The Defense Attorney Wants me to Sign a “HIPAA Protective Order.” Should I Do It?

I assume everyone in Illinois has seen a few purported “HIPAA Protective Orders.” (Especially if you practice in Peoria, for some reason). While I assume a lot of lawyers sign these rather blindly, is it a good idea? Is it necessary?

1. LOOK AT THE TERMS OF THE “AGREEMENT”

A lot of the time these agreements are too broad for us to feel comfortable signing. Many of them allow the defense to get all of the plaintiff or decedent’s medical records from birth to death without notice to the plaintiff’s counsel. Not every medical record should be automatically discoverable, and both HIPAA and the Illinois Subpoena procedure contemplate giving the plaintiff’s attorney the right to object.

Another place where these agreements are typically overbroad is in the area of redisclosure. Obviously a defense attorney and staff have to be able to look at the records – yet some propsed agreements allow redisclosure to “consultants”, “insurance companies” and “all others”. You need to reign this in – you don’t want your client’s medical information to end up in the wrong hands.

Finally, some of these go so far as to violate Petrillo. Do not let that happen.

2. A HIPAA PROTECTIVE ORDER IS NOT NECESSARY.

A health care provider needs one of two things before it can disclose records pursuant to a subpoena: either a qualified protective order, or a letter with certain information, as shown below. In other words, a qualified protective order is OK, but there is an easier way to get the job done.

  • A covered entity (health care provider) may disclose health care records pursuant to subpoena, but only if
    • it receives “satisfactory assurance” from the party seeking the information that the (person who the records are about) has been given notice of the request, OR
    • it receives “satisfactory assurance” from the party seeking the information that the party made reasonable efforts to secure a HIPAA qualified protective order. 45 CFR § 164.512(e)(1)(ii) 

So, in other words, a health care provider needs either a qualified protective order, or “satisfactory assurance” that notice was given. This satisfactory assurance means:

  • Written statement with accompanying documentation that:
    • The party requesting the subpoena made a food faith attempt to provide written notice to the (plaintiff);
    • The notice is sufficient to inform the (plaintiff) about the litigation and permit the plaintiff to raise an objection; and either
      • The time for objection has passed with no objection, or
      • A court ruled on any objections in favor of the party seeking the subpoena (45 CFR § 164.512(e)(1)(iii)) 

If a qualified protective order is sought instead, the only requirements are that the order:

  • Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested. 45 CFR § 164.512(e)(1)(v)(A)
  • Requires the return to the covered entity (health care provider) or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding. 45 CFR § 164.512(e)(1)(v)(B) (not clear if both parties have to do that, or just the party requesting the records.)

Be very careful with these.

(Howard Zimmerle is a personal injury and medical malpractice attorney in the Quad Cities. You can contact him at hzimmerle [at] mjwlaw.com or 309-794-1660).

About these ads

3 Comments

Filed under Illinois Case Law, Illinois law, Medical Information, Medical Malpractice, Traps, Trial Practice, Wrongful Death

3 responses to “The Defense Attorney Wants me to Sign a “HIPAA Protective Order.” Should I Do It?

  1. If some one needs to be updated with most recent technologies afterward he must be pay a quick visit this website and be up to date every day.

  2. Aw, this was an extremely good post. Taking a few minutes and actual effort to produce a good article… but what can I
    say… I hesitate a lot and never manage to get nearly anything done.

  3. Pretty nice post. I just stumbled upon your weeblog and wanted to say that I’ve really enjoyed surfing around your blog posts.
    In anny cazse I’ll be subscribing to your rss feed and I hope you write again very
    soon!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s