Discovery of Medical Records in Oklahoma State Courts
By Charles W. Adams
Nowadays, medical records are maintained in electronic format, and the availability of electronic medical records presents new challenges and opportunities for discovery. The Oklahoma Discovery Code authorizes discovery of all information that is relevant to the subject matter of a pending action, provided that it is not privileged.
The physician-patient and psychotherapist-patient privileges found in Okla. Stat. tit.12, §2503 protect the privacy of patients by authorizing patients to refuse to disclose and prevent anyone else from disclosing confidential communications made for the purpose of their diagnosis or treatment. While the statutory privilege appears to be very broad, there is an exception in the statute that authorizes an adverse party of a patient to use statutory discovery to obtain information relevant to a patient’s medical condition when the patient is relying upon the medical condition as an element of a claim or defense of the patient. The exception nearly swallows the physician-patient and psychotherapist-patient privileges so that the privileges will not bar discovery in most cases.
The procedures for discovery of medical information may also be affected by HIPAA, the federal Health Insurance Portability and Accountability Act. In contrast to the physician-patient and psychotherapist-patient privileges, which cover only confidential communications, HIPAA regulations prohibit disclosure of protected health information. Like the physician-patient and psychotherapist-patient privileges, however, HIPAA regulations provide exceptions for discovery in connection with judicial proceedings. As a result of the exceptions to both the physician-patient and psychotherapist-patient privileges and HIPAA, patient medical records may be obtained for litigation purposes in most cases, but the appropriate discovery procedures must be followed to obtain them.
Discovery of medical records is also affected in particular cases by the privilege for peer review information under Okla. Stat. tit.63, §1-1709.1. Peer review information refers to the records generated during the process of review of the competence or professional conduct of a health care professional by a health care facility or a county medical society, and it is not subject to discovery except to show that the health care facility was negligent in permitting the health care professional to provide health care services to the patient.
DISCOVERY OF ELECTRONIC MEDICAL RECORDS
Hospitals and most doctors’ offices now store all patient data in electronic format on computer servers and the advent of this technology has given rise to a new source of discoverable information in litigation. Electronic medical records (EMR) contain more data than traditional paper records, and often the medical record produced to the patient before the filing of a case or to their counsel in litigation is less than the entirety of data contained in the EMR. In addition, federal regulations now require the creation of audit logs for electronic health information to record the times when it was created, modified, accessed or deleted, and the identity of the person who performed these actions.1
The use of EMR has expanded the amount of information available for discovery of medical records in litigation. For example, if a patient is being monitored with heart monitoring equipment during a hospital admission, the data from the monitor is capturing real-time data from various monitoring lines. The data may be continuously recording and placed in the EMR but the print command may be set to selectively print data recorded once every 15 minutes or once every hour and may not print all data captured from all monitoring lines. As a result, the printed record may lack significant detail about the patient’s medical condition.
Under Okla. Stat. tit.76, §19(A)(1), a patient is “entitled, upon request, to obtain access to the information contained in the patient’s medical records, including any x-ray or other photograph or image.”2 Since the statute does not differentiate between a paper record and electronically stored information, §19(A)(1) should permit a patient to gain access to all of the patient’s “medical records” without limitation, including EMR. Section 19(A)(2) specifies amounts that health care providers may charge for providing EMR to their patients, as well as to attorneys, insurance companies, and in response to subpoenas for them.3
THE PHYSICIAN-PATIENT AND PSYCHOTHERAPIST-PATIENT PRIVILEGES
Okla. Stat. tit. 12, §2503 provides for physician-patient and psychotherapist-patient privileges. These privileges extend to confidential communications between the patient and the patient’s physician or psychotherapist, as well as other persons who participate in diagnosis or treatment of the patient under the direction of the physician or psychotherapist, such as members of the patient’s family. The confidential communications must be made for the purpose of diagnosis or treatment of the patient’s physical, mental or emotional condition, and they must not be intended to be disclosed to third persons, other than those who are participating in the patient’s diagnosis or treatment under the direction of the physician or psychotherapist.
The privileges are limited to confidential communications, as opposed to observations of a patient by medical personnel. For example, the Oklahoma Court of Criminal Appeals held in Snow v. State4 that testimony of paramedics, an emergency room nurse and a physician who treated a patient after a traffic accident, concerning the odor of alcohol on his breath and his behavior at the accident scene and at the hospital did not come within the physician-patient privilege because the behavior occurred in public view and therefore was not confidential. The evidence subcommittee’s note to Okla. Stat. tit.12, §2503 suggests that the statute “applies only to communications,” as opposed to “information gained through observation or examination.” Thus, the physician-patient privilege would appear not to cover tests and observations by medical personnel, unless they involved confidential communications between the patient and a physician.5 However, confidential communications between the patient’s physician and other persons participating in the diagnosis or treatment are covered by §2503, and therefore, the patient’s medical chart would appear to be protected by the physician-patient privilege, since it is a means of communicating between persons who are participating in the patient’s diagnosis or treatment.
Although there are several exceptions to the physician-patient and psychotherapist-patient privileges in §2503, the most significant exception is in §2503(D)(3) for communications “relevant to the physical, mental or emotional condition of the patient in any proceeding in which the patient relies upon that condition as an element of the patient’s claim or defense.”6 The physician-patient and psychotherapist-patient privileges for these communications are “qualified to the extent that an adverse party in the proceeding may obtain relevant information regarding the condition by statutory discovery.”7 While this exception is quite broad, it does not cover cases where the patient’s medical condition is relevant to the claim or defense of another party. Examples could include a plaintiff seeking medical records of a defendant doctor’s other patients in a medical malpractice case,8 or where a plaintiff is seeking medical records of an adverse witness for purposes of impeachment. If the patient dies, however, the exception to the physician-patient and psychotherapist-patient privileges extends to cases where any party relies on the patient’s medical condition as an element of that party’s claim or defense.9
Another limitation on the physician-patient and psychotherapist-patient privileges is found in Okla. Stat. tit.12, §2503(E), which states: “The testimonial privilege created pursuant to this section does not make communications confidential where state and federal privacy law would otherwise permit disclosure.” This provision was added in 2009, and its purpose and meaning are unclear. While the psychotherapist-patient privilege is recognized in the federal courts under Fed. R. Evid. 501,10 the physician-patient privilege is not.11 If taken literally, the provision might be interpreted to do away with the physician-patient privilege com-pletely, but that interpretation would be in conflict with the rest of §2503.
The physician-patient and psychotherapist-patient privileges may also be waived under the recently adopted Okla. Stat. tit. 12, §19.1.12 This section re-quires a plaintiff in a civil action for negligence to provide the defendant within 10 days of the defendant’s request with an authorization form “for the release of any and all relevant records related to the plaintiff for a period commencing five years prior to the incident that is at issue in the civil action for negligence.”13 The sanction provided in the statute for failure of a plaintiff to provide the authorization form is dismissal without prejudice to the refiling of the action, unless good cause is shown for the failure.14 A statement requesting the health care provider to notify the plaintiff’s counsel of any meetings scheduled with defense counsel may be added to the authorization form, not only to address concerns regarding ex parte communications between the health care provider and defense counsel, but also to provide protection to the health care provider as well as to the patient.
Previously, this provision was in Section 1-1708.1E of Title 63, which applied only to medical liability actions, and a similar provision was in Section 19 of Title 12, which applied only to professional negligence actions. The Oklahoma Supreme Court declared the affidavit of merit requirements15 in Section 1-1708.1E and Section 19 to be unconstitutional as a special law regulating the practice in judicial proceedings under Art. 5, §46 of the Oklahoma Constitution, and an unconstitutional burden on access to courts in violation of Art. 2, §6 of the Oklahoma Constitution, in Zeier v. Zimmer16 and Wall v. Marouk.17 Then the Oklahoma Legislature repealed Section 1-1708.1E in 2009, and adopted Section 19 in its place, but during the 2013 extraordinary legislative session, it repealed Section 19 and adopted Section 19.1 in its place. In contrast to the prior affidavit of merit requirements, which were limited to professional negligence and medical liability actions, the new affidavit of merit requirement applies to any civil action for negligence in which the plaintiff is required to present testimony of an expert witness to establish breach of the relevant standard of care and that the breach resulted in harm to the plaintiff. Because of the similarity of the latest version of the affidavit of merit requirement to the earlier versions, it is uncertain whether the latest version will withstand constitutional scrutiny or will suffer the same fate as its prior versions.
In contrast to the affidavit of merit provision in Section 19.1, the language of the release of medical records provision is not expressly limited to actions in which expert testimony to establish a breach of the relevant standard of care is required, and therefore, it may apply to any negligence action.18 On the other hand, the provision does require the plaintiff to provide the defendant with a copy of the written opinion of the qualified expert referred to in the affidavit of merit, as well as the release of medical records;19 so, this provision might be construed to be limited to actions in which expert testimony to establish a breach of the relevant standard of care is required. However, if the provision was construed to be limited to actions in which expert testimony to establish a breach of the relevant standard of care is required, it would be subject to being challenged on constitutional grounds as a special law.
An additional provision relating to waiver of the physician-patient and psychotherapist-patient privileges is found in Section 19 of Title 76.20 Section 19(B) provides that a person who has placed a patient’s physical or medical condition in issue in a personal injury or wrongful death action against a health care professional or facility is deemed to have waived any privilege concerning a communication with a health care provider or any knowledge obtained by the health care provider concerning the patient’s physical or medical condition. Despite the broad language of the statute, which appears to be a complete waiver of the physician-patient privilege,21 the Oklahoma Supreme Court held in Holmes v. Nightingale22 that discovery of a party’s medical records was restricted “to materials relevant to any issue in the malpractice action or to the injury or death in litigation.”23
Another issue involving discovery that has arisen over the years is whether a defense attorney should be allowed to consult informally with a patient’s physicians, rather than having to pursue formal discovery.24 The Oklahoma Supreme Court has ruled in a line of cases25 that judicial authority may not be used to either facilitate or impede ex parte communications between defense counsel and a plaintiff’s health care providers, even though an exception to the physician-patient or psychotherapist-patient privileges may apply because the plaintiff’s medical condition is in issue. Whether a plaintiff’s health care provider may voluntarily consult with defense counsel will depend on whether the requirements for disclosure of health care information under HIPAA have been satisfied.26 These requirements are discussed in the next section of this article.
HIPAA was adopted nearly 20 years ago in part to expedite electronic submission of medical claims in order to improve the operation of the health care system and reduce administrative costs.27 Since the implementation of HIPAA would involve maintaining health care information on computer systems, the statute included provisions for the adoption of standards to protect the security and integrity of the information as well as its confidentiality.28 The regulations issued by the Department of Health and Human Services to comply with HIPAA are found at 45 C.F.R. §§164.102-164.534, and the regulations containing the privacy standards are at 45 C.F.R. §§164.500-164.534.
In contrast to the physician-patient and psychotherapist-patient privileges which cover “confidential communications,” the HIPAA regulations prohibit the use or disclosure of “protected health information” by health care providers, except as provided in the regulations.29 The first method for obtaining protected information from a health care provider is pursuant to a written authorization from the patient.30 The regulations require the patient authorization to include the following in plain language: 1) a description of the information to be disclosed; 2) the person whom the patient authorizes to make the disclosure; 3) the person to whom the information is to be disclosed; 4) a description of the purpose of the disclosure; 5) an expiration date; 6) the patient’s signature; and 7) notice to the patient of the right to revoke the authorization.31
The patient’s attorney may use the written authorization to obtain the patient’s medical records. The attorney for the defendant in a civil action for negligence may also request a plaintiff to provide a written authorization for the plaintiff’s medical records under Okla. Stat. tit.12, §19.1(C).
In addition, the HIPAA regulations provide for disclosure of protected health information in the course of any judicial or administrative proceeding.32 Thus, HIPAA does not bar disclosure of protected health information in court proceedings if the appropriate procedures are followed. There are two methods for obtaining protected health information in judicial or administrative proceedings provided by 45 C.F.R. §164.512(e). The first is an order of a court or administrative tribunal.33 In Holmes v. Nightingale34 the Oklahoma Supreme Court decided that it was permissible under HIPAA for a trial court order to authorize ex parte oral communications by a health care provider with defense counsel. However, while the trial court order could allow the health care provider to engage in the ex parte communications, it could not require the health care provider to do so.35
The second method for obtaining protected health information is a subpoena or discovery request to the health care provider. The subpoena or discovery request must be accompanied by a written statement of satisfactory assurance to the health care provider that the party seeking protected health information has made reasonable efforts either to ensure that the patient has been given notice of the request and an opportunity to object,36 or to secure a qualified protective order.37
The satisfactory assurance to the health care provider of notice to the patient may be in the form of a written statement from the attorney who is seeking the protected health care information that: 1) the attorney has made a good faith attempt to provide notice to the patient that would permit the patient to raise objections to the subpoena or discovery request; and 2) the time for the patient to raise objections has passed, and either the patient did not object, or all objections were resolved by the court or administrative tribunal consistently with the subpoena or discovery request.38 The satisfactory assurance of reasonable efforts to secure a protective order may be in the form of a written statement from the attorney who is seeking the protected health care information that either the attorney has requested a qualified protective or-der from the court, or the parties to the action have agreed to a qualified protective order. The qualified protective order must prohibit the parties from using or disclosing the protected health care information for any purpose other than the litigation and require the return or destruction of the protected health care information after the litigation.39
A health care provider may be subject to substantial criminal sanctions under HIPAA for wrongful disclosure of individually identifiable health information.40 Accordingly, it is advisable for a health care provider to decline requests to disclose protected health information if the above procedures have not been followed.41
PEER REVIEW PRIVILEGE
Oklahoma’s peer review privilege may bar discovery of medical information that may be critical in medical malpractice cases unless the plaintiff asserts a claim for corporate negligence or negligent credentialing under Strubhart v. Perry Memorial Hospital Trust Authority.42 The peer review privilege is found at Okla. Stat. tit. 63, §1-1709.1, which provides that all records generated during the course of a peer review process to evaluate the competence or professional conduct of a health care professional are subject to the privilege, except as otherwise provided in the statute. Records and factual statements regarding a patient’s health care that were generated outside the peer review process, patient medical records, incident reports, and the identity of individuals having personal knowledge of a patient’s health care are not included within the peer review privilege.43 However, factual statements regarding a patient’s health care that were presented during a peer review process are not subject to discovery in a medical malpractice action.44
If a patient alleges that a health care facility was independently negligent for permitting a health care professional to provide health care services, the health care professional’s application for staff privileges and the results of any peer review process prior to the alleged negligence are subject to discovery.45 The Oklahoma Supreme Court recognized the doctrine of independent corporate negligence or responsibility in Strubhart v. Perry Memorial Hospital Trust Authority,46 where it imposed a duty upon hospitals to “ensure that 1) only competent physicians are granted staff privileges; and 2) once staff privileges have been granted to a competent physician, the hospital must take reasonable steps to ensure patient safety when it knows or should know that a staff physician has engaged in a pattern of incompetent behavior.”47 Section 1-1709.1(D)(1) provides that “credentialing and recredentialing data, and the recommendations made and actions taken as a result of any peer review process utilized by such health care facility regarding the health care professional prior to the date of the alleged negligence shall be subject to discovery pursuant to the Oklahoma Discovery Code.”48
While credentialing or recredentialing data are classified as peer review information, which is not discoverable in connection with a claim against a health care professional, credentialing or recredentialing data are discoverable in connection with a claim for independent corporate negligence against a health care facility. Accordingly, a plaintiff in a medical malpractice action against a staff physician who wishes to obtain this information from a health care facility should assert a claim for independent corporate negligence against the health care facility, alleging in good faith either that the staff physician was not competent when granted staff privileges, or that the health care facility knew or should have known that the staff physician had engaged in a pattern of incompetent behavior.
There are a variety of Oklahoma and federal statutes that protect the privacy of patients. The physician-patient and psychotherapist-patient privileges in the Oklahoma statutes authorize patients to refuse to disclose and prevent other persons from disclosing confidential communications made for the purpose of their diagnosis or treatment. The federal HIPAA law and its accompanying regulations prohibit health care providers from disclosing protected health information of patients. Nevertheless, discovery procedures may be used to obtain medical records in most cases if they are relevant to the subject matter of the action because of exceptions to the physician-patient and psychotherapist-patient privileges and the HIPAA regulations. The appropriate procedures must be followed to obtain the medical records, however, and there are some limited circumstances in which discovery will not be allowed. Finally, optimizing production of electronic medical records requires familiarity with how they are stored in the hospital or physician’s office and knowledge of the changing legal landscape regarding electronic discovery.
1. See 45 C.F.R. §170.210(b), (e). See generally Jennifer Keel, “Follow the Audit Trail,” Trial 28 (May 2014) (discussing discovery of audit trails for electronic health information).
2. Okla. Stat. tit.76, §19(A)(1) (Supp. 2013).
3. Id. §19(A)(2).
4. 1987 OK CR 228, ¶¶8-11, 744 P.2d 980, 981-82.
5. See Oxford v. Hamilton, 297 Ark. 512, 763 S.W. 2d 83 (1989) (results of blood alcohol test ordered by a treating physician were not covered by the physician-patient privilege because the test was not a confidential communication).
6. Okla. Stat. tit.12, §2503(D)(3) (2011).
8. Cf. Isidore Steiner, DPM, PC v. Bonanni, 292 Mich.App. 265, 267, 807 N.W.2d 902, 07-08 (2011) (nonparty patients did not waive physician-patient privilege by putting their medical condition in issue).
9. Okla. Stat. tit.12, §2503(D)(3) (2011).
10. Jaffee v. Redmond, 518 U.S. 1, 15 (1996).
11. See United States v. Bercier, 848 F.2d 917 (8th Cir. 1988) (“federal courts do not recognize the physician-patient privilege in federal criminal proceedings”).
12. Okla. Stat. tit.12, §19.1(C)(1)(b) (Supp. 2013).
14. Id. §19.1(C)(2).
15. The affidavit of merit provisions required a plaintiff to attach an affidavit to the petition that the plaintiff has consulted with qualified experts who reviewed the case and provided a written opinion that the claim was meritorious and based on good cause.
16. 2006 OK 98, 152 P.3d 861.
17. 2013 OK 36, 302 P.3d 775.
18. Okla. Stat. tit.12, §19.1(C)(1) (Supp. 2013).
19. Id. §19.1(C)(1(a).
20. Okla. Stat. tit.76, §19 (2011).
21. See Johnson v. District Court, 1987 OK 47, ¶5, 738 P.2d 151, 153 (“Title 76 O.S.Supp. 1985 §19 (B) does provide for a complete waiver of the patient/physician privilege in a medical malpractice action as opposed to the qualification of the evidentiary privilege under 12 O.S. 1981 §2503 (D)(3), in other cases where a physical, mental or emotional condition of a patient is raised as an element of a claim or a defense.”).
22. 2007 OK 15, 158 P.3d 1039.
23. Id. at ¶25,158 P.3d at 1046.
24. See Kelley C. Callahan, “Ex Parte Interviews With Treating Doctors in Oklahoma,” 63 OBJ 891 (1992) (“[E]x parte contacts with treating doctors [is] one of the most hotly contested issues between the plaintiff and defense bars, and a matter of no small interest to the medical community.”)
25. Holmes v. Nightingale, 2007 OK 15, ¶18, 158 P.3d 1039, 1045; Seaberg v. Lockard, 1990 OK 40, ¶3, 800 P.2d 230, 231-32; Johnson v. District Court, 1987 OK 47, ¶5, 738 P.2d 151, 153.
26. For recent discussions of ex parte interviews with defense counsel in other jurisdictions, see Whitney Boshers Hayes, “Physician-Patient Confidentiality in Health care Liability Actions, HIPAA’s Preemption of Ex Parte Interviews With Treating Physicians Through the Obstacle Test,” 44 U. Mem. L. Rev. 97 (2013); Natalie Theresa Johnston, Note, “Ex Parte Communications: Informal Discovery That HIPAA May Formally Eliminate,” 37 Am. J. Trial Advoc. 177 (2013).
27. See 42 U.S.C. §1320d-2(a) (Supp. 2012). See generally Teresa Meinders Burkett, “HIPAA Rules All Lawyers Should Know,” 78 OBJ 1943 (2007).
28. 42 U.S.C.§1320d-2(d) (Supp. 2012).
29. 45 C.F.R. §164.502(a).
30. Id. §164.508.
31. Id. §164.508(c). For a form for a written authorization that satisfies these requirements, see Charles W. Adams & Daniel Boudreau, Vernon’s Oklahoma Forms 2nd Civil Procedure §6.151 (Supp. 2013).
32. See 45 C.F.R. §164.512(e).
33. Id. §164.512(e)(i). For forms for a motion to authorize disclosure of protected health information and a court order for release of protected health information, see Adams & Boudreau, supra note 31, §§6.152, 6.153.
34. 2007 OK 15, 158 P.3d 1039.
35. Id. ¶18, 158 P.3d at 1045.
36. See 45 C.F.R. §164.512(e)(1)(ii)(A).
37. See 45 C.F.R. §164.512(e)(1)(ii)(B).
38. Id. §164.512(e)(1)(iii). For forms for a subpoena duces tecum to produce documents or other things (attendance of witness not required), a written statement of satisfactory assurance of notice to patient, and a notice to patient of intent to discover protected health information, see Adams & Boudreau, supra note 31, §§6.154 - 6.156.
39. Id. §164.512(e)(1)(iv). For forms for a written statement of satisfactory assurance of reasonable efforts to secure a qualified protective order, a motion for a qualified protective order, and an agreed qualified protective order, see Adams & Boudreau, supra note 31, §§6.157 - 6.159.
40. See 42 U.S.C. §1320d-6 (Supp. 2012).
41. For a form for a letter from an attorney for a health care provider regarding a failure to comply with HIPAA, see Adams & Boudreau, supra note 31, §6.160.
42. 1995 OK 10, 903 P.2d 263.
43. Okla. Stat. tit.63, §1-1709.1(A)(5) (Supp. 2013).
44. Id. §1-1709.1(C).
45. Id. §1-1709.1(C).
46. 1995 OK 10, 903 P.2d 263.
47. Id. at ¶37, 903 P.2d at 276.
48. Okla. Stat. tit.63, §1-1709.1(D)(1) (Supp. 2013).
ABOUT THE AUTHOR
Charles W. Adams has been a professor at the TU College of Law since 1979, where he teaches civil procedure and evidence. He has been a member of the OBA Civil Procedure Committee since 1983, serving as chairman from 1987-1989 and 1994-2001. He co-drafted much of the Oklahoma Pleading Code and its Commentary and co-authored Civil Procedure of Vernon’s Oklahoma Forms, the Oklahoma Discovery Practice Manual, Oklahoma Lien Laws and Oklahoma Civil Pretrial Procedure.
Originally published in the Oklahoma Bar Journal - Oct. 4, 2014 - Vol. 85, No.26