The Defense Attorney Wants me to Sign a “HIPAA Protective Order.” Should I Do It?

I assume everyone in Illinois has seen a few purported “HIPAA Protective Orders.” (Especially if you practice in Peoria, for some reason). While I assume a lot of lawyers sign these rather blindly, is it a good idea? Is it necessary?

1. LOOK AT THE TERMS OF THE “AGREEMENT”

A lot of the time these agreements are too broad for us to feel comfortable signing. Many of them allow the defense to get all of the plaintiff or decedent’s medical records from birth to death without notice to the plaintiff’s counsel. Not every medical record should be automatically discoverable, and both HIPAA and the Illinois Subpoena procedure contemplate giving the plaintiff’s attorney the right to object.

Another place where these agreements are typically overbroad is in the area of redisclosure. Obviously a defense attorney and staff have to be able to look at the records – yet some propsed agreements allow redisclosure to “consultants”, “insurance companies” and “all others”. You need to reign this in – you don’t want your client’s medical information to end up in the wrong hands.

Finally, some of these go so far as to violate Petrillo. Do not let that happen.

2. A HIPAA PROTECTIVE ORDER IS NOT NECESSARY.

A health care provider needs one of two things before it can disclose records pursuant to a subpoena: either a qualified protective order, or a letter with certain information, as shown below. In other words, a qualified protective order is OK, but there is an easier way to get the job done.

• A covered entity (health care provider) may disclose health care records pursuant to subpoena, but only if
  • it receives “satisfactory assurance” from the party seeking the information that the (person who the records are about) has been given notice of the request, OR
  • it receives “satisfactory assurance” from the party seeking the information that the party made reasonable efforts to secure a HIPAA qualified protective order. 45 CFR § 164.512(e)(1)(ii) 

So, in other words, a health care provider needs either a qualified protective order, or “satisfactory assurance” that notice was given. This satisfactory assurance means:

• Written statement with accompanying documentation that:
  • The party requesting the subpoena made a food faith attempt to provide written notice to the (plaintiff);
  • The notice is sufficient to inform the (plaintiff) about the litigation and permit the plaintiff to raise an objection; and either
    • The time for objection has passed with no objection, or
    • A court ruled on any objections in favor of the party seeking the subpoena (45 CFR § 164.512(e)(1)(iii)) 

If a qualified protective order is sought instead, the only requirements are that the order:

• Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested. 45 CFR § 164.512(e)(1)(v)(A)
• Requires the return to the covered entity (health care provider) or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding. 45 CFR § 164.512(e)(1)(v)(B) (not clear if both parties have to do that, or just the party requesting the records.)

Be very careful with these.

(Howard Zimmerle is a personal injury and medical malpractice attorney in the Quad Cities. You can contact him at hzimmerle [at] mjwlaw.com or 309-794-1660).