Lead Opinion
Opinion of the Court by
I. Introduction
This сourt has been asked to provide guidance to the United States District Court for the District of Hawai'i (“District Court”) on questions of Hawai'i law. At issue is whether the parties may use, or be compelled to produce, the confidential medical records of over 100 cancer patients, in an effort to prosecute or defend against claims that the Plaintiff doctors steered these patients away from treatment at Defendant Queens’ Medical Center. The patients are not parties to the underlying lawsuit, although 19 of them have been granted intervenor status. All of them hаve intervened solely to assert their right to privacy and seek a prohibition on the use and production of their medical records.
The District Court
1. May a third party who is in lawful possession of a patient’s confidential medical records use, or be compelled to produce, these records in litigation where the patient is not a party?
2. If a third party may use and/or produce a patient’s confidential medical records in litigation, is a de-identification*16 process sufficient to protect the patient’s privacy interests where the third party already allоwed its agents access to the patient’s records and its agents inadvertently made part of the patient’s medical information public?
This court may “reformulate the relevant state law questions as it perceives them to be, in light of the contentions of the parties.” Allstate Ins. Co. v. Alamo Rent-A-Car, Inc.,
1. May a party who is in lawful possession of a patient’s confidential medical records use, or be compelled to produce, these records in litigation where the patient is not a party?
2. Is a de-identification process sufficient to рrotect the patient’s privacy interests where the party already allowed its agents access to the patient’s records and its agents inadvertently made part of the patient’s medical information public?2
Hawai'i Rules of Appellate Procedure (“HRAP”) Rule 13 (2000) governs certified questions. It provides, in relevant part, ‘When a federal district ... court certifies to the Hawai'i Supreme Court that there is involved in any proceeding before it a question concerning the law of Hawai'i that is determinative of the cause and that there is no clear controlling precedent in the Hawai'i judicial decisions, the Hawai'i Supreme Court may answer the certified question by written opinion.” We therefore confine our answer to the “law of Hawai'i that is determinative of the cause,” namely article I, section 6 of the Hawai'i Constitution. That constitutional provision states, in relevant part, “The right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest.”
We answer the first certified question in the negative. Article I, section 6 of the Hawai'i Constitution protects the health infоrmation of patient intervenors to this case. Pursuant to that provision, and under the facts of this case, the parties cannot use, or be compelled to produce, confidential patient medical records in litigation where the patient is not a party, absent a compelling state interest.
As to the second certified question, we do not address whether sufficient de-identification is possible where one party already allowed its agents access to the patient’s records and its agents inadvertently made part of the patient’s medicаl information public. The de-identification process and requirements are set forth under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Pub L. No. 104-191, 110 Stat. 1936 (1996), and its corresponding regulations; therefore, the sufficiency of de-identification does not “eoneern[ ] the law of Ha-wai'i that is determinative of the cause.” HRAP Rule 13. Whether the use and production of de-identified medical records is “sufficient to protect the patient’s privacy interests,” however, is a question this court can address under article I, section 6. We hold that the use and production of de-identified medical information of patients who are not parties to the litigation violates those patients’ right to privacy under article I, section 6 of the Hawai'i constitution, as no
II. Background
The Plaintiffs in this case are Pacific Radiation Oncology, LLC; PRO Associates, LLC; John Lederer, M.D.; Vincent Brown, M.D.; Paul DeMare, M.D.; Thanh Huynh, M.D.; Laeton Pang, M.D.; and Eva Bieniek, M.D. (collectively, “PRO”). The Plaintiffs filed an Amended Complaint for Declaratory and Injunctive Relief and for Damages (“Amended Complaint”) against Defendants Queens’ Medical Center and Queens’ Development Corporation (collectively “QMC”).
According to the Amended Complaint, QMC notified Plаintiffs that the QMC Board had decided to convert QMC to a “closed radiation therapy department,” meaning that only physicians employed by QMC could exercise clinical privileges to provide professional radiation oncology services at QMC. QMC explained that it arrived at its decision to terminate PRO’S privileges after determining that PRO had “transferred] patients to other facilities for no medical reason or patient request....” Plaintiffs alleged in them Amended Complaint that QMC’s action was intended to destroy their ability to treat patients at facilities competing with QMC.
Plaintiffs’ Amended Complaint raised ten claims for relief: a claim of denial of procedural and substantive due process; a claim of violation of QMC bylaws and governing regulations; three separate claims of intentional and tortious interference; four separate elaims of unfair, deceptive, anti-competitive and illegal trade practices in violation of HRS Chapter 480; and a claim of breach of fiduciary duty and bad faith owed to a partner.
QMC filed an Answer and Counterclaim. Relevant to this certified question, QMC counterclaimed that Plаintiffs Lederer, Brown, DeMare, Huynh, and Pang “consulted with and/or began treatment of patients referred to them at QMC and then induced the patients to receive treatment at TCCH without making timely written disclosure of their ownership interests in TCCH,” which constituted unfair competition in violation of HRS § 480-2.
During the course of the litigation, QMC’s law firm publicly filed a list naming 132 patients PRO was alleged to have diverted to TCCH; also included were the patients’ QMC identification numbers and the PRO doctors who consulted and treated each patient. The list was attached as an exhibit to (1) a subpoena to TCCH’s custodian оf records and (2) a discovery request to PRO. The filing was subsequently sealed.
Plaintiffs then moved for a temporary restraining order or preliminary injunction to prevent further violations of patient privacy. In their moving papers, they alleged that QMC had accessed the electronic medical records of 133 cancer patients, without consent, to determine if Plaintiffs were directing patients to TCCH, and, if so, how much revenue QMC lost as a result. Plaintiffs argued that cancer patient medical records would likely include “history and physicals” information regarding “the most confidentiаl and sensitive inquiries, including prior pregnancies, abortions, sexual activities, potency, drug use, psychological issues, depression, AIDS info, family history, prior diseases, substance dependency, etc., etc.” QMC’s alleged breach of patient privacy culminated in the disclosure of 132 of the patients’ names in the exhibits to the subpoena and discovery request. Plaintiffs sought to enjoin “QMC, its attorneys, and its consultants
The District Court granted in part, and denied in part, the Plaintiffs’ motion. Construing the Plaintiffs’ pleading as a discovery motion, the District Court granted it, in part, and sanctioned defense counsel for publicly filing the list naming the 132 cancer patients, in willful violation of the parties’ Amended Stipulated Protective Order. The District Court denied the motion for a TRO and/or preliminary injunction, in part, because the Plaintiffs’ Amended Complaint alleged no claims of improper review and use of confidential patient information.
The Magistrate Judge, in turn, issued his Order Regarding Discovery Issues. He found the 132 cancer patients’ confidential medical records to be relevant to the parties’ claims and counterclaims. He ordered the records discoverable as follows:
Although the patient medical records contain protected health information (“PHI”), this does not preclude them discovery. As noted by Judge Kobayashi in the TRO Order, “[o]nce health information has been deidentified, it is no longer protected by HIPAA” or state law. TRO Order at 29. It reasonably follows that PHI is discoverable if de-identified. Accordingly, the 132 patient medical records shall be de-identi-fied. Upon de-identification, the medical records will be discoverable and shall be produced.
The Plaintiffs appealed the Magistrate Judge’s decision to the District Court. After granting 19 affected patients’ motion to intervene, the District Court reserved ruling on the Plaintiffs’ appeal and certified the instant questions to this court.
III. Discussion
Article I, section 6 of the Hawaii Constitution is entitled “Right to Privacy,” and it provides, “The right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest. The legislature shall take affirmative steps to implement this right.” In the context of patient medical records, this court has issued three decisions construing article I, section 6 on petitions for writ of mandamus: Brende v. Hara,
Each of the mandamus petitioners in these eases sought to compel the respondent judges to issue orders limiting and/or prohibiting the use of patient medical records. The mandamus petitioners in Brende and Cohan were both plaintiffs in tort litigation in which their medical condition and treatment were at issue. The petitioner in Naipo, on the other hand, was not a party to the litigation. Rather, in Naipo, the parties to a dog-bite lawsuit sought discovery of a non-party’s patient medical records. This distinction is key in the instant proceedings, which involve patient intervenors who are not parties to the lawsuit between Plaintiffs and QMC. Each of these cases will be discussed in turn, below.
Brende, Cohan, and Naipo all provide strong privacy protection over patient medical records. In Brende, this court held, “Petitioners’ health information is ‘highly personal and intimate’ information that is protected by the informational prong of article I, section 6. The constitutional provision protects the disclosure outside of the underlying litigation of petitioners’ health information produced in discovery.”
Brende noted that the framers viewed the Hawai'i constitutional right to privacy as follows:
[T]he [article I, section 6] right of privacy encompasses the common law right of privacy or tort privacy. This is a recognition that the dissemination of private and personal matters, be it true, embarrassing or not, can cause mental pain and distress far greater than bodily injury. For example, the right can be used to protect an individual from invasion of [the individual’s] private affairs, public disclosure of embarrassing facts, and publicity placing the individual in a false light. In short, this right of privacy includes the right of an individual to tell the world to “mind your own business.”
So inviolable is this right that the framers sought to shield individuals from “possible abuses in the use of highly personal and intimate information in the hands of government or private parties. ...” Comm. Whole Rep. No. 15, in Proceedings, at 1024 (emphasis added). In this way, article I, section 6 provides Hawaii’s people with powerful protection against any infringement of their right to privacy, by state and private actors. In fact, we have previously noted that the framers “equated privacy in the informational sense” with the “common law right of privacy,” so that “[o]ne who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of his [or her] privacy, if the matter publicized is of a kind that (a) would be regarded as highly offensive to a reasonable person, and (b) is not of legitimate concern to the public.” State of Hawai'i Orgаnization of Police Officers (“SHOPO”) v. Soc’y of Prof’l Journalists,
Article I, section 6 generally provides greater privacy to Hawaii’s people than its federal analogs. The Hawai'i constitutional right to privacy is a “fundamental right for purposes of constitutional analysis.” Cohan,
Article 1, section 6 also provides more stringent protection
The right to privacy is absolute where, as here, the individuals seeking to protect patient medical records, in discovery and beyond, are not parties to the litigation, have not consented to the use of their patient medical records in relation to the present lawsuit, and no compelling state interest has been shown. Naipo is a case “on all fours” with the instant case. In Naipo, plaintiff Eshell Mitchell sued the Yuen family in state court for multiple leg injuries she sustained when the Yuens’ dog, Braddah, bit her.
Naipo then petitioned this court for a writ of mandamus, arguing that her health information was protected by, inter alia, her right to privacy under article I, section 6 of the Hawai'i constitution. Id. We granted Naipo’s petition for mandamus relief and ultimately directed the respondent judge to quash the subpoena duces tecum.
Naipo's holding provides our answer to the first certified question, which is, “May a party who is in lawful possession of a patient’s confidential medical records use, or be compelled to produce, these records in litigation where the patient is not a party?” We hold that, pursuant to article I, section 6 of the Hawai'i Constitution, and under the facts of this case, the рarties cannot use, or be compelled to produce, confidential patient medical records in litigation where the patient is not a party, where no compelling state interest has been shown.
The second certified question is, “Is a de-identification process sufficient to protect the patient’s privacy interests where the party already allowed its agents access to the patient’s records and its agents inadvertently made part of the patient’s medical information public?” We doubt, under the circumstances of this ease where there has been an egregious breach of patient confidentiality by QMG both internally and publicly, that de-identification is possible. However, the question of the sufficiency of de-identification where one party already allowed its agents access to the patient’s records and its agents inadvertently made part of the patient’s medical information public, is ultimately a matter of compliance with HIPAA, which is a federal question we need not answer. We can ad
In Cohan, we held, “To allow [a party’s medical] information to be used outside the litigation, regardless of whether it is de-identified or not, would reach beyond what the Hawaii Constitution permits in the absence of a showing of a compelling state interest.”
Further, we observed that “the risk of re-identification remains, as there is ‘no national, uniform standard governing the level of identifier-stripping necessary to guarantee that de-identified data cannot be re-identified.”
We believe the same concerns underlying the use of de-identified medical records beyond litigation for parties to a lawsuit exist for individuals who are not parties to litigation and who have therefore not put their medical condition and/or treatment at issue in the first instance. Just as article I, section 6 proteсts parties from the use and production of their de-identified information outside of litigation, we conclude that article I, section 6 protects individuals from the use and production of their de-identified information in litigation to which they are not parties. Thus, the use and production of even sufficiently de-identified medical records, under the circumstances of this ease, will not adequately protect the patients from an invasion of their privacy.
We acknowledge that Cohan also stated the following:
Once health information has been de-identified, it is no longer protected by HIPAA Further, because HIPAA allows “more stringent” statе law to preempt federal law only when it relates to the privacy of “individually identifiable health information,” 45 C.F.R. § 160.203(b), this leads to the conclusion that state law also does not protect de-identified information. Nw. Mem’l Hosp.,362 F.3d at 926 .
By contrast, our express holding in Cohan was, “To allow [a party’s medical] information to be used outside the litigation, regardless of whether it is de-identified or not, would reach beyond what the Hawaii Constitution permits in the absence of a showing of a compelling state interest.”
IV. Conclusion
We answer both certified questions in the negative. Article I, section 6 of the Hawaii Cоnstitution protects the health information of patient intervenors to this case. Pursuant to that provision, the parties cannot use, or be compelled to produce, confidential patient medical records, even if sufficiently de-identi-fied, in litigation where the patient is not a party, as no compelling state interest has been shown.
Notes
. The Honorable Leslie E. Kobayashi, United States District Judge, presided.
. Defendant urges us to reformulate the certified questions to include the following "threshold question”: "Does [Hawai'i Revised Statutes ("HRS”) § 431:10C-]308.7(c) apply to all self-referrаl involving insured services covered by H.R.S. Chapter 431 or only to those involving no-fault auto-related services?” We decline to do so. We note that the District Court has already concluded that that statute does not apply to health care provider referrals and is "limited to the context of motor vehicle insurance” in an Order Granting in Part and Denying in Part Plaintiffs’ Motion for Summary Judgment on the Counterclaim. The present certified question is not the proper vehicle through which Defendant may challenge that order.
. The Plaintiffs also named as defendants the individual members of the Quеens' Medical Center Board of Trustees. The parties later stipulated to dismiss, without prejudice, these individuals.
. The United States Court of Appeals for the Ninth Circuit affirmed the denial. Pacific Radiation Oncology, LLC v. Queen’s Medical Center,
. 45 C.F.R. § 160.202(6) provides
More stringent means, in the context of a comparison of a provision of State law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, a State law that meets one or more of the following criteria:....
With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information.
That regulation also defines “state law” to include a state’s constitution and common law. Id.
. We therefore are not persuaded by QMC’s contention that “Hawaii's constitutional right of privacy is coextensive with HIPAA.” In support of this argument, QMC points to HRS Chapter 323B, Hawaii’s Health Care Privacy Harmonization Act, specifically section 3(a) in that chapter, which states in relevant part that a covered entity or business associate’s use or disclosure of indi
. Our decision also rested on the twin holding that Naipo’s confidential medical records “deserve[d] the protection of the physician-patient privilege of [Hawai'i Rules of Evidence] Rule 504,” which Naipo had not waived.
Concurrence Opinion
Concurring Opinion by
I concur in the Majority’s opinion, but write separately to briefly address the issue of federal preemption. I agree with Majority’s holding that, pursuant to article 1, section 6 of the Hawaii Constitution, “the parties cannot use, or be compelled to produce, confidential patient medical records, even if sufficiently de-identified, in litigation where the patient is not a party, as no compelling state interest has been shown.”
However, for the reasons stated in my concurrence in Cohan v. Ayabe,
Thus, while I agree with the Majority’s analysis of our state constitutional right to privacy, the application of the Majority opinion to the underlying appeal and to future cases may raise federal preemption issues.