Arons v. Jutkowitz , 9 N.Y.3d 393 ( 2007 )

9 N.Y.3d 393 (2007) 880 N.E.2d 831 850 N.Y.S.2d 345

MANUEL ARONS, Individually and as Executor of PHYLLIS ARONS, Deceased, Respondent,
v.
ROBERT JUTKOWITZ et al., Appellants, et al., Defendant.
TANYA WEBB, Respondent,
v.
NEW YORK METHODIST HOSPITAL et al., Appellants.
ANNETTE J. KISH, as Administrator De Bonis Non of the Estate of JAMES J. JERGE, Deceased, Respondent,
v.
DAVID H. GRAHAM, M.D., et al., Appellants.

Court of Appeals of the State of New York.

Argued October 17, 2007. Decided November 27, 2007.

Amabile & Erman, P.C., Staten Island (Flutra Limani of counsel), for Robert Jutkowitz, appellant in the first above-entitled action.

Mauro Goldberg & Lilling LLP, Great Neck (Barbara DeCrow Goldberg of counsel), and Vaslas Lepowsky Hauss Danke LLP for Robert Fulop, appellant in the first above-entitled action.

Wilson, Elser, Moskowitz, Edelman & Dicker LLP, New York City (Michael J. Gudzy, Timothy J. Sheehan and Richard E. Lerner of counsel), for William Gael and others, appellants in the first above-entitled action.

Philip J. Dinhofer, LLC, Rockville Centre (Philip J. Dinhofer of counsel), for respondent in the first above-entitled action.

Michael A. Cardozo, Corporation Counsel, New York City (John Hogrogian, Diane Conyers and Suzanne K. Colt of counsel), for New York City Health and Hospitals Corporation, amicus curiae in the first above-entitled action.

Aaronson, Rappaport, Feinstein & Deutsch, LLP, New York City (Steven C. Mandell of counsel), for appellants in the second above-entitled action.

Oshman & Mirisola, LLP, New York City (David L. Kremen of counsel), for respondent in the second above-entitled action.

Mauro Goldberg & Lilling LLP, Great Neck (Barbara DeCrow Goldberg of counsel), and Damon & Morey LLP for appellants in the third above-entitled action.

Hamsher & Valentine, Buffalo (Richard P. Valentine of counsel), and Hancock & Estabrook, LLP, Syracuse (Alan J. Pierce of counsel), for respondent in the third above-entitled action.

Kramer, Dillof, Livingston & Moore, New York City (Matthew Gaier and Brian Isaac of counsel), for New York State Trial Lawyers' Association, amicus curiae in the first, second and third above-entitled actions.

Chief Judge KAYE and Judges CIPARICK, GRAFFEO, SMITH and JONES concur with Judge READ; Judge PIGOTT dissents in a separate opinion.

OPINION OF THE COURT

READ, J.

These appeals call upon us to decide whether an attorney may interview an adverse party's treating physician privately when the adverse party has affirmatively placed his or her medical condition in controversy. We conclude that an attorney may do so, although the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub L 104-191, 110 US Stat 1936 [1996] [codified as amended in scattered sections of titles 18, 26, 29 and 42 of the United States Code]) through its Privacy Rule (45 CFR parts 160, 164) imposes procedural prerequisites unique to the informal discovery of health care professionals.

I.

A. Arons v Jutkowitz

In Arons, plaintiff husband, individually and as executor of his late wife's estate, brought a medical malpractice and wrongful death action against several physicians, other medical professionals and two hospitals. He alleged that two of the physician defendants failed to tell decedent that her MRI revealed hydrocephalus, thus delaying proper medical care for 14 months as her health deteriorated. Decedent, who was hospitalized repeatedly for unavailing treatments in the roughly six months after her diagnosis, lapsed into a coma and died some weeks later.

Once plaintiff filed a note of issue, one of the physician defendants requested HIPAA-compliant authorizations so that his attorneys might seek to interview decedent's treating physician. Plaintiff refused, prompting defendants to ask Supreme Court for an order pursuant to HIPAA regulations (45 CFR 164.512 [e] [1] [i]; 164.508) "directing plaintiff to provide authorizations permitting defense counsel to speak with certain physicians who rendered care to ... plaintiff related to claims being made in [the] action, if the physicians voluntarily agree to such interviews."

Supreme Court granted the motion. The court reasoned that by commencing the medical malpractice action, plaintiff put his late wife's medical condition into play, thus waiving her physician-patient privilege; that defendants were permitted to interview a plaintiff's treating physicians, "but only after the note of issue [had] been filed"; and, citing several lower court decisions, that "HIPAA regulations require authorizations from the plaintiff in order for the defendants to conduct post-discovery interviews with treating physicians" (2005 NY Slip Op 30130[U], *3). Consequently, Supreme Court directed plaintiff to provide authorizations to defense counsel within seven days, subject to several conditions; specifically,

"the authorization[s] must, on [their] face state in BOLD letters that the purpose of the interview is to assist the defendants in defense of a lawsuit and it is not at the request of the plaintiff. The authorization[s] must contain the name and address of the person to whom the health care provider may give an interview if he or she wishes and must identify the persons or entities the interviewer is representing and must conform in all respects to 45 C.F.R. § 164.508 (c). The authorizations may not be combined with a subpoena and there must be a separate authorization for each interview.

"Within 72 hours after the interview, the defendant must provide the plaintiff with any and all written statements, materials or notations and any document obtained from the interviewed health care provider, as well as copies of any memoranda, notes, audio or video recordings of any oral statements made by the health care provider. The defendant's counsel need not disclose their conclusions, impressions or analysis of any of the statements." (Id.)

Plaintiff appealed, and the Appellate Division, Second Department, reversed. The court opined that although plaintiff had waived the physician-patient privilege by bringing the lawsuit, defendants were entitled only to disclosure via the discovery devices enumerated in CPLR article 31 and the Uniform Rules for the New York State Trial Courts, which do not mention ex parte interviews, or mandate that a plaintiff execute authorizations permitting them. Further, "[i]n the absence of" explicit authority in article 31 or the Uniform Rules or plaintiff's consent, defense counsel had long been prohibited from privately interviewing a plaintiff's treating physicians during discovery, a "limit[ ] on disclosure ... imposed not because of the physician-patient privilege, which is generally waived by bringing a malpractice action, but by the very design of the specific disclosure devices available in CPLR article 31" (Arons v Jutkowitz, 37 AD3d 94, 97 [2d Dept 2006] [internal quotation marks omitted]).

Next, the court conceded that while it had previously decided that a treating physician's testimony could not be precluded at trial on the basis of ex parte interviews conducted after the filing of the note of issue, those decisions neither "declare[d] that defense counsel [had] a right to such informal, post-note of issue interviews," nor "require[d] plaintiffs to consent to them" (id.). Further, although HIPAA did not alter state law regarding these private interviews, it had created a "practical dilemma" for defense counsel seeking to conduct them because physicians refused to talk with them absent a HIPAA-compliant authorization or court order (id. at 99).

Finally, the court remarked that after the filing of a note of issue, an order for additional pretrial discovery called for the requesting party to demonstrate "unusual or unanticipated circumstances" (id. at 100, quoting 22 NYCRR 202.21 [d]); and that, in this case, the note of issue had been filed before HIPAA's privacy regulations became effective. "[I]n light of the unsettled nature of the law prior to [its] decision," the Appellate Division therefore modified Supreme Court's order by "deny[ing] ... defendants' motion with leave to move pursuant to 22 NYCRR 202.21 (d) for permission to conduct additional pretrial discovery relating to ... decedent's treating physicians as limited by article 31" (id. at 101 [emphasis added]). The Appellate Division subsequently granted defendants' motion for leave to appeal, asking us whether its opinion and order were properly made.

B. Webb v New York Methodist Hospital

In this medical malpractice action, plaintiff alleged that she suffered constant nausea, intractable vomiting and malnutrition as a result of a botched gastric stapling operation. Plaintiff, who weighed 450 pounds at the time of her surgery, lost 200 pounds afterwards.

Once the note of issue was filed, defendant physician and defendant hospital sought HIPAA-compliant authorizations for ex parte interviews with the gastroenterologist who treated plaintiff after her weight-loss operation, and the surgeon who operated on her to reverse the procedure. When plaintiff refused to supply authorizations, defendants moved to compel her to do so.

Supreme Court granted the motion and directed plaintiff to furnish authorizations for the interviews, subject to conditions that he had worked out in earlier litigation where the same issue had arisen. As was the case in Arons, these conditions included a direction for defense counsel to hand over to his adversary copies of all written statements and notations obtained from the physicians during the private interviews, as well as any audio or video recordings or transcripts, and interview memoranda or notes (excluding the attorneys' observations, impressions or analyses).

The Appellate Division, Second Department, reversed Supreme Court's order for the reasons stated in Arons, and denied defendants' motions "without prejudice to making a motion in Supreme Court ... pursuant to 22 NYCRR 202.21 (d) for permission to conduct additional pretrial discovery relating to" plaintiff's treatment by the treating physicians (Webb v New York Methodist Hosp., 35 AD3d 457, 457-458 [2d Dept 2006]). The Appellate Division subsequently granted defendants' motion for leave to appeal, asking us whether its decision and order were properly made.

C. Kish v Graham

In Kish, plaintiff, as administrator of decedent's estate, alleged that defendant physicians did not properly diagnose and treat decedent for perineal necrotizing fasciitis, resulting in his death. After discovery was complete, defendants served plaintiff with a demand for HIPAA-compliant authorizations permitting defense counsel to interview decedent's treating physicians. When plaintiff refused to sign the authorizations, defendants moved to compel her to do so or, alternatively, to prohibit her from offering these physicians' records at trial, or speaking with them before trial.

Supreme Court granted the motion and directed plaintiff to provide the authorizations, subject to the following conditions:

"(a) With respect to any of the subsequent treating physicians which defense counsel seeks to interview in private, defense counsel shall serve a trial subpoena upon such physician prior to, or contemporaneously with, defense counsel's delivery to the physician of the executed HIPAA-compliant authorization by plaintiff ...;

"(b) Such authorization shall be limited by the same temporal and subject matter limitations, if any, as on the plaintiff's pre-note of issue authorization providing the defendants with access to records of the subsequent treating physician, it being the intention of the Court not to require or allow such physician to provide defense counsel with additional records;

"(c) The authorization shall be accompanied by a cover letter from defense counsel to the subsequent treating physician stating:

"(1) While the subpoena requires such physician's testimony at trial, the physician is not obligated to speak with defense counsel prior to trial;

"(2) The purpose of the requested interview with the physician is solely to assist defense counsel at trial;

"(3) If the physician grants the requested interview with defense counsel, a copy of such physician's records, if any, previously provided to defense counsel will be available to assist the physician during the interview;

"(4) The physician is not required to provide defense counsel with any written material or records prior to trial; and

"(d) Provided that defense counsel complies with the conditions prescribed in this Order, no notice of the date or time of the interview need be given to plaintiff's counsel."

The Appellate Division, Fourth Department, reversed on the basis of Arons, with two Justices dissenting. The court subsequently granted defendants' motion for leave to appeal, asking us whether its order was properly made.

II.

A. Informal Discovery of Nonparty Treating Physicians

We have written before about the importance of informal discovery practices in litigation—in particular, private interviews of fact witnesses. In Niesig v Team I (76 NY2d 363 [1990]), the plaintiff in a personal injury action under Labor Law § 240 moved for permission for his counsel to conduct ex parte interviews of the corporate defendant's employees who were on the job site at the time of his accident. The particular question put to us was whether these employees were considered "parties" under Code of Professional Responsibility DR 7-104 (a) (1) (22 NYCRR 1200.35 [a] [1]), which prohibits an attorney from communicating directly with a "party" known to have counsel in the matter.

The trial court denied the plaintiff's request; the Appellate Division modified by limiting the ban on ex parte interviews to the corporation's current employees, concluding that they were "presumptively within the scope of the representation afforded" by the corporation's attorneys in the litigation (Niesig v Team I, 149 AD2d 94, 95 [2d Dept 1989]). The Appellate Division further observed that "it [had] not been suggested, much less proved, that the witnesses sought to be interviewed ex parte could not be compelled to testify at regular pretrial depositions" (id. at 106). Further, the court commented that it was "obvious that the plaintiff's personal interests in achieving a financial and a tactical advantage in the litigation [were] the real policies which would be advanced by acceptance of his argument" (id. at 107).

We pointed out that the Appellate Division's blanket ban was undesirable because it would

"close[ ] off avenues of informal discovery of information that [might] serve both the litigants and the entire justice system by uncovering relevant facts, thus promoting the expeditious resolution of disputes. Foreclosing all direct, informal interviews of employees of the corporate party unnecessarily sacrifices the long-recognized potential value of such sessions.... Costly formal depositions that may deter litigants with limited resources, or even somewhat less formal and costly interviews attended by adversary counsel, are no substitute for such off-the-record private efforts to learn and assemble, rather than perpetuate, information" (76 NY2d at 372).

While the Appellate Division's blanket ban was easy to understand and apply, we concluded that the many benefits of informal discovery "require[d] that an effort be made" to create a workable, narrower test (id. at 373). Accordingly, we restricted the ban on private interviews to those "corporate employees whose acts or omissions in the matter under inquiry are binding on the corporation ... or imputed to the corporation for purposes of its liability, or employees implementing the advice of counsel" (Niesig, 76 NY2d at 374). In response to defendants' "assertions that ex parte interviews should not be permitted because of the dangers of overreaching," we added the "cautionary note" that "it is of course assumed that attorneys would make their identity and interest known to interviewees and comport themselves ethically" (id. at 376).

Earlier this year, we had occasion to revisit Niesig when we decided Muriel Siebert & Co., Inc. v Intuit Inc. (8 NY3d 506 [2007]). Siebert, a discount brokerage firm, commenced an action against Intuit for breach of contract and fiduciary duty. Unbeknownst to Siebert, Intuit's lawyers arranged a private interview with a former executive who had been an important participant in the events contested in the litigation as well as a member of Siebert's "litigation team." The lawyers quizzed the executive about the underlying facts of the case in advance of his previously scheduled deposition.

Before commencing the interview, Intuit's lawyers cautioned the executive not to reveal privileged or confidential matter, specifically including any conversations with Siebert's attorneys, or information about Siebert's litigation strategy. He was further advised that if he was asked a question that might threaten such disclosures, he should decline to answer for that reason. The executive stated that he understood the admonitions; the record did not indicate that any privileged information had, in fact, been disclosed.

Upon learning about the interview, Siebert moved to disqualify Intuit's attorneys from the case, enjoin them from using any information provided by the executive, and stay his deposition. Supreme Court granted the motion, holding that the disqualification was warranted regardless of whether Intuit actually received any privileged information. Recognizing that DR 7-104 (a) (1) could not apply to a former corporate employee, the trial court grounded its decision on the "``appearance of impropriety' based upon the possibility that privileged information had been disclosed during the interview" (id. at 510). Citing Niesig, the Appellate Division reversed, and subsequently granted Siebert's motion for leave to appeal, asking us whether its order was properly made.

First, we noted that in Niesig we had "made clear" that there was no across-the-board ban on ex parte communications with an adversary's current employees (id. at 511). As a result, opposing counsel were afforded "the opportunity to unearth relevant facts through informal discovery devices, like ex parte interviews, that have the potential to streamline discovery and foster the prompt resolution of claims" (id.). For the same "policy reasons articulated in Niesig concerning the importance of informal discovery," we held that "so long as measures are taken to steer clear of privileged or confidential information, adversary counsel may conduct ex parte interviews of an opposing party's former employee" (id.). Since the record indicated that protective steps had been taken and adhered to, we affirmed the Appellate Division and answered the certified question in the affirmative.

We see no reason why a nonparty treating physician should be less available for an off-the-record interview than the corporate employees in Niesig or the former corporate executive in Siebert. As an initial matter, a litigant is "deemed to have waived the [physician-patient] privilege when, in bringing or defending a personal injury action, that person has affirmatively placed his or her mental or physical condition in issue" (Dillenbeck v Hess, 73 NY2d 278, 287 [1989], citing Koump v Smith, 25 NY2d 287, 294 [1969]; see also Hoenig v Westphal, 52 NY2d 605 [1981] [physician-patient privilege waived by commencement of personal injury lawsuit]). This waiver is called for as a matter of basic fairness: "[A] party should not be permitted to affirmatively assert a medical condition in seeking damages or in defending against liability while simultaneously relying on the confidential physician-patient relationship as a sword to thwart the opposition in its efforts to uncover facts critical to disputing the party's claim" (Dillenbeck at 287).

Plaintiffs counter that informal interviews of treating physicians are nonetheless impermissible because article 31 of the CPLR and part 202 of the Uniform Rules do not identify them as a disclosure tool. But there are no statutes and no rules expressly authorizing—or forbidding—ex parte discussions with any nonparty, including the corporate employees in Niesig and the former corporate executive in Siebert.^[1] Attorneys have always sought to talk with nonparties who are potential witnesses as part of their trial preparation. Article 31 does not "close[ ] off" these "avenues of informal discovery," and relegate litigants to the costlier and more cumbersome formal discovery devices (Niesig, 76 NY2d at 372). As the dissenting Justices pointed out in Kish, choking off informal contacts between attorneys and treating physicians invites the further unwelcome consequence of "significantly interfering with the practice of medicine": "[i]nstead of communicating with an attorney during a 10-minute telephone call, a physician could be required to attend a four-hour deposition or to provide a time-consuming response to detailed and lengthy interrogatories" (Kish v Graham, 40 AD3d 118, 129 [4th Dept 2007, Pine, J., dissenting]).

Plaintiffs also complain that in a more casual setting and without opposing counsel present, a physician might unwittingly divulge medical information as to which the privilege had not been waived, or might be gulled into making an improper disclosure. This is the same "danger[ ] of overreaching" that we rejected explicitly in Niesig and implicitly in Siebert, finding it to afford no basis for relinquishing the considerable advantages of informal discovery.

Again, we "assume[ ] that attorneys would make their identity and interest known to interviewees and comport themselves ethically" (Niesig, 76 NY2d at 376). In Siebert, where the executive was privy to information for which the attorney-client privilege had not been waived, we considered the risk of improper disclosure adequately addressed where the attorney conducting the interview prefaced his questioning with admonitions designed to prevent this from happening, and there was no reason to believe that privileged information had, in fact, been disclosed. Here, the danger that the questioning might encroach upon privileged matter is surely no greater than was the case in Siebert since the subject matter of the interview or discussion—a patient's contested medical condition—will be readily definable and understood by a physician or other health care professional. In sum, an attorney who approaches a nonparty treating physician (or other health care professional) must simply reveal the client's identity and interest, and make clear that any discussion with counsel is entirely voluntary and limited in scope to the particular medical condition at issue in the litigation.

Finally, we understand that, in fact, for many years trial attorneys in New York have engaged in the practice of interviewing an adverse party's treating physicians ex parte, particularly in malpractice actions, although only after a note of issue was filed (see Anker v Brodnitz, 98 Misc. 2d 148 [1979], affd on op below 73 AD2d 589 [2d Dept 1979], lv dismissed 51 NY2d 703, 743 [1980]; see also Vogel v Jewish Hosp. & Med. Ctr. of Brooklyn, 73 AD2d 601 [2d Dept 1979]; Brevetti v Roth, 114 AD2d 877 [2d Dept 1985]; Stoller v Moo Young Jun, 118 AD2d 637 [2d Dept 1986]; Reid v Health Ins. Plan of Greater N.Y., 80 AD2d 830 [2d Dept 1981]; Breen v Leonard Hosp., 82 AD2d 1000 [3d Dept 1981]; Feretich v Parsons Hosp., 88 AD2d 903 [2d Dept 1982]; Zimmerman v Jamaica Hosp., 143 AD2d 86 [2d Dept 1988]; Levande v Dines, 153 AD2d 671 [2d Dept 1989]; Tiborsky v Martorella, 188 AD2d 795 [3d Dept 1992]; Fraylich v Maimonides Hosp., 251 AD2d 251 [1st Dept 1998]; Luce v State of New York, 266 AD2d 877 [4th Dept 1999]; Klapper, Outside Counsel, Chipping Away at "Anker" Doctrine, NYLJ, Sept. 18, 1996, at 1, col 1 [discussing cases]; Connors, New York Practice, Appellate Division is Confronted with HIPAA, NYLJ, Jan. 17, 2007, at 3, col 1 [same]). As described by practitioners, "defense counsel would usually serve the doctor with a trial subpoena or an authorization for medical records, attempt to speak with the doctor, and hope that the doctor would cooperate," although "treating doctors have generally been disinclined to cooperate with attorneys for either side in malpractice actions" (Moore and Gaier, Medical Malpractice, Recent Cases on Ex Parte Interviews with Treating Physicians, NYLJ, Oct. 4, 2005, at 3, col 1). The effort was seen as worth making because pretrial interviews are "essential in procuring the doctors' assistance at trial" (Moore and Gaier, Medical Malpractice, Liability for Breach of Confidentiality—Part 2, NYLJ, Dec. 5, 2006, at 3, col 1).

We mention this long-standing practice for several reasons. First, the prohibition of interviews in lieu of article 31 discovery devices originated in the trial court's decision in Anker, a medical malpractice action handed down before—and at decided odds with our reasoning in—Dillenbeck, Hoenig, Niesig and Siebert. Second, it bears emphasizing that the filing of a note of issue denotes the completion of discovery, not the occasion to launch another phase of it. While interviews may still take place post-note of issue, at that juncture in the litigation there is no longer any basis for judicial intervention to allow further pretrial proceedings absent "unusual or unanticipated circumstances" and "substantial prejudice" (22 NYCRR 202.21 [d]). As a result, if a treating physician refuses to talk with an attorney and the note of issue has already been filed, it would normally be too late to seek the physician's deposition or interrogatories as an alternative. Finally, as one commentator put it and as these appeals illustrate, the prevailing "state of affairs" in New York was thrown into considerable confusion "when the 800-pound gorilla, also known as HIPAA ... entered the arena" (Connors, supra). We now turn our attention to this statute.

B. The Impact of HIPAA on Informal Discovery of Health Care Professionals

Congress enacted HIPAA principally to increase the portability and continuity of health insurance and to simplify administrative procedures so as to reduce health care costs (see HIPAA, Pub L 104-191, 110 US Stat 1936 [1996]). The "cornerstone" of HIPAA's "administrative simplification" provisions (Pub L 104-191 §§ 261-264) was the electronic record, "believed in the 1990s to be the future key to the efficient delivery of health care" (see Kutzko, Boyer, Thoman and Scott, HIPAA in Real Time: Practical Implications of the Federal Privacy Rule, 51 Drake L Rev 403, 407 [2002-2003]). Thus, HIPAA mandated national standards for electronic medical data management. At the same time, this shift away from paper-based to systematized electronic records was perceived to threaten the confidentiality of sensitive patient information. As a result, HIPAA also authorized the Secretary of the United States Department of Health and Human Services (HHS) to promulgate standards governing disclosure of patient health information in the event Congress did not pass privacy legislation within three years of HIPAA's enactment.

When Congress did not meet its self-imposed deadline, HHS proposed and subsequently adopted a Privacy Rule (see 45 CFR parts 160, 164; see also South Carolina Med. Assn. v Thompson, 327 F3d 346 [4th Cir 2003] [discussing HIPAA and rejecting claims that Congress impermissibly delegated its legislative function to HHS]). When devising the Privacy Rule, HHS sought to "strike[ ] a balance that permits important uses of information, while protecting the privacy of people who seek care and healing"; and to fashion a scheme sufficiently "flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed" (United States Department of Health and Human Services, Office for Civil Rights, Summary of the HIPAA Privacy Rule, at 1, available at http://www.hhs.gov/ocr/ privacysummary.pdf [last revised May 2003]).^[2] In most instances, compliance with the Rule was required by April 14, 2003 (45 CFR 164.534).

The Privacy Rule forbids an organization subject to its requirements (a "covered entity") from using or disclosing an individual's health information ("protected health information") except as mandated or permitted by its provisions (45 CFR 164.502 [a]). "Covered entities" generally include health plans, health care clearinghouses and health care providers such as physicians, hospitals and HMOs (45 CFR 160.103, 164.104 [a]). "Protected health information" encompasses any individually identifiable health information held or transmitted by a covered entity in any form or medium, whether electronic, paper or oral (45 CFR 160.103).

The Privacy Rule mandates disclosure in only two situations: when an individual asks a covered entity for his or her own health information, or when the Secretary of HHS asks a covered entity for access to such information in order to enforce HIPAA (45 CFR 164.502 [a] [2]).^[3] The Rule, however, permits uses and disclosures in numerous circumstances as regulated by its provisions (45 CFR 164.502 [a] [1]). Uses and disclosures qualifying as permissive under the Privacy Rule are just that—for purposes of compliance with HIPAA, the covered entity is permitted, but not required, to use the information or make the disclosure (see 65 Fed Reg 82462, 82657 ["(N)othing in the rule requires covered entities to act on authorizations that they receive, even if those authorizations are valid. A covered entity presented with an authorization is permitted to make the disclosure authorized, but is not required to do so"]). Stated another way, a covered entity, such as a physician, who releases a patient's protected health information in a way permitted by the Privacy Rule does not violate HIPAA; however, neither the statute nor the Rule requires the physician to release this information.^[4] The permitted uses and disclosures relevant to these appeals are those made pursuant to authorization (45 CFR 164.502 [a] [1] [iv]; 164.508) and the so-called litigation exception (45 CFR 164.502 [a] [1] [vi]; 164.512 [e]).

The Privacy Rule generally provides that a covered entity may not use or disclose an individual's protected health information to third parties without a valid authorization, except as otherwise permitted or mandated under the Rule (45 CFR 164.508 [a]). An authorization must be written in plain language (45 CFR 164.508 [c] [3]); and it must contain specific "core elements and requirements," including a "specific and meaningful" description of the protected health information to be used or disclosed, the identity of those persons or classes of persons authorized to make and receive the requested use or disclosure, an expiration date or event, the individual's signature, and a statement notifying the signatory of the right to revoke the authorization in writing (45 CFR 164.508 [c] [1], [2]).

The Privacy Rule also permits covered entities to use or disclose protected health information without authorization pursuant to a court or administrative order so long as only the protected health information covered by the order is disclosed (45 CFR 164.512 [e] [1] [i]); or in response to a subpoena, discovery request or other lawful process if the entity has received satisfactory assurances that the party seeking the disclosure has made reasonable efforts to ensure that the individual has been given notice of the request, or has made reasonable efforts to secure a qualified protective order from a court or administrative tribunal (45 CFR 164.512 [e] [1] [ii]). While this litigation exception may appear to be tailored for those situations in which the protected health information is not being sought from a party to the proceedings, HHS has declared that "[t]he provisions in [section 164.512 (e)] are not intended to disrupt current practice whereby an individual who is a party to a proceeding and has put his or her medical condition at issue will not prevail without consenting to the production of his or her protected health information" (65 Fed Reg 82462, 82530).

Next, the Privacy Rule sets out a floor of federal privacy protections whereby state laws that are "contrary" to the Privacy Rule are preempted unless a specific exception applies. A state law is "contrary" to the Privacy Rule, however, only if it would be impossible for a covered entity to comply with both the state requirement and the Rule, or the former is an obstacle to accomplishing the full purposes and objectives of HIPAA's "administrative simplification" provisions (45 CFR 160.202). Moreover, if a state law mandates a disclosure, the Privacy Rule permits the disclosure under its "required by law" exception, which generally allows a covered entity to disclose protected health information without authorization where disclosure is compelled by another law (45 CFR 164.512 [a]). As one commentator has explained, the upshot of all this is to limit the potential for preemption to those situations where state law prohibits or restricts a disclosure that the Privacy Rule mandates (Cohen, Reconciling the HIPAA Privacy Rule with State Laws Regulating Ex Parte Interviews of Plaintiffs' Treating Physicians: A Guide to Performing HIPAA Preemption Analysis, 43 Hous L Rev 1091, 1123-1134 [2006]).

In addition, HHS has pointedly advised that where "there is a State provision and no comparable or analogous federal provision, or the converse is the case," there is no possibility of preemption because in the absence of anything to compare "there cannot be ... a ``contrary' requirement" and so "the stand-alone requirement—be it State or federal—is effective" (64 Fed Reg 59918, 59995). As a result, there can be no conflict between New York law and HIPAA on the subject of ex parte interviews of treating physicians because HIPAA does not address this subject. Accordingly, the Privacy Rule does not prevent this informal discovery from going forward, it merely superimposes procedural prerequisites. As a practical matter, this means that the attorney who wishes to contact an adverse party's treating physician must first obtain a valid HIPAA authorization or a court or administrative order; or must issue a subpoena, discovery request or other lawful process with satisfactory assurances relating to either notification or a qualified protective order.

In the appeals now before us, defendants forwarded to plaintiffs HIPAA-compliant authorizations permitting their treating physicians to discuss the medical condition at issue in the litigation with defense counsel. After plaintiffs declined to sign these authorizations, defendants asked the trial courts for orders compelling them to do so, and the courts granted these requests. This was entirely proper. Plaintiffs waived the physician-patient privilege as to this information when they brought suit, so there was no basis for their refusal to furnish the requested HIPAA-compliant authorizations.^[5] The waiver does not depend on the form or medium in which relevant medical information is kept or may be found: information does not fall outside the waiver merely because it is captured in the treating physician's memory rather than on paper (see generally 65 Fed Reg 82462, 82620 [explaining rationale for treating verbal communications the same as paper and electronically based information]). Of course, it bears repeating that the treating physicians remain entirely free to decide whether or not to cooperate with defense counsel. HIPAA-compliant authorizations and HIPAA court orders cannot force a health care professional to communicate with anyone; they merely signal compliance with HIPAA and the Privacy Rule as is required before any use or disclosure of protected health information may take place.

Finally, the trial court orders in Arons and Webb included stipulations not required by HIPAA and inconsistent with Niesig and Siebert—specifically, a direction for defense counsel to hand over to his adversary copies of all written statements and notations obtained from the physician during the private interviews, any audio or video recordings or transcripts, and interview memoranda or notes (excluding the attorneys' observations, impressions or analyses). Imposition of these conditions was improper.^[6]

Accordingly, the orders of the Appellate Division should be reversed, with costs, and defendants' motions to compel plaintiffs to provide the subject authorizations granted in accordance with this opinion. The certified questions should be answered in the negative.

PIGOTT, J. (dissenting).

Our holding today grants defense counsel the unprecedented ability to compel a plaintiff, who has placed his or her mental or physical condition in controversy, to execute authorizations allowing defense counsel to speak to his or her treating physicians outside the formal discovery process and without the plaintiff being present. As one commentator has noted, however, it is "beyond cavil" that "neither the machinery in CPLR Article 31 nor the applicable Uniform Rules [for New York State Trial Courts] provide for disclosure of this nature" (Connors, New York Practice, Appellate Division Is Confronted With HIPAA, NYLJ, Jan. 17, 2007, at 3, col 1). Because this issue is one that, in my view, requires legislative action and cannot be adequately addressed by judicial decree, I respectfully dissent.

Article 31 of the CPLR and section 202.17 of the Uniform Rules (22 NYCRR) furnish a comprehensive statutory and regulatory framework governing the disclosure, in all actions, of the medical information of a party who has placed his or her mental or physical condition in controversy (see CPLR 3121 [entitled "Physical or mental examination"]; 22 NYCRR 202.17 [entitled "Exchange of medical reports in personal injury and wrongful death actions"]). This scheme ensures that all parties, including the litigant whose mental or physical condition is in controversy, are fully cognizant of the medical information in the possession of the other parties. For instance, under the Uniform Rules, a party conducting a physical examination of the litigant must provide a copy of the report setting forth the examining physician's findings and conclusions to every other party to the action (22 NYCRR 202.17 [c]). Moreover, a party obtaining a copy of medical records through the use of written authorizations supplied by the litigant must "deliver a duplicate of such copy" to the party who executed the authorization (CPLR 3121 [a]). In addition, a party may be granted an order to conduct the deposition of an adverse party's treating physician "upon notice stating the circumstances or reasons such disclosure is sought or required" (see CPLR 3101 [a] [4]).

Our holding today substantially modifies this carefully crafted scheme by allowing one party to unilaterally obtain, in a manner not authorized by article 31, information about an adverse party's medical condition. CPLR 3102, entitled "Method of obtaining disclosure," clearly limits the scope of disclosure devices that may be used by a litigant to "depositions upon oral questions or without the state upon written questions, interrogatories, demands for addresses, discovery and inspection of documents or property, physical and mental examinations of persons, and requests for admission" (CPLR 3102 [a]). Upon a litigant's failure "to respond to or comply with any request, notice, interrogatory, demand, question or order under [Article 31] ... the party seeking disclosure may move to compel compliance or a response" (CPLR 3124 [emphasis supplied]). Although a litigant whose mental or physical condition is in controversy may be compelled to provide authorizations entitling the opposing party to obtain medical records (CPLR 3124; 22 NYCRR 202.17 [j]), there is simply no statutory authority "under [Article 31]" for off-the-record interviews of treating physicians. Applying the basic principle of statutory construction "expressio unius est exclusio alterius" ("the expression of one thing is the exclusion of another") (Black's Law Dictionary 581 [6th ed 1990]), it is evident that the Legislature has limited the forms of authorizations to which defendants are entitled, namely, authorizations permitting defendants to obtain only copies of plaintiffs' medical records.

Pointing to our holdings in Niesig v Team I (76 NY2d 363 [1990]) and Muriel Siebert & Co., Inc. v Intuit Inc. (8 NY3d 506 [2007]), the majority rejects plaintiffs' argument that defendants are not entitled to the authorizations they seek because "there are no statutes and no rules expressly authorizing—or forbidding—ex parte discussions with any nonparty" (majority op at 409). The majority's reliance on those cases is, in my view, misplaced. Our holdings in Niesig and Siebert focused primarily on the definition of a party for purposes of discovery. Niesig involved the narrow issue of whether counsel could, without running afoul of Code of Professional Responsibility DR 7-104 (a) (1) (22 NYCRR 1200.35 [a] [1]), conduct informal, ex parte interviews of nonmanagerial, noncontrolling employees of an opposing party who witnessed an accident (see Niesig, 76 NY2d at 369, 374-375); Siebert addressed the narrow issue of whether counsel could conduct an informal, ex parte interview of a former employee of an opposing party (see Siebert, 8 NY3d at 511-512). Neither Niesig nor Siebert involved a party's invocation of article 31 to obtain the informal interviews, nor did the parties in those cases need the assistance of the opposing party. In neither instance was the protection of medical records and information implicated.

In contrast, defendants here seek court intervention compelling plaintiffs to execute HIPAA-compliant authorizations which, in my view, takes the matter out of the realm of informal discovery and into the realm of formal disclosure, which is supervised by the trial courts (see CPLR 3104). Because trial courts are constrained to limit their supervision of disclosure to those devices delineated in article 31, it likewise follows that article 31 must provide some basis for the relief. Given the fact that the Legislature has narrowly limited a litigant's obligation to execute authorizations to those situations where an adverse party is seeking copies of medical records, and nothing more, it is my view that defendants here are not entitled to authorizations to conduct informal, ex parte interviews with the treating physicians during pretrial discovery.

In addition to permitting such interviews during pretrial discovery, our holding impermissibly allows those interviews to take place after the note of issue and certificate of readiness have been filed. Of course, the filing of those documents signifies the end of discovery and, barring a timely motion to vacate, constitutes certification by the parties that "[d]iscovery proceedings now known to be necessary [have been] completed" (22 NYCRR 202.21 [b]). Under our holding today, however, defense counsel would be permitted to obtain court-ordered, HIPAA-compliant authorizations at any time and use them at any time both prior to and after the filing of a note of issue and certificate of readiness. Although defendants refer to such informal interviews as "trial preparation," they are really nothing more than post-note of issue discovery, which is expressly prohibited by the Uniform Rules unless the party seeking the discovery can demonstrate "unusual or unanticipated circumstances develop[ed] subsequent to the filing of [the] note of issue and certificate of readiness which require additional pretrial proceedings to prevent substantial prejudice" (22 NYCRR 202.21 [d]). By the time a case has been certified as ready for trial, the defendant should have a firm grasp of the plaintiff's medical condition after deposing the plaintiff, perusing the plaintiff's medical information and defense counsel's own medical examination of plaintiff and conferring with its own expert. Therefore, such interviews as contemplated here are neither necessary nor warranted, and our holding permits circumvention of the "unusual and unanticipated circumstances" requirement of 22 NYCRR 202.21 (d).

There is no doubt that the enactment of HIPAA uncovered a practice whereby physicians who may have at one time spoken informally with defense counsel are no longer able to do so without a signed HIPAA authorization. Nonetheless, that does not mean that this Court should sanction that conduct and afford defense counsel a disclosure device that is not authorized by either article 31 or the Uniform Rules.

In Arons v Jutkowitz: Order reversed, with costs, motion to compel plaintiff to provide the subject authorizations granted in accordance with the opinion herein and certified question answered in the negative.

In Webb v New York Methodist Hosp. and Kish v Graham: Order reversed, with costs, defendants' motion to compel plaintiff to provide the subject authorizations granted in accordance with the opinion herein and certified question answered in the negative.

NOTES

[1] The dissent's emphasis on the Legislature's silence with respect to authorizations of informal ex parte interviews (dissenting op at 417-418) is, thus, unavailing. Our decisions plainly permit informal discovery, and the Legislature has not directed to the contrary. Absent such legislative direction, we decline to limit the scope of such discovery here.

[2] HHS issued its proposed Privacy Rule in November 1999 (see 64 Fed Reg 59918 [Nov. 3, 1999]), and the final Privacy Rule in December 2000 (see 65 Fed Reg 82462 [Dec. 28, 2000]). The proposed rule and its explanatory text fill over 150 pages of the Federal Register; in just under 350 pages, HHS in the final rule reviewed the changes made to its original proposal, which provoked an astounding 52,000 public comments (see 67 Fed Reg 53182 [Aug. 14, 2002]). While the Privacy Rule was modified in 2002, none of the revisions are relevant to these appeals.

[3] HHS's Office for Civil Rights (OCR) is responsible for enforcing the Privacy Rule. OCR carries out this responsibility by investigating complaints against covered entities, conducting compliance reviews and performing education and outreach to foster compliance (see generally 45 CFR part 160, subparts C, D, E).

[4] Of course, the physician is not entirely free in this regard because some other law might compel the information's release.

[5] The dissent reasons that defendants' requests for court orders compelling plaintiffs to execute HIPAA-compliant authorizations "take[ ] the matter out of the realm of informal discovery" (dissenting op at 418). But this concern is tempered by the fact that plaintiffs now know that they cannot legitimately refuse to sign these HIPAA-compliant authorizations. Accordingly, there should be no need for future judicial intervention to require them to do so.

[6] We take no issue with those portions of the Arons and Kish orders that required defense counsel to identify themselves and their interest, to limit their inquiries to the condition at issue, and to advise physicians that they need not comply with the request for an interview (see supra at 410). We believe that the execution of a valid authorization and the fact that the physician, under HIPAA, is permitted, but not required, to grant the interview will address these concerns in the future.