-identified health information is not protected under HIPAA, and that, to the extent state privilege laws offer protection to de-identified medical records, HIPAA preempts those laws. Accordingly, the States' physician-patient privilege laws do not prevent Lilly from discovering the de-identified records it seeks. C. State Physician-Patient Privilege Laws
In any event, even in the absence of HIPAA preemption, it appears that the States' respective privilege laws would not apply to de-identified information. While all of the States provide privilege protection to communications (including those reflected in medical records) by a patient to a physician for the purposes of treatment, see, e.g., Conn. Gen.Stat. § 52-146o; La.Rev.Stat. Ann. § 13:3734(A)(1); Miss.Code Ann. § 13-1-21; Mont.Code Ann. §§ 50-16-525, 50-16-535; La.Code Evid. Ann. art. 510(B); Miss. R. Evid. 503(b); N.M. R. Evid. 11-504(B), each State has also recognized that de-identified or redacted medical records simply do not fall within the ambit of their respective privilege laws. See, e.g., Mont.Code Ann. § 50-16-504(6) (" Health care information" under Montana's Uniform Health Care Information Act is limited to " information ... that identifies or can readily be associated with the identity of a patient and relates to the patient's health care." ); N.M. Stat. Ann. § 14-6-1 (providing that health information in the custody of government agencies is confidential, but only insofar as it " relates to and identifies specific individuals as patients" ) (emphasis added), together with N.M. R. Evid. 11-504(D)(4) (" There is no privilege ... for communications relevant to any information that the physician ... or patient is required by statute to report to a public employee or state agency." ); Fischer v. Hartford Hosp., No. CV-0569702, 2002 WL 237409, at *3 (Conn.Super. Jan. 23, 2002) (" The defendant [hospital] ... is ordered to disclose the information requested by plaintiff provided that all identifiable [non-party] patient information shall be deleted." ); Jackson v. Baptist Ret. Ctr. of Arcadia, 933 So.2d 131, 131 (La.2006) (permitting discovery of non-party medical records subject to redaction of identifying information); Speer v. Whitecloud, 744 So.2d 1283, 1284 (La.1999) (" Once any personal information which would identify the patients is redacted from the records, the requested discovery does not invade the physician patient privilege, and the need for [notice to the patient and a contradictory hearing] is eliminated." ); Baptist Mem'l Hosp. v. Johnson, 754 So.2d 1165, 1169-70 (Miss.2000) (requiring disclosure of non-party patient medical records without redaction).
The State of Louisiana argues that a recent decision by a Louisiana intermediate appellate court prevents the Louisiana Department of Health and Hospitals (" DHH" ) from producing medical records of Medicaid patients without the patients' consent. See Foti v. Janssen Pharmaceutica, Inc., No. 08-CW-365 (La.Ct.App. Apr. 30, 2008), attached to 5/9/08 Deft.'s Position Statement Regarding Discovery Schedule, Ex. 7. In that decision, which is currently pending before Louisiana's Supreme Court, the intermediate court, citing Louisiana's evidentiary and statutory physician-patient privileges, requires DHH to obtain waivers from patients whose records it intends to produce, and to include in those waivers an assurance that various mechanisms, including de-identification, will be utilized to protect the patients' privacy. The court places the burden of obtaining the waivers upon the State.
This is precisely the point made in In re Rezulin Products Liability Litigation, 178 F.Supp.2d 412 (S.D.N.Y.2001), which provided a starting point for this Court's colloquy with the parties on the issue of redaction. See 8/14/08 Order to Show Cause. In Rezulin, a diversity case involving alleged deceptive marketing by a pharmaceutical company, the defendant company subpoenaed physicians to compel them to produce medical records pertaining to patients who had participated in clinical trials of the drug at issue. See Rezulin, 178 F.Supp.2d at 413. As in these Zyprexa cases, the defendant in Rezulin was amenable to production of redacted records. See id. Construing Texas law, Judge Kaplan concurred with the " heavy weight of authority" from across the country and held that " the discovery of [medical] records redacted to eliminate identifying information may be compelled consistent with the [physician-patient] privilege...." Id. at 416 & n. 16 (collecting cases). Here, as in Rezulin, the fact that the States afford protection to medical records containing identifying information is of no moment; production of de-identified records would offend none of the States' respective privilege laws.
Having taken into account the above considerations and arguments, this Court concludes that, provided the disputed medical records are de-identified in accordance with the requirements of 45 C.F.R. § 164.514(b)(2), they are not privileged and are thus discoverable pursuant to Rule 26(b) of the Federal Rules of Civil Procedure. See Fed.R.Civ.P. 26(b). For the same reason, the production of the records in de-identified form obviates the need for a mechanism to address the individual privacy objections of patients and health care providers. Cf. ACLU v. Dep't of Def., 543 F.3d 59, 63-64, 86-88 (2d Cir.2008) (referring, in the FOIA context, to the privacy interest in de-identified sexually graphic photographs as " de minimis." ).
III. Mechanism for Production
The remaining question to be decided is how the records are to be produced. The States vehemently resist having this Court order their respective agencies to compel providers to produce the records to the State Medicaid agencies. Instead, the States would have Lilly subpoena the records and provide each patient an opportunity to object.
At the outset, it is important to note that HIPAA provides for a subpoena process that does not require notice to patients. Pursuant to HIPAA regulations, Lilly could subpoena (de-identified) medical records without notifying the patient, so long as Lilly provided the physician with adequate assurance that it had made reasonable efforts to seek a HIPAA-qualified protective order. See 45 C.F.R. § 164.512(e)(1)(ii)(B). This Court is prepared to enter such a protective order. Thus, even absent a court order directing the State agencies to retrieve the records, patient notification would not be necessary.
Nevertheless, it does not follow from Lilly's legal authority to subpoena de-identified medical records that Lilly should be required to do so where another lawful, more efficient means of obtaining the records exists. These cases are subject to expedited discovery schedules, and cannot remain in the discovery phase indefinitely. The process for disclosure must be streamlined in order to complete discovery within the deadlines set forth in Case Management Orders 4(A) and 4(B). Requiring Lilly to subpoena the medical records would complicate and prolong the discovery process. Significantly, Lilly does not know the identities of the patients whose medical records it seeks. Moreover, the States are in a better position to ensure that the medical records produced are a randomly selected, statistically significant sample. If Lilly were constrained to subpoena the medical records, it would likely target only certain records, which would inevitably lead to protracted argument over whether the records subpoenaed represent a statistically significant sample, or, put otherwise, whether the parameters of the subpoena process are " reasonably calculated to lead to the discovery of admissible evidence." Fed.R.Civ.P. 26(b)(1).
For the reasons that follow, this Court concludes that the States' Medicaid agencies have the legal and practical ability to obtain the patient records, and that disclosure of the records in this manner will provide the most effective means of maintaining patient privacy while ensuring that Lilly receives in a timely fashion the discovery to which it is entitled.
Pursuant to 42 U.S.C. § 1396a(a)(25), states participating in the Medicaid program are required to make reasonable efforts to pursue third parties who might be liable for reimbursement of care and services provided under Medicaid plans. See 42 U.S.C. § 1396a(a)(25)(A)-(B). " Third party means any individual, entity or program that is or may be liable to pay all or part of the expenditures for medical assistance furnished under a State plan." 42 C.F.R. § 433.136(3) (emphasis added). This broad definition of " third party" includes tortfeasors. Cf. Arkansas Dep't of Health & Human Servs. v. Ahlborn, 547 U.S. 268, 280-82, 292, 126 S.Ct. 1752, 164 L.Ed.2d 459 (2006) (striking down statute allowing for lien against patient's recovery from tortfeasor, but only insofar as that statute permitted a lien in an amount exceeding the costs of medical care). And pursuant to 42 U.S.C. § 1396a(a)(27), participating states must maintain agreements with providers requiring the latter to " keep such records as are necessary fully to disclose the extent of the services provided to individuals receiving assistance under the State plan," and to furnish those records to the state agency upon request. 42 U.S.C. § 1396a(a)(27). The ability of the States to collect Medicaid patient records is confirmed by an implementing regulation, which parrots section 1396a(a)(27) in somewhat broader terms, and requires service providers to " [k]eep any records necessary to disclose the extent of services the provider furnishes to recipients[,]" and to furnish those records to the Medicaid agency upon request. 42 C.F.R. § 431.107(b) (emphasis added); see also United States ex rel. Woodard v. Tynan, 776 F.2d 250, 252 (10th Cir.1985) (" By participating in the Medicare and Medicaid programs [providers] expressly consented to [the State's] access to all of their relevant business records." ).
" Neither federal nor state law requires that any person participate in the Medicaid program as a patient or as a provider." In re Search Warrant for 2045 Franklin, Denver, Colo., 709 P.2d 597, 601 (Colo.App.1985). Courts thus have recognized that by voluntarily electing to participate in the Medicaid program, a Medicaid recipient implicitly waives the physician-patient privilege vis-à-vis the Medicaid agency, at least to the extent necessary for the state to verify the services billed and to investigate possible Medicaid fraud. See id.; see also People v. Ekong, 221 Ill.App.3d 559, 561-64, 164 Ill.Dec. 25, 582 N.E.2d 233 (1991); In re Grand Jury Investigation, 441 A.2d 525, 530-32 (R.I.1982). The physician-patient privilege simply is not implicated when a state agency compels production of Medicaid records for use in connection with the agency's lawful functions; and to the extent that state law provides otherwise, it is trumped by the Supremacy Clause and by the state's obligations under the Medicaid regulations.
The States' various arguments regarding the authority of their agencies to obtain patient records are ultimately unavailing. First, the States' contention that their right to collect Medicaid medical records arises only in the context of subrogation claims or suits against physicians who abuse the Medicaid system is inconsistent with the broad language of the provision that codifies that right and, indeed, obligation. See 42 U.S.C. § 1396a(a) (25); see also Ahlborn, 547 U.S. at 275-77, 126 S.Ct. 1752 (the States' obligation reasonably to pursue third parties who might be liable for Medicaid costs is mandatory pursuant to federal law). The States' complaints include demands for damages seeking reimbursement, through one theory of liability or another, for Zyprexa-related expenditures by their respective Medicaid plans. These demands are thus akin to subrogation claims, albeit cloaked in other language. As the States are seeking recovery of Medicaid monies from Lilly, a third party that they allege is responsible for their expenditure of Medicaid funds, the States' claims fall within the purview of 42 U.S.C. § 1396a(a)(25).
Indeed, if the States were precluded from relying on their aggregation theories of liability, they likely would seek to obtain patient records for use in their cases in chief, in which event the States would be obligated to grant Lilly access to those records. That the States currently do not intend to rely on those records should not preclude Lilly from accessing relevant evidence.
Second, with the exception of Louisiana, the States' Medicaid application forms notify applicants that their health information may be used as required by state and federal law. To be sure, some of these provisions are more explicit than others. But the Notices of Privacy Practices issued by the all of the States' respective agencies-including Louisiana's-make clear that health information obtained by the agencies may be disclosed pursuant to a court order.
See State of Connecticut, Department of Social Services, Eligibility Determination Document [" Conn. Medicaid App." ], at 15 (Apr.2007), available at http:// www. ct. gov/ dss/ lib/ dss/ pdfs/ w- 1 e. pdf; State of Mississippi, Division of Medicaid, Application for Mississippi Medicaid Medical Home's Aged, Blind or Disabled Program, at 5 (Mar. 31, 2005), Hood v. Eli Lilly & Co., No. 07-CV-645 (JBW) (E.D.N.Y.), D.E. # 45, Ex. A; State of Montana, Department of Public Health and Human Services, Application for Assistance [" Mont. Medicaid App." ], at 13 (Sept.2006), State of Montana v. Eli Lilly & Co., No. 07-CV-1933 (JBW) (E.D.N.Y.), D.E. # 36; State of New Mexico, Human Services Department, Medicaid Application, at 2 (June 2, 2003), Madrid v. Eli Lilly & Co., No. 07-CV-1749 (JBW) (E.D.N.Y.), D.E. # 16.
Compare Conn. Medicaid App. at 11 (" I give my permission to the department to release information about me ... for purposes directly connected with the administration of the department's programs.... includ[ing] ... civil proceedings related to the administration of the department's programs." ), with Mont. Medicaid App. at 13 (" Federal and state laws and regulations limit the use and disclosure of confidential or protected health information about applicants and recipients of assistance programs" ).
See State of Connecticut, Dep't of Health, Notice of Privacy Practices 2 (Apr. 14, 2003), available at http:// www. csda. com/ dental resources/ HIPPA. pdf (" If the disclosure is permitted, the Privacy Officer shall only release what is minimally necessary to accomplish the purpose of the disclosure unless ... the information is required by law to be disclosed and the disclosure ... is for judicial/administrative proceedings [.]" ); State of Louisiana, Dep't of Health and Hosps., Notice of Privacy Practices 1 (Apr. 14, 2003), available at http:// www. dhh. louisiana. gov/ offices/ publications/ pubs- 92/ HIPAAFlyer. pdf (" DHH will use and disclose information when required or permitted by Federal or State law or by a court order." ); State of Mississippi, Div. of Medicaid, Notice of Privacy Practices 2 (Apr. 14, 2003), available at http:// www. dom. state. ms. us/ Terms_ of _ Use/ Privacy Practices/ Privacy Practices. pdf (" We may disclose your health information in the course of any administrative or judicial proceeding." ); State of Montana, Dep't of Pub. Health & Hum. Servs., Medicaid Handbook, Notice of Use of Protected Health Information 46 (Apr. 14, 2003), available at http:// medi caidprovider.hhs.mt.gov/pdf/medicaidinfohandbook.pdf (" We adhere to laws that provide specific instances when medical information must be shared, even if you do not sign an authorization form." ); State of New Mexico, Hum. Servs. Dep't, New Mexico Program Notice of Privacy Practices Summary 1 (Apr. 14, 2003), available at http:// www. hsd. state. nm. us/ m ad/pdf_ files/HIPAA/NPPEffective DateApril14 logov2.pdf (New Mexico can release health information " to the courts or law enforcement if NM Medicaid is ordered by a court to do so." ).
All of these considerations compel the conclusion that the medical records Lilly seeks are within the control of the respective States for the purposes of Rule 34 of the Federal Rules of Civil Procedure. See Fed.R.Civ.P. 34(a)(1)(A); see also In re NTL, Inc. Sec. Litig., 244 F.R.D. 179, 195 (S.D.N.Y.2007) (" Under Rule 34, ‘ control’ does not require that the party have legal ownership or actual physical possession of the documents at issue; rather, documents are considered to be under a party's control when that party has the right, authority, or practical ability to obtain the documents from a non-party to the action." ) (internal quotation marks and citations omitted). Accordingly, resort to the subpoena process is not necessary.
Finally, protective measures are available to address the States' concern for patient privacy. Indeed, in discussing why Lilly should not have redacted patient names from call notes produced to the States, counsel for the State of Connecticut, apparently speaking on behalf of all plaintiffs, observed that " state attorneys general, if there's any litigant, are going to assure the privacy of those people's names." Transcript of Proceedings Held on May 28, 2008, at 25. In light of this assurance, the Court is confident that patient privacy will not be compromised by production of Medicaid patient records to the States' Medicaid agencies and in turn to Lilly, especially with a protective order in place.
CONCLUSION
For the foregoing reasons, the States are ordered to produce a randomly selected, statistically significant sample of patient medical records by the deadline set in Case Management Orders 4(A) and 4(B). The parties are directed to meet and confer in good faith as to what constitutes a statistically significant sample, to reach agreement on the language of a protective order, as well as to resolve any other logistical concerns they may have. A hearing will be held on October 1, 2008, at 9:30 a.m. in Courtroom 13C South, to finalize these matters. All States except Connecticut must de-identify the records in accordance with HIPAA regulations. See 42 C.F.R. § 164.514(b)(2). Connecticut may redact its records if it so chooses. In each record, the patient's name must be replaced with a unique identifier, and the States must supply information to Lilly that enables it to link each record with its corresponding claims data.
Because the States have disclaimed any intention of using these records as evidence in their cases, Lilly has agreed to bear the costs of the copying and redaction of the records. See Letter from Eli Lilly & Co. to the Court (Sept. 19, 2008), State of Connecticut v. Eli Lilly & Co., No. 08-CV-955 (JBW) (E.D.N.Y.), D.E. # 87.
Any objections to this Memorandum and Order must be filed with the Honorable Jack B. Weinstein on or before September 29, 2008, or will be deemed waived. Absent further court order, the filing of an objection does not stay the parties' obligations hereunder.
SO ORDERED.
Though invited by the Court to narrow their claims in a similar fashion, see, e.g., 9/11/08 Order, State of Connecticut v. Eli Lilly & Co., No. 08-CV-955 (JBW) (E.D.N.Y.), D.E. # 81, at 3-4, the other States declined to do so.
Assuming arguendo that this issue were governed by Louisiana law, this Court would be obligated to follow a controlling decision of the State's highest court, or, in the absence of such a decision, to predict how the highest court would resolve this issue. See In re Rezulin Prods. Liab. Litig., 178 F.Supp.2d 412, 414 & nn. 8-9 (S.D.N.Y.2001) (collecting cases). In contrast to the intermediate appellate decision cited by the State, the Supreme Court of Louisiana has made clear that de-identified medical records are not privileged under Louisiana law. See Jackson, 933 So.2d at 131; Speer, 744 So.2d at 1284. Moreover, to the extent that the appellate court's decision would afford protection to de-identified records under Louisiana law, HIPAA preempts that state law. Accordingly, this Court is not persuaded that Louisiana law requires both waivers and de-identification of patient medical records.
Louisiana's Medicaid Application does not contain any notice provisions regarding use of health information. Instead, patients in Louisiana must sign a separate authorization form to permit release of their health information to the Louisiana Department of Health and Hospitals (" DHH" ). See State of Louisiana, Department of Health and Hospitals, Authorization to Release or Obtain Health Information For Eligibility in Program Enrollment, at 1 (Apr. 14, 2003), Foti v. Eli Lilly & Co., No. 05-CV-1455 (JBW) (E.D.N.Y), D.E. # 116, Ex. B. As a practical matter, patients are required to sign the waiver in order for eligibility determinations to be made. See id. at 2 (" If you do not agree to release of information required to determine your eligibility for enrollment in our health plan or to determine your entitlement to benefits we may not be able to make the required eligibility decisions." ). And once information is disclosed to DHH, that information " may be re-disclosed by [DHH] and will no longer be protected by DHH privacy policies." See id. Moreover, a patient who signs the waiver form acknowledges that her health information may be needed for disclosure to a third party, including disclosure for the purposes of litigation. See id.