[934]*934OPINION OF THE COURT
Jane S. Solomon, J.
Petitioner, a nurse, seeks to compel respondents Health and Hospitals Corporations and Woodhull Medical & Mental Health Center (hospital) to produce material sought in a subpoena that was served in connection with an administrative disciplinary hearing. The petition is granted in part as follows.
As a preliminary matter, this special proceeding is brought under CPLR 3102 (c), which provides for preaction disclosure and for disclosure in aid of arbitration. No preaction disclosure is involved in this proceeding, and the disciplinary hearing is not an arbitration. However, the hospital made no objection to petitioner’s reliance on the rule. The relief sought is not obtainable by other means, and respondents have addressed petitioner’s demand on its merit. Since petitioner seeks redress regarding a formal, adversarial nonjudicial proceeding, similar in some respects to an arbitration, the underlying policy of CPLR 3102 (c) to lend the power of the court promoting an open and fair proceeding applies. Therefore, the court will consider the petition.
The hospital employed petitioner as a registered nurse in its labor and delivery unit (LDU). She was on duty October 12, 2003. The hospital terminated petitioner’s employment after it learned of irregularities in the way certain medication was administered and handled. In connection with that termination, the parties now are engaged in hearings at the Office of Labor Relations, in which petitioner is attempting to challenge her termination by proving that she did not engage in misconduct. If petitioner does not prevail at this hearing, it is likely that she will lose not only her job, but her license and livelihood as well.
Central to the hearing is a factual issue regarding whether she (1) failed to properly handle a narcotic medication (morphine sulphate) in disregard of established hospital policies and procedures, (2) took possession of three ampules of morphine without authorization, and (3) failed to endorse a patient identified as patient MR# 976651. (The parties do not explain what it means to endorse a patient, but it appears that the allegation is that she was improperly medicated.) Petitioner claims that she did not engage in any misconduct, and with respect to the mishandling of medication, she claims that other hospital staff were on duty at the time who may be responsible.
The parties’ submissions do not explain how the hospital determined that patient MR# 976651 was improperly medicated, [935]*935but there apparently is no dispute that she is the patient whose medical treatment is a basis for petitioner’s termination.
In an effort to evaluate the hospital’s proffered reason for refusing to permit petitioner access to that patient’s records, my court attorney requested on my behalf that the hospital’s attorney provide the court with a redacted copy of any consent forms executed by the patient. The hospital’s attorney advised that there were two consent forms, one executed on February 17, 2003 in connection with a prior admission, and one that the hospital’s attorney orally represents was executed at the time of the admission in question. The first is in English; the second is not. The first contains a consent to receive treatment, but is silent regarding the use of confidential information. The second appears to be a Spanish language translation of the first. It is dated October 25, 2003. If the representation of the hospital’s attorney is accurate that the patient signed the second consent form when she was admitted to the hospital for the treatment at issue, then she may not have been admitted until nearly two weeks after the underlying incident.
Petitioner was accompanied by a union representative at step I and step II administrative hearings, previously held by the Office of Labor Relations. The hospital refused petitioner’s demands that it provide certain records, including the records relied upon by the hospital in terminating her employment. Petitioner is now represented by counsel, who served a subpoena duces tecum on the hospital in connection with step III hearings now underway.
The subpoena demands seven categories of items: (1) assignment sheets reflecting any assignment given to petitioner on October 11 and 12, 2003; (2) a list of staff on duty in the LDU on those days, including the names of students; (3) and (4) the narcotics sheets for those days; (5) a list of names, medical information and the names of treating physicians for all adult female patients and their infants in the LDU on those days; (6) a copy of all policies in effect at the time regarding the infusion pump, code nurse, circulation nurse, narcotics count and students; and (7) a copy of the incident report. The hospital did not respond.
Petitioner is seeking all the material demanded in the subpoena, except that she has narrowed her demand regarding patients’ medical information. She now seeks the records of only one patient, identified as patient MR# 976651, whom the hospital claims as a basis for its action. (See, affirmation in opposition of Olimpio Russo, Esq. 1i 8.)
[936]*936In response to this petition, the hospital has agreed to produce the requested assignment sheets, narcotics sheets, copies of policies and the incident report to the extent the material was not already produced. It claims that some of this material is subject to redaction “if warranted” to protect privileged, confidential and “non-relevant” information, such as patients’ names and “medical information.” (Russo affirmation 1i 10.) The scope of redaction, if any, shall be addressed below.
With respect to petitioner’s demand for records showing who was on duty in the LDU on the dates in question, the hospital argues that “without the appropriate showing of relevancy it can be deemed as a potentially harassment tactic.” (Russo affirmation U 7.) The material is relevant as a record of potential witnesses, and with respect to petitioner’s defense that someone else is responsible for the manner in which morphine was administered or accounted for. Therefore, it must be produced.
In refusing to produce the records of patient MR# 976651, the hospital argues that it is prohibited from producing any patient records under the Health Insurance Portability and Accountability Act of 1996 ([HIPAA] 42 USC § 1320d-l et seq.), absent a HIPAA-compliant authorization from the patient. Neither party meaningfully addresses HIPAA in their submissions.
The hospital argues that HIPAA § 1177 (b) (3) (also codified as 42 USC § 1320d-6 [b] [3]) provides for criminal penalties to any person who discloses individually identifiable health information to another person. The portion of the statute cited by the hospital reads as follows:
Ҥ 1320d-6. Wrongful disclosure of individually identifiable health information
“(a) Offense. A person who knowingly and in violation of this part [42 USC § 1320d et seq.]—
“(1) uses or causes to be used a unique health identifier;
“(2) obtains individually identifiable health information relating to an individual; or
“(3) discloses individually identifiable health information to another person, shall be punished as provided in subsection (b) of this section.
“(b) Penalties. A person described in subsection (a) of this section shall— . . .
Free access — add to your briefcase to read the full text and ask questions with AI
[934]*934OPINION OF THE COURT
Jane S. Solomon, J.
Petitioner, a nurse, seeks to compel respondents Health and Hospitals Corporations and Woodhull Medical & Mental Health Center (hospital) to produce material sought in a subpoena that was served in connection with an administrative disciplinary hearing. The petition is granted in part as follows.
As a preliminary matter, this special proceeding is brought under CPLR 3102 (c), which provides for preaction disclosure and for disclosure in aid of arbitration. No preaction disclosure is involved in this proceeding, and the disciplinary hearing is not an arbitration. However, the hospital made no objection to petitioner’s reliance on the rule. The relief sought is not obtainable by other means, and respondents have addressed petitioner’s demand on its merit. Since petitioner seeks redress regarding a formal, adversarial nonjudicial proceeding, similar in some respects to an arbitration, the underlying policy of CPLR 3102 (c) to lend the power of the court promoting an open and fair proceeding applies. Therefore, the court will consider the petition.
The hospital employed petitioner as a registered nurse in its labor and delivery unit (LDU). She was on duty October 12, 2003. The hospital terminated petitioner’s employment after it learned of irregularities in the way certain medication was administered and handled. In connection with that termination, the parties now are engaged in hearings at the Office of Labor Relations, in which petitioner is attempting to challenge her termination by proving that she did not engage in misconduct. If petitioner does not prevail at this hearing, it is likely that she will lose not only her job, but her license and livelihood as well.
Central to the hearing is a factual issue regarding whether she (1) failed to properly handle a narcotic medication (morphine sulphate) in disregard of established hospital policies and procedures, (2) took possession of three ampules of morphine without authorization, and (3) failed to endorse a patient identified as patient MR# 976651. (The parties do not explain what it means to endorse a patient, but it appears that the allegation is that she was improperly medicated.) Petitioner claims that she did not engage in any misconduct, and with respect to the mishandling of medication, she claims that other hospital staff were on duty at the time who may be responsible.
The parties’ submissions do not explain how the hospital determined that patient MR# 976651 was improperly medicated, [935]*935but there apparently is no dispute that she is the patient whose medical treatment is a basis for petitioner’s termination.
In an effort to evaluate the hospital’s proffered reason for refusing to permit petitioner access to that patient’s records, my court attorney requested on my behalf that the hospital’s attorney provide the court with a redacted copy of any consent forms executed by the patient. The hospital’s attorney advised that there were two consent forms, one executed on February 17, 2003 in connection with a prior admission, and one that the hospital’s attorney orally represents was executed at the time of the admission in question. The first is in English; the second is not. The first contains a consent to receive treatment, but is silent regarding the use of confidential information. The second appears to be a Spanish language translation of the first. It is dated October 25, 2003. If the representation of the hospital’s attorney is accurate that the patient signed the second consent form when she was admitted to the hospital for the treatment at issue, then she may not have been admitted until nearly two weeks after the underlying incident.
Petitioner was accompanied by a union representative at step I and step II administrative hearings, previously held by the Office of Labor Relations. The hospital refused petitioner’s demands that it provide certain records, including the records relied upon by the hospital in terminating her employment. Petitioner is now represented by counsel, who served a subpoena duces tecum on the hospital in connection with step III hearings now underway.
The subpoena demands seven categories of items: (1) assignment sheets reflecting any assignment given to petitioner on October 11 and 12, 2003; (2) a list of staff on duty in the LDU on those days, including the names of students; (3) and (4) the narcotics sheets for those days; (5) a list of names, medical information and the names of treating physicians for all adult female patients and their infants in the LDU on those days; (6) a copy of all policies in effect at the time regarding the infusion pump, code nurse, circulation nurse, narcotics count and students; and (7) a copy of the incident report. The hospital did not respond.
Petitioner is seeking all the material demanded in the subpoena, except that she has narrowed her demand regarding patients’ medical information. She now seeks the records of only one patient, identified as patient MR# 976651, whom the hospital claims as a basis for its action. (See, affirmation in opposition of Olimpio Russo, Esq. 1i 8.)
[936]*936In response to this petition, the hospital has agreed to produce the requested assignment sheets, narcotics sheets, copies of policies and the incident report to the extent the material was not already produced. It claims that some of this material is subject to redaction “if warranted” to protect privileged, confidential and “non-relevant” information, such as patients’ names and “medical information.” (Russo affirmation 1i 10.) The scope of redaction, if any, shall be addressed below.
With respect to petitioner’s demand for records showing who was on duty in the LDU on the dates in question, the hospital argues that “without the appropriate showing of relevancy it can be deemed as a potentially harassment tactic.” (Russo affirmation U 7.) The material is relevant as a record of potential witnesses, and with respect to petitioner’s defense that someone else is responsible for the manner in which morphine was administered or accounted for. Therefore, it must be produced.
In refusing to produce the records of patient MR# 976651, the hospital argues that it is prohibited from producing any patient records under the Health Insurance Portability and Accountability Act of 1996 ([HIPAA] 42 USC § 1320d-l et seq.), absent a HIPAA-compliant authorization from the patient. Neither party meaningfully addresses HIPAA in their submissions.
The hospital argues that HIPAA § 1177 (b) (3) (also codified as 42 USC § 1320d-6 [b] [3]) provides for criminal penalties to any person who discloses individually identifiable health information to another person. The portion of the statute cited by the hospital reads as follows:
Ҥ 1320d-6. Wrongful disclosure of individually identifiable health information
“(a) Offense. A person who knowingly and in violation of this part [42 USC § 1320d et seq.]—
“(1) uses or causes to be used a unique health identifier;
“(2) obtains individually identifiable health information relating to an individual; or
“(3) discloses individually identifiable health information to another person, shall be punished as provided in subsection (b) of this section.
“(b) Penalties. A person described in subsection (a) of this section shall— . . .
“(3) if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, [937]*937or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.”
The hospital’s reliance on this section is misplaced.
The hospital refused even to provide a printed consent form showing that the patient in question may not have been admitted for treatment until 13 days after the alleged misconduct. If the hospital made an honest error, petitioner is entitled to inquire into whether that error played a role in her termination.
“HIPAA is a complex piece of legislation that addresses the exchange of health-related information.” (National Abortion Fedn. v Ashcroft, 2004 WL 555701, *2, 2004 US Dist LEXIS 4530, *5 [SD NY, Mar. 19, 2004].) Contrary to the hospital’s broad reading of HIPAA, the statute and its implementing regulations (45 CFR parts 160-164) provide for the disclosure of medical records under certain circumstances. Generally, a covered entity (which includes a health care provider such as the hospital) may not use or disclose protected health information without a HIPAA-compliant authorization. (45 CFR 164.508 [a].) However, disclosure is permitted in the course of any judicial or administrative proceeding. (45 CFR 164.512 [e].) Disclosure may be made in response to an order from a court or administrative tribunal (45 CFR 164.512 [e] [1] [i]), or in response to a subpoena or discovery request, where the covered entity receives “satisfactory assurance” that the party seeking the information has made reasonable efforts to secure a qualified protective order that meets the requirements of the regulation. (45 CFR 164.512 [e] [1] [ii] [B].) A qualified protective order means an order or stipulation by the parties that prohibits [938]*938them from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested, and that requires the return of the material to the covered entity or destruction of the protected health information at the end of the litigation or proceeding. (45 CFR 164.512 [e] [1] [v] [A]-[B].) When disclosing protected health information, a covered entity must make reasonable efforts to limit such disclosure to the minimum necessary. (45 CFR 164.502 [b].)
The HIPAA regulations also provide for the “deidentification” of protected health information. Individually identifiable information is a subset of protected health information, and is defined in the statute as:
“(6) Individually identifiable health information. The term ‘individually identifiable health information’ means any information, including demographic information collected from an individual, that—
“(A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
“(B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and—
“(i) identifies the individual; or
“(ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.” (42 USC § 1320d [6].)
Health information may be “de-identified,” that is, stripped of identifying material such as name, address, telephone number, Social Security number, date of birth, etc., such that its disclosure under limited circumstances will not run afoul of HIPAA.
In this case, petitioner served a subpoena in connection with an administrative proceeding. The subpoena does not state that petitioner agreed to use the information sought only in connection with the administrative proceeding, nor did it contain any of the other safeguards embodied in a qualified protective order. (See, 45 CFR 164.512 [e] [1] [v] [A]-[B].) Therefore, the hospital’s failure to respond to the subpoena is defensible, although it would have saved the parties the expense and time of litigating in this proceeding had it simply communicated with [939]*939petitioner’s counsel. The present order is a qualified protective order that satisfies HIPAA and its regulations, so the hospital now must provide the relevant medical records.
Petitioner does not argue that she needs personal identifying information regarding the patient from whose treatment the accusation against her arose (whether that patient is MR# 976651 or some other person), and does not seek to produce the patient as a witness. She wants to learn the facts surrounding the incident that resulted in her termination, including what medication was administered to the patient and under what circumstances. In keeping with the policy that only the minimum degree of disclosure should be made (45 CFR 164.502 [b]), the hospital is directed to de-identify the material by redacting the patient’s name, Social Security number, date of birth, address and telephone number from the material. Otherwise, all the records, including laboratory reports, shall be produced.
Accordingly, it hereby is ordered and adjudged that the petition is granted to the extent that, within 10 days of service of a copy hereof with notice of entry, the hospital shall produce all material identified in items 1 through 4 and 6 through 7 of the subpoena, and the information demanded in item 5 of the subpoena shall be produced subject to the following limitations:
1. The hospital shall produce all of the medical records, including laboratory reports, for the patient alleged to be involved in the misconduct attributed to petitioner and described by petitioner and respondent as patient “MR# 976651,” for the period of October 11 and October 12, 2003.
2. The hospital shall redact the material as to de-identify it in accordance with the foregoing decision.
3. Petitioner is prohibited from using or disclosing the material for any purpose other than the proceeding for which the information was requested, or subsequent proceedings or litigation arising from a determination in the present proceeding.
4. Petitioner shall return all protected health information to the hospital or destroy it at the end of the proceeding or subsequent proceedings or litigation arising from a determination in the present proceeding.
And it further is ordered that petitioner is granted the costs and disbursements of this proceeding.
The hospital properly does not rely upon CPLR 3122 (a), which provides that a medical provider need not respond to a subpoena duces tecum demanding medical records under CPLR article 31 unless accompanied by a written medical authorization by the patient. The subpoena served here was not served as part of article 31 disclosure. The hospital objected only under HIPAA.