HIPAA: Michigan Supreme Court Examing Preemption, Confidentiality and Ex Parte Interview of Treating Physicians in Medical Liability Litigation

The AMANews reports that the Michigan Supreme Court is examining whether the Health Insurance Portability and Accountability Act of 1996 (HIPAA) preempts state law to allow a defendant physician in a medical liability case to interview the plaintiff/patient's other treating physicians.

The history and docket information on the case before the Michigan Supreme Court, Andrea L. Holman v. Mark Rasak, SCt Case Number 137993, can be found via search here. Oral arguments were held on November 3, 2009. The Michigan Supreme Court provides a background summary of the case along with links to the briefs filed by the parties, including Amicus Curiae Briefs filed by the Michigan Association for Justice, Michigan Defense Trial Counsel, Michigan Health and Hospital Association, Michigan State Medical Society and ProAssurance Casualty Company and American Physicians Assurance Corporation.

The case involves a defendant physician who sought to interview the treating physicians, but the plaintiff/patient refused to waive her confidentiality rights under HIPAA. Plaintiff signed a HIPAA Authorization releasing the medical records but refused to provide a release for "oral communications." Defendant physician then sought a protective order to permit the ex parte interviews of the treating physicians but the circuit court denied the motion.

The circuit court concluded that the HIPAA provisions relative to the protective order only pertain to documentary evidence and that HIPAA does not authorize ex parte oral interviews.

On appeal the State of Michigan Court of Appeals in Andrea L. Holman v. Mark Rasak, D.O. ruling on November 18, 2008, reversed the circuit court's order denying the defendant physician's motion for a protective order to allow him to conduct ex parte interviews with the plaintiff/patient's treating physicians. The court held that HIPAA supersedes Michigan law to the extent that its protections and requirements are more stringent than those provided by stat law. The court held that the defendants may conduct an ex parte oral interview if a qualified protective order, consistent with 45 CFR 164.512(e)(1), is first put in place.

This will be an interesting ruling to watch. Stay tuned!

More of PIPEDA and litigation: Goldberg v. St. John

PIPEDA made a brief appearance in an Ontario court in an interlocutory decision of Case Management Master Thomas Hawkins rendered at the end of September 2004. In Goldberg v. St. John, the defendant sought the plaintiff's client records to test a lost income claim. The plaintiff had been an employee of CIBC World Markets and he resisted the discovery request on the basis that the information should be subject to privilege and that its disclosure was barred by PIPEDA. He lost on the PIPEDA claim:

Goldberg v. St. John:

"[3] In order to challenge and test the plaintiff's evidence as to lost income, the defendants seek the following information: production of client records on all the plaintiff's customers for the period from 1997 to the present including client names and addresses. The defendants wish to track all the plaintiff's commission revenue and to understand why the plaintiff's commission revenue increased or decreased. Some 150 clients are involved. The theory of the defence is that some or all of the income which the plaintiff has lost and will lose in the future was and will be the result of factors unrelated to the accident.

[4] The plaintiff and CIBC World Markets Inc. resist this request on the ground that the information which the defendants seek is information which they are required to keep confidential. This confidentiality obligation is found in several places. First there is the Investment Dealers Association National Instrument 33-102. Secondly, there are the confidentiality of client information provisions found standard 'B' in the Conduct and Practices Handbook for Securities Industry Professionals prepared by The Canadian Securities Institute.

[5] The plaintiff and CIBC World Markets Inc. also rely upon the privacy provisions of the Personal Information Protection and Electronic Documents Act, S. C. 2000 ch. 5. I do not base my decision on this statute. I am not persuaded that this federal statute applies to a provincially regulated business and its employees such as CIBC World Markets Inc. and the plaintiff. CIBC World Markets Inc. is a stockbroker, not a bank."

Once again, it has been held that PIPEDA does not shield a party to litigation from disclosing relevant records. But this also reminds one that the info may be shielded by other legal and procedural rules.

Best Lawyers' 2009 West Virginia Personal Injury Litigator of the Year

Congratulations to my partner, Tom Flaherty, who was selected as Best Lawyers' 2009 West Virginia Litigator of the Year. A well deserved honor.

Tom is a straightforward and hardworking defense litigator who does an incredible job representing the best interests of his clients.

This past year he was involved in various high profile and important cases, including successfully leading a team of FSB lawyers to secure a settlement in the case against former West Virginia University football coach, Rich Rodriguez.



In all, seven Flaherty, Sensabaugh & Bonasso, PLLC lawyers were selected by their peers as 2009 Best Lawyers in America. See the complete list of those honored in my prior post, FSB: Best Lawyers in America 2009.

Following is Best Lawyers' press release honoring Tom:

Best Lawyers, the oldest and most respected peer-review publication in the legal profession, has named Thomas V. Flaherty as the “West Virginia Best Lawyers Personal Injury Litigator of the Year” for 2009.

After more than a quarter of a century in publication, Best Lawyers is designating “Lawyers of the Year” in high-profile legal specialties in large legal communities.

These specialties are Banking Law, Bet-the-Company Litigation, Corporate Law, Family Law, Personal Injury Litigation, and Real Estate Law and only a single lawyer in each specialty in each community is being honored as the “Lawyer of the Year.”

Best Lawyers compiles its lists of outstanding attorneys by conducting exhaustive peer-review surveys in which thousands of leading lawyers confidentially evaluate their professional peers. The current, 15th edition of The Best Lawyers in America (2009), is based on more than 2.5 million detailed evaluations of lawyers by other lawyers.

The lawyers being honored as “Lawyers of the Year” have received particularly high ratings in our surveys by earning a high level of respect among their peers for their abilities, professionalism, and integrity.

Steven Naifeh, Managing Editor of Best Lawyers, says, “We continue to believe – as we have believed for more than 25 years – that recognition by one’s peers is the most meaningful form of praise in the legal profession. We would like to congratulate Thomas V. Flaherty on being selected as the ‘West Virginia Best Lawyers Personal Injury Litigator of the Year’ for 2009.”

Privacy laws and litigation

Focus on Privacy

Fall 2004

 

 

Canadian Privacy Law and Litigation:[1]

Ontario Court canvasses the effect of privacy laws on discovery
and the meaning of “commercial activities” in PIPEDA

 

 

David T.S. Fraser – david.fraser@mcinnescooper.com

 

            Most privacy law practitioners expected that the year 2004 would bring a torrent of findings from the Office of the Privacy Commissioner once the Personal Information Protection of Electronics Documents Act, S.C. 2000, c.5 (“PIPEDA”) became fully applicable to the collection, use and disclosure of personal information in the private sector.  While the Commissioner’s Office struggles through its backlog, the civil courts have been a rather productive area for consideration of PIPEDA.

 

            One of the more recent cases emerging from the courts relating to PIPEDA is that of Clustercraft Jewellery Manufacturing Co. Ltd. v. Wygee Holdings Ltd., [2004] O.J. No. 2877 (QL).  The case relates to the alleged non-delivery of a quantity of diamonds to Clustercraft. The respondent, Wygee Holdings Ltd., sought information related to employees of Clustercraft who may have been able to shed light on the allegedly missing diamonds. Clustercraft’s witness resisted the questions on the basis that it was not able to disclose the information due to the constraints of PIPEDA.

 

            A Master of the Ontario court ordered that Clustercraft answer the questions put to it related to the employees, an order that was appealed to Justice Ducharme. At the appeal, Clustercraft claimed that information related to employees and former employees should not be compelled because it was not relevant and, it was argued, the company was prohibited from doing so without the consent of the employees due to PIPEDA.

 

            In the brief reasons for the order, Justice Ducharme concluded that the information not only crossed the relevance threshold but could not be shielded from disclosure by PIPEDA due to the application of s. 7(3)(c) of that Act.

 

            The general rule, in circumstances where PIPEDA applies, is that personal information can only be collected, used and disclosed with the knowledge and consent of the individual, subject to enumerated exceptions. One of those exceptions is applicable to the litigation context. Section 7(3)(c) of PIPEDA provides:

 

(3)        For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is …

 

(c)        required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;

 

Though the applicable Rules of Civil Procedure are generally seen as sufficient to engage the operation of this subsection, Justice Ducharme concluded, at paragraph 9:

 

At a minimum, the order of Master Albert is an order made by a court with jurisdiction to compel the production of information. Thus, this submission of the Appellant also fails.

 

The Clustercraft case confirms that where “personal information” that is otherwise protected by PIPEDA is relevant and producible in the course of litigation, PIPEDA will not act as a shield to prevent its disclosure.

 

            An additional aspect of this case that does not appear to have been discussed by the parties or the Court is whether PIPEDA would be applicable to the information in the first place. The information being sought by the Respondents related to Clustercraft’s present and past employees. Though there has not been extensive judicial comment on this point to date, the language of PIPEDA suggests that employee information of businesses such as Clustercraft is beyond the Act’s purview.

 

            The application section of PIPEDA, section 4, provides:

 

            4. (1) This Part applies to every organization in respect of personal information that

 

(a)        the organization collects, uses or discloses in the course of commercial activities; or

 

(b)        is about an employee of the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.

 

The law applies to commercial activities (except in those provinces where local legislation is declared to be “substantially similar”) or information about employees of the federally regulated private sector. Unless Clustercraft is a “federal work, undertaking or business”, PIPEDA would not preclude the collection, use or disclosure of its employees’ personal information, for litigation or any other purpose.

 

---

[1] Reprinted by permission of LexisNexis Canada Inc., from  The Canadian Privacy Law Review, October 2004, edited by Michael Geist, Copyright 2004.

Admissibility of video surveillance evidence

The use of video surveillance has come under increased scrutiny in recent years, prompted mostly by new privacy laws such as PIPEDA and the western provinces' PIPAs. To insurance lawyers, the most important question is what impact do these laws have on the admissibility of video surveillance evidence.

The only published court decision on this point, Ferenczy v. MCI Medical Clinics, 2004 CanLII 12555 (ON S.C.), may be interpreted to hold that a violation of PIPEDA does not render video evidence inadmissible (but it could be much more clear):

"[35] For all of the foregoing reasons I conclude the evidence here in question was not collected, recorded, used or disclosed in contravention of the Act. However, as I indicated earlier in these reasons, the evidence is in any event relevant and its probative value exceeds its prejudicial effect. Its admission into evidence would not render the trial unfair and it is, in my view, admissible at trial in any event at trial."

Johannes Schenk recently wrote about a BC arbitration decision in which the arbitrator decided that a violation of that province's Personal Information Protection Act would render the resultant evidence inadmissible. From paragraph 58 of IN THE MATTER OF an Expedited Arbitration Between EBCO Metal Finishing Ltd. and International Association of Bridge, Structural, Ornamental & Reinforcing Iron Workers, Shopmens' Local 712, [2004] B.C.C.A.A.A. No. 260:

... The PIPA is clearly intended to apply to the employment relationship. The authority of the legislation would not be given effect were an employer to breach its provisions and be permitted to rely on the unlawfully obtained evidence anyway. For an arbitrator in British Columbia to admit the evidence in such a case would amount to error of law and abdication of jurisdiction.

Aribral decisions have little precedential value, particularly outside the particular province, but this highlights that this issue has not entirely been put to rest.

Assistant Privacy Commissioner concludes that initiating a lawsuit is implied consent to video surveillance

McInnes Cooper recently acted for one of Canada’s largest automobile insurers in achieving a favourable result in two related complaints to the Office of the Privacy Commissioner, both stemming from a decision by the insurer to use video surveillance to verify the claimed injuries.

Following a motor vehicle accident, the plaintiff advanced a claim against the driver of the vehicle, whose insurer responded to defend the claim. During the examinations for discovery, the insurer concluded that there were inconsistencies in the reported injuries and hired a private investigator to conduct video surveillance of the plaintiff. Surveillance captured the plaintiff, sometimes with her husband, carrying out daily activities. The tape was used at trail to impeach the witness.¹

The plaintiff and her husband each brought separate complaints to the Privacy Commissioner, both alleging that the use of video surveillance was a collection of personal information without consent, contrary to the Personal Information Protection and Electronic Documents Act (PIPEDA). The Assistant Commissioner concluded that both complaints were not well-founded. For the plaintiff’s husband, the Assistant Commissioner reviewed the tapes and saw that he was not recognizable in the images. Thus, she concluded, the information was not “identifiable” and there was no collection of “personal information”, as that term is defined in PIPEDA.

With respect to the plaintiff, the Commissioner agreed with the insurer’s argument that, by initiating a lawsuit in which injuries are at issue, the plaintiff has impliedly consented to the insurer collecting personal information that is necessary to defend its insured. This implied consent only extends to information that is relevant to the merits of the case and the conduct of the defence. The Assistant Commissioner concluded that "the collection of her personal information was limited to what was necessary for [the insurer] to defend itself against … Court action."

The insurer argued, following the Ontario decision of Ferenczy v. MCI Medical Clinics, 2004 CanLII 12555 (ON S.C.) (see The Canadian Privacy Law Blog: PIPEDA and Video Surveillance: Guidance from the Ontario Courts), that PIPEDA does not apply to third-party personal injury claims as the insurer is an agent for the defendant and the relationship between the parties to litigation is not a commercial one. Unfortunately, the Assistant Commissioner did not refer to this line of argument in her finding.

As of yet, the Assistant Commissioner’s finding is not reported on the Commissioner’s website.

---

¹  Counsel for the plaintiff argued that the video was made in violation of PIPEDA and should be inadmissible. The court decided, from the bench on voire dire, that PIPEDA did not apply and, if it did, any violation of PIPEDA would not render the evidence inadmissible.

Article: Privacy litigation and customer relations

DMNews (Direct Marketing News) has an interesting article, commenting on the Albertson's pharmacy ligitation begun by the Privacy Rights Clearinghouse (see Lawsuit: Privacy advocacy group sues drug store chain over alleged privacy concerns). The article, written by Alan Chapell, has some good insights on the importance of privacy in customer relations:

Albertson’s Case Shows Hazards of Privacy Waters:

"...

Scenario 1: Completely innocent. Let’s assume for the sake of argument that every allegation Privacy Rights Clearinghouse made is false, and that Albertson’s will be vindicated. Unfortunately, by the time the truth comes out, Albertson’s will have spent a boatload of money in legal fees.

Moreover, guilty or not, its brand image will have taken a large hit. Allegations are usually printed on the front page, while retractions are often buried in the classifieds next to the tag sale ads. And in an environment where all pharmacies are created more or less equal, any negative press is likely to send some of its customers across the street.

Scenario 2: Enron part deux. Now let’s take the worst-case scenario. Let’s say it’s proven that Albertson’s took confidential customer prescription information, placed it into a database and then sold that data to pharmaceutical companies.

Then let’s say that the drug companies use that data to send mailings and place telephone calls to consumers reminding them to renew their prescriptions. And let’s say that these practices are found in court to be in violation of the law. The fallout of fines, legal bills, bad press and customer loss could be nothing short of devastating to the company.

Scenario 3: Middle of the road. Now let’s assume that the facts are somewhere in the middle. Maybe Albertson’s did send prescription reminders, and perhaps those reminders were financed by drug companies. Is that the same thing as selling consumer prescription data to the drug companies?

My point is that there’s a very subtle distinction between selling customer data to a third party and having that third party finance marketing campaigns to your customer lists. I’m not sure how Albertson’s alleged prescription plan differs from a traditional list rental situation. And even if Albertson’s is on the right side of the law, it will be in the unenviable position of defending its legal position at the expense of customer good will.

Consumers are not necessarily interested in subtle legal arguments if they feel that they’ve been misled or otherwise mistreated..."

Access requests and civil litigation discovery are two different things ...

The Office of the Privacy Commissioner has recently (24 January 2005) released a finding based on a complaint brought by a former employee who sought access to his personal information. The complainant was already suing his former employer related to his employment.

The case raises a number of interesting issues: you can only charge a token amount ($1500 is not a token amount) to provide access to personal information and discovery rights under concurrent litigation do not oust the right of access under PIPEDA:

Commissioner's Findings - PIPEDA Case Summary #285: Company refuses former employee's request for access - December 21, 2004 - Privacy Commissioner of Canada:

"Finally, the Assistant Commissioner commented on the two issues raised by the respondent during the investigation. With respect to the view that the complaint was an attempt to circumvent the disclosure and production rules under the Rules of Civil Procedure, the Assistant Commissioner noted that the scope of discovery is different from the scope of an access to personal information request under the Act. Discovery requires each party to a proceeding to disclose before trial all of the facts and information that it is aware of and that are relevant to the issues in the lawsuit. The Act grants a right of access to all personal information about an individual held by an organization, subject to certain exceptions, whether relevant or not. The Assistant Commissioner maintained that documents received through discovery cannot be considered sufficient to meet the requirements of an access request under the Act.

Regarding the company's concerns about providing minutes from board meetings to the complainant, the Assistant Commissioner reminded the organization that the Act provides for exceptions to the right of access to one's personal information, which are outlined in section 9, noting in particular the provision regarding confidential commercial information.

She recommended that the company examine its records and provide the complainant with access to all of his personal information collected, used or disclosed during the time period requested, subject to any exceptions.

The Assistant Commissioner noted that she remained skeptical that no single member of the board of directors took notes during the meetings when the decision to terminate the complainant's employment and his ensuing lawsuit were discussed. She recommended that the company confirm with all staff members and directors that no notes, e-mails or other material collected and retained contained the complainant's personal information. The Assistant Commissioner asked that the company report back to her to confirm what actions it had taken in response to the complainant's allegations."

Article: A privacy win and a privacy loss

From the Direct Marketing News comes an article by Robert Gellman reviewing two ipmortant American privacy-related cases:

It’s time to catch up with two court cases that were the subject of past columns and that produced new opinions. Privacy did well in one case and poorly in the other.

The first case is the litigation over the do-not-call registry decided in February by the 10th Circuit. Everybody knows that the court rejected the telemarketing industry’s arguments that the registry is unconstitutional. It was a sweeping victory for the registry, as the court dismissed every argument put forward in opposition. ...

February also brought a decision by the Supreme Court in a case arising under the Privacy Act of 1974, a law that applies only to federal agencies. The case, Doe v. Chao, involved the improper disclosure of a Social Security number by the Department of Labor. The issue was what a plaintiff had to prove to receive the $1,000 in minimum damages that the statute provides.

...

The case is a setback for privacy. Privacy advocates hoped that the court would have more sympathy for the consequences of privacy violations and for the difficulty of proving damages in privacy cases, but they did not prevail.

...

If you didn’t like the result in these cases, just wait. There will be more decisions in more privacy cases soon.

E-mail in litigation: Delete, delete, damn e-mail!

The front page of today's Globe and Mail Report on Business is full of coverage of a high-profile lawsuit between CIBC and Genuity. The most compelling evidence in the case is a bunch of e-mails that the senders and recipients thought were private:

Globetechnology: E-mail used as weapon in court case

The Canadian Imperial Bank of Commerce has turned employee e-mails into a potent legal weapon in an acrimonious court battle with a team of top executives who left the bank last year to form a competing investment firm.

In a lawsuit filed in the Ontario Superior Court, CIBC alleged that six former senior executives, including its one-time vice-chairman David Kassie, improperly recruited bank employees and took confidential bank data to their new company, Genuity Capital Markets....

The revealing e-mails are a stark reminder to employees in the digital age that messages they zap into the Internet ether can come back to haunt them....

CIBC was able to tap into messages sent by BlackBerrys that the former executives apparently believed were protected by a private system of e-mail communications known as PINning, which involves personal identification numbers or PINs.

The bank's ability to read and publish the BlackBerry e-mails is expected to send chills through the legions of investment bankers and lawyers who conduct all kinds of communications through the ubiquitous portable e-mail devices.

“You mean they broke into the PIN messages, how did they do that?” gasped one Bay Street lawyer and frequent BlackBerry PIN user who declined to be identified.

The CIBC isn't saying how it accessed the BlackBerry messages, but states in its lawsuit that the executives “seemed to have believed [they] did not create any record of their e-mails on the [Bank's] central computer systems.” ...

If you don't want to see it again, don't put it in writing, don't e-mail it, and don't text it.

Finding on implied consent to video surveillance in litigation

The Office of the Privacy Commissioner has published a summary on its website of the finding I referred to in my previous post about video surveillance and personal injury litigation (see The Canadian Privacy Law Blog: Assistant Privacy Commissioner concludes that initiating a lawsuit is implied consent to video surveillance). You can view the summary here: Commissioner's Findings - PIPEDA Case Summary #311: A woman's activities recorded and videotaped by a private investigator hired by an insurance company (August 9, 2005).

We advised the insurance company in this case.

The summary also addresses the complaint brought by the plaintiff against the private investigator, but the Assistant Commissioner unfortunately does not deal with the status of the insurer or the private investigator as an agent for the defendant in the underlying personal injury lawsuit. Though we raised the argument in the submissions to the Commissioner, we'll unfortunately have to wait until another case arises to have greater certainty on that issue.

As an aside, the insurance company in this case has decided not to seek judicial review of the decision of the Assistant Commissioner to assume jurisdiction. It was argued that PIPEDA did not apply in the circumstances because there is no commercial relationship between the plaintiff and the defendant in the personal injury lawsuit, and the insurer and PI were merely agents of the defendant.

From the published summary:

Commissioner's Findings - PIPEDA Case Summary #311: A woman's activities recorded and videotaped by a private investigator hired by an insurance company (August 9, 2005):

"Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use and disclosure of personal information, except where inappropriate.

The Assistant Privacy Commissioner reviewed the circumstances surrounding the insurance company's decision to conduct surveillance, including video surveillance on the woman. She agreed that when an individual initiates a lawsuit there is an implied consent that the other party to the suit may collect information required to defend itself against the damages being sought by the individual who filed the suit. When the woman initiated her lawsuit against the insurance company's client and when her testimony and medical reports revealed discrepancies and were inconsistent with the injuries claimed, the Assistant Privacy Commissioner concluded that she gave her implied consent to the collection of her personal information.

That being said, the Assistant Privacy Commissioner emphasized that implied consent is not without limitations. Implied consent does not authorize unlimited or uncontrolled access to an individual's personal information, but only to the extent it is relevant to the merits of the case and the conduct of the defense. In this case, the Assistant Privacy Commissioner noted that the collection of the woman's personal information was limited to what was necessary for the insurance company to defend itself against her Court action."