Blanket Medical Releases and Client Privacy: The Dangers of Releasing HIPAA into the Wild
By John M. Dunn and Daniel W. Crunkleton

The next thing you know, you’re in depositions where seemingly irrelevant (yet embarrassing) medical history is brought up. You try objecting, to prevent opposing counsel from grilling your client about the time 30 years ago when she was 12 years old and had to be hospitalized following a suicide attempt. Where are you going with this? you demand to know. Opposing counsel smugly responds, “You’re claiming emotional distress, I’m entitled to explore this matter.” The problem is, you have no idea where this information came from, whether it is correct or whether there may be more.

Now you’re in trial in front of a jury.  All of a sudden, opposing counsel is using this seemingly irrelevant evidence at trial to transform your client from being the victim of a physical injury into a hypersensitive hypochondriac who has never seen a day without suffering emotional distress. When all is said and done, your client’s medical history, not the actions of the defendant or your own legal arguments have taken center stage, and your chances of recovery are diminished. Little did you know, when you permitted your client to sign that innocent looking little medical waiver, that you had sown the seed for your client’s ultimate embarrassment and given opposing counsel free range to divert the attention to your client’s (perhaps embarrassing) medical history.

One of the hazards to releasing information protected by HIPAA is the implication that a complete waiver of one’s medical privacy has been waived. Blindly executing such a blanket release exposes all of the information that may be contained in your client’s medical history to ex parte scrutiny by opposing counsel. While it is true that executing such a release relieves you of some of the burdens often associated with document production, as will be discussed below, the hazards of such a release - or even a more limited release, may outweigh any benefit. Additionally, alternative methods for producing medical documents which will both fulfill a party’s obligation of production during discovery, while simultaneously protecting a client’s medical privacy should always be considered.

HIPAA: Overview and Scope

Barring any written release, medical records are confidential 1. The Health Insurance Portability and Accountability Act (HIPAA) 2 is a federal law that guarantees this medical privacy, while at the same time, providing a mechanism for obtaining relevant information needed by third parties. The codification of HIPAA has its origins in doctor-patient privilege, codified in Oklahoma at 12 O.S.2001 § 2503(B)(3) and thereby incorporated into the federal system by Federal Rule of Evidence 501.  Like other privileges, though, medical privacy is not absolute and may be considered waived (at least partially) upon the initiation of a lawsuit in which one’s mental or medical condition is an element of the claim or defense. 3 However, too often a plaintiff’s attorney will blindly execute a blanket HIPAA release when requested to do so by opposing counsel, not realizing the effect either on his lawsuit or on his client’s privacy.

Specifically, HIPAA prevents the disclosure of medical records from certain “covered entities.” 4  Under HIPAA, there are three entities which are prevented from disclosing medical information without permission: health plans, healthcare providers and healthcare clearing houses. 5  HIPAA then permits the release of protected medical information only under specific circumstances: judicial order or patient release (a so-called “HIPAA release”). When a judicial order is used, it must specifically require a covered entity to release a specific piece of information. 6 The second possibility is a patient release. Under federal regulations, such a release must meet the following elements: 7

1. The release must be voluntarily given.
2. It must specifically describe the information to be disclosed.
3. It must provide the subject of the disclosure.
4. It must provide name of the person making the disclosure.
5. It must give the purpose of the disclosure.
6. The expiration of the release must be specific; and
7. It must have the signature and date of the person making the release.

Additionally, the HIPAA release may be subject to re-disclosure to third parties, 8 under the theory that once a release has been executed, any privacy interest has been waived. 9  Such a possibility is important to plaintiffs in litigation because an opposing counsel is not a “covered entity” under 45 C.F.R. §§ 160.103 or 164.501. In other words, once a blanket HIPAA release has been properly executed and delivered to the opposing party, that party is legally able to share this information to third parties without further notice to the disclosing party.

The Legal Effect of Placing Medical or Psychological Health at Issue

Although it is true that when a party puts his mental or medical health at issue, it becomes a proper subject of discovery, it is not true that blanket releases are mandatory 10 and plaintiffs should be cautious before executing them. The Oklahoma Supreme Court said in Nitzel v. Jackson 11 (and several times since 12), that there is no requirement that a blanket release be given because the privacy interest has only been waived “to the extent of the condition claimed to have been caused by the negligence of the tortfeasor.” 13, 14 It is important to note that the Nitzel court did not say that a defendant in a personal injury case is entitled to a medical release; only that the plaintiff in such a case has waived privilege as it relates to the harms caused by the tortfeasor. In other words, the defendant is not entitled to a “fishing expedition” just because a suit has been initiated. A defendant is only entitled to the information concerning the injury claimed. By refusing to execute a blanket release, opposing counsel could attempt either to secure a court order or to narrow the scope of request. Even if the scope is sufficiently narrowed, plaintiff can escape the risks of medical release, by providing the requested documents. If defendant believes other documents exist, it can request the court to enter an order releasing that information.

Recently, however, the Oklahoma Supreme Court limited these options even further. In Holmes v. Nightengale , 15 the court ruled that an order which “permit[s], rather than mandating [a release] ... does not contravene HIPAA’s confidentiality requirement.” 16 In other words, Oklahoma state law does not overrule the federal HIPAA requirements, even when a claimant’s medical condition is in issue. Any court order must require the release of a specific document and does not authorize a blanket release nor does it merely allow for the release. Therefore, under Oklahoma law, the trial court appears to be without authority to force a party to sign a waiver of any kind. 17, 18 Furthermore, since HIPAA releases must be voluntary under federal law anyway, 19 it seems unlikely that a waiver obtained at the point of a gavel would be considered “voluntary” and would therefore be ineffective.

Obtaining Documents With or Without a Release

There are three traditional methods of obtaining documents, namely a request for production, an informal, ex parte request of a third party and subpoena dues tecum . In the case of a request for production, the party seeking the document asks for it from the opposing party. That party can produce the documents that it feels is responsive to the request and object to further production. In the case of a subpoena, the party seeking to compel a third party to produce the documents must provide notice to the parties involved in the litigation. Those parties then have the opportunity to object or challenge. Further, once the documents are received, the receiving party must disclose the receipt of those documents to the opposing counsel. The third method exactly describes the use of a HIPAA release – an informal letter addressed to a covered entity requesting the documents and the patient’s release. When confronted with those two items, the entity will normally simply provide the requested information without further inquiry. However, there is no statutory or case law requirement that a party receiving information from an informal request must disclose it to the opposite party. Moreover, a party need not rely on the discovery process for the release of medical documents, however, compliance with this kind of request cannot be compelled by the court. 20 Therefore, it would seem that this puts the disclosing party in the position of not knowing which documents have been disclosed. The receiving party becomes the “gate keeper,” by being able to determine which documents are or are not relevant to the present case.

Conclusions

Attorneys should be wary of advising their clients to sign a blanket HIPAA release, and should only do so in very specific circumstances. Neither federal nor Oklahoma law require that they be executed, and the Oklahoma Supreme Court has specifically held that trial courts do not have the authority to order one. The filing of a suit in which a medical condition is at issue only requires the disclosure of that information that is relevant to the case. If a blanket HIPAA release is granted, it in essence waives doctor-client privilege and opens the floodgate of potentially embarrassing information to be introduced into the case, explored in depositions and potentially argued at trial. Even if it is ultimately held to be irrelevant by the court, the fact that it is even mentioned is – at minimum – distracting to a jury and – at most – potentially damaging to your possibility of recovery.

It is true that blanket HIPAA releases could be more convenient to a busy attorney. Indeed, once the blanket release is delivered, the opposing counsel could get any desired document himself. As a result, if an opposing counsel were to seek a motion to compel discovery, there would be little room for arguing that the claimant has been less than forthcoming – the blanket HIPAA release is the most access to documents that could possibly be given. However, attorneys should also be sensitive to the privacy interests of their clients. A client may, in fact, have episodes in their past that they would prefer to forget about – or at least not want to see entered into the public record. As such, an attorney in this situation should make certain that these facts – if indeed irrelevant – are given the degree of protection that the law allows.

1. 12 O.S. § 2503 (physicians and psychotherapists), 43A O.S. §1-109 (mental health), 59 O.S. § 1261.6 (social workers).
2. 42 U.S.C. § 1320d et seq.
3. 76 O.S.2001 § 19(B). See also 12 O.S. § 2503(D)(3).
4. Covered Entity Chart, Dept. of Health & Human Services, available at www.cms.hhs.gov/HIPAAGenInfo/Downloads/CoveredEntitycharts.pdf.
5. 45 C.F.R. 160.103(B)(3).
6. Holmes v. Nightengale, 2007 OK 15, ¶ 2, ___P.3d___.
7. 45 C.F.R. § 164.508.
8. 45 C.F.R. § 164.508(c)(2)(iii)
9. Robinson v. Lane , 1971 OK 9 at ¶ 11, 480 P.2d 620 specifically stated this in the case of testimony (“In our opinion, when a litigant testifies concerning a particular ailment and its treatment, he has removed the reasons for the [doctor-patient] privilege. By his own conduct, he had made known to a jury and the public the ailment or disability he is suffering.”) ( emphasis added ).
10. Higginbotham v. Jackson , 1994 OK 8, ¶ 0, 869 P.2d 319. (“There is no statutory discovery method contained in the Oklahoma Discovery Code that requires a plaintiff in a personal injury lawsuit to execute in favor of the defendant a general medical authorization entitling defendant to obtain all of plaintiff’s medical records.”)
11. 1994 OK 49, 879 P.2d 1222.
12. E.g., Ellis v. Gurich, 2003 OK 47, 73 P.3d 860 and Brown v. Blevins , 1998 OK 104, 986 P.2d 1218.
13. Nitzel at ¶ 1, 879 P.2d at 1223. Also, Brown at ¶ 1, 968 P.2d at 1218.
14. Ellis v. Gurich , 2003 OK 47, ¶ 2(1), 73 P.3d 860: “... the filing of a wrongful death action is not ipso facto a waiver of the psychotherapist-patient privilege held by Plaintiff pursuant to 12 O.S.2001 § 2503.”
15. Holmes v. Nightengale , 2007 OK 15, ___P.3d___.
16. Holmes at ¶ 2, ___P.3d at ___.
17. Johnson v. Dist. Ct. Okla. County, 1987 OK 47 at ¶ 5, 738 P.2d 151 at 153: “The respondent district’s order compelling discovery by ex parte communication was in excess of its authority...”
18. Seaberg v. Lockard , 1990 OK 40, ¶ 3, 800 P.2d 230. (“Although the law sanctions voluntary ex parte communications with physicians and other health providers where no legal privilege is deemed to exist, judicial authority may not be exercised to facilitate or impede such informal communications.) (emphasis in original).
19. Supra note.
20. Johnson at ¶ 5.

About The Authors

John M. Dunn is a graduate of the University of Tulsa College of Law. He is currently the principal member of the Law Offices of John M. Dunn PLLC and practices in the areas of civil, criminal and constitutional law with a special emphasis on litigated matters.

Daniel W. Crunkleton is an assistant professor of chemical engineering at the University of Tulsa. He is also a second-year law student at the University of Tulsa. His legal interests are in the areas of legal issues of concern to emerging technologies, including litigation and intellectual property.

Blanket Medical Releases and Client Privacy: The Dangers of Releasing HIPAA into the Wild
Published 78 OBJ 1951 (August 4, 2007)