Justice O’NEILL
delivered the opinion of the Court.
In this mandamus proceeding, we must decide whether the trial court abused its discretion by granting a protective order
barring the defendants, their attorneys, and any associated persons from having any ex parte contacts with any of the plaintiffs non-party medical providers. Because the plaintiff failed to establish that any of the providers she authorized to release medical information possessed irrelevant, privileged information, we hold that the trial court abused its discretion.
I. Background
Real party in interest Kelly Regian began seeing the relator, Dr. Lester Collins, for headaches in 2002. Over time, her symptoms worsened. More than two years later, her primary care physician ordered an MRI, which revealed nasophar-yngeal carcinoma. Regian was referred to the MD Anderson Cancer Center in Houston, where she was diagnosed with stage IV nasopharyngeal carcinoma. She and her husband later sued Collins and the ETMC Neurological Institute, a professional association with which Collins was affiliated, alleging that Collins’s negligence in failing to diagnose the condition allowed the cancer to progress from a curable to an incurable stage.
Several months before filing the suit, in compliance with section 74.051(a) of the Civil Practice and Remedies Code, the Re-gians sent Collins written notice of a health care liability claim arising from his alleged failure “to timely diagnose and refer Kelly Regian for treatment of naso-pharyngeal carcinoma.” Attached to the notice was the section 74.052 authorization form for release of protected health information that the Code requires a claimant to provide in order for a health care liability claim to proceed. Tex. Civ. Prac. & Rem.Code § 74.052(a). The Legislature prescribed the form’s precise language as part of the civil liability reforms instituted by its passage of House Bill 4 in 2003.
Id.
§ 74.052(c).
In the form, Regian authorized Collins to obtain and disclose, within specified parameters, health information for the “specific purposes” of “faeilitatfing] the investigation and evaluation of the health care claim described in the accompanying Notice of Health Care Claim,” and “[d]e-fen[ding] ... any litigation arising out of the claim.” The authorization extended to “verbal as well as ... written” information.
See id.
It provided that the authorization would expire upon resolution of the claim asserted or at the conclusion of any litigation, and that “without exception, [Regian would] have the right to revoke th[e] authorization in writing,” subject to the consequences imposed by section 74.052 of the Code.
Id.
In exhibit “A” attached to the form, Regian authorized the disclosure of information in the custody of a list of health care providers who had examined or treated Regian in connection with the injuries alleged to have been sustained as the result of Collins’s alleged negligence; all of the health care providers listed in this section were associated with the MD Anderson Cancer Center. In exhibit “B,” Regian authorized the release of information in the custody of health care providers who had treated her in the five years preceding the events leading to her claim against Collins. Finally, in exhibit “C,” the form designated “Excluded Health Information” — that is, information in the possession of health care providers “to which this authorization does not apply because [Regian] contend[s] that such health information is not relevant to the damages being claimed or to [Regian’s] physical, mental, or emotional condition.”
In this section, Regían listed seven health professionals, none of whom were listed in the previous sections. Although section 74.052(c) instructs claimants to designate “the inclusive dates of examination, evaluation, or treatment to be withheld from disclosure,” Regían listed only the health care providers’ names.
Several months after sending the notice and authorization form, the Regians filed the lawsuit underlying this mandamus proceeding. Within days of the defendants’ answers, the Regians sought a protective order prohibiting the defendants from engaging in ex parte communications with Kelly’s treating physicians. In them motion, the Regians complained that it was “common practice for a medical malpractice defendant’s lawyer to have
ex parte
communications with an injured claimant’s prior and subsequent treating physicians in order to obtain information that goes beyond what is contained in the plaintiff-patient’s medical records.” They contended that a defendant’s attorney might elicit opinion testimony not reflected in the health care provider’s written records that could be used to ambush the plaintiff at trial:
Typically, with a wink and a smile, the defense lawyer will start with a perfunctory “You’re under no obligation to talk to me, and I only want to discuss those things that are relevant to the issues in the lawsuit.” The treating physician may then be presented with a copy of the original petition and the defendant’s answer and affirmative defenses, with a comment along the lines of “[t]his is what the plaintiff alleges and this is what we are saying.” From there the discussion becomes a full-fledged fishing expedition for a non-retained expert, and a headlong foray into everything
but
the care and treatment provided to the plaintiff.
(Emphasis in original). The Regians further maintained that by filing suit, a health care liability claimant waives the physician-patient privilege only as to information relevant to a mental or physical condition of the patient that a party relies on as part of a claim or defense, and that only by prohibiting ex parte contacts can a court assure that irrelevant information is not disclosed. The motion did not identify any health care providers who possessed both relevant and irrelevant information. Collins opposed the motion. After a nonevi-dentiary hearing, the trial court granted the motion,
prohibiting the defendants, their lawyers, and all persons associated with them from having any ex parte contacts with any of Regian’s non-party treating physicians.
Collins then sought a writ of mandamus from the court of appeals. The court of appeals recognized that section 74.052(c) contemplates the verbal disclosure of protected health information, but concluded that the statute does not explicitly address whether verbal information may be obtained ex parte. 224 S.W.3d 798, 802. The court also concluded that “ex parte communications, in some instances, may be more practical, less time consuming, and less costly than formal discovery.”
Id.
at 803. Thus, the court reasoned, allowing ex parte communications would be consistent with the Legislature’s objectives in enacting the statute.
Id.
The court noted that the statute provides a mechanism to allow a claimant to protect irrelevant information by identifying health care providers
who possess information the claimant contends is irrelevant.
Id.
It further noted, however, that “exclusion of information by date does not protect irrelevant, privileged information that is acquired in the same date as relevant information.”
Id.
at 803 n. 3. The court observed that various arguments against allowing ex parte communications have been made, including “the lack of safeguards against the revelation of privileged information, the chilling effect potential breaches of confidentiality may have on a patient’s communication with a physician, and the possibility of questionable conduct by defense counsel.”
Id.
at 804. But it downplayed those risks, noting that defense counsel could be subject to sanctions for unethical conduct and that it was unlikely patients would withhold information and potentially jeopardize their health based on the mere possibility that the information might be discovered through ex parte communications in a subsequent lawsuit.
Id.
The court concluded that section 74.052 did “not change existing law and therefore does not prohibit a defendant from communicating ex parte with a claimant’s ... health care providers.”
Id.
at 805. Nevertheless, the court held that the trial court did not abuse its discretion in issuing the protective order because the statute does not expressly prohibit the issuance of protective orders prohibiting ex parte contacts.
Id.
at 806. We granted oral argument in this case to determine whether the order issued by the trial court amounts to an abuse of discretion.
II. Analysis
A. Parties’ Arguments
Collins maintains that the trial court abused its discretion in granting the protective order because section 74.052(c) expressly contemplates ex parte communications in allowing a defendant health care provider and the providers’ attorneys to obtain “verbal” information. Collins contends the trial court’s order undermines the statute’s underlying purpose of speeding up and simplifying the process for resolving health care liability claims. Moreover, he argues that case law preceding the Legislature’s enactment of section 74.052 recognized that ex parte contacts were permissible and there is no indication that the Legislature intended to change the status quo. Collins agrees with the Regians that the release prescribed in section 74.052(c) only extends to relevant health care information. But he contends the Legislature conferred a gatekeeper function on claimants by allowing them to identify health care providers who possess irrelevant information. Collins contends the Regians failed to take advantage of that power. According to Collins, if any of the non-party treating physicians the Re-gians identified in exhibit “B” of the form possessed both relevant and irrelevant information, the Regians should have also listed them in exhibit “C,” along with the dates of any visits in which irrelevant information was disclosed. Finally, Collins argues this scheme is not preempted by regulations implementing the federal Health Insurance Portability and Accountability Act of 1996, Pub.L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended at 42 U.S.C. §§ 1320d to 1320d-8 (2006)), because section 74.052 is not contrary to HIPAA and, in fact, imposes more stringent requirements than the federal law requires. Collins contends mandamus relief is warranted because this case presents an important issue of first impression with significant public policy consequences.
The Regians argue, on the other hand, that this Court and others have recognized trial courts’ authority to issue protective orders to prevent the inadvertent disclosure of privileged medical information through ex parte communications, which, they contend, have heretofore been impermissible. Citing statements by two lawmakers in the legislative history of House Bill 4, the Regians maintain that the Legislature intended to preserve existing law when it passed section 74.052. They further contend that if the statute permits ex parte communications, it is preempted by HIPAA.
B. Legal Background
Generally, litigants are not empowered to restrict access to non-party fact witnesses. But interactions between health care providers and their patients may raise unique privacy concerns. This case requires us to examine the interplay between three enactments relating to medical privacy: Texas Rule of Evidence 509, section 74.052(c) of the Civil Practice and Remedies Code, and regulations adopted under HIPAA. We begin with a brief overview of each of these provisions.
1. Rule of Evidence 509
Texas Rule of Evidence 509(c) protects confidential communications between physicians and their patients and prohibits their disclosure. We have recognized that the privilege serves two purposes. First, it encourages the full and open communication that is required for effective treatment.
R.K v. Ramirez,
887 S.W.2d 836, 840 (Tex.1994). It also serves to prevent the unnecessary disclosure of highly personal information.
Id.
In light of the potentially sensitive nature of information that may have been disclosed within the patient/physician relationship, we have stressed that trial courts bear a “heavy responsibility ... to prevent any disclosure that is broader than necessary.”
Id.
at 844. But several exceptions to the rule may limit the privilege. Pertinent here, the privilege does not shield relevant information when the patient sues a physician, when the patient signs a written consent for the release of relevant information, or when otherwise-privileged information is “relevant to an issue of the physical, mental or emotional condition of a patient in any proceeding in which any party relies upon the condition as a part of the party’s claim or defense.” Tex.R. Evid. 509(e)(1), (2), (4). Information relevant to the Regians’ claim for damages arising from Collins’s alleged failure to timely diagnose Kelly’s nasopharyngeal cancer clearly is not subject to the privilege in this lawsuit.
2. Section 74.052(c)
In 2003, the Legislature enacted section 74.052 of the Civil Practice and Remedies Code. The measure is a part of the Legislature’s effort to decrease the cost of medical care and increase its availability, in part, by decreasing the costs of health care liability claims. Act of June 2, 2003, 78th Leg., R. S., ch. 204, § 10.11(b), 2003 Tex. Gen. Laws 847, 884-85. As the court of appeals noted, by requiring the disclosure of relevant health care information, both verbal and written, the statute furthers “full, efficient, and cost effective discovery.” 224 S.W.3d at 803. Moreover, by requiring a potential claimant to authorize the disclosure of otherwise privileged information sixty days before suit is filed, the statute provides an opportunity for
health care providers to investigate claims and possibly settle those with merit at an early stage. If a conflict emerges between section 74.052 and any rule of procedure or evidence, section 74.052 governs. Tex. Civ. Prac. & Rem.Code § 74.002. The statutory authorization is to be construed in accord with medical privacy regulations adopted under HIPAA.
Id.
§ 74.052(c).
3. HIPAA
Congress enacted HIPAA to increase the portability of health insurance and to reduce health care costs by simplifying administrative procedures.
Arons v. Jutkowitz,
9 N.Y.3d 393, 850 N.Y.S.2d 345, 880 N.E.2d 831, 839-40 (2007); Pub.L. No. 104-191, 110 Stat.1936 (1996) (codified as amended at 42 U.S.C. §§ 1320d to 1320d-8 (2006)). The development of national standards for electronic medical records management was central to the goal of simplification.
Id.
Envisioning increasing privacy concerns associated with the move toward electronic record-keeping, Congress simultaneously authorized the secretary of the United States Department of Health and Human Services to promulgate rules governing the disclosure of confidential medical records.
Arons,
850 N.Y.S.2d 345, 880 N.E.2d at 840; 42 U.S.C. 1320d-2 (2006). The privacy rules HHS enacted, 45 C.F.R. pts. 160
&
164 (2008), “strike[ ] a balance that permits important uses of information, while protecting the privacy of people who seek care and healing.” United States Department of Health and Human Services, Office for Civil Rights,
Summary of the HIPAA Privacy Rule,
at 1,
available at
http://www.hhs.gov/ocr/priva ey/hi-paa/understanding/summary/privacysum-mary.pdf [last revised May 2003]. The privacy rules prohibit the disclosure of protected health information except in specified circumstances.
See
45 C.F.R. § 164.502 (2008). A person who discloses protected health information in violation of the privacy rule is subject to a fine of up to $50,000, and imprisonment of no more than a year, or both. 42 U.S.C. § 1320d-6 (2006). “Health information” means “any information, whether oral or recorded in any form or medium.” 45 C.F.R. § 160.103 (2008). With limited exceptions, HIPAA’s privacy rules preempt any contrary requirement of state law unless the state law is more stringent than the federal rules.
Id.
§ 160.203. A requirement is “contrary” if it would be impossible for a covered entity to comply with both the state law requirement and the HIPAA privacy rules, or if the requirement would undermine HIPAA’s purposes.
Id.
§ 160.202.
While the rules strongly favor the protection of individual health information, they permit disclosure of health information in a number of circumstances. In a judicial proceeding, protected information may be disclosed in response to a court order.
Id.
§ 164.512(e)(1)®. It may also be disclosed without a court order in response to a subpoena or discovery request if the health care provider receives satisfactory assurances that the requestor has made reasonable efforts to ensure that the subject of the information has been given notice of the request.
Id.
§ 164.512(e)(l)(ii)(A). A health care provider receives “satisfactory assurances” when the requestor provides a written statement and documentation demonstrating that the requestor has made a good faith attempt to notify the subject of the request, and the subject has been given an opportunity to object.
Id.
§ 164.512(e)(l)(iii). Alternatively, the re-questor may provide satisfactory assurances that reasonable efforts have been made to obtain a qualified protective order limiting the use of the information to the legal proceeding and providing for its return or destruction.
Id.
§ 164.512(e)(l)(ii)(B), (e)(l)(v). Finally, health care information may be disclosed if the patient has executed a valid written authorization.
Id.
§ 164.508(a)(1), (c)(l)(vi). Any disclosure the health care provider makes in reliance on a written authorization must be consistent with its terms.
Id.
§ 164.508(a)(1).
C. Effect of Section 74.052(c)
The Regians contend that a release executed under section 74.052(c) does not extend to authorize verbal interviews with health care providers. According to the Regians, the statute’s reference to “verbal” information was instead intended to cover information that the patient orally conveyed to the physician. We agree with the court of appeals that such a reading of the statute is erroneous. 224 S.W.3d at 803. The term is used in describing the “health information to be obtained, used, or disclosed,” and is presented as a category of information in addition to written information. Tex. Civ. Prac. & Rem.Code § 74.052(c). If, as the Regians argue, the provision refers to the means by which the information was conveyed to the physician, rather than the information that is to be disclosed, then the form also does not authorize the release of written medical records. Such a reading not only would render section 74.052(c) a nullity, it would undermine the Legislature’s purpose of reducing the costs of health care liability claims because medical records could be obtained from non-party health care providers only through the use of subpoenas or other formal mandatory processes. Because we are to give meaning to all words in statutes and construe them to effectuate the Legislature’s objective in enacting them, we conclude that the release authorizes non-party health care providers to orally convey relevant information to defendants.
See
Tex. Gov’t Code §§ 311.021(2), 311.023(1), (5).
The Regians further contend that, even if section 74.052(c) authorizes health care providers to orally convey health care information, it does not authorize defendants to contact them ex parte. In support, the Regians cite an exchange between two legislators in which one of the House Bill 4 sponsors stated, “[njothing in this section is intended to change the law of privilege [for a patient].” S.J. of Tex., 78th Leg., R.S. 5005 (2003) (statement of Senator Ratliff). According to the Regians, Texas law at that time forbade ex parte contacts between a health care liability defendant and a plaintiff-patient’s health care provider. The Regians’ argument is flawed in at least two respects. First, we have cautioned that legislative history cannot override a statute’s plain words.
Alex Sheshunoff Mgmt. Servs., L.P. v. Johnson,
209 S.W.3d 644, 652 n. 4 (Tex.2006). In this instance, the statute places no express restrictions on the conveyance of verbal information, and the fact that it calls for the release to be delivered well before suit is filed strongly implies that the Legislature envisioned a relatively informal process. Moreover, we agree with the court of appeals that prior to section 74.052(e)’s passage, Texas law did not clearly prohibit ex parte communications with nonparty health care providers. 224 S.W.3d at 803-04. In
Mutter v. Wood,
744 S.W.2d 600, 601 (Tex.1988), the case upon which the Regians principally rely, we held that the trial court abused its discretion by requiring the plaintiffs to sign an authorization permitting the defendant-hospital’s attorney to discuss the plaintiffs medical information with treating physicians. We did so, however, not because the authorization allowed ex parte contacts, but because it allowed access to information that was not relevant to the underlying suit and thus remained privileged.
Id.
We need not decide, however, whether section 74.052(c)
authorizes ex parte contacts in all situations because, as explained below, the Re-gians failed to carry their burden in obtaining a protective order.
D. Propriety of the Protective Order
In the context of formal discovery under the Rules of Civil Procedure, we have established standards for the issuance of protective orders. While “a trial judge may exercise some discretion in the granting of protective orders[,] ... this discretion is not without bounds.”
Masinga v. Whittington,
792 S.W.2d 940, 940 (Tex.1990). A party seeking a protective order “must show particular, specific and demonstrable injury by facts sufficient to justify a protective order.”
Id.
(citing
Garcia v. Peeples,
734 S.W.2d 343, 345 (Tex.1987)). Here, the Regians did not seek an order protecting them from discovery authorized by the rules. Instead, they sought the order to place limits on Collins’s ability to obtain information available under a release they provided in accordance with section 74.052(c). We believe, however, that health care liability claimants seeking to limit access to information released under the statute should face no less of a burden than parties seeking to limit ordinary discovery, particularly in light of the important objectives the Legislature sought to advance in enacting the law.
In section 74.052(c), the Legislature provided a mechanism for claimants to exclude irrelevant and therefore privileged information from the scope of a release. As we have described, the legislatively prescribed form allows a claimant to identify health care providers whom they contend do not possess relevant information by listing them and providing the dates of treatment in section (C) of the form. Tex. Civ. Prac. & Rem.Code § 74.052(c). In essence, the Legislature created a scheme that enables patients to act as gatekeepers of their own privileged health information. Although the Regians seek to limit access to the treating physicians they identified in the exhibit they attached under section (B) of the form, they did not list them in the exhibit they attached under section (C) or provide dates on which the physicians might have learned of irrelevant information. Neither did they provide equivalent information in their motion for a protective order; in fact, the Regians’ motion did not even assert that any of Kelly’s non-party treating physicians possessed both relevant and irrelevant information.
The Regians complain that requiring health care claimants to identify health care providers who possess both relevant and irrelevant information along with the dates on which irrelevant information was obtained would be “cumbersome and overly burdensome [and] impractical because it essentially would prohibit [Collins] from obtaining any healthcare information whatsoever on the dates specified under subsection C.” They also argue that such a procedure would be unworkable because parties often disagree about whether information is relevant or not. We agree with Collins, however, that health care claimants, who are entitled to unrestricted access to their health information and to their non-party health care providers, are in the best position to identity what information they consider privileged. Because the Regians did not make the requisite showing of specific and demonstrable injury,
we hold that the trial court abused its discretion in issuing the protective order.
E. Preemption
The Regians argue that, to the extent section 74.052(c) authorizes ex parte communications with non-party treating physicians, it is preempted by HIPAA. As we have said, we do not decide whether section 74.052(c) authorizes ex parte communications in every situation; instead, we hold that in this case, the Regians failed to make the showing necessary to obtain a protective order. In any event, however, HIPAA itself allows the disclosure of protected health information if the patient has executed a valid, written authorization conforming to the requirements of 45 C.F.R. § 164.508(c). 45 C.F.R. 164.508(a) (2008). The Regians do not dispute that the authorization Kelly signed conforms to those requirements. Rather, they contend the authorization is not a valid HIPAA release because it was not voluntary, as Kelly was required to sign it as a condition of bringing this suit.
First, while it is true that the Regians could not have proceeded with their suit if Kelly had not executed the authorization, it was their choice to file the suit in the first instance. Moreover, on several occasions, courts have ordered plaintiffs to execute authorizations compliant with section 164.508.
See, e.g., In re Zyprexa Prods. Liab. Litig.,
No. MDL 1596, 2004 WL 3520244, at *1 (E.D.N.Y. Aug.16, 2004);
Doe v. Messier,
No. 20042512c, 2006 WL 619113 at *3 (Mass.Super.Ct. Feb. 2, 2006);
Doe v. O’Neil,
No. 20042513c, 2006 WL 620669, at *3 (Mass.Super.Ct. Feb. 2, 2006).
HIPAA preempts state law only if it would be impossible for a covered entity to comply with both the state and federal requirement, or if it would undermine HI-PAA’s purposes. While several courts have held that HIPAA preempts state law procedures that would allow ex parte contacts between health care providers and defendants and their representatives, none of them involve situations in which the patient has executed a written release compliant with 45 C.F.R. § 164.508. Because section 74.052(c) authorizes disclosure under the exact same terms as 45 C.F.R. § 164.508, it would not be impossible for a health care provider to comply with both laws. Moreover, while the privacy of medical information is the primary goal of the privacy rules, the rules balance that interest against other important needs. Reducing the costs of medical care is a concern underlying both HIPAA and section 74.052(c). In this case, the legislatively prescribed form authorizes disclosure only to the extent the information would “facilitate the investigation and evaluation” or defense of the health care claim described in the Regians’ notice. Tex. Civ. PRAC.
&
Rem.Code § 74.052(c). Accordingly, under the circumstances presented, we conclude that HIPAA does not preempt section 74.052(c).
III. Adequate Remedy by Appeal
We finally consider whether mandamus is an appropriate remedy in this case. Collins argues that mandamus is warranted because the trial court’s order thwarts important public policies embodied in section 74.052(c). We agree. If the Legislature intended to provide health care liability defendants with an informal, expedited means of evaluating the merits of a health care claimant’s claims, then the order here undermines that purpose. Consequently, we hold that Collins has no adequate remedy by appeal.
See In re McAllen Med. Ctr., Inc.,
275 S.W.3d 458, 469 (Tex.2008).
IV. Conclusion
For the foregoing reasons, we hold that the trial court abused its discretion in granting the protective order under the
circumstances of this case. We further hold that Collins has no adequate remedy by appeal. Accordingly, we conditionally grant the writ of mandamus and order the trial court to vacate its protective order. We are confident the trial court will comply, and our writ will issue only if it does not.