JOHNSON & JOHNSON HEALTH CARE SYSTEMS INC. v. SAVE ON SP, LLC

• Court: District Court, D. New Jersey
• Decided: June 10, 2025
• Docket: 2:22-cv-02632
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY

JOHNSON & JOHNSON HEALTH CARE SYSTEMS INC., Civil Action No. 22-02632 (CCC) (CLW)

Plaintiff, OPINION AND ORDER v. SAVE ON SP, LLC et al, Defendants.

CATHY L. WALDOR, U.S.M.J. This matter comes before the Court upon Express Scripts, Inc., and Accredo Health Group, Inc.’s Appeal of the Special Master’s Order to Compel Discovery pursuant to Federal Rule of Civil Procedure 53(f)(2) and Local Rule 72.1(c)(1) entered on April 7, 2025, by Special Master Freda Wolfson, U.S.D.J. (ret.). (ECF No. 582). In accordance with Federal Rule of Civil Procedure 78 and Local Civil Rule 78.1, the Court addresses Express Scripts, Inc., and Accredo Health Group, Inc.’s appeal without oral argument. Upon careful consideration of the record for this matter, and for the reasons discussed herein, Express Scripts, Inc., and Accredo Health Group, Inc.’s appeal is DENIED, and the Special Master’s Order is AFFIRMED. I. RELEVANT BACKGROUND AND PROCEDURAL HISTORY Plaintiff Johnson & Johnson Health Care Systems, Inc. (“Plaintiff”) initiated this action against Defendants Save On SP, LLC, Express Scripts, Inc. (“ESI”), and Accredo Health Group, Inc. (“Accredo”), for their alleged involvement in a scheme to procure financial benefit by thwarting Plaintiff’s payment assistance program intended to provide financial assistance for patients using certain costly prescription medications. (See generally, Second Amended Complaint, ECF No. 618). Prior to the addition of Defendants Accredo and ESI to the present dispute on October 2, 2024, (see First Amended Complaint, ECF No. 395), this Court entered a

Discovery Confidentiality Order on November 22, 2022, (ECF No. 62), which counsel to ESI and Accredo later endorsed in connection with Plaintiff’s service of third-party subpoenas on November 10, 2023. (See Motion to Compel, Ex. 3, ECF No. 507-1). The Confidentiality Order provides that this action is likely to involve the disclosure of significant confidential health information for patient-subscribers. (See Discovery Confidentiality Order, ECF No. 62). The term “Confidential Health Information” (“CHI”) incorporates all “protected health information” (“PHI”) as defined by the Standards for Privacy of Individually Identifiable Health Information, 45 CFR parts 160 and 164, promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). (Id. at ¶ 3(a)). For the purposes of this litigation and subject to the conditions within the Confidentiality Order, the parties are to

produce all unredacted CHI, including PHI, in response to a discovery request. (Id. at ¶ 3(c)). Upon the conclusion of this litigation, the parties are mandated to destroy or return material produced or notes derived from the receipt of confidential materials subsumed within the scope of the Confidentiality Order. (Id. at ¶ 19). The Confidentiality Order’s intended purpose is to constitute a “Qualified Protective Order” as understood by HIPAA and its accompanying regulations. (Id. at ¶ 3(d)).1 On December 12, 2024, having recognized that this action would entail significant discovery and case management, the undersigned issued an Order appointing the Honorable Freda

1 The Court will refer to the Confidentiality Order as a “Qualified Protective Order” interchangeably, though both are the same. L. Wolfson, U.S.D.J. (ret.) (“Special Master”) as a Special Master to oversee the progression of discovery and to resolve discovery disputes. (Order Appointing Special Master, ECF No. 184). Between October 2024 and January 2025, after Plaintiff included Accredo and ESI as Defendants, the parties began exchanging documents and initiated meet and confer efforts to resolve certain

PHI redactions made by ESI and Accredo. (Motion to Compel, Exs. 1–10, ECF No. 507-1). Those efforts reached an impasse, and Plaintiff filed a Motion to Compel the Production of Documents Without Redaction pursuant to the Confidentiality Order on February 3, 2025. (Motion to Compel, ECF No. 507). ESI and Accredo opposed the Motion, contending that it must comply with both HIPAA and the Confidentiality Order because the Confidentiality Order “does not explicitly require that [ESI] and Accredo produce PHI without regard to HIPAA’s ‘minimum necessary rule’” absent a court order or a sufficient explanation from Plaintiff as to why the information it seeks meets the “minimum necessary rule.” (Opposition to Motion to Compel at 2– 3, ECF No. 525). In reply, Plaintiff asserted that the language of the Confidentiality Order envelops PHI in its definition of CHI, and that PHI should have been produced unredacted because

the Confidentiality Order constitutes an exception to HIPAA’s “minimum necessary rule” as a disclosure required by law. (Reply to Opposition to Motion to Compel at 3–4, ECF No. 531). At oral argument before the Special Master, ESI and Accredo argued that HIPAA regulations distinguish disclosures made by law pursuant to 45 C.F.R. § 164.512(a) and disclosures permitted within judicial and administrative procedures under to 45 C.F.R. § 164.512(e). (Plf. Appeal Opposition Brief, Ex. 3 at 60–64, ECF No. 643-2). ESI and Accredo took the position that the regulations do not include civil discovery responses in the definition of “required by law” under 45 C.F.R. § 164.103, and therefore the “minimum necessary rule” applies to disclosures made within judicial and administrative procedures. (Id. at 62–64). And because the Confidentiality Order notes that it is a Qualified Protective Order as contemplated by § 164.512(e), ESI and Accredo asserted that the parties did not agree for the producible content governed by the Confidentiality Order to qualify as a disclosure “required by law” under § 164.512(a). (Id. at 63– 65). Thus, in order to comply with HIPAA, ESI and Accredo proposed that Plaintiff must identify

the specific information it seeks for them to produce documents consistent with HIPAA’s “minimum necessary rule.” (Id.). In response, Plaintiff argued that the HIPAA-compliant Confidentiality Order requires production of unredacted PHI and that ESI and Accredo are simply violating its terms. (Id. at 67–70). The Special Master rejected ESI and Accredo’s arguments, stating that the Confidentiality Order was not favorable to their position and ordered the PHI to be produced unredacted. (Id. at 71). On April 7, 2025, the Special Master entered an order with an accompanying opinion to that effect. (Special Master Opinion, ECF No. 582). In her written opinion, the Special Master construed the HIPAA regulations and applicable caselaw to determine that the “minimum necessary requirement” does not apply in judicial proceedings where a qualified protective order

is in place and that the information sought by Plaintiff fell within the scope of the Confidentiality Order, thereby subjecting the requested CHI to the safeguards established by HIPAA. (Id. at 23– 25). Pursuant to Federal Rule of Civil Procedure 53(f), ESI and Accredo filed an objection to the Special Master’s Order. (Appeal of Special Master Order, ECF No. 600). Plaintiff filed an opposition, (ECF No. 643), and ESI and Accredo filed a reply, (ECF No. 651). II. LEGAL STANDARD a. Standard of Review The Order Appointing the Special Master incorporates Federal Rule of Civil Procedure 53(f), which governs this Court’s review of the Special Master’s order compelling discovery. (See Order Appointing Special Master ¶10, ECF No. 184). According to Rule 53(f), the Court reviews factual findings and legal conclusions de novo and reviews procedural matters for an abuse of

discretion. Fed. R. Civ. P. 53(f)(3)–(5). “The phrase ‘de novo determination’ . . . means an independent determination of a controversy that accords no deference to any prior resolution of the same controversy.” United States v. Raddatz, 447 U.S. 667, 690 (1980) (Stewart, J., dissenting). However, for procedural matters, the Special Master’s decision may only be set aside for an abuse of discretion. Fed. R. Civ. P. 53(f)(5). Similar to that of a Magistrate Judge, the Special Master’s management of the discovery process “is entitled to great deference.” See Schiano v. MBNA, No. 05-cv-01771, 2009 WL 1416040, at *3 (D.N.J. May 19, 2009); Honeywell v. Minolta Camera Co., No. 87-cv-04847, 1990 WL 66182, at *1 (D.N.J. May 15, 1990). In applying the same standard of review for decisions of a Magistrate Judge to the

Special Master, the Court may reverse the Special Master’s non-dispositive decision only if it was clearly erroneous or contrary to law. See L. Civ. R. 72.1(c)(A); McDonough v. Horizon Blue Cross Blue Shield of N.J., Inc., No. 09-0571, 2013 WL 322595, at *2 (D.N.J. Jan. 22, 2013). A “finding is clearly erroneous when, although there may be some evidence to support it, the reviewing court, after considering the entirety of the evidence, is left with the definite and firm conviction that a mistake has been committed.” Coyle v. Hornell Brewing Co., No. 08-cv-2797, 2009 WL 1652399, at *3 (D.N.J. June 9, 2009) (quoting Kounelis v. Sherrer, 529 F. Supp. 2d 503, 518 (D.N.J. 2008)). “A [ruling] is contrary to law if the magistrate judge has misinterpreted or misapplied applicable law.” Gunter v. Ridgewood Energy Corp., 32 F. Supp. 2d 162, 164 (D.N.J. 1998). “The party filing the notice of appeal bears the burden of demonstrating that the magistrate judge’s decision was clearly erroneous or contrary to law.” Marks v. Struble, 347 F. Supp. 2d 136, 149 (D.N.J. 2004) (quoting Cardona v. Gen. Motors Corp., 942 F. Supp. 968, 971 (D.N.J. 1996)). b. Principles of Statutory and Regulatory Interpretation

Because this appeal concerns whether the “minimum necessary rule” applies in judicial proceedings where a qualified protective order is in place, the Court must interpret and apply HIPAA’s statutory and regulatory text, which is a question of law this Court must review de novo. Idahoan Fresh v. Advantage Produce, Inc., 157 F.3d 197, 202 (3d Cir. 1998) (citing Shell Oil Co. v. Babbitt, 125 F.3d 172, 175 (3d Cir. 1997)). “It is the cardinal canon of [regulatory] interpretation that a court must begin with the [regulatory] language.” In re Philadelphia Newspapers, LLC, 599 F.3d 298, 305 (3d Cir. 2010). When interpreting a regulation, the Court must avoid an interpretation which renders superfluous any element of the text. Id. (collecting cases). The Court must also read the entire statutory and regulatory text in a way that renders the provisions compatible. United States v. Bass, 404 U.S. 336, 344 (1971). As such, the Court must “read the

[regulation] in its ordinary and natural sense.” Harvard Secured Liquidation Tr. v. I.R.S., 568 F.3d 444, 451 (3d Cir. 2009). The Court may only defer to an agency’s interpretation of its own regulation when a genuine ambiguity exists after it exhausted “all the ‘traditional tools’ of construction.” Kisor v. Wilkie, 588 U.S. 558, 559 (2019) (citing Chevron U.S.A. Inc. v. Natural Res. Defense Council, Inc., 467 U.S. 837, 843 n.9 (1984), overruled on other grounds by Loper Bright Enters. v. Raimondo, 603 U.S. 369 (2024)). “A provision is ambiguous only where the disputed language is ‘reasonably susceptible of different interpretations.’” In re Philadelphia, 599 F.3d at 304 (quoting Dobrek v. Phelan, 419 F.3d 259, 264 (3d Cir. 2005)). “When the words of a statute are unambiguous, then this first canon is also the last: judicial inquiry is complete.” Conn. Nat’l Bank v. Germain, 503 U.S. 249, 253–54 (1992) (internal citations and quotations omitted); see also Hartford Underwriters Ins. v. Union Planters Bank, N.A., 530 U.S. 1, 6 (2000) (“[W]hen a [regulation’s] language is plain, the sole function of the courts, at least where the disposition by the text is

not absurd, is to enforce it according to its terms.” (first alteration in original)). c. Relevant HIPAA Provisions HIPAA is a complex stature intended to address the exchange for health-related information. Nat. Abortion Fed. v. Ashcroft, No. 03-cv-8695, 2004 WL 555701 at *2 (S.D.N.Y. Mar. 19, 2024). Congress delegated to the Secretary of Health and Human Services authority to promulgate regulations, among other things, to protect the privacy of PHI. See 45 C.F.R. § 164.500–.534; South Carolina Med. Ass’n v. Thompson, 327 F.3d 346, 349 (4th Cir. 2003). Relevant to the present dispute, the HIPAA rules generally prevent a covered entity—such as the Defendants here—from using or disclosing protected health information except as permitted or required, inter alia, to comply with § 164.512. 45 C.F.R. § 164.502(a). But when using or

disclosing protected health information, a covered entity must make reasonable efforts to protect such information by disclosing the minimum information necessary to satisfy the requested disclosure. Id. at (b)(1). This is the “minimum necessary requirement” central to the present dispute. One of the exceptions to the “minimum necessary requirement” is uses or disclosures required by law provided by § 164.512(a). Id. at (b)(2)(v). Under § 164.512(a), (1) A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. (2) A covered entity must meet the requirements described in paragraph . . . (e) . . . of this section for uses or disclosures required by law.

45 C.F.R. § 164.512(a) (emphases added). The term “required by law” means a mandate compelling “an entity to make a use or disclosure of protected health information that is enforceable in a court of law” and “includes, but is not limited to, court orders.” 45 C.F.R. § 164.103 (emphases added). Paragraph (e) of § 164.512 governs disclosures for judicial and administrative proceedings. It permits disclosure in either one of two circumstances. The first permits disclosure “[i]n response to an order of a court . . . provided that the covered entity discloses only the protected health information expressly authorized by such order.” 45 C.F.R. § 164.512 (e)(1)(i). The second permits disclosure “in response to a [ ] discovery request [ ] that is not accompanied by an order of a court” provided that “the covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v).” 45 C.F.R. § 164.512 (e)(1)(ii) (emphases added). Paragraph (e)(1)(iv) provides that a covered entity receives a satisfactory assurance from the party seeking PHI when the covered entity receives a writing that the parties to the dispute agreed to a qualified protective order and have presented it to the court or the party seeking PHI made an application to the court for a qualified protective order. Id. at (e)(1)(iv). A qualified protective order means “an order of a court” or “a stipulation by the parties to the litigation” that: (A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and (B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.

Id. at (e)(1)(v). Put simply, paragraph (e) permits a covered entity to “disclose medical information without violating HIPAA if served with (1) a court order authorizing the disclosure of such information or, alternatively, (2) a formal discovery request accompanied by certain required assurances and notices.” Howard v. Rustin, No. 06-cv-0200, 2007 WL 2811828 at *2 (W.D. Pa. Sept. 24, 2007). III. DISCUSSION a. The Parties’ Arguments ESI and Accredo’s objection to the Special Master’s decision rests on the premise that HIPAA’s “minimum necessary requirement” applies in judicial proceedings because the term “judicial proceedings” is not expressly listed as an exception to the requirement under § 164.502 (b)(2). (Appeal of Special Master Order at 10–11, ECF No. 600). ESI and Accredo advance that “required by law” exception under § 164.515(a) has two independent sub-parts, and that the existence of the Qualified Protective Order here is sufficient to satisfy § 164.515(a)(2) but not § 164.512(a)(1). (Id. at 12–14). Instead, they posit that absent an additional court order to mandate or compel the disclosure PHI, disclosure in response to Plaintiff’s requests for production § 164.515(e) is not a disclosure “required by law” according to § 164.515(a), and consequently, the “minimum necessary rule” applies to the disclosure. (Id. at 14–18). ESI and Accredo additionally contend that the Special Master’s decision ordering compulsion of unredacted PHI in accordance with the Qualified Protective Order does not satisfy the “required by law” subparts under subsection (a) because her order did not exist before the Special Master held that the “minimum necessary rule” was inapplicable. (Id. at 18). ESI and Accredo further challenge the Special Master’s decision to compel unredacted PHI on the basis that Plaintiff did not articulate the specific categories of PHI that are necessary for discovery, and therefore, requests the Court to particularize which PHI must be disclosed if the Court orders disclosure. (Id. at 19–24). In opposition, Plaintiff asserts that ESI and Accredo waived much of their statutory

interpretation arguments—specifically, the arguments concerning Auer deference to the Department of Health and Human Services’ interpretation of the HIPAA rules and the canon against surplusage. (Opposition to Appeal at 11–13, ECF No. 643). Plaintiff contends that a covered entity may use or disclose PHI to the extent it complies with a court order so long as the requirements of § 164.515(e) are met, which mandate that a covered entity disclosing PHI pursuant to a discovery request ensures that the party seeking PHI receives a satisfactory assurance by making reasonable efforts to secure a Qualified Protective Order. (Id. at 14–15). Plaintiff argues that § 164.515(a)(1) has an independent meaning because disclosure of PHI would have to comply with the terms set forth by the Qualified Protective Order, and therefore, the “minimum necessary rule” does not apply when a Qualified Protective Order is in place. (Id. at 15–20 & 15, n.2).

Finally, Plaintiff asserts that the Special Master correctly found that all relevant, non-privileged CHI was critical to developing its case and that it needs unredacted CHI because Defendants employed varying methods to track patient-subscriber identification. (Id. at 21–22). In reply, ESI and Accredo contend that Plaintiff’s reading of § 164.515(a) is incorrect and that the “minimum necessary rule” does not apply only if (1) disclosure is required by law and (2) a Qualified Protective Order exists. (Reply at 8–9, ECF No. 651). They assert, that under Plaintiff’s reading, both subparts of paragraph (a) would have identical—not independent— meaning. (Id. at 9–10). ESI and Accredo propose that the Qualified Protective Order does not render the production “required by law” because it does not mandate production and ESI and Accredo cannot limit their disclosure to what is explicitly required by the Qualified Protective Order. (Id. at 11). Therefore, ESI and Accredo aver that if the Qualified Protective Order does not compel production of PHI, then it must meet the “necessary rule” because HIPAA contemplates that the Court will conduct a “specific analysis” before ordering production of “specific PHI,” and

that the Special Master failed to conduct that analysis here. (Id. at 12–14). The Court is not persuaded by ESI and Accredo’s reading of the HIPAA regulations. As an initial matter, ESI and Accredo’s reliance on the Department of Human Health and Services’ interpretation of the HIPAA regulations mandates a finding that the regulations are truly ambiguous after exhausting all traditional means of statutory interpretation. See Kisor, 588 U.S. at 559. The Court will not make such a finding as it was not before the Special Master. “It is well- settled that arguments not presented to a [Special Master] and raised for the first time on appeal are deemed waived.” Easterday v. USPack Logistics, LLC, No. 15-cv-7559, 2020 WL 7137859 at *4 (D.N.J. Dec. 4, 2020). An argument is “waived unless a party raises it in its opening brief, and for those purposes, ‘a passing reference to an issue . . . will not suffice to bring that issue before

this court.’” Laborers’ Int’l Union of N.A. v. Foster Wheeler Energy Corp., 26 F.3d 375, 398 (3d Cir. 1994) (quoting Simmons v. City of Philadelphia, 947 F.2d 1042, 1066 (3d Cir. 1991)). The questions this Court must address therefore remain whether the Special Master correctly construed HIPAA’s regulations to determine that the “minimum necessary rule” does not apply, and if so, whether the Special Master properly compelled production of unredacted PHI pursuant to the terms of the Qualified Protective Order. The Court answers both questions in the affirmative. b. The “Minimum Necessary Rule” Does Not Apply This Judicial Proceeding Because Both Subsections of § 164.512(a) Have Been Established As both parties acknowledge, for the “required by law” exception to the “minimum necessary rule” to apply, both subsections of § 164.512(a) must be met. Meaning, the covered entity must: (1) use or disclose PHI to the extent required by law and in accordance with such law; and (2) comply with subsection (e). See 45 C.F.R. § 164.512(a). To satisfy paragraph (a)(1), there must be a court order mandating a covered entity to make use of or disclose PHI and that order must be enforceable in the court. See 45 C.F.R. § 164.103(a)(1). The Court finds the first prong unquestionably met here. The Qualified Protective

Order entered by this Court mandates PHI to be disclosed in discovery unredacted. (See Discovery Confidentiality Order ¶ 3(c) (“[T]he parties shall produce Discovery Material containing Confidential Health Information in response to discovery requests of another party in this litigation without redaction,” (emphases added)), ECF No. 62). The Qualified Protective Order is nonetheless an enforceable order of this Court to make use of CHI—including PHI—in discovery subject to its terms. Any violation of the order may be punished by sanctions, including contempt of the Court. (See id. ¶ 21). And ESI and Accredo twice assented to the terms of the Qualified Protective Order—once as non-parties and then after they became named defendants. (See Motion to Compel, Exs. 1, 2, & 3, ECF No. 507-1). Accordingly, once this Court entered the Qualified Protective Order, it became a mandate in law requiring ESI and Accredo to disclose all PHI

throughout discovery subject to the terms of the Order. (See Discovery Confidentiality Order ¶ 3(c), ECF No. 62). As the Special Master astutely observed, it is no surprise that courts do not apply the “minimum necessary” analysis when a HIPAA Qualified Protective Order is in place. (Special Master Opinion at 14, ECF No. 582). This is because “it is evidently denudate that a purpose of HIPAA was that health information, that may eventually be used in litigation or court proceedings, should be made available during the discovery phase.” Bayne v. Provost, 359 F. Supp. 2d 234, 237 (N.D.N.Y. 2005). Therefore, when a valid protective order permits PHI disclosure tailored to the conditions set forth within it, HIPAA serves as no additional barrier. See Ruggles v. WellPoint,

Inc., No. 08-cv-0201, 2010 WL 11570681, at *14 (N.D.N.Y. Dec. 28, 2010); Lowe v. Vadlamudi, No. 08-cv-10269, 2010 WL 2474806, at *3 (E.D. Mich. June 4, 2010).2 Turning to the second requirement of paragraph (a), the covered entity must ensure compliance with paragraph (e). See 45 C.F.R. § 164.103(a)(2). Compliance with paragraph (e) sufficient to satisfy prong two of § 164.512(a) requires that the covered entity respond either to a court order authorizing disclosure, or a formal discovery request accompanied by assurances from the party seeking PHI. Howard, 2007 WL 2811828 at *2. A “satisfactory assurance” is provided by documents that demonstrate that the parties agreed to a Qualified Protective Order and presented it to the court or that party seeking the protected information has requested a Qualified Protective Order from the court. 45 C.F.R. § 164.512(e)(1)(iv). Contrary to ESI and Accredo’s

reading of the “required by law” sub-parts, it is not the Court’s entry of the Qualified Protective Order which establishes compliance with paragraph (e) sufficient to establish prong two of § 164.512(a), but that efforts were made to secure one in connection with Plaintiff’s formal discovery

2 The Court finds no merit in ESI and Accredo’s proposition that the Special Master’s order compelling discovery of unredacted PHI also does not satisfy § 164.512(a) because the order did not exist before she held that the “minimum necessary rule” did not apply. Indeed, various other courts have recognized that, although not required by the HIPAA rules, an order compelling discovery used in conjunction with a protective order bolsters HIPAA’s strong policy to protect patient medical information. See Howard, 2007 WL 2811828 at *3 n.5; Ruggles, 2010 WL 11570681, at *14; E.E.O.C. v. Boston Market Corp., No. 03-cv-4227, 2004 WL 3327264, at *4 n.5 (E.D.N.Y. Dec.16, 2004); Law v. Zuckerman, 307 F. Supp. 2d 705, 711 (D. Md. 2004). ESI and Accredo assert no legal authority to the contrary. For all intents and purposes, the Special Master’s order authorizing and compelling discovery of all PHI subject to the terms of the Qualified Protective Order independently satisfies the “required by law” exception to the “minimum necessary rule.” requests. And because the Court entered one here, it therefore follows that both paragraphs (e) and (a)(2) have been met. Because the Court finds that both sub-parts of paragraph (a) are established, ESI and Accredo’s PHI disclosures in response to Plaintiff’s document requests are not subject to HIPAA’s

“minimum necessary requirement.” See Handy v. Del. River Surgical Suites, LLC, No. 19-cv- 1028, 2024 WL 1539599 at *4, *6 (E.D. Pa. Feb. 29, 2024) (ordering compulsion of unredacted PHI and patient lists after finding that the “minimum necessary rule” did not apply because a Qualified Protective Order existed); MSP Recovery Claims, Series, LLC v. Sanofi-Aventis U.S. LLC, No. 18-cv-2111, 2023 WL 4562998 at *5 (D.N.J. July 14, 2023) (finding the “minimum necessary requirement” inapplicable to disclosures required by law because a Qualified Protective Order was in place to secure confidential information); Jackson v. Wexford Health Sources, Inc., No. 20-cv-0900, 2022 WL 3644158 at *5 n.4 (S.D. Ill. Aug. 24, 2022) (rejecting defendant’s proposed insertion of a “minimum necessary” PHI disclosure provision into the parties’ proposed amended Qualified Protective Order because the requirements of § 164.512(a) were satisfied).

This Court therefore holds that the “minimum necessary rule” does not apply because the existence of the Qualified Protective Order mandating compulsion of all unredacted PHI in connection with the Plaintiff’s discovery requests satisfies § 164.512(a). The Special Master’s decision is affirmed. c. Plaintiff Asserts Good Reason to Seek All Unredacted PHI This Court rejects ESI and Accredo’s challenge to the Special Master’s order compelling disclosure of all unredacted PHI. ESI and Accredo again do not assert any law to support the argument that the Special Master abused her discretion by ordering all unredacted PHI to be propounded in discovery in accordance with the Qualified Protective Order. Additionally, the Court discerns no clear errors of law. Consequently, the Court defers to and adopts the Special Master’s reasoning that Plaintiff adequately exhibited a need for all PHI. See L. Civ. R. 72.1(c)(A); McDonough, 2013 WL 322595, at *2. Accordingly, the Special Master’s order compelling disclosure of unredacted PHI pursuant to the terms of the Qualified Protective Order is affirmed. For the avoidance of doubt, the Court finds that good cause exists to produce all unredacted

PHI because it is within the scope of discoverable information provided by the Qualified Protective Order and Plaintiff asserted sufficient reason for acquiring such unredacted information as a result of the inconsistent manner in which ESI and Accredo tracked patient-subscribers. (Opposition to Appeal at 21–22, ECF No. 643). Additionally, the Qualified Protective Order obviates the need for ESI and Accredo’s confidentiality concerns because PHI may only be used in connection with this litigation and PHI obtained during the proceedings must be returned or destroyed at the conclusion of the litigation. (See Discovery Confidentiality Order ¶ 19, ECF No. 62). Indeed, the Qualified Protective Order is more protective than what HIPAA requires because it affords the producing parties the ability to place an “Attorneys’ Eyes Only” designation on any document with sensitive information. (Id. at ¶ 2). ESI and Accredo must produce all CHI and PHI unredacted

as defined by Paragraph 3 of the Confidentiality Order. IV. CONCLUSION Based on the foregoing, Express Scripts, Inc., and Accredo Health Group, Inc.’s appeal is DENIED, and the Special Master’s Order is AFFIRMED. The “minimum necessary rule” does not apply here, and Plaintiff adequately articulated a need for disclosure of all PHI within the scope of the Qualified Protective Order. It therefore is on this 10th day of June, 2025, ORDERED that the Special Master’s Order (ECF No. 582) is AFFIRMED; and it is further ORDERED that ESI and Accredo produce all unredacted CHI and PHI requested by Plaintiff in discovery in accordance with Paragraph 3 of the Qualified Protective Order.

s/ Cathy L. Waldor Hon. Cathy L. Waldor United States Magistrate Judge

Cc: Hon. Claire C. Cecchi, U.S.D.J. Hon. Freda L. Wolfson, U.S.D.J. (ret.), Special Master