Smith v. American Home Prod. Corp.

855 A.2d 608, 372 N.J. Super. 105

• Court: New Jersey Superior Court Appellate Division
• Decided: September 23, 2003
• Status: Published

Opinion

855 A.2d 608 (2003) 372 N.J.Super. 105

Theresa SMITH Plaintiff,
v.
AMERICAN HOME PRODUCTS CORP. WYETH-AYERST PHARMACEUTICAL, et al., Defendants.

Superior Court of New Jersey, Law Division, Middlesex County.

Argued August 8, 2003. Decided September 23, 2003.

Ellen Relkin (Weitz & Luxenberg), New York City and Kevin Haverty (Williams, Cuker & Berezofsky, Philadelphia, PA), for plaintiff.

Anita Hotchkiss (Porzio, Bromberg & Newman), Morristown and Kevin Gardner (Connell Foley), Roseland, for defendants.

Anne Patterson (Riker, Danzig, Scherer, Hyland & Perretti), Morristown, for amicus curiae New Jersey Defense Association.

Diane Sullivan (Dechert), Princeton, for amicus curiae Defense Research Institute.

Mark Lesser (Kronisch & Lesser), Livingston, for amicus curiae Association of Trial Lawyers of America.

CORODEMUS, J.S.C.

Presently before this court is a unified motion by defendants, the phenylpropanolamine ("PPA") manufacturers, compelling ex parte physician interviews and seeking judicial approval of a revised medical authorization. Plaintiffs, consumers of PPA, allege injuries caused from the use of the drug claiming that regulations promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996, Pub.L. 104-191, effective April 14, 2003, ("HIPAA") preempt the informal discovery procedures as permitted under Stempler v. Speidell, 100 N.J. 368, 495 A.2d 857 (1985). Plaintiffs contend that defendants' proposed medical authorization is moot as the standards under Stempler are less stringent than the federal act requiring patients' "protected health information" ("PHI"). 45 C.F.R. § 164.501. The issue of HIPAA's preemption of Stempler is one of first impression in New Jersey.

For the reasons set forth below, the court holds that HIPAA is an express but selective preemption of New Jersey law. It does not conflict with the general principles of N.J.S.A. 2A:84A-22.4^[1] and the informal discovery techniques permitted under Stempler. However, the current proposed medical authorization offered by the defense does not comport with HIPAA or the Stempler safeguards. Therefore, the motion is granted in part, denied in part.

I. BACKGROUND

A. HIPAA and the Privacy Rule.

In 1996, the United States Congress enacted the HIPAA, 42 U.S.C.A. § 1320(d) et seq. (HIPAA or "the Act"). One of the primary purposes of the Act is to standardize and increase the efficiency of common electronic transactions in health care through the "administrative simplification"^[2] provisions of HIPAA as well as to protect the security and privacy of individually identifiable health information ("IIHI").^[3] Congress entrusted the Secretary of the Department of Health and Human Services with the task of creating national standards to "ensure the integrity and confidentiality of the information" to be collected and disseminated. 42 U.S.C.A. § 1320d-2(d)(2)(A). The regulations promulgating these standards as created by the Department of Health and Human Services became effective on April 14, 2003, and are collectively known as "the Privacy Rule," which sets forth standards and procedures for the collection and disclosure of "protected health information" ("PHI").^[4] The Privacy Rule establishes patients' rights and requires that health professionals implement various procedures regarding the use of and access to health care information. It prohibits "covered entities" from using and disclosing PHI except as required or permitted by the regulations. 45 C.F.R. § 164.501 and 45 C.F.R. § 160.103. There are three categories of "covered entities": (1) health plans; (2) health care clearing-houses; and (3) health care providers. 45 C.F.R. § 160.103.^[5]

The Privacy Rule prohibits covered entities from using or disclosing PHI in any form oral, written or electronic, except as permitted under the Privacy Rule. 45 C.F.R. § 164.502(a). "Use" and "disclosure" are defined very broadly. 45 C.F.R. § 164.501. "Use" includes an examination of PHI; "disclosure" includes divulging or providing access to PHI. The Privacy Rule is also centered on the concept that, when using PHI or when requesting PHI from another covered entity, a covered entity must make reasonable efforts to limit PHI to the "minimum necessary" to accomplish the intended purpose of the use, disclosure or request. 45 C.F.R. § 164.508. In other words, even if a use or disclosure of PHI is permitted, covered entities must make reasonable efforts to disclose only the minimum necessary to achieve the purpose for which it is being used or disclosed. The "minimum necessary" standard was implemented to prevent improper disclosure of PHI, yet to be flexible where a patient waives his or her privacy privilege for confidential medical information.

B. The New Jersey Supreme Court Permits Defense Counsel to Conduct Ex Parte Interviews with Plaintiff's Treating Physicians.

By virtue of filing a suit for personal injury, the plaintiff has placed his or her medical condition in issue, and consequently, has waived some of his or her privacy privilege. Stempler v. Speidell, supra, 100 N.J. at 373, 495 A.2d at 859 (1985) (citing N.J.S.A. 2A:84A-22.1 to -22.7). In Stempler, the Court found that the costs incurred and the time expended during trial preparation justified "personal interviews" as an "informal method of assembling facts and documents in preparation for trial." Id. at 382, 495 A.2d at 864. Defendants often conduct personal interviews of the treating physician of a plaintiff that has filed a suit for personal injury. These informal, personal interviews generally take place outside the presence of plaintiff's counsel. The New Jersey Supreme Court permits defendants to conduct these ex parte interviews of a plaintiff's health care provider so long as the defendant complies with specific patient authorization requirements. Id. at 373-82, 495 A.2d at 859-64. Those requirements are that defense counsel must: "provide plaintiff's counsel with reasonable notice of the time and place of the proposed interview; provide the physician with a description of the anticipated scope of the interview; and communicate with `unmistakable clarity' the fact that the physician's participation in an ex parte interview is voluntary." Id. at 382, 495 A.2d at 864.

II. CONTENTIONS OF THE PARTIES

A. Defendants Argue that Stempler Interviews are Permissible Under HIPAA.

1. Stempler interviews are consistent with HIPAA.

Defendants' briefs and reply assert that there is no conflict between Stempler and HIPAA. They base this declaration on the fact that once a plaintiff has waived his patient-physician privilege, there is no conflict between Stempler and HIPAA. Therefore, according to defendants, this court's preemption analysis is not warranted. HIPAA's broad statutory purpose, according to the defendants, is in harmony with Stempler. The primary purpose of HIPAA, as reflected in its legislative history, is aimed at regulating the commercial behavior of the national health care industry. 68 Fed.Reg. 8334 (Feb. 20, 2003). Any argument that HIPAA supercedes any state law is limited to that provision of state law that requires medical or health plan records to be maintained or transmitted in written rather than electronic form. 42 U.S.C.A. § 1320d-7.

More importantly, the defendants note that HIPAA recognizes that a patient who may be a plaintiff in a personal injury case can waive his or her patient-physician privilege by expressly permitting the unrestricted use and disclosure of PHI through the use of a valid authorization.^[6] 45 C.F.R. §§ 164.508, 164.502(b)(2). This provision is identical to the New Jersey statute that allows waiver of the patient-physician privilege when a personal injury case is placed into suit. N.J.S.A. 2A:84A-22.4.

Defendants disagree with plaintiffs' contention that HIPAA requires in all circumstances that "only minimal necessary amounts of [protected health] information... may be disclosed," pointing out that 45 C.F.R. § 164.502(b)(1) involves duties of a commercial nature such as billing, submitting insurance claims for payment and the like, i.e. where specific minimum information is needed in a personal injury case.

Defendants strongly take issue with plaintiffs' reliance of the "minimal necessary" standard, which does not apply to the requirement section (iii) uses or disclosures made pursuant to an authorization under 45 C.F.R. § 164.508. They claim: "Section 164.508 affirms that an authorization is a means by which a covered entity can use and disclose protected health care information, and the section provides the form requirements for a valid HIPAA authorization."

Defendants also contend that psychologists', psychiatrists', and therapists' interviews are appropriate where plaintiff's mental or emotional condition is in issue. Defendants rely upon the Appellate Division statement that stated in no uncertain terms:

[A] psychologist may be compelled to reveal relevant confidences of treatment when the patient tenders her mental or emotional condition in issue during the course of litigation. Under such circumstances, the patient's communications to her psychotherapist should not be enshrouded in the veil of absolute privilege. Rather, important public policy considerations favoring liberal pre-trial discovery compel disclosure of all relevant information.

[Arena v. Saphier, 201 N.J.Super. 79, 81, 492 A.2d 1020, 1021 (App.Div.1985).]

Defendants claim that the waiver of the psychologist-patient privilege has been upheld by the New Jersey Supreme Court in Kinsella v. Kinsella, 150 N.J. 276, 302-03, 696 A.2d 556, 569-70 (1997). In Kinsella, the Court recognized that given the sensitive and personal nature of the communications between psychologist and the patient, along with the critical role confidentiality has in the success of mental health therapy, this privilege is likened to the attorney-client privilege. However, as in the attorney-client privilege, there exist very narrow circumstances that permit piercing this protection. Id. at 330, 696 A.2d at 584. HIPAA also provides for the use and disclosure of PHI, specifically psychotherapy notes, so long as a valid authorization is employed. 45 C.F.R. § 164.508(a)(2). Defendants offer to provide plaintiffs with a revised HIPAA-compliant authorization that will permit the production of psychological records only in accordance with the appropriate protocol. Defendants further contend that adequate safeguards already exist in Stempler to protect the patient from unnecessary disclosure.

2. HIPAA does not preempt informal interview authorized by Stempler.

The defendants contend that Stempler is not inconsistent with HIPAA and that they should be permitted to continue with discovery as it has been routinely sought prior to the HIPAA amendments taking effect. In order to accommodate plaintiffs' perceived concerns with HIPAA, defendants, in April 2003, proposed a revised medical authorization. In May 2003, plaintiffs objected to the continued informal discovery procedures as permitted by Stempler and sought a ruling requiring that "a deposition, where all procedural safeguards [sic] exist is a more appropriate avenue to obtain the information sought without the potential HIPAA issues." Defendants' argument endorses a traditional Stempler rationale. Citing specific amendment exceptions, 45 C.F.R. § 164.508 and § 164.502(b)(2), defendants state that when a patient puts his or her medical condition in issue by filing a suit for personal injuries, he or she waives the patient-physician privilege and authorizes discovery of his or her medical condition, treatment and history. The waiver language is clear in New Jersey's lawsuit exception regarding patient-physician privilege. N.J.S.A. 2A:84A-22.4.

Second, defendants argue that in accordance with congressional intent, the Act serves as a "floor" for the regulation of electronic storage and commercial use of nationwide "customer" health information. The primary goal of HIPAA as reflected in the legislative history, is the regulation of the commercial behavior of the national health care industry:

The Department of Health and Human Services (HHS) Medicare Program, other Federal agencies operating health plans or providing health care, State Medicaid agencies, private health plans, health care providers, and health care clearinghouses must assure their customers (for example, the patients, insured individuals, providers and health plans) that the integrity, confidentiality and availability of electronic protected health information they collect, maintain, use or transmit is protected.

[68 Fed.Reg., supra, at 8334.]

In 1985, the New Jersey Supreme Court ruled that a defendant in such an action may conduct discovery in the form of ex parte interviews of plaintiff's health care provider (e.g., treating physician) as "an aid to defendant's discovery," provided the defendant complies with specific patient authorization requirements. Stempler, supra, 100 N.J. at 373-82, 495 A.2d at 859-64. The requirements of Stempler include affording the health care provider reasonable notice of the time and place of the interview, a description of the scope of the interview, and, with unmistakable clarity, advising the health care worker of the voluntariness of his or her participation. In particular, contained in the Stempler decision is the judicial reasoning that, "Personal interviews, although not expressly referred to in our Rules, are an accepted, informal method of assembling facts and documents in preparation for trial. Their use should be encouraged, as should other informal means of discovery that reduce the cost and time of trial preparation." Ibid. Therefore, as reasoned by defendants, since Plaintiffs have put their condition in question, then their medical conditions are subject to Stempler.

As to the HIPPA regulation, the defendants argue that the revised authorization satisfied the conditions of the amendments. HIPAA requires all patient authorizations for the use of protected health information to contain the necessary items. Defendants contend that so long as plaintiffs sign the proposed medical authorizations, there is nothing new that would preclude the health care interviews that traditionally occur.

B. Plaintiffs Argue that HIPAA Preempts Stempler v. Speidell.

Plaintiffs argue that HIPAA preempts the informal interviews authorized by Stempler. Plaintiffs contend that Stempler, decided eleven years prior to the HIPAA regulations, does not offer adequate safeguards required under the new privacy regulations. "To the extent that Stempler does not provide adequate safeguards against disclosure of non-litigation related health information, it is inconsistent with HIPAA and is expressly preempted by the statute and regulations promulgated pursuant to that law."

According to the plaintiffs, the Act and the Privacy Rule have

dramatically altered the way medical providers do business and the way parties in personal injury matters comport themselves as evidenced by the massive number of manuals, courses and Internet guides that have been generated in light of the April 14, 2003 effective date of HIPAA. It is not simply business as usual with new authorizations and ex parte interviews are certainly one of the major procedures that HIPAA has changed by virtue of express preemption.

Plaintiffs further assert that when informal discovery involves mental health care workers (e.g., psychologists or therapists), New Jersey statutes and the New Jersey Rules of Evidence provide a higher degree of protection than Stempler or HIPAA. See N.J.S.A. 45:14B-28^[7] and N.J.R.E. 505 (psychologist-patient privilege); N.J.S.A. 45:8B-29,^[8] and N.J.R.E. 510 (marriage and family therapist privilege). Plaintiffs maintain that Stempler does not encompass providers of psychiatric/psychological care; these more protective privileges are similar to the attorney-client privilege. The psychologist-patient privilege is a more comprehensive privacy protection of an individual's innermost thoughts and feelings, which were intended to be kept from public revelation (citing Kinsella, supra, 150 N.J. at 295, 696 A.2d at 566).

Plaintiffs' examination of the history of HIPAA and the congressional intent at the time the law was enacted is thorough. In particular, plaintiffs note Congress's concern stemming from the rapid distribution of electronic information on the Internet. Plaintiffs suggest that Congress was dubious as to the amount of protection a patient would have in this new information age and they conclude, based upon the legislative history, that because of its concerns Congress promulgated HIPAA and mandated its subsequent regulations. It became the duty of the United States Department of Health and Human Services ("HHS"), to create standards to ensure "the integrity and confidentiality of the information being collected and disseminated." 42 U.S.C.A. § 1320d-2(d)(2)(A). Plaintiffs contend that the congressional express preemption became evident in the legislative mandate to secure electronic transmission of health information in aid of managing the health care and health care insurance industries. "In this regard Congress' express preemption of any contrary provisions of state law" other than those which provide more stringent protections than HIPAA, is particularly significant. See 42 U.S.C.A. § 1320d-7(a)(1).

Plaintiffs allege that Stempler interviews conflict with HIPAA's protection in two important ways. First, plaintiffs assert that Stempler interviews cause unauthorized disclosures. See 45 C.F.R. § 164.502(a) ("a covered entity may not use or disclose protected health information except as permitted or required by [these regulations]"). Second, plaintiffs argue that these interviews do not correspond to the permissible limit of protected health information to the minimum amount necessary to accomplish the intended purpose. 45 C.F.R. § 164.502(b)(1) ("when using or disclosing protected health information... a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure or request"). In light of these two conflicts, plaintiffs conclude that Stempler interviews cannot comply with HIPAA.

Juxtaposing the two HIPAA sections against the policies set forth in Stempler, plaintiffs state that the allowance of ex parte interviews of health care workers was once acceptable because "the Court assumed that a procedure wherein plaintiff's counsel has `the opportunity to communicate with the physician, if necessary, in order to express any appropriate concerns as to the proper scope of the interview,' the dynamics of which could not ever be fully foreseen, would be adequate to educate the physician about what the law may deem relevant and discoverable; particularly where it is a close call." Stempler, 100 N.J. at 380, 495 A.2d at 863. However, under the HIPAA regulations as presently promulgated, only the minimum necessary amount of information consistent with the stated purpose is to be disclosed. Any further information, whether collateral or marginal, is prohibited. As presently constituted, Stempler ex parte interviews are unstructured, unsupervised, and rife with opportunities for unintentional, though nevertheless impermissible, disclosures. In the absence of what plaintiffs characterize as stringent control, ex parte interviews should no longer take place. Plaintiffs argue that protection of patient privacy was the overriding congressional intent rather than ex parte communications under any contrary state law. They argue: "The same notice and reasonable assurance requirements found in § 164.512(e) apply to oral and thus ex parte communications as do requests for records" (citing 45 C.F.R. § 164.103).

In further support of their argument, plaintiffs cite several out-of-state resources that have grappled with the HIPAA versus state law conundrum. For example, the Eastern District of Louisiana has found that Louisiana's health care law is less stringent than HIPAA, and therefore ruled that that HIPAA preempts that law. U.S. ex. rel. Stewart v. Louisiana Clinic, No. Civ.A. 99-1767, 2002 WL 31819130 (E.D.La., Dec. 12, 2002). The Eastern District of Louisiana reasoned that the Louisiana statute does not address the "form, substance, or the need for express legal permission from an individual" as required by 45 C.F.R. § 160.202. Therefore, the court held that HIPAA preempted the less stringent Louisiana statute. Ibid.

The concept of ex parte health care interviews is a New Jersey case law creation. Such a decision "by judicial fiat" does not share the rigors or analysis of legislation. Roosevelt Hotel v. Sweeney, 394 N.W.2d 353, 356 (1986). Indeed, nearly half of the states do not permit this procedure for this very reason. Id. at 356-57.

Few states have addressed ex parte interviews in light of HIPAA. Tennessee has considered this dilemma. The Supreme Court of Tennessee, in Givens v. Mullikin ex rel. Estate of McElwaney, 75 S.W.3d 383 (Tenn.2002), ruled that ex parte conversations could not be held without patient authorization giving the patient the choice to allow ex parte interviews with his physician. The necessary authorization would have to describe the information to be sought and provide the necessary assurances as proscribed under HIPAA to ensure limited use of the disclosed information. Id. at 412. The alleged cost savings through the use of informal interviews are now minimized with the cost of providing detailed medical authorizations to ensure compliance with HIPAA. 39-FEB Tenn. B.J. 29, 31 (2003).

A second major area of concern raised by the plaintiffs in opposition to the defense's motion is with ex parte interviews of psychologists, psychiatrists, neuropsychologists, and marriage and family therapists. The defendants' briefs do not address this issue.

Putting the HIPAA controversy aside, plaintiffs argue that nowhere in Stempler is there an allowance for ex parte interviews with mental health professionals. In this instance, N.J.S.A. 45:14B-28 and N.J.R.E. 505 control. Likewise, N.J.S.A. 45:8B-28 and N.J.R.E. 510 provide similar privileges for family therapists and their patients. Case law has endorsed these privileges. See Runyon v. Smith, 322 N.J.Super. 236, 242, 730 A.2d 881, 885 (App.Div.1999), aff'd, 163 N.J. 439, 749 A.2d 852 (2000) (finding a psychologist's testimony in a custody case violated the psychologist-patient privilege); Crescenzo v. Crane, 350 N.J.Super. 531, 543, 796 A.2d 283, 290-91 (App.Div.2002) (a three-part test to determine whether a privileged psychiatrist-patient communication should be pierced "must be made in a courtroom by a judge consistent with appropriate due process concerns including notice and an opportunity to be heard").

C. Amici Parties Expressed Their Concerns.

1. Amicus Curiae in Support of Defendants' Contentions.

Amici briefs submitted by the Defense Research Institute ("DRI") and the New Jersey Defense Association ("NJDA") support the defendants' position and are countered by the amicus brief submitted by the Association of Trial Lawyers of America-NJ ("ATLA-NJ") in support of plaintiffs' position.

DRI and NJDA, in support of informal interviews, assert that Stempler interviews are recognized under HIPAA via 45 C.F.R. § 164.512(e), which permits disclosure of PHI pursuant to a judicial proceeding or administrative proceeding. DRI further argues that Congress addressed similar concerns, allayed in Stempler, that only health information relevant to the litigation is within the scope of permitted disclosure. DRI contends that HIPAA does not preempt state law regarding these disclosures as it pertains to litigated matters, nor is the discovery practice in conflict with HIPAA's fundamental purpose of securing privacy of an individual's medical confidences shared with his or her physician. DRI further argues that HIPAA expressly provides for the state litigation practice of informal interviews of plaintiffs' physicians so long as there is reasonable notification to the patient and the patient is given an opportunity to object to the informal interview of the treating physician. DRI maintains Congress had no intention to disrupt current state civil practice regarding a party who has placed his or her medical condition at issue.

Both DRI and NJDA maintain that since HIPAA does not restrict state law litigation practice, the Privacy Rule contains a specific exemption for litigation-related discovery. Therefore Stempler is not contrary to HIPAA's objectives and preserves the right to interview an adverse party's witnesses, thereby providing a less costly and more effective flow of information using a balanced approach between the interests of an individual's right to privacy and the legal system's interest in an effective and efficient course of discovery.

DRI further argues that there is also a strong presumption against preemption. No federal patient-physician privilege exists; Congress defers to state law regarding such matters. NJDA contends that HIPAA is in line with Stempler objectives to provide reasonable notice and the opportunity to object to pending disclosure.

2. Amicus Curiae in Support of Plaintiffs' Contentions.

ATLA-NJ submitted an amicus brief in support of plaintiffs' position on Stempler interviews in light of HIPAA regulations. ATLA-NJ contends that ex parte physician interviews should not be conducted because the risk of improper disclosure of plaintiffs' PHI is too great. ATLA-NJ suggests that the most appropriate safeguard against physician error of disclosure is to have plaintiffs' attorneys present during defense counsel's interviews with physicians, thereby essentially eliminating the Stempler interviews. According to ATLA-NJ, Stempler is not practical in the current regulatory environment and contravenes with HIPAA's privacy objectives.

III. ANALYSIS

The passage of HIPAA and the enactment of the Privacy Rule mark a dramatic departure from the current state of medical and legal practice. The change is a myopic examination of a lone example of what may be the single most important question raised in the 21st century by Americans, namely balancing privacy concerns versus technological advancements. The more accessible personal information becomes, the more critical it is to create intelligible guidelines to provide an equitable balance between the individual's interest in his or her privacy and the national interest, in this instance, HIPAA compliance.

HIPAA and the Privacy Rule represent a governmental attempt to balance these competing interests. Electronically transmitted data offer instant retrieval of medical history, and electronically transmitted diagnostic tools (radiographic, digital) and lab results, assisting in the more expeditious diagnosis and treatment of patients. This is a blessing to all society, but carries a price of privacy loss. It is the achievement of this balance that will be the task of many judges from here on.

As technology became more probing, expeditious, and accessible, information that patients previously thought confidential may now be retrieved by unintended persons. For example, pharmaceutical companies may obtain diagnosis information to use for the purpose of direct-to-consumer advertising. Grace-Marie Mowery, Note, "A Patient's Right of Privacy in Computerized Pharmacy Records," 66 U. Cin. L.Rev. 697 (1998); Audrey C. Kao and Erica Ozanne Linden, "Direct to Consumer Advertising and the Internet: Information Privacy, Product Liability and Organizational Responsibility," 46 St. Louis U.L.J. 157 (2002).

"Loose lips" or unauthorized disclosure of medical information by health care providers and/or their staff is nothing new in our American jurisprudence. Motives for disclosing may be altruistic, familial or negligent and may indeed result in civil liability for breach of confidentiality and/or contract. For instance in Delaware, a physician was found to be potentially liable for her employee's unauthorized disclosure of a patient's pregnancy to her family members. The Delaware court held that although it did not rise to the common law tort for invasion of privacy, it was deemed a breach of the physician's duty of confidentiality because she failed to implement reasonable office procedures to guard against unauthorized disclosures. Martin v. Baehler, No. 91C-11-008, 1993 WL 258843, at *4 (Del.Super.Ct. May 20, 1993).

New Jersey has established confidentiality protections to preserve such revered relationships as the patient-physician relationship. In the case of Estate of Behringer v. Medical Center of Princeton, 249 N.J.Super. 597, 592 A.2d 1251 (1991), the Court deliberated over the two distinct legal theories of an AIDS-infected surgeon who was denied surgical privileges by the hospital, with which he was professionally affiliated and where he had also obtained treatment. Many of his colleagues and other members of the hospital staff learned of his medical condition through the hospital "grapevine." Soon the information was disseminated to his patients, which foreseeably resulted in many withdrawing from his medical practice. Although the court recognized that the hospital had a duty to follow its managerial policy of withdrawing the physician's surgical privileges in its effort to prevent potential liability to other patients, the hospital failed to respect the surgeon's status as a patient by breaching its duty of confidentiality by failing to implement reasonable measures to ensure the privacy of the physician's medical records. Therefore the hospital was found liable for damages.

The sensitive nature of medical information about AIDS makes a compelling argument for keeping this information confidential.... Also, the privacy interest in ones' exposure to the AIDS virus is even greater than one's privacy interest in ordinary medical records because of the stigma that attaches with the disease. The potential for harm in the event of a non-consensual disclosure is substantial....

[Estate of Behringer, supra, 249 N.J.Super. at 639, 592 A.2d at 1272 (quoting Doe v. Barrington, 729 F.Supp. 376, 384 (D.N.J.1990)).]

Under New Jersey law, as in HIPAA, patient-physician confidentiality carries an exception for civil litigation. Under N.J.S.A. 2A:84A-22.4, the New Jersey Supreme Court held that in situations where persons place their medical condition in question, discovery, including the use of informal discovery methods such as ex parte interviews, is available to the defense within the safeguard authorizations set forth in Stempler. Yet, New Jersey recognizes by case law and by statute more stringent safeguards regarding the privacy of HIV/AIDS, hepatitis and genetic testing.^[9] Certainly these exceptions are not enough protection for the public.

This court recognizes the strong dichotomy of judicial reasoning between those states that permit informal discovery and the states prohibiting such techniques. See J. Christopher Smith, "Recognizing the Split: The Jurisdictional Treatment of Defense Counsel's Ex Parte Contact with Plaintiff's Treating Physician," 23 J. Legal Prof. 247, 252-55 (1999). The rhetoric echoed over a decade or so in a plethora of judicial rulings throughout the nation when informal discovery was in the judicial vanguard will most likely be reigned in as states reason their way in preemption/HIPAA issues. These beliefs are still strongly held.

[T]he gravamen of the issue is not whether evidence of plaintiff's medical condition is subject to discovery, but by what methods the evidence may be discovered. We conclude that considerations of patient privacy, the confidential relationship between doctor and patient, the adequacy of formal discovery devices, and the untenable position in which ex parte contacts place the non-party treating physician supersede defendant's interest in a less expensive and more convenient method of discovery. We hold that defense counsel may not interview plaintiff's non-party treating physicians privately without plaintiff's express consent. Defendant instead must utilize the statutorily recognized methods of discovery.

[Crist v. Moffatt, 326 N.C. 326, 389 S.E.2d 41, 48 (1990).]

Yet, debating and/or modifying the New Jersey Supreme Court ruling providing for informal discovery techniques is not a role for this court. Rather, its task is deciding the narrow issue of whether HIPAA preempts the informal discovery techniques. The answer is plainly "no."

New Jersey law has long recognized that there exists in this country a "strong federal policy against federal court intervention with pending state judicial proceedings absent extraordinary circumstances." Middlesex Cty. Ethics Comm. v. Garden State Bar Ass'n, 457 U.S. 423, 431, 102 S.Ct. 2515, 2521, 73 L.Ed.2d 116 (1982). Reliance on the presumption against preemption limits "congressional intrusion into states' traditional prerogative and general authority to regulate for the health and welfare of their citizens." City of Boerne v. Flores, 521 U.S. 507, 509, 117 S.Ct. 2157, 2159, 138 L.Ed.2d 624 (1997).

This court certainly acknowledges that there are circumstances where preemption is wholly appropriate. Consistent with the nature of federalism, "[w]e begin by noting that preemption is not to be lightly presumed...." Village of Ridgefield Park v. New York Susquehanna & Western Railway Corp., 163 N.J. 446, 455, 750 A.2d 57, 62 (2000) (quoting Franklin Tower One L.L.C. v. N.M., 157 N.J. 602, 615, 725 A.2d 1104, 1111 (1999)). In determining whether federal law has preempted state law, presumptions one way or the other are of no assistance, but rather the question is always one of particular congressional intent. In deciding Union Ink Co., Inc. v. AT&T Corp., 352 N.J.Super. 617, 801 A.2d 361 (2002), Judge Kestin tells us, "[T]he historic police powers of the States are not to be superseded by federal law unless that was the clear and manifest purpose of Congress." Franklin Tower One v. N.M., 157 N.J. 602, 615, 725 A.2d at 1111 (1999) (quoting Wisconsin Pub. Intervenor v. Mortier, 501 U.S. 597, 605, 111 S.Ct. 2476, 2482, 115 L.Ed.2d 532 (1991)). Moreover, in considering preemption claims, the court must consider the venerable presumption that "Congress did not intent to displace state law," Maryland v. Louisiana, 451 U.S. 725, 746, 101 S.Ct. 2114, 2129, 68 L.Ed.2d 576 (1981), and that it should not unnecessarily disturb the "federal-state balance." United States v. Bass, 404 U.S. 336, 349, 92 S.Ct. 515, 523, 30 L.Ed.2d 488 (1971).

A state law is not preempted unless it is contrary to the federal objectives regarding privacy protections of patient health information. Likewise, a state law deemed "more stringent" or more protective of the use and disclosure of patient health information than afforded under federal law is not preempted. See 42 U.S.C.A. § 1320d-7(a)(1).^[10]

Conversely, state laws that diverge from the HIPAA Administrative Simplification provisions promulgated under the Standards for Privacy of Individually Identifiable Health Information ("Privacy Standards") are preempted. 42 U.S.C.A. § 1320d-7(a)(1); 45 C.F.R. § 160.203; cf. U.S. ex. rel. Stewart v. Louisiana Clinic, 2002 WL 31819130 (E.D.La., Dec. 12, 2002) (holding that Louisiana law concerning disclosure of non-party patient records not to be contrary to federal law). A state law is contrary to these privacy regulations if a covered entity would find it impossible to comply with both the state and federal requirements or the state law is an obstacle to the execution of the full purposes and objectives of HIPAA. See 45 C.F.R. § 160.201. These federally mandated Privacy Standards demonstrate a strong federal policy of protection for patient health information. Congress's express preemption of any contrary provisions of state law, other than those that provide more stringent protections than HIPAA, is particularly significant. See 42 U.S.C.A. § 1320d-7(a)(1).

It is important to understand this regulation as a new federal floor of privacy protections that does not disturb more protective rules or practices. Nor do we intend this regulation to describe a set of "best practices." Rather, this regulation describes a set of basic consumer protections and a series of regulatory permissions for use and disclosure of health information. The protections are a mandatory floor, which other governments and any covered entity may exceed.

[65 Fed.Reg. 82, 462 (Dec. 28, 2000) (Emphasis added).]

When evaluating whether a state law is more stringent, courts should examine certain considerations—whether the state law: 1) prohibits or restricts a use or disclosure more so than the Privacy Rule; 2) permits greater rights of access to or amendment of information; 3) provides the individual with a greater amount of information; 4) narrows the scope or duration of an authorization or consent, expands the criteria necessary for an authorization or consent, or reduces the coercive effect of the circumstances surrounding an authorization or consent; or 5) requires longer or more detailed retention or reporting of disclosures. 45 C.F.R. § 160.202.

Nowhere in HIPAA does the issue of ex parte interviews with treating physicians, as an informal discovery device, come into view. The court is aware of no intent by Congress to displace any specific state court rule, statute or case law (e.g., Stempler) on ex parte interviews. As for this state's informal discovery practices, congressional intent seems not to intrude on New Jersey's general authority over its judicial and administrative proceedings. HIPAA under 45 C.F.R. § 164.512(e) allows a covered entity to disclose protected health information without written authorization of the patient or an opportunity for the patient to agree or object to the disclosure during judicial proceedings under certain circumstances such as a court order, discovery request, or subpoena. Otherwise the covered entity, or physician in the instant case, must receive satisfactory assurances that the party seeking the protected health information has made reasonable efforts to secure a qualified protective order^[11] from the court.

Stempler advocates the use of authorizations similar to HIPAA's, which outline the specific scope of matter intended to be disclosed in the interview, presumably only matter relevant to the patient's medical condition placed in litigation by the very patient, turned plaintiff. It is important to note that the waiver of the patient-physician privilege under N.J.S.A. 2A:84A-22.4 is not an absolute waiver, as there is no withdrawal of the privacy protection of medical information not being litigated. The authorization for use and disclosure of medical information must be limited in scope and now, as HIPAA demands, limited in time of use, presumably until the litigation is closed. The extra protection secured by a protective order or an order to have plaintiff's counsel present at the interview as suggested in Stempler ensure protections similar to those outlined in HIPAA. This is the difference between the waiver of testimonial privilege and patient-physician fiduciary duty of confidentiality.

One area where state law is more stringent than HIPAA is related to mental health care practice. For instance, "psychotherapy notes"^[12] are held to a higher standard of protection because they are not part of the medical record and should not be shared with anyone else. All other personal health information is considered to be sensitive and protected consistently under this rule. Psychotherapy notes cannot be used or disclosed unless an authorization is given by the patient except when used for treatment, for a covered entity's own training, or when a covered entity is defending itself in a legal action brought by the individual. 45 C.F.R. § 164.501; 45 C.F.R. § 164.502. Psychotherapy notes, as defined in the Privacy Rule, do not include the entire mental health record and the definition is therefore less restrictive than many state laws with respect to the protection afforded mental health records. Under N.J.S.A. 45:14B-28, a mental health care provider has a higher duty similar to the attorney-client privilege by way of the psychologist-patient privilege. The psychologist-patient privilege is a more comprehensive privacy protection of an individual's innermost thoughts and feelings. As a result, state law that is more restrictive—that is, "more stringent"—than the Privacy Rule's requirements will control the use and disclosure of such information, rather than the Privacy Rule. Ibid. Therefore on this point, plaintiffs are correct as to preemption and New Jersey law will control.

Because informal discovery is not expressly addressed under HIPAA, the courts should be governed by state law, in the case of New Jersey as set forth by our Supreme Court. Therefore, ex parte interviews as a form of informal discovery may proceed as permitted under Stempler in line with N.J.S.A. 2A:84A-22.4. Because the disclosure is limited in scope, the Stempler interviews do not conflict with the general principles of HIPAA.

Whether a use or disclosure of medical information will be permitted under the HIPAA and the Privacy Rule depends on the person accessing the information and the patient who holds the original privilege. Thus in these New Jersey PPA cases, the court must determine three issues: (1) preemption; (2) authorization compliance; and (3) merit of use.

First, preemption (whether Stempler ex parte interviews are preempted under HIPAA). The plain fact is that informal discovery is not expressly addressed under HIPAA as either endorsed or prohibited. In the absence of such controlling legislation, the courts should be governed by state law, in the case of New Jersey as set forth by our Supreme Court. Therefore, ex parte interviews as a form of informal discovery may proceed as permitted under Stempler.

Second, authorization compliance (whether the current patient authorizations comport with Stempler or are preempted by HIPAA). In this instance, this court finds that HIPAA does preempt Stempler, because Stempler safeguards for disclosure authorizations fall below the HIPAA requirements. The drafting of a new HIPAA-compliant authorization must be undertaken. This court will ask the chairperson of the New Jersey Civil Practice Committee whether the members will explore the possibilities of drafting sample HIPAA-compliant authorizations; or perhaps the New Jersey Legislature will assume the privacy issue. Ultimately, it will be up to the Legislature to decide if either a comprehensive privacy act, such as those in Wisconsin and Rhode Island, or additional individual privacy statutes, need to be legislated. See "The State Of Health Privacy: An Uneven Terrain (A Comprehensive Survey Of State Health Privacy Statutes)," Practising Law Institute's First Annual Institute on Privacy Law: Strategies for Legal Compliance in a High Tech and Changing Regulatory Environment, PLI Order No. G0-00G0, June 2000.

Third, merit of use (must this court permit ex parte interviews with all health providers assuming a newly drafted HIPAA-compliant authorization is created?). The answer to this question is "no." Stempler recognized that in certain instances of "extreme cases" the court may require the plaintiffs' lawyers to be on the line with defense lawyers during the interview or require depositions in accordance with formal discovery rules. Stempler, supra, 100 N.J. at 383, 495 A.2d at 864-65.

During oral argument, this court inquired, and was answered by amici counsel that it was within the court's discretion whether to require the use of the informal discovery process. Although none of the counsel could define what "extreme cases" meant under Stempler, it was conceded by all that the use of formal versus informal discovery was within the discretion of this court. For indeed, the Court held in Stempler that:

Such supervision could take the form of an order requiring the presence of plaintiff's counsel during the interview or, in extreme cases, requiring defendant's counsel to proceed by deposition. We are satisfied that the flexibility afforded by our decision will permit trial courts and counsel to fashion appropriate procedures in unusual cases without interfering unnecessarily with the use of personal interviews in routine cases.

[Stempler, supra, 100 N.J. at 383, 495 A.2d at 865 (Emphasis added.).]

Since the enactment of the Privacy Rule, the determination of what may be included in or omitted from a patient authorization will no longer be satisfied by the mechanical application of a "standard medical authorization." Such an authorization must comply with HIPAA, concomitant with the required language in Stempler, and being mindful of the "more stringent" language contained state by state regarding privacy.

The Supreme Court recognized in Stempler the "one size will not fit all" scenario when the court confronted a remedy regarding the allowance of ex parte interviews, because of the varying cases before a trial court. Therefore, the remedy should be a measured one in accordance with the respective case complexity.

Alternative solutions to ex parte interviews are given by the Supreme Court including: (1) affording plaintiff's counsel the opportunity to communicate with the physician, if necessary, in order to express any appropriate concerns as to the proper scope of the interview and the extent to which plaintiff continues to assert the patient-physician privilege; (2) advising plaintiff to seek and obtain a protective order if substantial prejudice to plaintiff warrants; (3) allowing plaintiff's counsel to be present during the informal interview; or, (4) in extreme cases, requiring defendants' counsel to proceed only by deposition. Stempler, supra, 100 N.J. at 382-83, 495 A.2d at 864-65.

Recognizing the complexity of the issue even without the overlay of the Privacy Rule, the Supreme Court in Stempler required prompt attention to be given by the Civil Practice Committee. This court elicited information at oral argument in regard to what formal action ensued from the Civil Practice Committee. It appears that no such action was taken. The Supreme Court suggested parameters such that discretion is given to the trial courts to fashion appropriate procedures in "usual cases" without interfering with personal interviews, yet recommended wider latitude in "extreme cases."

Since there are approximately 300 PPA cases on this court's docket and only one and a half months until trial, it would be improvident to cease discovery to hold extensive hearings as to what constitutes "pertinent" medical information and/or to cite all "more stringent" statutory privacy constraints that may apply to ex parte interviews. Therefore, this court determines that the PPA cases are "extreme cases" and orders defendants to proceed directly to deposition of treating physicians and/or those "covered entities" as defined in HIPAA.

Were this a new mass tort, this court could alter the old discovery process, for example, hold hearings regarding the "related" medical disciplines necessary and provide the appropriate "qualified protective order" afforded under 45 C.F.R. § 164.512(e)(1). Nevertheless, for the balance of this mass tort case, defendants will follow formal discovery rules. While this may cause some retooling, it is not in anyway prejudicial, but rather protects the common good until a more refined approach to HIPAA is set.

IV. CONCLUSION

The opposing interests of privacy protection versus information technology prescribe an amendment to judicial norms in favor of a stronger societal policy for the protection of an individual's sensitive medical information, while protecting due process. Balancing these competing interests has placed the need for an examination of usual discovery practices in the forefront. From this hearing, it was apparent that each plaintiff might average between four to twelve treating physicians in his or her lifetime, raising the potential of wrongful disclosure of confidential patient information by physician error. Therefore this court must make its decision not on consideration of one case, but for nearly 300 mass tort cases with a prospective four to ten medical personnel for each case, thus multiplying the risk of wrongful disclosure to monumental amounts. Judges with other personal injury cases may not find such examinations as imperative on a case-by-case basis; however, compliance with HIPAA must be met by all.

Nowhere in HIPAA does the issue of ex parte interviews with treating physicians come into view; therefore, this court finds no express preemption regarding such interviews, leaving Stempler a viable tool for defense counsel. However, in light of the burgeoning importance of protecting an individual's privacy, particularly in regard to his or her medical information, the broad use of Stempler must somehow be readjusted to ensure compliance with the federal objectives under HIPAA. The Privacy Rule affords the use and disclosure of an individual's medical information for administrative and judicial proceedings, yet HIPAA safeguards (reasonable notice and patient's opportunity to object) are not supported by the revised medical authorization forms.

The revised medical authorization forms previously offered by defendants are deficient because they do not accurately represent the permissible scope of medical information for disclosure as allowed under HIPAA or New Jersey law. Psychotherapy notes or medical records containing patient health information irrelevant to the litigated medical condition should not be indiscriminately given merely because the patient has brought a personal injury lawsuit. Because congressional intent is so strongly weighed in favor of the patient's privacy protection, the determination of what is deemed not "pertinent," to impute the testimonial privilege to the non-testimonial context of ex parte interviews, is paramount. Stempler, supra, 100 N.J. at 373, 495 A.2d at 859. Therefore future cases may entail not just the ascertainment of all medical information, but rather a precise formulation of the contours of the privilege to allow discovery of pertinent information necessary for litigation. Any overreaching demands without the authority of law (e.g., court order, subpoena) places the physician who is unfamiliar with the legal system at risk of breaching his or her fiduciary duty to his or her patient and subjecting him or her to potential liability. Under the aegis of HIPAA, physicians approached by defendants' counsel are left with the only prudent action: consult with the patient's attorney and his or her personal attorney prior to disclosure of any of the patient's medical information, or risk violating HIPAA.^[13] Such additional costs can only place a higher burden economically and managerially onto a profession that already sees itself under siege.^[14]

The holding in Stempler reserves judicial discretion with regard to the appropriateness of ex parte interviews even under "extreme cases." This court recognizes that mass tort cases with their inherent complexity fall within the definition of extreme cases. Therefore under this court's authority, and given the magnitude of the potential intricacies of entirely redoing the discovery process to include informal discovery with HIPAA-compliant authorizations,^[15] the most practical recourse is to deny the use of Stempler interviews. This court sees no necessity for informal discovery so late into the PPA litigation. This however, does not imply that Stempler is not available as an informal discovery tool for mass tort cases. Rather, given the complexity of such cases, special hearings early during case management for the design of HIPAA-compliant authorization forms may become the custom for the conduct of Stempler interviews in future mass tort litigation.

NOTES

[1] There is no privilege under this Act in an action in which the condition of the patient is an element or factor of the claim or defense of the patient or of any party claiming through or under the patient or claiming as a beneficiary of the patient through a contract to which the patient is or was a party or under which the patient is or was insured. N.J.S.A. 2A:84A-22.4.

[2] On December 28, 2000, pursuant to a mandate under the "administrative simplification" provisions of HIPAA, the Department of Health and Human Services issued new standards for privacy of individually identifiable health information (IIHI) called "The Final Privacy Rule" as published in the Federal Register. On December 27, 2001, President Bush signed into law H.R. 3323, the Administrative Simplification Compliance Act, Pub.L. 107-105, 115 Stat. 1003.

[3] By definition in 45 C.F.R. § 164.501, IIHI is information that is a subset of health information, including demographic information collected from an individual, that is (1) created by the health care provider, health plan, employer or health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or with respect to which there is a reasonable basis to believe the information can only be used to identify the individual. In addition, 45 C.F.R. § 160.103 provides that "health information" means information, whether oral, or recorded in any form or medium, that (1) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

[4] PHI includes "any information, whether oral or recorded in any form or medium, that: (1) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual." 45 C.F.R. § 160.103.

[5] "Health care provider" means a "provider of services" (as defined in 42 U.S.C.A. 1395x(u)), a provider of "medical and other health services" (as defined in 42 U.S.C.A. 1395x(s)), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business. 45 C.F.R. § 160.103.

[6] An Authorization is a document that is signed by an individual or personal representative of an individual. The minimal elements of authorization pursuant to 45 C.F.R. § 164.508(c)(1) are: (1) a description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion; (2) the name or other specific identification of the persons(s) or class of persons authorized to make the requested use or disclosure; (3) the name or other specific identification of the person(s) or class of persons, to whom the covered entity may make the requested use or disclosure; (4) a description of each and every purpose of the requested use or disclosure, although the statement "at the request of the individual" is a sufficient description of the purpose when the individual initiates the authorization and does not, or elects not to, provide a statement of the purpose; (5) an expiration date of the event that relates to the individual or the purpose of the use or disclosure; and (6) the signature of the individual and the date. Also pursuant to 45 C.F.R. § 164.508(c)(2), the authorization must contain statements adequate to place the individual on notice that: (1) the individual has a right to revoke the authorization in writing and (2) treatment, payment, enrollment or eligibility for benefits may be conditioned on the authorization. In addition, 45 C.F.R. § 164.508(c)(3) requires that the authorization must be in plain language. A Consent is a document that is signed by an individual or personal representative of an individual that gives permission for PHI to be used or disclosed, but is not required and may not substitute for a required authorization. 45 C.F.R. § 164.506.

[7] The confidential relations and communications between and among a licensed practicing psychologist and individuals, couples, families or groups in the course of the practice of psychology are placed on the same basis as those provided between attorney and client, and nothing in this act shall be construed to require any such privileged communications to be disclosed by any such person.

There is no privilege under this section for any communication: (a) upon an issue of the client's condition in an action to commit the client or otherwise place the client under the control of another or others because of alleged incapacity, or in an action in which the client seeks to establish his competence or in an action to recover damages on account of conduct of the client which constitutes a crime; or (b) upon an issue as to the validity of a document as a will of the client; or (c) upon an issue between parties claiming by testate or intestate succession from a deceased client. N.J.S.A. 45:14B-28

[8] A communication between a marriage and family therapist and the person or persons in therapy shall be confidential and its secrecy preserved. This privilege shall not be subject to waiver, except where the marriage and family therapist is a party defendant to a civil, criminal or disciplinary action arising from the therapy, in which case, the waiver shall be limited to that action. N.J.S.A. 45:8B-29

[9] HIV/AIDS information is protected under N.J.S.A. 26:5C-1 to -14, while health information determined by genetic testing is protected under N.J.S.A. 10:5-47. New Jersey case law supports the confidentiality of hepatitis information. Estate of Elkerson v. North Jersey Blood Center, 342 N.J.Super. 219, 776 A.2d 244 (2001) (holding that survivors of hepatitis-infected patient who received tainted blood were not entitled to discovery of blood donors' identities to enable retesting of donor for the presence of hepatitis B virus).

[10] As defined by HIPAA, a state law is not preempted if it is necessary: (1) to prevent fraud and abuse; (2) to regulate insurance or health plans; (3) is designed to report health care delivery or costs; (4) is designed to serve a compelling need related to public health safety and welfare; or (5) is designed to regulate controlled substances. 45 C.F.R. § 160.203(a). In addition, a state law is not preempted if it provides for: (1) the reporting of disease, injury, child abuse, birth, or death; (2) the conduct of public health surveillance, investigation, or intervention; or (3) requires a health plan to report, or provide access to information for management or financial audits, program monitoring and evaluation or the licensure or certification of people or facilities. 45 C.F.R. § 160.203(c)-(d). See also 70 Def.Couns.J. 127, 149 (2003).

[11] For the purposes of paragraph (e)(1) of this section [Disclosures for judicial and administrative proceedings], a qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii) of this section, an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that:

(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and

(B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding. [45 C.F.R. § 164.512(e)(1)]

[12] Under HIPAA, Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. 45 C.F.R. § 164.501

[13] Insurance companies are now offering insurance protection for liabilities derived from HIPAA violations. See "Insurance for HIPAA Violations," by Veterans Press, Inc. and EMR Legal, Inc.; Compliance Quarterly Newsletter, vol. 1, issue 2 (June 2000), also available on their website at www.veteranspress.com/newsletters/ComplianceQuarterl-yArticles.pdf.

[14] In 2003, New Jersey physicians lobbied for relief from the current insurance crisis via unprecedented work strikes to secure malpractice insurance reforms. Failure to secure legislative approval has resulted in a proposal for a complete walkout from emergency care facilities in October, thus threatening the state's health care system. Carol Ann Campbell, "MDs Vow to Press Malpractice Reform—Doctors, Angry That Legislature Failed to Resolve Conflicting Bills, Promise Job Action in Fall," the Star Ledger, July 3, 2003, and "The Auditor," the Star Ledger, September 14, 2003.

[15] Some common confidentiality regulations that may be necessary to consider in the formulation of a "standard" authorization include: Adoption (N.J.A.C. 10:121A-3.6); Adult Pediatric Day Health Services Facilities (N.J.A.C. 8:43F-4.4); Adult Protective Services (N.J.A.C. 8:89-2.8); Related Medicaid Services (N.J.A.C. 10:69-9.8); Alcohol and Drug Abuse (42 U.S.C.A. §§ 290dd-2 and 290ee-2 and 42 C.F.R. Part 2 Section 2.1 et seq.); Alternate Family Care Clients (N.J.A.C. 8:43B-10.1); Ambulatory Care Facilities (N.J.A.C. 8:43A-16.2); Assisted Living Facility Residents (N.J.A.C. 8:35-13.2); Child Care Centers; Community Mental Health Programs (N.J.A.C. 10:37-6.79); Community Residents for Mentally Ill Adults (N.J.A.C. 10:37A-3.2); Department of Human Services Program Participants (N.J.A.C. 10:41-2.4); Emergency Housing and Shelters (N.J.A.C. 5:15-3.1); "HealthStart"—Maternity and Pediatric Care Services (N.J.A.C. 10:52-3.11); Hospice Patients (N.J.A.C. 8:42C-5.1); Hospital Patients (N.J.A.C. 8:43G-4.1); Housing and Community Resources (N.J.A.C. 5:3-1.1); Medicaid (N.J.A.C. 10:63-1.13); Narcotic Treatment Programs (Part 310 and Part 1401 of 21 U.S.C.A.); NJ Family Care (N.J.A.C. 10:78-1.5); Rehabilitation Hospitals (N.J.A.C. 8:43H-17.2); and Screening and Outreach Services (N.J.A.C. 10:31-2.4).