Cohan v. Ayabe., 322 P.3d 948

Background

In 2009 Richard Cohan was injured in Hawai‘i and sued Marriott and a restaurant; the case proceeded through the Court Annexed Arbitration Program (CAAP).
Marriott served broad authorizations for medical and employment records and insisted on an HSBA-form Stipulated Qualified Protective Order (SQPO); Cohan refused to sign and proposed a HIPAA-patterned protective order restricting use to the underlying litigation.
An arbitrator ordered Cohan to sign Marriott’s authorizations and use the HSBA SQPO; the CAAP Administrator and the Arbitration Judge affirmed. Cohan petitioned this court for mandamus relief.
The contested SQPO provisions would permit internal/external audits, de-identified use for statistics, broad record-keeping, expansion of permissible uses with limited plaintiff control, and a 90-day post-litigation destruction window.
The authorizations also allowed redisclosure “in relation to the case” and stated records "may no longer be protected under federal privacy regulations," and released providers from liability for disclosures.
The Hawai‘i Supreme Court held that article I, §6 of the Hawai‘i Constitution protects health information from disclosure outside the underlying litigation and granted mandamus: vacating the order affirming arbitration and directing revision of the SQPO/authorizations consistent with the opinion.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Whether article I, §6 protects health info from disclosure outside the underlying litigation	Cohan: State constitutional right to privacy prohibits any use or re‑disclosure outside the litigation absent compelling state interest	Marriott: HIPAA-compliant SQPO and authorizations adequately protect privacy; plaintiff waived some objections	Court: Article I, §6 protects health information from disclosure outside the underlying litigation; contested provisions violate that protection
Whether HIPAA controls or preempts state constitutional protection / whether HIPAA is the minimum floor	Cohan: Hawai‘i Constitution affords greater protection than HIPAA and HIPAA is only a federal floor	Marriott: HIPAA permits disclosures under a qualified protective order; some SQPO provisions comport with HIPAA	Court: HIPAA sets a federal floor; state constitution may require stricter protections for individually identifiable health information; SQPO must at minimum satisfy HIPAA but cannot authorize outside‑litigation uses barred by the Constitution
Validity of de‑identification/statistical use clause in SQPO	Cohan: De‑identified use enables dissemination outside litigation and risks re‑identification; should be barred	Marriott: De‑identified data is not protected by HIPAA and may be used for analytics	Court: De‑identification clause is improper here; de‑identified information used outside underlying litigation is not allowed under Hawai‘i constitutional privacy protection (and the SQPO’s de‑identification language also fails HIPAA’s rigorous requirements)
Whether mandamus relief was appropriate to vacate arbitration/court orders compelling signatures	Cohan: Order releases confidential health records and is not immediately appealable; mandamus is proper	Marriott: Some objections were untimely/waived; relief not warranted	Court: Mandamus proper because the order would release confidential health information outside the litigation and the order is not appealable; directed vacatur and revision of documents

Key Cases Cited

Brende v. Hara, [citation="113 Hawai'i 424, 153 P.3d 1109"] (Haw. 2007) (state constitutional privacy protects health information from disclosure outside the underlying litigation and a protective order may provide protections beyond HIPAA)
Kema v. Gaddis, [citation="91 Hawai'i 200, 982 P.2d 334"] (Haw. 1999) (mandamus standards; remedy where nonappealable order releases confidential files)
Nw. Mem'l Hosp. v. Ashcroft, 362 F.3d 923 (7th Cir. 2004) (discussion of HIPAA de‑identification framework and interaction with state law)
Rees v. Carlisle, [citation="113 Hawai'i 446, 153 P.3d 1131"] (Haw. 2007) (judicial restraint; reliance on statutory/federal frameworks when possible)
In re Zyprexa Prods. Liab. Litig., 254 F.R.D. 50 (E.D.N.Y. 2008) (addressing preemption issues and holding de‑identified records may not be protected by HIPAA in certain contexts)