Opinion
No. SCCQ–15–0000300.
06-13-2016
PACIFIC RADIATION ONCOLOGY, LLC, a Hawai‘i Limited Liability Corporation, et al., Plaintiffs–Appellants, v. The QUEEN'S MEDICAL CENTER, a Hawai‘i Non–Profit Corporation, et al., Defendants–Appellees.
[138 Hawai'i 15]
I. Introduction
This court has been asked to provide guidance to the United States District Court for the District of Hawai‘i ("District Court") on questions of Hawai‘i law. At issue is whether the parties may use, or be compelled to produce, the confidential medical records of over 100 cancer patients, in an effort to prosecute or defend against claims that the Plaintiff doctors steered these patients away from treatment at Defendant Queens' Medical Center. The patients are not parties to the underlying lawsuit, although 19 of them have been granted intervenor status. All of them have intervened solely to assert their right to privacy and seek a prohibition on the use and production of their medical records.
The District Court certified the following questions to this court:
The Honorable Leslie E. Kobayashi, United States District Judge, presided.
1. May a third party who is in lawful possession of a patient's confidential medical records use, or be compelled to produce, these records in litigation where the patient is not a party?
2. If a third party may use and/or produce a patient's confidential medical records in litigation, is a de-identification
[138 Hawai'i 16]
process sufficient to protect the patient's privacy interests where the third party already allowed its agents access to the patient's records and its agents inadvertently made part of the patient's medical information public?
This court may "reformulate the relevant state law questions as it perceives them to be, in light of the contentions of the parties." Allstate Ins. Co. v. Alamo Rent–A–Car, Inc., 137 F.3d 634, 637 (9th Cir.1998) (citations and quotation marks omitted). To avoid confusion, we reformulate the certified questions to clarify that the term "party" refers to the parties to the litigation, not to the parties to the physician-patient relationship. We believe that the "parties" in this case are the plaintiffs and defendants, and the "third parties" in this case are the patient intervenors. We also reformulate the question so that a negative answer to the first certified question will not preclude us from answering the second certified question to the extent we can. Therefore, the reformulated certified questions are:
1. May a party who is in lawful possession of a patient's confidential medical records use, or be compelled to produce, these records in litigation where the patient is not a party?
2. Is a de-identification process sufficient to protect the patient's privacy interests where the party already allowed its agents access to the patient's records and its agents inadvertently made part of the patient's medical information public?
Defendant urges us to reformulate the certified questions to include the following "threshold question": "Does [Hawai‘i Revised Statutes ("HRS") § 431:10C-]308.7(c) apply to all self-referral involving insured services covered by H.R.S. Chapter 431 or only to those involving no-fault auto-related services?" We decline to do so. We note that the District Court has already concluded that that statute does not apply to health care provider referrals and is "limited to the context of motor vehicle insurance" in an Order Granting in Part and Denying in Part Plaintiffs' Motion for Summary Judgment on the Counterclaim. The present certified question is not the proper vehicle through which Defendant may challenge that order.
Hawai‘i Rules of Appellate Procedure ("HRAP") Rule 13 (2000) governs certified questions. It provides, in relevant part, "When a federal district ... court certifies to the Hawai‘i Supreme Court that there is involved in any proceeding before it a question concerning the law of Hawai‘i that is determinative of the cause and that there is no clear controlling precedent in the Hawai‘i judicial decisions, the Hawai‘i Supreme Court may answer the certified question by written opinion." We therefore confine our answer to the "law of Hawai‘i that is determinative of the cause," namely article I, section 6 of the Hawai‘i Constitution. That constitutional provision states, in relevant part, "The right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest."
We answer the first certified question in the negative. Article I, section 6 of the Hawai‘i Constitution protects the health information of patient intervenors to this case. Pursuant to that provision, and under the facts of this case, the parties cannot use, or be compelled to produce, confidential patient medical records in litigation where the patient is not a party, absent a compelling state interest.
As to the second certified question, we do not address whether sufficient de-identification is possible where one party already allowed its agents access to the patient's records and its agents inadvertently made part of the patient's medical information public. The de-identification process and requirements are set forth under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub L. No. 104–191, 110 Stat. 1936 (1996), and its corresponding regulations; therefore, the sufficiency of de-identification does not "concern[ ] the law of Hawai‘i that is determinative of the cause." HRAP Rule 13. Whether the use and production of de-identified medical records is "sufficient to protect the patient's privacy interests," however, is a question this court can address under article I, section 6. We hold that the use and production of de-identified medical information of patients who are not parties to the litigation violates those patients' right to privacy under article I, section 6 of the Hawai‘i constitution, as no
[138 Hawai'i 17] compelling state interest has been shown in this case.
II. Background
The Plaintiffs in this case are Pacific Radiation Oncology, LLC; PRO Associates, LLC; John Lederer, M.D.; Vincent Brown, M.D.; Paul DeMare, M.D.; Thanh Huynh, M.D.; Laeton Pang, M.D.; and Eva Bieniek, M.D. (collectively, "PRO"). The Plaintiffs filed an Amended Complaint for Declaratory and Injunctive Relief and for Damages ("Amended Complaint") against Defendants Queens' Medical Center and Queens' Development Corporation (collectively "QMC"). The Amended Complaint alleged that the Plaintiffs "had a long-standing, 40–year relationship with QMC to provide professional radiation oncology therapy services to PRO patients at facilities owned by QMC, using equipment, technician support, and other services provided by QMC." QMC is the only Nuclear Regulatory Commission-approved hospital at which radiation oncologists can operate on patients. Plaintiffs also acknowledged that they had "a one-third interest in The Cancer Centers of Hawai‘i [‘TCCH’]," a competitor of QMC.
The Plaintiffs also named as defendants the individual members of the Queens' Medical Center Board of Trustees. The parties later stipulated to dismiss, without prejudice, these individuals.
According to the Amended Complaint, QMC notified Plaintiffs that the QMC Board had decided to convert QMC to a "closed radiation therapy department," meaning that only physicians employed by QMC could exercise clinical privileges to provide professional radiation oncology services at QMC. QMC explained that it arrived at its decision to terminate PRO's privileges after determining that PRO had "transferr[ed] patients to other facilities for no medical reason or patient request...." Plaintiffs alleged in their Amended Complaint that QMC's action was intended to destroy their ability to treat patients at facilities competing with QMC.
Plaintiffs' Amended Complaint raised ten claims for relief: a claim of denial of procedural and substantive due process; a claim of violation of QMC bylaws and governing regulations; three separate claims of intentional and tortious interference; four separate claims of unfair, deceptive, anti-competitive and illegal trade practices in violation of HRS Chapter 480; and a claim of breach of fiduciary duty and bad faith owed to a partner.
QMC filed an Answer and Counterclaim. Relevant to this certified question, QMC counterclaimed that Plaintiffs Lederer, Brown, DeMare, Huynh, and Pang "consulted with and/or began treatment of patients referred to them at QMC and then induced the patients to receive treatment at TCCH without making timely written disclosure of their ownership interests in TCCH," which constituted unfair competition in violation of HRS § 480–2.
During the course of the litigation, QMC's law firm publicly filed a list naming 132 patients PRO was alleged to have diverted to TCCH; also included were the patients' QMC identification numbers and the PRO doctors who consulted and treated each patient. The list was attached as an exhibit to (1) a subpoena to TCCH's custodian of records and (2) a discovery request to PRO. The filing was subsequently sealed.
Plaintiffs then moved for a temporary restraining order or preliminary injunction to prevent further violations of patient privacy. In their moving papers, they alleged that QMC had accessed the electronic medical records of 133 cancer patients, without consent, to determine if Plaintiffs were directing patients to TCCH, and, if so, how much revenue QMC lost as a result. Plaintiffs argued that cancer patient medical records would likely include "history and physicals" information regarding "the most confidential and sensitive inquiries, including prior pregnancies, abortions, sexual activities, potency, drug use, psychological issues, depression, AIDS info, family history, prior diseases, substance dependency, etc., etc." QMC's alleged breach of patient privacy culminated in the disclosure of 132 of the patients' names in the exhibits to the subpoena and discovery request. Plaintiffs sought to enjoin "QMC, its attorneys, and its consultants
[138 Hawai'i 18] from reviewing and more importantly from publishing the highly confidential information including the names of these many, many cancer patients."
The District Court granted in part, and denied in part, the Plaintiffs' motion. Construing the Plaintiffs' pleading as a discovery motion, the District Court granted it, in part, and sanctioned defense counsel for publicly filing the list naming the 132 cancer patients, in willful violation of the parties' Amended Stipulated Protective Order. The District Court denied the motion for a TRO and/or preliminary injunction, in part, because the Plaintiffs' Amended Complaint alleged no claims of improper review and use of confidential patient information. As to whether the Plaintiffs could prevent Defendants from obtaining or using confidential patient information, the District Court concluded that "the parties must address these issues through the normal discovery process."
The United States Court of Appeals for the Ninth Circuit affirmed the denial. Pacific Radiation Oncology, LLC v. Queen's Medical Center, 810 F.3d 631 (9th Cir.2015).
The Magistrate Judge, in turn, issued his Order Regarding Discovery Issues. He found the 132 cancer patients' confidential medical records to be relevant to the parties' claims and counterclaims. He ordered the records discoverable as follows:
Although the patient medical records contain protected health information ("PHI"), this does not preclude their discovery. As noted by Judge Kobayashi in the TRO Order, "[o]nce health information has been deidentified, it is no longer protected by HIPAA" or state law. TRO Order at 29. It reasonably follows that PHI is discoverable if de-identified. Accordingly, the 132 patient medical records shall be de-identified. Upon de-identification, the medical records will be discoverable and shall be produced.
The Plaintiffs appealed the Magistrate Judge's decision to the District Court. After granting 19 affected patients' motion to intervene, the District Court reserved ruling on the Plaintiffs' appeal and certified the instant questions to this court.
III. Discussion
Article I, section 6 of the Hawai‘i Constitution is entitled "Right to Privacy," and it provides, "The right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest. The legislature shall take affirmative steps to implement this right." In the context of patient medical records, this court has issued three decisions construing article I, section 6 on petitions for writ of mandamus: Brende v. Hara, 113 Hawai‘i 424, 153 P.3d 1109 (2007) (per curiam); Naipo v. Border, 125 Hawai‘i 31, 251 P.3d 594 (2011) (per curiam); and Cohan v. Ayabe, 132 Hawai‘i 408, 322 P.3d 948 (2014).
Each of the mandamus petitioners in these cases sought to compel the respondent judges to issue orders limiting and/or prohibiting the use of patient medical records. The mandamus petitioners in Brende and Cohan were both plaintiffs in tort litigation in which their medical condition and treatment were at issue. The petitioner in Naipo, on the other hand, was not a party to the litigation. Rather, in Naipo, the parties to a dog-bite lawsuit sought discovery of a non-party's patient medical records. This distinction is key in the instant proceedings, which involve patient intervenors who are not parties to the lawsuit between Plaintiffs and QMC. Each of these cases will be discussed in turn, below.
Brende , Cohan , and Naipo all provide strong privacy protection over patient medical records. In Brende, this court held, "Petitioners' health information is ‘highly personal and intimate’ information that is protected by the informational prong of article I, section 6. The constitutional provision protects the disclosure outside of the underlying litigation of petitioners' health information produced in discovery." 113 Hawai‘i at 430, 153 P.3d at 1115 (footnote omitted). This holding was reaffirmed in Cohan. See 132 Hawai‘i at 410, 322 P.3d at 950 ("[T]he privacy provision of the Hawai‘i Constitution, article I, section 6, protects [the petitioner's] health information against disclosure outside the underlying litigation.")[138 Hawai'i 19]
The holding in Brende and Cohan applies to situations in which a party to litigation seeks to limit and/or prohibit the disclosure, outside of discovery, of his or her own patient medical records. While that is not the situation in the present case (where non-parties seek to prohibit the use and disclosure of their patient medical records), we turn to Brende and Cohan for their exploration of the constitutional history behind article I, section 6.
Brende noted that the framers viewed the Hawai‘i constitutional right to privacy as follows:
[T]he [ article I, section 6 ] right of privacy encompasses the common law right of privacy or tort privacy. This is a recognition that the dissemination of private and personal matters, be it true, embarrassing or not, can cause mental pain and distress far greater than bodily injury. For example, the right can be used to protect an individual from invasion of [the individual's] private affairs, public disclosure of embarrassing facts, and publicity placing the individual in a false light. In short, this right of privacy includes the right of an individual to tell the world to "mind your own business."
113 Hawai‘i at 430, 153 P.3d at 1115 (quoting Stand. Comm. Rep. No. 69, in Proceedings of the Constitutional Convention of Hawaii of 1978 ("Proceedings"), Vol. 1, at 674).
So inviolable is this right that the framers sought to shield individuals from "possible abuses in the use of highly personal and intimate information in the hands of government or private parties. ..." Comm. Whole Rep. No. 15, in Proceedings, at 1024 (emphasis added). In this way, article I, section 6 provides Hawaii's people with powerful protection against any infringement of their right to privacy, by state and private actors. In fact, we have previously noted that the framers "equated privacy in the informational sense" with the "common law right of privacy," so that "[o]ne who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of his [or her] privacy, if the matter publicized is of a kind that (a) would be regarded as highly offensive to a reasonable person, and (b) is not of legitimate concern to the public." State of Hawai‘i Organization of Police Officers ("SHOPO") v. Soc'y of Prof'l Journalists, 83 Hawai‘i 378, 398, 927 P.2d 386, 406 (1996) (citing Stand. Comm. Rep. No. 69, Proceedings, at 674; and Restatement (Second) of Torts § 652D, 383 (1977) ). There is no requirement that the one invading another individual's privacy be a state actor. See, e.g., SHOPO, 83 Hawai‘i 378, 927 P.2d 386 (analyzing whether a non-state actor's, e.g., an organization of journalists, access to police officer disciplinary records would violate the officers' constitutional privacy rights).
Article I, section 6 generally provides greater privacy to Hawaii's people than its federal analogs. The Hawai‘i constitutional right to privacy is a "fundamental right for purposes of constitutional analysis." Cohan, 132 Hawai‘i at 415, 322 P.3d at 955 (quoting Comm. Whole Rep. No. 15, in Proceedings, at 1024). We view article I, section 6 as "afford[ing] much greater privacy rights than the federal right to privacy...." Janra Enters., Inc. v. City & Cty. of Honolulu, 107 Hawai‘i 314, 320, 113 P.3d 190, 196 (2005) (citation omitted).
Article 1, section 6 also provides more stringent protection over patient medical records than does HIPAA. This conclusion
45 C.F.R. § 160.202(6) provides
More stringent means, in the context of a comparison of a provision of State law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, a State law that meets one or more of the following criteria:....
With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information.
That regulation also defines "state law" to include a state's constitution and common law. Id.
We therefore are not persuaded by QMC's contention that "Hawaii's constitutional right of privacy is coextensive with HIPAA." In support of this argument, QMC points to HRS Chapter 323B, Hawaii's Health Care Privacy Harmonization Act, specifically section 3(a) in that chapter, which states in relevant part that a covered entity or business associate's use or disclosure of individually identifiable health information that complies with HIPAA "shall be deemed to comply with all state laws relating to the use, disclosure, or confidentiality of such information." HRS § 323B–4(6) (2010 & Supp.2012), however, provides, "Nothing in this chapter shall be construed to ... [l]imit or otherwise affect any evidentiary privilege, limitation on discovery, or confidentiality protection provided by any state law, decision, or order in relation to individually identifiable health information sought, used, or produced in any judicial or administrative proceeding." Therefore, the intervenors' constitutional right to privacy in their confidential medical records is unaffected by Chapter 323B. In other words, honoring an individual's right to privacy in his or her protected health information requires more than bare compliance with HIPAA.
[138 Hawai'i 20] was implicit in Cohan, where a provision in a Stipulated Qualified Protection Order that provided that the defendant hotel could use a tort plaintiff's health information in its internal reviews was invalidated under article I, section 6, yet we noted that "[a]n analysis under HIPAA arguably may lead to a different result." 132 Hawai‘i at 419, 419 n.18, 322 P.3d at 959, 959 n.18.
The right to privacy is absolute where, as here, the individuals seeking to protect patient medical records, in discovery and beyond, are not parties to the litigation, have not consented to the use of their patient medical records in relation to the present lawsuit, and no compelling state interest has been shown. Naipo is a case "on all fours" with the instant case. In Naipo, plaintiff Eshell Mitchell sued the Yuen family in state court for multiple leg injuries she sustained when the Yuens' dog, Braddah, bit her. 125 Hawai‘i at 33, 251 P.3d at 596. As part of her negligence claim, Mitchell sought to establish that Braddah had previously bitten Jennifer Naipo. See id. Mitchell issued a subpoena duces tecum to Wahiawa General Hospital for production of Naipo's medical records. See id. The respondent judge denied Naipo's motion to quash the subpoena and ordered the hospital to turn over Naipo's medical records for an in camera inspection. 125 Hawai‘i at 34, 251 P.3d at 597.
Naipo then petitioned this court for a writ of mandamus, arguing that her health information was protected by, inter alia, her right to privacy under article I, section 6 of the Hawai‘i constitution. Id. We granted Naipo's petition for mandamus relief and ultimately directed the respondent judge to quash the subpoena duces tecum. 125 Hawai‘i at 37, 251 P.3d at 600. We unequivocally held, "Petitioner Jennifer Naipo is not a party to Eshell Mitchell's lawsuit against the Yuens. Her health information in her medical records at Wahiawa General Hospital is protected by her constitutional right to privacy." 125 Hawai‘i at 35, 251 P.3d at 598.
Our decision also rested on the twin holding that Naipo's confidential medical records "deserve[d] the protection of the physician-patient privilege of [Hawai‘i Rules of Evidence] Rule 504," which Naipo had not waived. 125 Hawai‘i at 35, 36, 251 P.3d at 598, 599. We therefore are not persuaded by QMC's argument that Naipo "held that the medical records were protected from disclosure to the trial judge on physician patient privilege grounds rather than privacy."
--------
Naipo 's holding provides our answer to the first certified question, which is, "May a party who is in lawful possession of a patient's confidential medical records use, or be compelled to produce, these records in litigation where the patient is not a party?" We hold that, pursuant to article I, section 6 of the Hawai‘i Constitution, and under the facts of this case, the parties cannot use, or be compelled to produce, confidential patient medical records in litigation where the patient is not a party, where no compelling state interest has been shown.
The second certified question is, "Is a de-identification process sufficient to protect the patient's privacy interests where the party already allowed its agents access to the patient's records and its agents inadvertently made part of the patient's medical information public?" We doubt, under the circumstances of this case where there has been an egregious breach of patient confidentiality by QMC both internally and publicly, that de-identification is possible. However, the question of the sufficiency of de-identification where one party already allowed its agents access to the patient's records and its agents inadvertently made part of the patient's medical information public, is ultimately a matter of compliance with HIPAA, which is a federal question we need not answer. We can address
[138 Hawai'i 21] under Hawai‘i law, however, that part of the second certified question asking if de-identification could sufficiently protect the patients' privacy rights. We answer that part of the second certified question in the negative.
In Cohan, we held, "To allow [a party's medical] information to be used outside the litigation, regardless of whether it is de-identified or not, would reach beyond what the Hawai‘i Constitution permits in the absence of a showing of a compelling state interest." 132 Hawai‘i at 419, 322 P.3d at 959. In Cohan, we noted that the de-identification process under HIPAA is "extremely complex and problematic," and that, "[a]part from these technical considerations, there is the very complicated issue as to whether a patient has a legitimate basis for being concerned about what happens to their personal health information once it is de-identified." 132 Hawai‘i at 417, 418, 322 P.3d at 957, 958 (footnote omitted). We quoted the following observation from the Seventh Circuit Court of Appeals with approval: "Even if there were no possibility that a patient's identity might be learned from a redacted medical record, there would still be an invasion of privacy." Cohan, 132 Hawai‘i at 418, 322 P.3d at 958 (citing Nw. Mem'l Hosp. v. Ashcroft, 362 F.3d 923, 929 (7th Cir.2004) ). Such an invasion could produce undesirable effects upon patient health care, including "social and psychological harm through embarrassment, economic harm through job discrimination and job loss, patient difficulty in obtaining health insurance, health care fraud, and patient reluctance to share sensitive information with their doctors or pharmacists." 132 Hawai‘i at 418, 322 P.3d at 958 (quoting Christopher R. Smith, Somebody's Watching Me: Protecting Patient Privacy in Prescription Health Information, 36 Vt. L. Rev, 931, 943 (2012) ).
Further, we observed that "the risk of re-identification remains, as there is ‘no national, uniform standard governing the level of identifier-stripping necessary to guarantee that de-identified data cannot be re-identified." 132 Hawai‘i at 418 n.16, 322 P.3d at 958 n.16 (quoting Smith, supra, at 935 ). The risk of re-identification poses "subjective privacy concerns" for some patients, who object to the "dehumanization [in] having one's most intimate information circulated by an indifferent and faceless infrastructure without any control over the process or content." Id. (quoting Will Thomas DeVries, Protecting Privacy in the Digital Age, 18 Berkeley Tech. L.J., 283, 298 (2003) ).
We believe the same concerns underlying the use of de-identified medical records beyond litigation for parties to a lawsuit exist for individuals who are not parties to litigation and who have therefore not put their medical condition and/or treatment at issue in the first instance. Just as article I, section 6 protects parties from the use and production of their de-identified information outside of litigation, we conclude that article I, section 6 protects individuals from the use and production of their de-identified information in litigation to which they are not parties. Thus, the use and production of even sufficiently de-identified medical records, under the circumstances of this case, will not adequately protect the patients from an invasion of their privacy.
We acknowledge that Cohan also stated the following:
Once health information has been de-identified, it is no longer protected by HIPAA. Further, because HIPAA allows "more stringent" state law to preempt federal law only when it relates to the privacy of "individually identifiable health information," 45 C.F.R. § 160.203(b), this leads to the conclusion that state law also does not protect de-identified information. Nw. Mem'l Hosp., 362 F.3d at 926.
132 Hawai‘i at 417, 322 P.3d at 957 (latter emphasis added). We consider the last statement to be an accurate summary of the holding in Nw. Mem'l Hosp., which was, more specifically, that Illinois' medical-records privilege, while providing "more stringent" state law protection of "individually identifiable health information," was no barrier to the discovery of de-identified health information. See also Zyprexa Prods. Liab. Litig., 254 F.R.D. 50, 52 (E.D.N.Y.2008) (similarly concluding, "the States' [physician-patient] privilege laws pose no obstacle to the
[138 Hawai'i 22] discovery of [patient] medical records, provided those records are de-identified.").
By contrast, our express holding in Cohan was, "To allow [a party's medical] information to be used outside the litigation, regardless of whether it is de-identified or not, would reach beyond what the Hawai‘i Constitution permits in the absence of a showing of a compelling state interest." 132 Hawai‘i at 419, 322 P.3d at 959. Extending Cohan to cases in which parties seek to use and produce the medical records of non-parties, we hold that to allow an individual's medical information, even if de-identified, to be used in litigation to which that individual is not a party, would reach beyond what the Hawai‘i Constitution permits in the absence of a showing of a compelling state interest. In this case, QMC has made no such showing, and we do not believe that a compelling state interest exists in infringing upon the Hawai‘i state constitutional privacy rights of over 100 cancer patients in order to resolve what is essentially a contract dispute between competing cancer treatment providers.
IV. Conclusion
We answer both certified questions in the negative. Article I, section 6 of the Hawai‘i Constitution protects the health information of patient intervenors to this case. Pursuant to that provision, the parties cannot use, or be compelled to produce, confidential patient medical records, even if sufficiently de-identified, in litigation where the patient is not a party, as no compelling state interest has been shown.
I concur in the Majority's opinion, but write separately to briefly address the issue of federal preemption. I agree with Majority's holding that, pursuant to article 1, section 6 of the Hawai‘i Constitution, "the parties cannot use, or be compelled to produce, confidential patient medical records, even if sufficiently de-identified, in litigation where the patient is not a party, as no compelling state interest has been shown."
However, for the reasons stated in my concurrence in Cohan v. Ayabe, 132 Hawai‘i 408, 424–46, 322 P.3d 948, 964–66 (2014), I believe that HIPAA may preempt this holding to the extent that it prevents the disclosure of de-identified medical records. Put briefly, 45 C.F.R. § 160.203 provides that HIPAA standards and requirements preempt contrary provisions of state law, except when the state law is "more stringent" and relates to "the privacy of individually identifiable health information." However, federal courts have determined that once medical records are de-identified pursuant to the requirements in 45 C.F.R. § 164.514, they are no longer considered "individually identifiable health information" and thus do not fall under the preemption exception in 45 C.F.R. § 160.203. See Nw. Mem'l Hosp. v. Ashcroft, 362 F.3d 923, 926 (2004) ("Provided that medical records are redacted in accordance with the redaction requirements (themselves quite stringent) of [ 45 C.F.R.] § 164.514(a), they would not contain ‘individually identifiable health information’ and the ‘more stringent’ clause would fall away."); In re Zyprexa Prods. Liab. Litig., 254 F.R.D. 50, 54 (2008) (quoting same). HIPAA does not prevent the use and disclosure of de-identified medical records, and thus the portion of our holding that relates to de-identification may be preempted by C.F.R. § 160.203. See In re Zyprexa, 254 F.R.D. at 54 (HIPAA "makes clear that to the extent state privilege laws are more protective of de-identified health information than is HIPAA, those laws are preempted by HIPAA's regulatory scheme.").
Thus, while I agree with the Majority's analysis of our state constitutional right to privacy, the application of the Majority opinion to the underlying appeal and to future cases may raise federal preemption issues.