*1
Richard
v. AYABE, Judge of Bert I.
The Honorable Circuit, the First Circuit Court of Hawai'i, Respondent,
State Services, DBA Mar Inc. Hotel
Marriott Mar Club and Ko Olina Beach
riott’s Resorts, DBA Ownership Inc.
riott International, Club Vacation
Respondents, in Interest. Real Parties
No. SCPW-13-0000092. Court of Hawai'i.
Supreme
Feb. *2 Hotel his wife sued Marriott
Cohan and Services, Beach dba Marriott’s Ko Olina Inc. Resorts, Ownership Inc. and Marriott Club Club International dba Marriott Vacation “Marriott”) Restau- (collectively, and RRB *3 rants, Chuck’s Steak and Seafood LLC dba (Restaurant) damages. The case was for Arbitration Pro- placed in the Court Annexed (CAAP). Naso, Courtney Esq., was gram the arbitrator. appointed 30, 2012, Cohan April Marriott sent On medical rec- to obtain thirteen authorizations for release of and two authorizations ords records, sign him to employment and asked Krueger, Cynthia Wong, K. and James authoriza- The medical records the forms. Wailuku, Tilley, petitioner. K. Loren following provisions: included the tions Ryan Inouye, Hon- Sidney Ayabe and I. K. revoked, otherwise this authoriza- Unless olulu, respondents. following expire on the date tion will proceed- final conclusion of the event: the POLLACK, JJ., McKENNA, ACOBA, and being ing, authorization is for which this RECKTENWALD, C.J., Concurring, with specified, is not signed. If a date or event J., NAKAYAMA, Joins. whom with year expire one this authorization will my signature below. date POLLACK, by J. Opinion of the Court (Cohan) filed a Richard Cohan Petitioner the health information I understand that (Petition) re- of Mandamus Petition for Writ may be released under this authorization compel respondent court to questing this recipient, in relation to re-disclosed (1) affirming an judge vacate his order to: this authoriza- for which case/matter compelled Petitioner arbitration decision longer no provided, and tion medical sign for release of authorizations privacy regula- protected under the federal (2) records, pro- qualified and order that tions. uti- proposed Petitioner be tective order instead. lized care the above-named health I release provision of the We hold that liability recipient(s) from all vider and Constitution, I, 6, pro- article section Hawai'i pertaining to the disclo- whatsoever claims against dis- tects Cohan’s in the information as contained sure of underlying litigation. outside the closure pursuant to this authori- records released Petition, grant Therefore we zation. (1) judge is directed to: vacate respondent employment rec- (Emphases decision, affirming the arbitration the order authorizations, which include medical ords qualified records, ben- reports, and claims for accident authorizations for release order and the included the during employment, efits made revised consistent medical records be following language: opinion. counsel] [Marriott’s I further authorize and all this authorization further disclose
I. regard- use, by its information obtained content, persons all 2009, less of and his wife September In lawsuit/claim, ... includ- in the din- involved from California. While visited Hawai'i to, counsel, opposing ing, limited but not & Seafood at Marriott’s ing at Chuck’s Steak consultants, pri- personnel, court Club, experts, into a koi Cohan fell Ko Olina Beach services, re- investigators, copy court vate injured. pond and was
4H companies, porting parties, and insurance notified Marriott that he would not consider representatives. signing any authorizations unless Marriott sought pursuant
first to obtain the records any applicable (HRCP) undersigned ... Hawai'i waives Rules of Civil Procedure requirements provisions of the Federal by way Rule 312 or compel. of a motion to (5 525(a) Privacy Act U.S.C. Section alternative, proposed that the seq.), provisions et of U.S.C. Section parties stipulated qualified pro- enter into a provisions Chapter (SQPO). tective order Statutes, Chapter Hawai'i Revised Cohan forwarded a draft order that con- the Hawai'i restricting Revised Statutes (i.e. provisions patterned tained after HIPAA the use and dissemination of the aforesaid prohibiting use or disclosure of the informa- including information ... but not limited *4 underlying litigation tion outside the without (if any) regarding psy to information the requiring Cohan’s consent chiatric, and Marriott work, psychological, social infec disease, destroy the records, return documents or them testing at the tious HIV alcohol litigation). rejected other end of and substance abuse treatment. proposed draft order and that the added). (Emphases returned Cohan the au- parties adopted use a form the Hawai'i unsigned thorizations and informed Marriott (HSBA). Bar State Association that the re- comply authorizations did not with jected the HSBA-approved form Portability the federal Health as too ex- Insurance and Accountability (HIPAA), pansive Act of and Pub.L. asked Marriott to delete several 104-191, (1996).1 No. provisions: Stat. 1936 (offered HSBA-approved language proposed changes Marriott) Requirement: Except pro- 1. Non-Disclosure as herein, vided none of Health Plaintiffs/Claimant’s any Information obtained from source shall be by anyone by any entity disclosed or used or for any purpose, explicit without Plaintiffs/Claimant’s
written consent. (b) Specifically Uses, Disclosures, Allowable and specifically Maintenance: It is understood and agreed that Health Informa- Plaintiffs/Claimant’s may used, disclosed, be tion main- and/or and/or tained, without consent as Plaintiffs/Claimant’s may required comply with state or federal laws, rules, arbitrator, court, and or administrative 164.512, (v) (e)(1) 45 C.F.R. purposes paragraph which sets forth the For uses of this section, means, provides: qualified protective disclosures under order respect protected with health information (e) judicial Standard: for and ad- Disclosures (e)(l)(ii) requested under of this proceedings. ministrative section, an order of a court or of an adminis- provid- Permitted A [medical disclosures. stipulation by parties trative tribunal or a protected er] disclose litigation proceeding to the or administrative any judicial in the course of or administrative that: proceeding: parties using (A) Prohibits the or dis- closing protected health information for (ii) response subpoena, discovery to a re- any purpose litigation pro- other than or quest, process, or other lawful that is not ceeding for which such information was re- accompanied by quested; an of a court or order ad- tribunal, ministrative if: (B) Requires to the [medical return vider] or destruction of (iv) .... made) (including copies information all at (A) parties dispute giving rise to litigation proceeding. the end of request agreed (Emphasis for have qualified protective present- have ed it to the court or administrative tribunal governs depositions upon 2. HRCP Rule 31 writ- jurisdiction dispute; questions subpoena proce- over the ten delineates obtaining dure for documents. tecum), subpoenas (including and in duces orders claim, litigation, proceeding any
relation to and/or arising of- out of the accident/incident Accident”), including following: (“Subject l.(b)(2) l.(b)(2) for their inter- Defendants’ insurer’s Defendants’ insurer’s internal for and/or and/or including auditing, handling auditing, including handling review nal review and/or and/or disposition any disposition any claim or matter related to claim or matter related to the Occurrence, Occurrence, Subject Subject De- communication between communication between insurers/underwriters/agents; and their and their Defendants fendants insurers/underwriters/ agents; relating the review audit of relating audit of claims for the to the review and/or and/or reserves, setting premiums, purpose purpose setting premiums, calculating claims tho calcu- reserves, lating calculating experience, experience, procuring loss calculating addi- loss and/or and/or -it-beiag-understood procuring- coverage, being agreed coverage, it understood and additional tional and-agr-eed will not that information bo used for will not be used for record history; compilation or database-of-Plaintiff s compilation claim record or database Plaintiffs history; claim l.(b)(3) provision auditing, Delete entire for external review such and/or Commissioner, by reinsurers, the Insurance auditors; external l.(b)(6) required gov- any legally reporting to Delete entire organiza- health or medical insurance ernmental *5 private their contractors for Plaintiffs tions or expenses Subject health care and related to the Occurrence; (offered changes language proposed HSBA-approved The Cohan’s Marriott) 1.(b)(7) analytical provision purposes, or Delete entire for statistical personal identification infor- vided that Plaintiffs name, address, specific specific (e.g., mation street number, date, Security birth driver’s license Social number) in such use of is not included review or Information; Health l.(b)(8) keeping requirements record or Delete entire obligations relating foregoing, Subject pertaining to the Occurrence. uses, disclosures, uses, disclosures, permissible permissible and The above-noted above-noted provisions provisions are not to unrea- are not intended to unrea- maintenance intended maintenance sonably party’s sonably party’s their insur- or their counsel’s or insur- limit a or counsel’s or limit requirements. record-keeping obligations record-keeping obligations requirements. or er’s or er’s attorneys, agents, agents, attorneys, their or insurers Defendants or their or insurers Defendants or may-request permissible catogorios permissible categories request additional that additional that usesf-disclosures, uses, disclosures, or or maintenance addod. maintenance be added. consent, consent, unreasonably unreasonably-withheld Plaintiff withhold shall not Plaintiff shall provided-that categories requested
provided categories requested additional the additional that the this-Qrder, intent of are with the intent of are consistent with the this Order. consistent Qualified “Stipulated that if Marriott modified website under Protec- Cohan indicated use)”: (for litigation tive Order protective its order to delete version During pre-hearing language, he CAAP con- stricken used the form the second 2012, 26, on June we dis- ference held agree SQPO, proposed, Cohan would to the Stipulated Qualified cussed the form of the subpoenas then be attached to which could [the Cohans] as were re- Protective Order sought-after for the records. questing certain deletions the form pre-hearing CAAP At the June proposed hearing After by [Marriott]. conference, parties discussed the differ- discussing from all each coun- counsel protective By ent versions of the order. position, sel’s it was decided form to be 3, 2012, Stipulated Qualified July letter dated arbitrator used Pro- shall be (for litigation use) ap- they parties of her decision that formed the tective Order pears State Bar appears on the HSBA on the Hawai'i Association use the form (HSBA) order, website right privacy under Health Care Infor- and he has a to the his Privacy Judge mation Protection Ayabe Forms. health information. affirmed the CAAP Administrator’s decision order Cohans’] [Mar- counsel shall inform [The counsel, 13,2012. entered on writing, than November riott’s] no later 6, 2012, July they Friday, intend whether
to adhere Arbitrator’s above-stated II. parties decision. the event one or more 14, 2013, February On Cohan filed not to decides adhere to the above-stated Petition Support and a Memorandum in parties appropri- decision shall file the (Petition Memorandum). Petition Cohan ar- ate in court to motions further resolve this gued Ayabe Judge abused his discretion issue. by affirming the arbitrator’s order on (Underlining in place origi- of italics in the (1) grounds the order that: violates Cohan’s nal). 6, 2012, By July e-mail dated I, under article sec- Marriott that informed the HSBA form was Constitution, tion 6 of Ha- the Hawai'i unacceptable: (2) law; wai'i protec- case version of the stipulated qualified protective HSBA proposed by tive order wrongfully has no mention in Hawai'i Rules of allows health information to be used legally noting Civil Procedure it is (3) purposes beyond litigation; required. It is no more form of than some fail to limit authorizations disclosure Co- agreement, agreeable an but it perhaps, information; private han’s no pot in a tea tempest as Rule HRCP is statute, law, requires sign or rule Cohan to available. Rule 31 is a better avenue authorizations order. records, would have defense to obtain the court asked the to: again, to be admissible evidence. *6 Therefore, (cid:127) we agree. Ayabe order; cannot Judge Order to vacate his (cid:127) protective Marriott thereafter moved order requiring for an Enter a order Mar- 31, compelling sign Cohan to authori- pursue using the fifteen riott to HRCP Rule that it HIPAA-compliant zations so could obtain medical language, prior the the to employment subpoena. By SQPO; records via use of 2012, 7, September order on entered the (cid:127) requires sign Order no law Cohan to granted request arbitrator the ordered the authorizations for the medical and sign authorizations, Cohan well to as information; employment protective the form order from the HSBA (cid:127) qualified protective Enter a order consis- website. proposed tent Cohan’s with version later, days by Septem- Eleven letter dated proposed by with the version Marriott 2012, 18, appealed ber Cohan the arbitrator’s proposed with Cohan’s modifications. 7, September 2012 decision to the CAAP 14, court, by order This entered on March argued Administrator. Cohan that Marriott 2013, Marriott and the to ordered Restaurant requested was not entitled to the relief be- joint Response, answer In their the Petition. discovery cause it did utilize the methods 3, 2013, April filed on Marriott and the Res- by the proposed authorized HRCP and had a argued taurant that Cohan waived his protective order that was too He broad. challenge SQPO the form of the because argued jurisdic- further that the court lacked appeal he failed the CAAP arbitrator’s compel him sign tion to a document not 3, July They argued 2012 letter. also law, rule, by state regulation, mandated HSBA-approved ef- SQPO their form of the The CAAP affirmed decision. Administrator any privacy fectively protects Co- concerns the arbitrator’s decision. regarding han have his health informa- appealed Cohan the CAAP Administrator’s tion. Ayabe, decision to Honorable Bert I. 2013, 26, Judge. Again, argued July we issued an Cohan On Arbitration party party requiring structing supplemental was no law a each to file a there addressing SQPO sign qualified protective or a brief whether authorizations 414 alleged wrong adequate signed means to redress required to be
medical authorizations Kema v. requested action. complied with or to obtain Administrator by the CAAP 334, 200, 204, Gaddis, 982 P.2d 91 Hawai'i law. federal and state (1999). has discretion to a court Where 9, 2013, submitted a August Cohan On act, will not lie to interfere mandamus Support of Supplemental Memorandum discretion, the exercise of that or control Cohan reit- of Mandamus. Petition for Writ erroneously, judge acted when the has even SQPO and challenges to Marriott’s erates exceeded his or her judge has unless in his Peti- set forth medical authorizations flagrant a jurisdiction, has committed maintains that tion Memorandum. discretion, refused abuse of or has manifest feder- SQPO meet the minimum does not the court subject properly a before to act on protective order as requirements for al in which it is under circumstances by much less the more required 204-05, P.2d at legal duty to act. Id. at requirements of the Ha- stringent privacy “ ‘[m]anda- court has held that 338-39. This additionally ar- wai'i Constitution.3 appropriate remedy where [a] mus is the negate the medical authorizations gues that releasing an order confidential court issues safeguards required HI- immediately ... and the order is not files because the Hawai'i Constitution PAA and Hara, v. 113 Hawai'i appealable.’” Brende re-dis- expressly allow for the authorizations (2007) 1109, 424, 429, (per 153 P.3d without ref- closure curium) Kema, 205, 91 Hawai'i at (quoting any limitations im- erencing existence of 339).4 P.2d at SQPO. posed 9, 2013, Marriott submitted its August On IV. Petitioner Answering Brief to Supplemental of Mandamus. Petition for Writ A. (1) argues that: the medical author- and Hawai'i comply with federal izations legisla complex piece HIPAA “a (2) law, SQPO complies with Marriott’s state exchange of health- tion that addresses law, and and Hawai'i state federal information,” Nat’l Abortion Fed’n v. related comply with fed- employment authorizations 8695(RCC), 2004 WL Ashcroft, No. 03 Civ. state law. eral and Hawai'i 2004), (S.D.N.Y. *2 Mar. one at *7 “radically changed landscape of that has III. discovery litigators can conduct informal how Law involving medical treatment.” an extraor in cases A of mandamus is writ 705, Zuckerman, F.Supp.2d 711 v. 307 remedy not issue unless the dinary that will (D.Md.2004). per regulations HIPAA indisput The a clear and petitioner demonstrates health informat discovery of lack of alternative mit right to relief and a able appeal Although is dated the letter of argues Constitution to do. the Hawai'i 3. Cohan 18, 2012, protections requires September minimum the CAAPAdministra- more than the both I, recog- provided by upon 6 Ayabe rely as article section Judge declined a to tor right people privacy ... to violation, of the "[t]he nizes merits purported and ruled on the rule showing infringed without the of shall not be affirming decision. in the arbitrator’s of the issue ,[and][t]he legisla- compelling interest ... state 11(B), "The Arbitration Haw. Arb. R. Under steps implement to this ture take affirmative shall power Judge to have the non-reviewable shall right.” modify uphold, the decision of the overturn or Administrator, including power Arbitration urges find Cohan’s chal- the court to stay any proceeding.” The decision the Arbi- 3, regarding lenge July the use 2012 letter Judge Petitioner’s to review the merits of tration HSBA-approved stipulated qualified challenged by Marriott as a appeal not been has untimely. R. See Haw. Arb. tective order original pro- flagrant in an abuse of discretion (B) (a challenge party required an arbitra- 11 event, ceeding circumstances, In under the or in this case. days from the date of within ten tor’s decision clearly flagrant not a abuse was Cohan, however, act). challenged was Judge to review for the Arbitration 3, of discretion July required Instead, appeal from the 2012 letter. involving of an issue the Administrator’s order Sep- appealed from the arbitrator’s he 7, order, magnitude. constitutional he was authorized 2012 which tember
415
long
ion5 “so
agreement
as a court order or
infringed
nized and shall not be
without the
parties
of
prohibits
disclosure
showing
of the in
compelling
of a
state interest.”
In
litigation
formation
requires
outside the
promulgating
privacy
this
provision, the 1978
the return of the information
pro
once the
Constitutional
pri-
Convention intended “that
ceedings are
(quoting
concluded.” Id. at 708
vacy [be] treated as a
right
fundamental
Hand,
Helping
A
Cnty.,
LLC v. Baltimore
purposes
analysis.”
of constitutional
Comm.
585,
(D.Md.2003)).
F.Supp.2d
295
592
15,
Rep.
Proceedings
Whole
No.
in 1
Constitutional Convention of Hawai'i of 1978
provides
the “federal floor of
(Proceedings), at 1024.
express right
This
privacy protections that does not disturb
privacy
recognition
is “a
that the dissemina-
protective
practices....
more
rules or
private
matters,
tion of
personal
be it
floor,
protections
mandatory
are a
which oth
true,
not,
embarrassing or
can cause mental
governments
er
any [Department
pain
greater
and distress
bodily
far
than
Health and
regulated]
Human Services
enti
short,
injury....
right
In
privacy
Brende,
ties
exceed.”
113 Hawai'i at
includes the
of an individual to tell the
429,
(quoting
Hosp. v. Ashcroft, 362 F.3d I, cluding article section 6 of the Hawai'i Cir.2004). 426-47, Constitution. Id. at 153 P.3d at
Hawai'i is one of ten expressly proposed states that prohibited 1111-12. The *8 recognize right privacy in their constitu- using plaintiffs’ defendant from the health I, tions.6 Article section 6 of the Hawai'i information in discovery obtained from a Constitution in part relevant plan, provider, any health health care right people of privacy recog- “[t]he the underlying is other source litigation outside the information, Glenn, 5. Health information Protecting includes 6. Catherine Louisa Health In- Privacy: Self-Regulation whether oral or recorded in um, The Case form or medi- formation Records, Electronically (1) Held Medical 53 Vand. that: is created or received a health of L. Rev. 1605, (2000) (identifying 1609 n. 25 the provider, plan, public care health health authori- Alaska, Arizona, California, constitutions of Flor- insurer, ty, employer, university life school or ida, Hawai'i, Illinois, Louisiana, Montana, South clearinghouse; health care and relates to the Carolina, Washington protecting and health past, present physical or future or mental health privacy). Christopher information See also R. individual; provision or condition of an the of Smith, Somebody’s Watching Protecting Me: Pa- individual; past, present health care to an or the Information, Privacy Prescription tient in Health payment provision or future for the of health 931, (2012) (citing 36 Vt. L. Rev. 945 n. 90 care to an individual. 45 C.F.R. 160.103. recognizing several state court cases a state con- right privacy). stitutional 416 intimate,” it is personal consent. Id. plaintiffs’ and without I, 6.7 prong of article section informational required the health information further entities, care if to the health Id.
to be returned
destroyed at the
applicable, or otherwise
Thus,
pro-
“constitutional
we held that the
ar-
litigation.
Id. The defendant
end
the disclosure outside
protects
vision
neces-
proposed order was not
gued that the
litigation
underlying
health in-
petitioners’
of
stipulate
sary
refused to
(em-
discovery.”8 Id.
produced in
formation
of informa-
or disclosure
prohibiting
use
noted,
added).
“once the
The court
phasis
than health
from sources other
tion obtained
disclosed,
potential
harm
427,
P.3d at 1112.
Id. at
153
providers.
care
Accordingly, the
Id.
cannot be undone.”
Brende court
petition,
granting
In
plaintiffs were entitled to
held that the
court
only to
applies
HIPAA
noted that
first
431-32,
P.3d at
Id. at
153
mandamus relief.
discovery
in
di-
information obtained
“health
1116-17.
429,
Id. at
rectly
health care entities.”
from
regula-
at 1114. Because
153 P.3d
B.
privacy
floor of
establish a “federal
tions
person’s health
protection of a
Hawai'i’s
medical informa-
in Hawai'i “a
protections,”
overarching con
on an
information is based
judicial pro-
in a
protective order issued
tion
privacy
principle of informational
stitutional
minimum,
must,
provide the
ceeding
at a
infor
the disclosure of health
prohibits
(emphasis
HIPAA”
Id.
protections of the
underlying litigation with
mation outside
I,
that article
court further held
compelling state interest.
showing
of a
out
Constitution, estab-
of the Hawai'i
section 6
contrast,
regulations are
the HIPAA
applies to “infor-
lishing
right
privacy,
of
“dense,
confusing,
lengthy.”
complex,
“the
privacy”
protects
mational
6,
Smith, supra, note
at 978.9
highly
which is
keep
confidential
430,
exemplified by HIPAA’s
complexity is
153 P.3d
This
intimate.” Id. at
personal and
health informa-
treatment of “de-identified”
marks and brackets omit-
(quotation
at 1115
SQPO
a de-identi-
ted).
includes
“highly tion.10 Marriott’s
health information is
Because
against
injury
discovery
produced in
"privacy
mation
noted that the
of
7. The Brende court
might
of that
previously
result from the disclosure
in
information was
codified
health
litigation.” Id.
(Supp.
information outside of the
chapter
323C
Hawai'i Revised Statutes
431,
Information),
court found no
1999)
417 method, provision. defines requires fication HIPAA de-identi- as “Safe Harbor” identifiers, eighteen fied health information health information removal of types as such numbers, identify numbers, does not telephone “that an individual and with as account li- numbers, respect plate to which there no reasonable basis cense and e-mail addresses. 164.514(b)(2). Id. § can to believe the information be used to Health information is ” identify an sufficiently individual.... C.F.R. considered de-identified when 164.514(a). § entity Once health information has covered does “[t]he not have actual de-identified, longer protected knowledge been it is no that the information could be used Further, by HIPAA. HIPAA because allows or in with alone combination other informa- stringent” preempt to identify “more state law feder- tion to subject an individual who is a only 164.514(b)(2)(h). when to information.” Id. privacy § al law it relates information,” But, “individually identifiable health HIPAA expressly allows a covered enti- 160.203(b), § ty re-identify 45 C.F.R. leads to the to previously con- de-identified in- formation, protect clusion that state law does not provided adopts also certain Hosp., information. Nw. Mem’l 164.514(c). de-identified safety § measures. C.F.R. re-identified, F.3d at 926. Once the information is rules. Id. to matter, an initial de-identifying pro- As extremely complex proble- cess itself is discovery In the dispute, judges event of a rigorous, comprehensive required matic. Under the would be to determine if informa- for sufficiently scheme de-identification established has 45 tion been de-identified so as 164.514(b), § are escape C.F.R. there two HIPAA protection methods to and state law first, to achieve preemption. de-identification.11 The If identifiers remain and HI- method, “Expert Opinion” known as the applies, judges re- PAA therefore would deter- quires “person appropriate knowledge with mine whether information health has been experience generally accepted adequately so, of and protected, doing apply principles regulations statistical scientific and meth- an intricate web of related to rendering for operations.12 ods information not individual- covered entities’ internal Be- ly apply identifiable” to those methods and HIPAA permits entity cause also a covered recipient protected then determine that the of the in- disclose health information to a identify formation could the individual. 45 “business associate” to conduct the de-identi- 164.514(b)(1). second, behalf,13 § process judges C.F.R. fication known on its would protected Regarding Guidance See Methods De-identi health information disclosed” and for requests "[r]eview Protected Health in Accor on an disclosure individual fication of Information Portability dance with the Health basis in Insurance accordance with such criteria.” Rule, (HIPAA) 164.514(d)(3)(ii). Accountability Privacy Privacy § per- Act C.F.R. U.S. Rule Serv., Dep’t http://www.hhs. of Health & Human mits incidental uses and disclosures that occur as gov/ocr/privacy/hipaa/understanding/covered by-product permissible required of another or (last disclosure, long entities/De-identification/guidance.html entity vis use or as the as covered 26, 2014). applied safeguards. Feb. ited has reasonable 45 C.F.R. 164.502(a)(l)(iii). § reg- are There several other entity’s ulations related to a covered uses and example, identify 12. For covered entities must information, protected disclosures of health such persons persons, appro- or as "[t]hose classes of (45 requests for health information C.F.R. priate, pro- in its need workforce who access to 164.514(d)(4)), (45 agreements § data use C.F.R. carry tected out their 164.514(e)), (45 fundraising § communications "[f|or person duties" each such or class of 164.514(f)), § underwriting C.F.R. and insurance category categories protected persons, the (45 § premium rating 164.514(g)). C.F.R. health information to which access is needed and appropriate such conditions access.” 45 Further, 164.514(d)(2)(i). states, applicable regulation C.F.R. those dis- 13.The entity part, entity may closures that a covered makes on a routine relevant covered use "[a] basis, "implement policies proce- it must tected health create information individually (which may protocols) dures be standard that is not identifiable health infor- protected limit health information disclosed mation or disclose reasonably necessary only purpose, amount to a for such achieve business associate purpose 45 C.F.R. whether or not the de-identified information is to disclosure.” *10 164.514(d)(3)(i). disclosures, entity.” § other be used But for all the covered 45 C.F.R. 164.502(d)(1) designed § "[d]evelop (emphases must to limit criteria 418 to share sensitive patient and reluctance stringent requirements to examine the need pharmacists.” with their doctors or formation If in- relationship as well.14
governing that Bell, Pri- Smith, de-identified, (citing Juliana supra, at 943 sufficiently howev- is formation New Web Prod- vacy at Risk: Patients Use er, analysis required, is no such Health and Share Personal ucts to Store may the data without entity share covered (2009)). Records, 485, 489 U. Balt. L. Rev. 38 restriction.15 by the anxiety This is exacerbated considerations, “reali- Apart from these technical health information do- ties of modern very complicated issue as to is the .the there main,” the tradi- which have overwhelmed legitimate basis for patient a has a whether patient data legal protection tional happens to their being concerned about what through patient-phy- principally achieved once it is de- health information personal Terry, relationship. Nicholas P. sician Circuit has held The Seventh identified.16 Privacy, Wrong with Health What’s 5 J. possibility if there were no “[e]ven 1, (2009). L. “The Health & Biomedical a identity might be learned from patient’s a longitudinal patient data contained modern record, an there would be redacted medical portable, and ma- systems comprehensive, is Hosp., Nw. Mem’l privacy.” invasion of Thus, Id. “potential for nipulatable.” priva- that their If citizens feel F.3d at 929. many parties are abuse is immense”—“there information are not cy rights in health care Id. this data.” ... that crave access to may lead to vari- adequately protected, this (footnote omitted). including negative patients, for ous outcomes sum, through requires judges em- psychological harm “social and scheme arbitrators, barrassment, examining validity through job harm dis- when economic authorizations, loss, only interpret difficulty in medical job patient crimination fraud, change insurance, apply law an intricate obtaining health care health 164.504(e) requirements (setting § regulations concerning forth id. at are several 14.There contracts). entity's relationship as- with business associate covered business "creates, receives, sociate, one who defined as maintains, protected Regarding health infor- or transmits Methods 15. Guidance De-identifica- activity regulated by this mation for a function or in Accor- Protected Health tion Information including processing subchapter, ministration, or ad- claims Portability and with the Health Insurance dance processing analysis, or admin- Rule, data (HIPAA) Privacy Accountability U.S. Act assurance, istration, review, quality utilization Serv., http://www.hhs. Dep’t of Health & Human safety patient listed at 42 CFR 3. activities gov/ocr/privacy/hipaa/understanding/covered management, practice manage- billing, benefit (last entities/De-identification/guidance.html vis- ment, "[plrovides, repricing" or other than 26, 2014). Though Privacy Rule Feb. ited capacity of the workforce of in the of a member may entity a covered disclose does not limit how actuarial, accounting, entity, legal, such covered information, entity may a covered de-identified [], consulting, aggregation management, data recipient require information to enter of such accreditation, administrative, or financial ser- agreement to access files into a data use entity, an for such covered or to or for vices to or Id. known disclosure risk. arrangement organized care in which the entity participates!.]” 45 C.F.R. covered provisions’ Despite intrica- the identification Further, 160.103(l)(ii). goes § the definition on remains, cy, as there the risk of re-identification entity may be a business to state that a "covered national, governing the "no uniform standard entity," covered id. at of another associate § necessary guaran- identifier-stripping level of 160.103(2), may which entities and enumerate data cannot be re-identi- tee that de-identified associates. not be classified as business or Smith, Along supra, at 935. with con- fied.” 160.103(3)-(4). §§at Id. security of this cerns related 164.502(a)(3) See, (providing § e.g., 45 C.F.R. distributed, subjective patients some have once may use or disclose that a business associate (arguing privacy at 936 that the concerns. Id. only permitted protected health information having [in] one’s issue is one of "dehumanization required by associate contract or its business by an indif- intimate information circulated most 164.502(e) (provid- arrangement); id. at other without and faceless infrastructure ferent entity may ing disclose a covered content") (quoting process control over to a business association DeVries, Privacy Protecting "create, receive, Will Thomas the business associate to allow maintain, Berkeley Digital Age, Tech. L.J. protected health informa- or transmit (2003)). It is noted that this invasion entity "obtains its behalf" if the covered tion on alleged wrongful only con- because of the occurs satisfactory that the business associate assurance information”); in the first instance. safeguard duct of a defendant appropriately will *11 by regulation, maintained, keep pace but also to with closed or without Cohan’s con- rapidly evolving technology shaping sent, the dis- purposes for of Marriott’s internal re- closure of information. views or purpose “audit of claims for the setting premiums, reserves, calculating contrast, calcu- Constitution,
In by pre- Hawaii’s lating cluding experience, loss private procuring the disclosure of addi- health infor- and/or underlying eoverage[.]” mation outside of the tional litigation, application obviates of an inordinately com- argues that the “language, if re- plex may law that expensive result in discov- tained, improperly put would at risk Cohan’s ery disputes, appeals, litigation delays medical information for beyond matters far disagreements. resolve such very pur- scope underlying personal of his injury pose of disclosing Cohan’s health information litigation, tort forcing such that sign him to in discovery underlying is to resolve the dis- without the ... modifications would violate pute. To allow this information to be used privacy protections by afforded him both litigation, outside the regardless of whether state and federal law.” not, it is de-identified or beyond would reach what permits the Hawai'i Constitution in the Marriott contends that Cohan cannot show absence of a showing compelling of a state resulting harm language from the he seeks to interest. 1(b)(2) strike from paragraph because the paragraph already provides that it is “under-
V. stood agreed that information will not be used compilation record or database A. history.” Plaintiffs claim parties dispute provisions six that are Regardless of whether Cohan can show SQPO.17 included in provi- Marriott’s Each harm, sion, provision the “internal compliance review” allows its with the Hawai'i Constitution, will Cohan’s health be discussed in turn. information to be used to premiums audit claims to set and to calculate SQPO paragraph 1(b)(2)—Review
1. experience,” reserves and purposes “loss and Audit of Claims for Internal are outside underlying litigation.18 Ac- Purposes Businesses cordingly, language SQPO paragraph 1(b)(2) 1(b)(2) SQPO paragraph provides scope exceeds the allowed used, may be dis- State Constitution. Cohan, Memorandum, Supplemental guage in his SQPO paragraph is also used in Marriott’s 1(b) paragraph 1(b) SQPO’s contended that the al- directly and Cohan did not address this "any claim, litiga- lows disclosure in relation to tion, Memorandum, provision Supplemental in his we proceeding arising out of the ... and/or provision deciding do not consider this in wheth- subject accident” whereas the Hawai'i Constitu- Judge er the Arbitration abused his discretion. permits only tion "underlying disclosure as to the light argument of Cohan’s waiver of his to this added). litigation.” (Emphasis During oral ar- provision, we also need not determine whether gument, acknowledged Cohan’s counsel that the compelling Marriott demonstrated a state inter- originally provision contested matched his own est for disclosure of health in proposed language SQPO at the trial court level. satisfy legally required reporting mandate. Consequently, we do not consider this determining the merits of the Petition. analysis arguably may 18. An under HIPAA lead 1(b)(2) paragraph SQPO to a different result. Similarly, argument Cohan waived his as to provides may that Cohan’s health information be 1(b)(6), SQPO pro- Marriott's which used, maintained, disclosed or without his con- may vides that Cohan’s health information be sent, purposes of Marriott’s internal reviews any legally required reporting gov- used "for applicable regulation or audits. The organiza- ernmental health or medical insurance entity,” states that a "covered which is defined as private tions or their contractors for [Cohan’s] (1) (2) plan; clearing- a house; a health a health care expenses Subject health care and related to the provider added). health care who trans- (Emphasis Accident." Cohan's mits health information in electronic posed SQPO form specifically ”[i]t agreed connection with a transaction covered plaintiff's understood and (45 used, 160.103), disclosed, subchapter "may § may C.F.R. formation be use or and/or and/or maintained, plaintiff's disclose without consent as health information for its own required comply treatment, payment, operations.” state federal or health care laws/ 164.506(c)(1). (Emphasis rulesf.]” opera- Because this lan- 45 C.F.R. "Health care *12 1(b)(7)—Disclosure SQPO paragraph SQPO paragraph 1(b)(3)—External 3. 2. Information of De-Identified Information Review of Health 1(b)(7) provides that SQPO paragraph 1(b)(3) provides that SQPO paragraph may be used “for health information Cohan’s may be used for Cohan’s health provided analytical purposes, or statistical by auditing, such as “external review and/or infor personal identification that [Cohan’s] Commissioner, reinsurers, or the Insurance address, name, specific street (e.g., mation auditors.” external number, date, Security specific Social birth number) included in is not driver’s license of his health argues that the use Cohan Information.” or use of Health such review of an external purposes for care information provision contends that the entire does external auditors by review undisclosed from the be excised should underlying litigation. the pertain not “put[s] at risk Cohan’s language the because of argues that HIPAA allows use Marriott far for use for matters medical information external review. information for health care underlying personal beyond scope his the of argues that injury litigation[.]” Marriott tort of clearly allows for the use provision This by he is harmed the cannot show that outside of the health information Cohan’s provision. not limit re-disclo- present litigation and does Accordingly, the by entities. explain type sure such what provision does not This conducted, privacy under will analysis who com- vision violates will be statistics, the results pile the and whether Constitution.19 the State ment, apparently under the following but not activi- defined to include the tions” is (to that Marriott references. entity activi- the extent the ties of the covered functions): are related to covered ties argues "external review 19. Cohan and/or development, planning and such Business auditing” qualify HIPAAas a use under does conducting cost-management planning- and as litigation proceed- or in "the of the information managing oper- analyses related to and related requested.” ing was which such information for develop- including formulary ating entity, argues cannot show that he that Cohan administration, development or im- and ment 1(b)(3) language paragraph by is harmed coverage payment provement or of methods of information for the use of health care because management gen- policies; and and Business reinsurers, auditing by external review and/or entity, activities of eral administrative Commissioner, external audi- or the Insurance cluding, but not limited to: 164.501(4), § which 45 C.F.R. tors is allowed may companies conduct or insurance states that arrange service, (ii) including provi- Customer services, review, legal and au- "medical holders, plan analyses policy sion of data part diting health care functions” as of their customers, provided sponsors, or other regulation operations. applicable HIPAA not disclosed protected health information is entity may use or disclose states that "a covered holder, sponsor, policy plan or cus- to such tomer; protected information for its own treat- ment, operations." 45 payment, or health care § Marriott asserts that the C.F.R. 164.501. 164.506(c)(1). applicable § defini- C.F.R. 1(b)(2) paragraph SQPO language is consis- operations” provides: "Con- tion of “health care 164.506(c) given § review, legal C.F.R. ducting arranging tent medical 164.506(c)(1) compa- services, auditing functions, § that insurance including fraud and "may protected health infor- or disclose nies use compliance pro- detection and and abuse treatment, payment, or health 164.501(4) mation for its own (emphasis § grams!.]” 45 C.F.R. Further, operations." However, 1(b)(3) Marriott notes that care paragraph would al- operations” includes "business "health care to be disclosed to busi- low Cohan's information management general activi- administrative of Marriott. Under ness associates entity ties.” business associates must' covered its 164.501(6), § upon requirements. Marriott relies comply While See 45 C.F.R. with strict 164.501(5) provides 164.502(a)(3) (business § appear a better would use or § associate language, only SQPO as it relates to as rationale for the disclose required "[b]usiness permitted internal review functions such its business associate conducting arrangement); planning development, such as 45 C.F.R. or other contract 164.504(e) analyses planning-related (setting requirements cost-management § for busi- forth contracts). entity!.]” operating com- managing Because these ness associate related to Thus, 164.501(5). language prehensive requirements are not set forth 45 C.F.R. SQPO, 1(b)(2) provision appears violate HIPAA. require- may satisfy HIPAA subject litigation, available will be made to entities outside therefore violates Presumably, need litigation. there is no Hawai'i Constitution.21 strip if it the health information of identifiers SQPO paragraph 1(b)(8)—Unreasonably litigation. de- remains inside Because Withholding Consent to Disclosure identified is for use outside *13 Health Information litigation, present provision the the is not in protec- the Hawai'i accord with constitutional 1(b)(8) paragraph pro SQPO also tion for health information.20 “agents, attorneys, vides that or its Marriott may request per
or insurers that additional uses, disclosures, SQPO paragraph 1(b)(8)—Disclosure categories missible of or 4. SQPO, added” and maintenance be to the of Health Information for Record unreasonably Cohan “shall not con Keeping Requirements withhold information], sent disclosure of health [to 1(b)(8) SQPO paragraph provides provided the categories that additional re that health bemay Cohan’s information used quested are consistent the intent of this any keeping requirements “for record or ob Order/Agreement.”22 ligations relating any foregoing, of the that language, Cohan contends the if re- pertaining Subject to the Accident.” tained, improperly would risk disclosure of proposes provision to strike the Cohan’s medical information for be- matters argues order and yond scope of the underlying litigation retained, language, if “[t]he stricken would private protections and violate the afforded improperly put at risk Cohan’s medical infor- by him and federal ar- state law. Marriott mation use for beyond for matters far gues provision, that the which “relate[s] scope underlying personal injury of the tort request reservation to additional [Marriott’s] litigation.” Marriott counters that uses,” permissible is “not harmful because provision. cannot show he is harmed impose unilaterally any does not additional uses consent of without the [Cohan].” requirement health disclosure of any However, keeping require- provision information “for record does not limit the obligations relating any ments or use or disclosure Cohan’s health informa- Further, foregoing, pertaining Subject underlying litigation. to the Ac- tion to the cident,” provides no provision ostensible limitation to does not limit Marriott its allowing agents requesting categories use Cohan’s information outside in additional section, in the HIPAA 20.As discussed earlier tions for the de-identification of health care formation, 164.514(a)- regulations §§ related to forth in de-identified information set 45 C.F.R. (b). inordinately complex. applicable are HIPAA states, regulation entity may part, in relevant covered "[a] protected Although use health 21. cites C.F.R. information to 45 individually 164.502(d)(l)-(2) (relating §§ create that is identi- information not to uses and disclo- information) statutory fiable health information or disclose sures of de-identified as a 1(b)(8), only paragraph regu- SQPO associate information to a business basis for the cited purpose, subject para- for whether or de-identi- related to the such not the lations are not graph Furthermore, 1(b)(8). SQPO fied is to be used covered 164.502(d)(1) (b)(8), (emphasis entity.” added). § 45 C.F.R. infor- which Cohan's health keeping may Marriott contends does not used "for that HIPAA mation requirements record obligations relating because, protect pursu- de-identified information foregoing, 164.502(d)(l)-(2), pertaining §§ Subject "[c]overed ant to 45 C.F.R. Acci- entities, added), i.e., companies, identify may (emphasis insurance use dent" does not tected health information to create information entities that use Cohan’s health information individually require require- infor- to conform to HIPAA is not identifiable health them mation, such ‘de-identified’ information is ments. requirements subject to the C.F.R. [45 not argument regulation addressing This rests on whether the 22. There is no 164.502].” However, fully provision, provides that deidentified. Mar- of this which para- unreasonably SQPO not riott’s de-identification Cohan "shall withhold consent information], 1(b)(7) graph comply provided of health [to does not with the minimal disclosure 164.502(d)(l)-(2), categories requirements requested §§ of 45 C.F.R. are con- the additional regula- Order/Agreement.” comprehensive which sistent with the intent of this codifies set of (record requirements); paragraph keeping health infor- for Cohan’s uses and disclosures 1(b)(8) unreasonably Cohan from (preventing mation, time limits but at the same (time consent); paragraph 5 withholding provided that the withhold consent power to information)— returning health deadline with the categories are consistent additional information to be Cohan’s health all allow Therefore, SQPO. requiring Co- intent of the underlying liti- purposes outside used 1(b)(8) SQPO paragraph comply with han to compelling any showing of a gation without protections pro- comport with the would Therefore, respondent interest. state Ha- under the for health information vided affirming the CAAP Adminis- judge erred Constitution. wai'i sign requiring Cohan to order and trator’s SQPO. SQPO paragraph Deadline 5—Time Health Information to Return *14 VI. 5, entitled “Return SQPO paragraph requiring the execu In addition to Copies,” provides that of All or Destruction SQPO, or Marriott’s the arbitrator’s tion of health infor must return Cohan’s
Marriott
sign Marriott’s
that Cohan
der mandates
destroy the
counsel or
mation to Cohan’s
medical and em
proposed authorizations for
ninety days after the “fi
within
information
separately
ob
ployment records.24
fully-
by
...
of the
nal conclusion
case/claim
language contained in these
jected to the
agree
non-litigation settlement
executed
overly
The medical
broad.
authorizations
by
ment.”
to Cohan Marr
submitted
authorizations
Cohan,
iott,25
grant
signed
would
if
ninety-day
provides a
SQPO provision
This
to disclose
counsel authorization
Marriott’s
litigation
end of
grace period after the
to
and all
destroy Cohan’s
to return or
Marriott
persons as follows:
I,
Because article
information.
tected health
counsel] to
[Marriott’s
I further authorize
prohib-
Constitution
6 of the Hawai'i
section
all
this authorization and
further disclose
information outside
the use of such
its
use, regardless
by its
information obtained
inference,
would, by
re-
litigation, it
present
content,
involved
persons
and all
immediately
parties to return records
quire
lawsuit/claim, for which this authori-
in the
litigation
after the
concludes.23
including,
being signed,
but not
zation is
to,
counsel, experts, con-
opposing
limited
B.
sultants,
per-
agency
court/administrative
sonnel,
private in-
government agencies,
case,
the Hawai'i
application of
In this
services,
copy
reporting
court
vestigators,
that the six contest-
Constitution establishes
repre-
companies, parties, and insurance
compli-
SQPO are not in
provisions of the
ed
sentatives.
provisions—
law. The six
ance with state
added).
(Emphasis
(internal review);
1(b)(2)
para-
paragraph
(external
1(b)(3)
review); paragraph
Additionally,
the medical authorizations
graph
1(b)(8)
permission to re-dis-
1(b)(7) (de-identification);
grant Marriott
would
paragraph
argues
Evidence
regulation
that Hawai'i Rules of
corresponding
re-
24. Cohan
HIPAA
23.The
(HRE)
priv-
"Physician-patient
part,
return to the cov-
quires, in relevant
"the
Rule
entitled
protected
entity
health
supplementary
protection
ered
or destruction
ilege,”
provides
made)
(including
copies
at the
all
information
against
his health information.
the disclosure of
litigation
proceeding.” 45 C.F.R.
end of
§
trast,
light
as to infor-
of the court’s determination
added).
)(v)(B)
164.512(e)(
(emphasis
In con-
protection
Hawai'i Constitu-
under the
mational
tion,
SQPO
that Marriott
not be addressed.
this contention need
ninety days
within
return the information
must
the ...
"final conclusion of
after the
case/claim
"employment
Although
references
agree-
non-litigation
by fully-executed
settlement
Supplemental Memoran-
in its
authorizations"
dum,
argues
SQPO
ment.” Marriott
by the
submitted
all of the authorizations
regulation
complies
because
with the
medically
parties appear
related.
to be
protected health informa-
return
Marriott must
ninety days
after the conclusion
tion within
But,
ninety-day grace period in the
the case.
SQPO
what HIPAAallows.
is more than
information,
require
close Cohan’s health
“in relation The authorizations also do not
is Cohan
notified before
health
[case]
[the]
which
authorization
be
his
informa-
re-disclosed,
provided,”
provide
thereby eliminating
that such
tion is
his
“may
longer
ability
no
know or
protected
challenge
be
under
dissemina-
federal
pi’ivaeyregulations”:
protected
tion of his
health information.
“I understand that the health information
discovery of
While
Cohan’s medical
may
released under this authorization
be
records are relevant to the
matter of
recipient
re-disclosed
in relation to
claims,
I,
his
article
section 6
the Hawai'i
for which this authoriza-
case/matter
protects
Constitution
disclosure
provided,
longer
tion is
no
produced
discovery
limits
privacy regula-
under
federal
underlying litigation.
such
disclosure
tions.”
people
recog
This
“is
(Emphasis
The authorizations would
infringed
nized and shall not be
without also “release
from all
liability
[Marriott]
showing
compelling
aof
state interest.”
pertaining
claims whatsoever
to the disclo- Brende,
de-identified
imposes requirements,
of State law
preempts any
stan-
conflicting state law.1 To un-
dards,
implementation specifications
point, Judge
derscore this
Manion’s concur-
that,
HIPAA,
rence thus stated
stringent
requirements,
passing
are more
than
“In
Congress
standards,
recognized
privacy
only
interest
implementation specifications
‘individually
identifiable medical records’
imposed
regulation.” Majority
under
records,
and not redacted medical
and HI-
opinion
HIPPA,
(citing
at 955
Pub.L. No.
preempts
PAA
regard.”
state law in
104-191,
Id.
(1996);
§
110 Stat. 1936
(Manion, J.,
at 933
concurring in part and
160.203(b)).
§
C.F.R.
A standard is “more
dissenting
part).
stringent”
“provides greater
if it
privacy pro-
tection for the
individual who is the
Additionally, in
Zyprexa
In re
Products
individually
identifiable health infor-
(E.D.N.Y.
Liability Litigation,
protective of HIPAA, are those laws
tion than regulatory by HIPAA’s
preempted
scheme.
Id. Northwestern,
Citing approvingly that, “de-identi- judge thus held
magistrate protected un- is not
fied HIPAA, that, to the extent state
der protection to de-identi- laws offer
privilege records, preempts those
fied medical magistrate judge Accordingly,
laws.” Id. privi- stringent state that more
determined discovery of de- prevent did not
lege laws records. Id. medical
identified 1(b)(7),
Here, paragraph rejecting provision is not that “the
majority concludes with the Hawaii constitutional
in accord because the for health information”
tection for use outside information is
“de-identified litigation.” Majority opinion present view, majority’s on my reliance
at 29. In right privacy to constitutional
the state infor- of de-identified
prevent the disclosure run afoul of and thus
mation could privi- just as the state
preempted by HIPAA in In preempted
lege laws were Zyprexa.
re 1(b)(7) clear-
Accordingly, since protocols for de-identifi-
ly violates HIPAA’s
cation, rejecting rely on HIPAA I would relying on the provision rather than privacy. constitutional
state
HAWAII STATE Petitioner/Union-Appellant,
TION,
v. SCHOOL; LABORATORY
UNIVERSITY Laboratory Charter Public
Education Board, Respon Local School
School
dent/Employer-Appellee.
No. SCWC-12-0000295.
Supreme of Hawai'i. Court
Feb.
notes
authorizations make no refer-
VII.
SQPO
ence to the
the
the
limitations on
entitled to
relief
is
mandamus
be
disclosure of his health
forth
information set
Judge’s
cause the Arbitration
order is not
SQPO, thereby allowing
in the
poten-
for the
appealable and results in
of
the release
confi
tial disclosure of
“to a
his
information
dential health information outside the under
group
people”
way
pre-
wide
with no
Brende,
lying litigation. See
113 Hawai'i at
venting
recipients
the
of the information
429,
Kema,
(citing
at 1114
153 P.3d
91 Ha
parties
re-disclosing
from
it to
to
unrelated
205,
339).
wai'i
982 P.2d at
at
underlying litigation. Consequently,
recipients
Petition,
grant
while
health informa-
Therefore we
and the
(1)
apprised
protections
would be
of the
respondent judge
tion
to:
is directed
vacate
authorizations,
decision,
in
against disclosure listed
affirming
arbitration
they
(2)
would lack
of the
protective
notice
more restrictive
qualified
order that
protections against
types
certain
of disclo- order and the authorizations for release of
may
that
in
proper
sure
be contained
a
medical records be revised consistent with
SQPO.
opinion.
this
require
sign
authorizations
Cohan to
RECKTENWALD,
Concurring Opinion by
expressly stating that
release
his information
C.J.,
NAEAYAMA, J.,
in
Joins.
which
may
longer
protected by
no
priva-
be
federal
regulations.26
cy
Additionally,
I
in the
the ma-
the authoriza-
concur
result reached
analysis,
provide
recipient
jority
do not
that the
in much of
but write
tions
its
separately
agree
re-disclosed information is
dis-
to address several issues.
I
I,
SQPO.
closure
set forth in
section 6 of the Hawai'i Consti-
restrictions
article
If,
Brende,
1114,
pursuant
may
party
it
"medical informa-
then
follows that a
not be
judicial proceed-
sign
tion
ing
order issued in a
required
an authorization form that does
must,
minimum,
provide
protections
at a
provide
protections.
the same minimum
not
HIPAA,"
429,
of the