Arcelormittal Indiana Harbor LLC v. Amex Nooter LLC, 2:15-cv-00195

Background

Explosion and fire occurred April 3, 2013 at ArcelorMittal Indiana Harbor facility; Amex Nooter employee Korrie Griffith admitted removing a valve from a live gas line.
Indiana Harbor served discovery requesting any drug-test results for Griffith related to the April 3, 2013 fire.
Amex Nooter objected, citing HIPAA (45 C.F.R. § 164.512(e)) and saying it would not produce records without required assurances.
Indiana Harbor sent Griffith a March 23, 2016 notice by certified mail (Griffith signed for it) informing him that his drug-test records would be requested; no objection was filed.
Indiana Harbor later sent Amex Nooter an April 8, 2016 email asserting compliance with HIPAA but did not attach documentary proof of the March 23 notice to Griffith.
Court found Indiana Harbor’s notice to Griffith sufficient but its written statement to Amex lacked the required accompanying documentation; nonetheless, because Amex had seen the March 23 letter in the motion exhibits, the Court ordered Amex to produce the drug-test results but denied the motion to compel as initially filed.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Whether Amex may disclose Griffith’s drug-test results under HIPAA without Griffith’s written authorization	Indiana Harbor: HIPAA §164.512(e)(1)(ii)(A) satisfied by giving Griffith notice; Amex may disclose records without authorization	Amex: Refusal because Indiana Harbor did not provide the required assurances/documentation; also argued consent or protective order required	Court: Disclosure permitted under §164.512(e)(1)(ii)(A) once satisfactory assurances provided; ordered production after court reviewed March 23 notice
Whether Indiana Harbor provided the requisite written statement and documentation to Amex to satisfy HIPAA assurances	Indiana Harbor: Sent written statement (April 8 email) and had given Griffith notice; thus assurances met	Amex: Written statement lacked accompanying documentary proof of notice to Griffith; therefore assurances insufficient	Court: Initial written statement lacked required attachments, so denial of motion to compel was justified on that basis, but production ordered after court saw the March 23 letter in exhibits
Whether express consent or a protective order is required for disclosure under HIPAA §164.512(e)	Indiana Harbor: Not required if §164.512(e)(1)(ii)(A) procedures are followed	Amex: Asserted express consent and protective order needed	Court: Express consent and protective order not required when disclosure is authorized under §164.512(e)(1)(ii)(A)
Whether Amex’s corporate policy barring release without consent overrides HIPAA	Indiana Harbor: Federal HIPAA regulation controls; policy cannot prevent lawful disclosure	Amex: Relied on Corporate Safety Manual limiting release without written consent	Held: Corporate policy does not override federal HIPAA authorization; Amex must disclose when law permits

Key Cases Cited

(There were no key authorities cited in the opinion that have official reporter citations.)