Ex Parte Communications With Physicians? Missouri's Old Rule v. HIPAA's New Rule
Ashley Baird1 |
Jaclyn Taylor1 |
I. Introduction
The November-December 2007 issue of the Journal of The Missouri Bar contained what purported to be a balanced article on whether the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) allows defense counsel to conduct ex parte conversations with a plaintiff’s treating physicians under Missouri law. Upon reading the article, one could not help but notice that, instead, it presented a very defense-oriented perspective on this issue and concluded that HIPAA permits ex parte conversations with physicians.2
While it continues to be a matter of debate among attorneys who practice in the area of medical malpractice, this article will provide support that HIPAA has had a major effect on ex parte communications between adversarial counsel and a patient’s treating physician.
It is the authors’ belief, after reading the law of Missouri as well as the law around the country, that HIPAA preempts Missouri law on ex parte contacts because Missouri law is less stringent than HIPAA’s privacy requirements. We look to Missouri court decisions as well as those decisions in states with laws similar to Missouri for guidance on the issue.
II. Missouri’s 1993 Brandt Decisions Concerning Ex Parte Conversation With Treating Physicians
In 1993 (10 years prior to the enactment of HIPAA) the Supreme Court of Missouri decided Brandt v. Pelican3 (“Brandt I”) and Brandt v. Medical Defense Associates4 (“Brandt II”). Brandt I and Brandt II are the premier Missouri cases discussing the issue of ex parte communications between a patient’s treating physician and a defendant’s attorneys.
In the Brandt cases, the plaintiff filed a medical malpractice cause of action against a doctor for his failure to monitor and warn the plaintiff of the potential side effects of a drug he prescribed. Subsequent to the plaintiff’s treatment by the defendant doctor, she was treated by two other doctors. Plaintiff’s counsel took the depositions of the two subsequent treating doctors. After these depositions took place, the defendant’s attorneys initiated ex parte communications with the doctors regarding the plaintiff’s physical condition (PHI pursuant to HIPAA).
After their ex parte communications with defense counsel, the two subsequent treating doctors testified at trial and provided expert opinions on behalf of the defendant. One doctor was a paid expert witness for the defendant. On appeal, the plaintiff argued that the two doctors changed their previous testimony after the ex parte communications with defense counsel.
Brandt I held that neither Missouri common law nor the incompetent witness statute5 prohibits a patient’s treating physician from having ex parte communications with the defendant’s attorneys during the discovery period of litigation.6 Brandt II held that once an issue concerning a patient’s medical condition is instigated in litigation, this serves as a waiver of a physician’s testimonial privilege under § 491.060(5), RSMo, as well as a waiver of a physician’s fiduciary duty of confidentiality.7
According to the Brandt decisions, the only bar on a physician’s ex parte communication is that he or she cannot go outside the scope of this waiver.8 As can be observed from the holdings in these cases, the Supreme Court of Missouri put a low threshold on defense counselors who seek ex parte communications with a patient’s treating physicians.
III. HIPAA’S Purpose is to Protect Individual Health Information
Ten years after Missouri’s Brandt decisions, the federal HIPAA Privacy Rules went into effect. One of the primary purposes of HIPAA is to protect the security and privacy of individually identifiable health information.9 HIPAA and the related provisions established in the Code of Federal Regulations supersede and preempt any contrary provisions of state law, unless the state law provides privacy protection that is more stringent than HIPAA’s requirements.10
“HIPAA’s stated purpose of protecting a patient’s right to the confidentiality of his or her individual medical information is a compelling federal interest[,]” as opposed to a state’s “less compelling . . . interest in permitting access to medical information where confidentiality has been waived.”11 Thus, to the extent a state’s law is less stringent than the privacy protections provided by HIPAA, HIPAA controls.12
Congress delegated the task of creating national standards to the Department of Health and Human Services to “ensure the integrity and confidentiality of the information.”13 “The regulations promulgating these standards became effective on April 14, 2003, and are collectively known as ‘the Privacy Rule,’ which sets forth standards and procedures for the collection and disclosure of ‘protected health information’” (PHI).14
PHI includes
any information, whether oral or recorded in any form or medium, that:
(1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
(2) Relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.25
Under the HIPAA Privacy Rule, an entity must make reasonable efforts to limit PHI to the “minimum necessary” to accomplish the intended purpose of the use, disclosure or request.16 Pursuant to 45 C.F.R. § 164.512(e), a health care provider “may disclose protected health information in the course of a judicial” proceeding under either of two circumstances: (1) if the provider is ordered to do so by a court, or (2) if the provider discloses in response to traditional methods of formal discovery, i.e. “subpoena, discovery request or other lawful process,” as long as certain conditions are met.17
The standards under HIPAA’s second prong above for traditional methods of formal discovery are the following:
(1) “the provider must be assured that the entity has provided the patient with written notice and an opportunity to object, or”
(2) that in relation to the information contemplated by the discovery request or subpoena, “the requesting entity must move the Court for a qualified protective order.”18
Therefore, pursuant to the above-mentioned HIPAA regulations and provisions, individuals must be afforded the HIPAA procedural protections concerning the disclosure of the broad range of PHI.
IV. The Majority Rule Across the Country Holds HIPAA Preempts State Laws That Allow Unrestricted Ex Parte Contacts
No reported Missouri case has specifically addressed whether HIPAA supersedes Missouri law concerning ex parte conversations with physicians as set forth by the Brandt court.19 However, the courts of other jurisdictions have dealt specifically with the issue of whether the HIPAA Privacy Rule preempts a state’s law that allows unrestricted ex parte contacts with a patient’s treating physician.
The seminal case on this issue is Law v. Zuckerman.20 Law is a case interpreting Maryland law, and like Missouri, Maryland allows ex parte contacts between defendant’s counsel and a treating physician when a patient places his or her medical condition at issue in a lawsuit.21 In Law, the plaintiff brought a medical malpractice case against the defendant for rendering her cervix incompetent during laser surgery.22 After the plaintiff produced her medical records to the defendant’s counsel, defendant’s counsel met ex parte with the plaintiff’s treating physician, without notifying the plaintiff or giving her an opportunity to object.23 The plaintiff argued that the contact violated the HIPAA Privacy Rule.24
The court recognized that HIPAA, while not barring all contact between counsel and a health care provider, “clearly regulates the methods by which a physician may release a patient’s health information, including ‘oral’ medical records.”25 The Law court held that Maryland law was less stringent than the HIPAA requirements, and therefore HIPAA preempted Maryland’s law. “[I]n the absence of strict compliance with HIPAA” ex parte contacts with treating physicians “are prohibited.”26 The mechanisms set forth in the Privacy Rule are meant to ensure that protected health information is not disclosed without first providing notice to the patient and an opportunity to object to the disclosure.27
The Law court pointed out that the “HIPAA statute has radically changed the landscape of how litigators can conduct informal discovery in cases involving medical treatment.”28 It noted that, before HIPAA, “ex parte contacts with an adversary’s treating physician may have been a valuable tool in the arsenal of savvy counsel. The element of surprise could lead to case altering, if not case dispositive results.”29 After the enactment of HIPAA, “[c]ounsel should now be far more cautious in their contacts with medical fact witnesses when compared to other fact witnesses to ensure that they do not run afoul of HIPAA’s regulatory scheme.”30
A result similar to Law was reached in Croskey v. BMW of North America, Inc., decided under Michigan law.31 In Croskey, the plaintiff was seeking damages from the defendants for a radiator explosion in plaintiff’s car. One of the issues presented in the court’s opinion was a motion filed by the defendant requesting permission from the court for defendant’s “counsel to meet ex parte ‘with all of [p]laintiff’s treating physicians and health care providers.’”
The Croskey court determined that Michigan’s law (similar to Missouri law concerning ex parte communications) is less stringent than HIPAA, and therefore adversarial counsel’s contacts with the plaintiff’s treating physicians must comply with HIPAA’s Privacy Rule.32 The Law and Croskey interpretation of the “more stringent” requirement is consistent with how other courts have construed the privacy rule.33
Before adversarial counsel may participate in ex parte communications with a treating health care provider, HIPAA requires the adversarial counsel to first obtain a court order or the patient’s express consent.34 In short, HIPAA “protect[s] a patient’s healthcare information, unless the patient is given reasonable notice and an opportunity to object.”35 If a state law provides less stringent privacy protections than HIPAA, then HIPAA preempts the state law and the patient will be provided with the HIPAA privacy protections as well as any state law protections.
V. Conclusion
The only circumstance under which HIPAA and its standards do not preempt state law is when the state law provides privacy protection that is “more stringent” than HIPAA’s requirements. 42 U.S.C.A. § 1320d-7(a)(2).
A comparison of the Brandt I and Brandt II decisions with the standards presented by HIPAA as illustrated above indicates that Missouri law is considerably less stringent than the HIPAA Privacy Rule. Missouri law permits ex parte communications between treating physicians and defense attorneys so long as the communications are not outside the scope of the issues presented in litigation; while HIPAA only allows for such communications, including oral communications, when the healthcare provider has obtained consent of the patient and the health care provider is ordered to do so by the court or through methods of formal discovery.36
Therefore, this author asserts that Missouri law regarding ex parte communications with treating physicians is less stringent than HIPAA; therefore, HIPAA preempts Missouri law, and the proper procedure upon that finding is to comply with the protections provided by both the state law and HIPAA.37
Before adversarial counsel may participate in ex parte communications with a treating health care provider, the adversarial counsel must first obtain an authorization from the plaintiff, and then supply the individual with the privacy assurances required under the federal HIPAA guidelines.38
Footnotes
1 Ashley Baird graduated from UMKC School of law and is currently practicing as an associate with Dempsey & Kingsland, P.C. Jaclyn Taylor graduated from UMKC School of Law and is currently practicing as an assistant prosecutor in Platte County, Missouri.
2 The previous article’s conclusion was that HIPAA does not preempt Missouri law and ex parte communications should continue as they were allowed prior to the enactment of HIPAA. Ted Agniel et al., Ex parte Communications With Treating Health Care Providers: Does HIPAA Change Missouri Law?, 63 J. MoBar 296, 298 (2007).
3 856 S.W.2d 658 (Mo. banc 1993).
4 856 S.W.2d 667 (Mo. banc 1993).
5 Section 491.060, RSMo 2006, states as follows: “The following persons shall be incompetent to testify:…(5) A physician licensed pursuant to chapter 334, RSMo, a chiropractor licensed pursuant to chapter 331, RSMo, a licensed psychologist or a dentist licensed pursuant to chapter 332, RSMo, concerning any information which he or she may have acquired from any patient while attending the patient in a professional character, and which information was necessary to enable him or her to prescribe and provide treatment for such patient as a physician, chiropractor, psychologist or dentist.”
6 856 S.W.2d 658, 662.
7 856 S.W.2d 667, 674.
8 Id.
9 Smith v. Am. Home Prods. Corp., 855 A.2d 608, 611 (N.J. Super. Ct. Law Div. 2003).
10 Id.; 42 U.S.C.A. § 1320d-7(a)(2).
11 Crenshaw v. Mony Life Ins. Co., 318 F.Supp.2d 1015, 1024-25 (S.C. Cal. 2004).
12 42 U.S.C.A. § 1320d-7(a)(2).
13 Smith v. Am. Home Prods. Corp., 855 A.2d 608, 611 (N.J. Super. Ct. Law Div. 2003).
14 Id. at 611.
15 45 C.F.R. § 160.103 (emphasis added).
16 Smith at 112.
17 45 C.F.R. § 164.512(e)(1)(i)-(ii). Under this section of the Code, the conditions are that (a) the health care provider must be assured that the requesting entity or its representative has provided the patient with written notice and opportunity to object, or (b) that in relation to the information contemplated by the discovery request or subpoena, the requesting entity has moved the court for a “qualified protective order.” 45 C.F.R. § 164.512(e)(1)(ii)(A)-(B).
18 Luna v. Kennett HMA, Inc., No. 1:07CV00043 RWS, slip.op. at *1, 2007 WL 4468693 (E.D. Mo. December 17, 2007) (citing 45 C.F.R. 164.512(e)(1)(ii)(A) & (B).
19 Missouri’s most recent case of Luna v. Kennett HMA, Inc. held that the defendant “complied with HIPAA” and therefore it did not determine “whether the HIPAA Privacy Rules preempt and supersede Missouri law as it stands after the Brandt decisions.” Luna v. Kennett HMA, Inc., No. 1:07CV00043 RWS, slip.op. at *1, 2007 WL 4468693 (E.D. Mo. December 17, 2007).
20 307 F.Supp.2d 705 (S.D. Md. 2004).
21 Id. at 708 (citing Butler-Tulio v. Scroggins, 774 A.2d 1209 (Md. Ct. App. 2001)).
22 Id. at 707.
23 Id.
24 Id.
25 Id. at 708.
26 Id. at 707.
27 See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82462, 82463 (Dec. 28, 2000) (codified in 45 CFR parts 160 and 164)..
28 Law, 307 F. Supp. at 711.
29 Id.
30 Id.
31 2005 WL 1959452 (E.D. Mich. Feb. 16, 2005) (reversed in part on other grounds).
32 Id. at *1.
33 See Moreland v. Austin, 670 S.E.2d 68, 2008 WL 4762052 (Ga. 2008) (holding HIPAA preempts Georgia law on ex parte contacts with treating physicians); United States ex rel. Stewart v. Louisiana Clinic, 2002 WL 31819130 (E.D. La. Dec. 12, 2002) (holding Louisiana patient privacy statute is preempted by HIPAA); see also Smith v. Am. Home Prods. Corp., 855 A.2d 608, 611 (N.J. Super. Ct. Law Div. 2003) ( holding that New Jersey law protecting privacy of mental health records was not preempted by HIPAA because it was more stringent than HIPAA).
34 See Moreland v. Austin, 670 S.E.2d 68, 2008 WL 4762052 (Ga. 2008) (holding HIPAA preempts Georgia law on ex parte contacts with treating physicians).
35 Id.
36 See United States ex rel. Stewart v. Louisiana Clinic, 2002 WL 31819130 (E.D. La. Dec. 12, 2002) (emphasizing discovery request and court order as means to get health information); see also Smith v. Am. Home Prods. Corp. Wyeth-Ayerst Pharm., 855 A.2d 608, 2003 WL 23739068 (N.J. Super. Ct. Law Div. 2003) (examining HIPAA privacy exceptions).
37 Beverly Cohen, Reconciling the HIPAA Privacy Rule With State Laws Regulating Ex Parte Interviews of Plaintiffs’ Treating Physicians: A Guide to Performing HIPAA Preemption Analysis, 43 Hous. L. Rev. 1091, 1134 (2006). (“When compliance is possible under both the state law and HIPAA (i.e. the laws are not contrary), then that is precisely what the parties must do – comply with both. It is self-evident that a covered entity should refrain from making use or disclosure of protected health information that would put it in violation of either state law or HIPAA.”)
38 Id. at 1136.