IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON DIVISION ONE
STATE OF WASHINGTON, No. 84140-8-I
Appellant,
ORDER GRANTING
v. MOTION TO PUBLISH
JOHNSON & JOHNSON; JANSSEN PHARMACEUTICALS, INC.; ORTHO-
MCNEIL-JANSSEN PHARMACEUTICALS, INC., n/k/a JANSSEN PHARMACEUTICALS, INC.;
JANSSEN PHARMACEUTICA, INC. n/k/a JANSSEN PHARMACEUTICALS, INC.;
and XYZ Corporations 1 through 20,
Respondents.
The appellant, State of Washington, having filed a motion to publish opinion, and the panel having considered the motion, and finding that the opinion dated July 31, 2023 will be of precedential value; now, therefore it is hereby ORDERED that the unpublished opinion filed July 31, 2023 shall be published.
FOR THE COURT:
IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON
STATE OF WASHINGTON, No. 84140-8-I
Appellant,
DIVISION ONE
v.
UNPUBLISHED OPINION
JOHNSON & JOHNSON; JANSSEN PHARMACEUTICALS, INC.; ORTHO- MCNEIL-JANSSEN PHARMACEUTICALS, INC., n/k/a JANSSEN PHARMACEUTICALS, INC.; JANSSEN PHARMACEUTICA, INC. n/k/a JANSSEN PHARMACEUTICALS, INC.; and XYZ Corporations 1 through 20,
Respondents.
COBURN, J. — The State sued Johnson & Johnson and Janssen Pharmaceuticals (collectively Janssen), claiming that they violated the Consumer Protection Act and created a public nuisance by contributing to the opioid crisis in Washington. During discovery, the State produced data from a Medicaid claims database consistent with the Health Insurance Portability and Accountability Act (HIPAA) disclosure practices, which meant only the years of claims were included, instead of full dates. Janssen moved to compel the production of the specific days and months related to service and prescription dates. A Special Master agreed with the State that releasing full dates created a risk of re-identifying Medicaid patients that was
Citations and pincites are based on the Westlaw online version of the cited material.
not small enough to be acceptable under HIPAA. The trial court disagreed, overruled the Special Master, added its own parameters related to the release of data, and granted the motion to compel. A commissioner of this court granted the State’s request for discretionary review. We reverse.
BACKGROUND
The State Attorney General filed this lawsuit against Janssen 1 and affiliated defendants alleging that they violated the state’s Consumer Protection Act and created a public nuisance regarding its manufacture and marketing of pharmaceutical opioids. Discovery was presided over by a court-appointed Special Master. A Special Master is permitted under CR 53.3 to provide independent assistance to the court in resolving complex discovery issues. 4 ELIZABETH A. TURNER, W ASHINGTON PRACTICE: RULES PRACTICE CR 53.3 author’s cmt. 1 (7th ed. 2021).
During discovery, the State produced 11 years of data from a database of all Medicaid claims in the state maintained by the Washington Healthcare Authority (HCA). The database contains health information for millions of Washington residents. The data provided to Janssen included the year in which Medicaid services were provided, but not the month or the day of the service, in accordance with HCA’s typical disclosure practices.
In passing HIPAA in 1996, Congress recognized the need for strict privacy protections for health information, authorizing the United States Department of Health and Human Services (DHHS) to promulgate regulations to put protections in place,
1 The State alleges that Johnson and Johnson is the only company that owns more than 10 percent of Janssen Pharmaceuticals’ stock and corresponds with the Federal Drug Administration regarding Janssen’s products.
3
codified at 45 C.F.R. §§ 160 and 164. See Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936. The regulations apply to “covered entities,” including health plans and health care providers transmitting any health information electronically. 45 C.F.R. § 164.104(a)(1), (3). The rule defines protected health information to mean “individually identifiable health information”—that is, health information “[t]hat identifies the individual” or “[w]ith respect to which there is a reasonable basis to believe the information can be used to identify the individual.” 45 C.F.R. § 160.103. Covered entities are generally prohibited from using or disclosing protected health information, with a limited number of exceptions outlined in 45 C.F.R. § 164.502.
DHHS provides standards and requirements related to “[d]e-identification of protected health information.” “Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information.” 45 C.F.R. § 164.514(a). Under “Implementation specifications: Requirements for de- identification of protected health information,” a covered entity “may determine that health information is not individually identifiable health information only” through two methods: “Safe Harbor” or “Expert Determination.” 45 C.F.R. § 164.514(b).
The Safe Harbor method requires removing 18 identifiers listed in 45 C.F.R. § 164.514(b)(2)(i). 45 C.F.R. § 164.514(b)(2). That list includes “[a]ll elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death.” 45 C.F.R. § 164.514(b)(2)(i)(C).
4
Under the Expert Determination method, a covered entity may determine that health information is not individually identifiable health information only if
(1) A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable:
(i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and
(ii) Documents the methods and results of the analysis that justify such determination.
45 C.F.R. § 164.514(b)(1).
The DHHS’s Office of Civil Rights (OCR) issues guidance on complying with de-
identification procedures, including the expert determination method. This guidance notes that there is no certain degree or certification program for use in designating an expert, but that expertise may be gained through relevant education and experience generally in mathematics, statistics, or scientific domains. It also notes that
There is no explicit numerical level of identification risk that is deemed to universally meet the “very small” level indicated by the [Expert Determination] method. The ability of a recipient of information to identify an individual (i.e., subject of the information) is dependent on many factors, which an expert will need to take into account while assessing the risk from a data set . . . As a result, an expert will define an acceptable “very small” risk based on the ability of an anticipated recipient to identify an individual.
The guidance also states “OCR does not require a particular process for an expert to use to reach a determination that the risk of identification is very small. However, the Rule does require that the methods and results of the analysis that justify the determination be documented.” The guidance also observed general principles (replicability, data source availability, distinguishability, assess risk) used by experts in
5
the determination of the identifiability of health information and cited published research by Dr. Latanya Sweeney, PhD, among others. Though not a definitive list, the principles serve as a starting point and “experts are advised to consider how data sources that are available to a recipient of health information . . . could be utilized for identification of an individual.” The guidance explained that experts, when evaluating identification risk, often consider the degree to which a data set can be linked to a data source that reveals the identity of the corresponding individuals. To do so, experts consider 1) that the de-identified data are unique or distinguishing, 2) the existence of a naming data source, including publicly available databases, and 3) the existence of a mechanism to relate the de-identified and identified data sources.
After receiving the Medicaid data that included 1,835,136,898 distinct records, Janssen moved the court to compel the State to supplement the Medicaid claims data with the month and day of the services and prescriptions. Janssen argued that it needed the data to determine the “extent to which prescriptions for Janssen opioid medications preceded diagnoses for opioid use disorder” as part of its defense.
The State objected. It submitted a declaration from the Privacy Officer of the Washington Healthcare Authority (HCA) explaining that HCA is a covered entity subject to the requirements of HIPAA and 42 C.F.R. part 2, which regulates the disclosure of information related to federally subsidized substance use disorder treatment. The State argued that there are two ways that Janssen can legally obtain information protected under part 2: with individual patient consent, or under a court order finding good cause for disclosure after every impacted patient receives notice and an opportunity to be heard. See 42 U.S.C. § 290dd-2(b)(1),(b)(2)(C); 42 C.F.R. § 2.64(b), (d). The State
6
argued that, despite having raised these issues with Janssen, Janssen had not offered a plan for identifying the millions of impacted patients and obtaining their consent, nor had it offered any proposal to give notice to these impacted patients. The State argued that granting a motion to compel HCA to disclose full dates associated with individual patients would cause HCA to violate federal law under HIPAA and 42 C.F.R. part 2.
The Special Master held a hearing on the motion in October 2021 and provisionally granted Janssen’s motion, subject to Janssen providing “expert certification to the special master that the disclosure of this information does not have the potential for re-identification or for reverse engineering to disclose the identity of the individuals for whom the data is disclosed, and is HIPAA-compliant.”
Janssen submitted a declaration from Dr. M. Laurentius Marais, PhD, which stated that there was virtually no risk of re-identification of individuals should the data be supplemented. The State submitted an expert report by Dr. Latanya Sweeney, PhD, who refuted Dr. Marais’ declaration as containing incorrect statements. Dr. Sweeney demonstrated how full dates in the Medicaid Dataset “would allow it to be joined with other publicly available and privately held information, thus allowing sensitive information on individuals in the Medicaid Dataset to be re-associated with named individuals.”
Janssen Expert Dr. Marais Dr. Marais works for a “consulting firm that specializes in applied mathematical and statistical analysis” and holds “a PhD degree and master’s degrees in business administration, mathematics, and statistics from Stanford University.” He has several decades of experience in applying and reviewing mathematical and statistical theory
7
and methods. He has taught and conducted scholarly research at the University of Chicago and Stanford University. Dr. Marais lists his areas of expertise as “the uses of biostatistical and epidemiological methods to draw conclusions from data concerning the rates of and risk factors for health effects, including the analysis of data on the efficacy of and adverse events associated with pharmaceutical drugs.” Janssen retained Dr. Marais to conduct similar work he had previously performed for Janssen in California – to statistically analyze the de-identified medical claims data by locating the date of an opioid use disorder diagnosis for each patient and analyzing data prior to that diagnosis to determine whether the corresponding pharmacy claims data reflected any opioid prescription for the same patient. In response to the Special Master’s order, Janssen submitted a declaration from Dr. Marais specifically addressing concerns about re-identification.
Dr. Marais declared he was “competent to testify about the matters set forth herein because I have either personally observed such matters or have formed opinions within my areas of professional expertise concerning such matters.” Dr. Marais explained in his declaration:
8. Assuming Plaintiff did not hold the same level of concern about its previous production of de-identified Medicaid data, Plaintiff’s current elevated concern must arise from some hypothetically increased vulnerability to re-identification based on month and day information in addition to the calendar-year information produced previously. Based on my education, pertinent experience, and pertinent background knowledge, it is my opinion that the re-identification risk associated with the production Janssen seeks, whether arising from the completed dates alone or in combination with other demographic information produced to date, or with other publicly accessible information, is de minimis, if indeed any nonzero risk exists at all.
9. I base this opinion on the simple fact that any risk of re-
identification from the additional month and day information Janssen is
8
seeking would have to arise from the purely hypothetical notion of using complete service and dispensing dates to link records from the de-
identified Medicaid data disclosed by Plaintiff to dated records from another, complementary data source that could reveal the identities of individual patients (a so-called “naming data source”). But Janssen does not have access to identified versions of any such complementary data resources. Indeed, patient names and other identifying information have routinely been removed from analogous data sets in other opioid litigation, and I understand that, to the extent Janssen seeks any potentially identifying, supplementary information in this litigation, it has indicated it too would be produced in a de-identified form. Accordingly, there is simply no way that Janssen could use the complete date information that it seeks to re-identify the Medicaid claims data in this litigation.
Dr. Marais went on to explain that there is no realistic prospect that Janssen could re-identify patients using two data sets produced in the litigation provided by the Washington Labor & Industries Workers Compensation (L&I) and Washington Public Employees Benefits Board Program (PEBB). Dr. Marais reasoned that “neither the L&I nor the PEBB data (nor any other data set produced in this litigation) include individually identifying information.” Dr. Marais concluded that “the demographic descriptors included in these data sets (year of birth, gender, race, marital status, and three-digit ZIP code) are insufficient to establish that records drawn from different data sets but having identical demographic descriptors actually represent the same individual patient, even when these combinations of descriptors are unique in the data sets where they appear.” He further opined that “even if [demographic indicators] did happen to represent the same patient, this fact per se would still not identify that patient (because the patient data sets produced in this proceeding simply do not contain a key to individually identifying information, either individually or collectively, with or without the complete service dates that Janssen seeks).” Dr. Marais said that this reasoning “supports my opinion that the incremental re-identification risk associated with the
9
production Janssen seeks is essentially nil.”
Dr. Marais asserted that he needed the complete date of every medical service and prescription fill event in order for him to conduct his analysis, but suggested that the State could “re-produce” the Medicaid data without demographic variables such as birth year, gender, marital status and race.
Dr. Marais further concluded that “there is no basis for supposing” that full Medicaid service dates would contain information that overlapped with service or pharmacy claim records in the workers’ compensation or public employee benefits program datasets available to Janssen. Dr. Marais did not document any method of applying statistical and scientific principles and methods to support his opinion that the risk of re-identification is essentially nil.
State’s Expert Dr. Sweeney The State’s expert, Dr. Sweeney is the director and founder of the Data Privacy Lab and Public Interest Technology Lab at Harvard University, where she is also a professor. Prior to her current position she was a Chief Technology Officer at the United States Federal Trade Commission, was a commissioner on the U.S. Evidence Based Policy Making Commission, and a professor of Computer Science, Technology, and Policy at Carnegie Mellon University. Dr. Sweeney earned a PhD in computer science from the Massachusetts Institute of Technology. Alongside this experience, Dr. Sweeney also lists extensive experience specific to data privacy in medical records, including the identification of re-identification risks and privacy vulnerabilities in publicly available medical data. Her work includes re-identification of Washington State health data in 2015 using blotter stories from archived newspapers and publicly available
10
health data. 2 Through this method, Dr. Sweeney was able to learn sensitive information about patients, such as drug and alcohol abuse and sexually transmitted diseases, none of which had anything to do with the news stories. Dr. Sweeney’s work is cited in the preamble to HIPAA and in other federal regulations.
The State retained Dr. Sweeney to review Janssen’s request for the creation of a version of the de-identified Medicaid Dataset that has full dates for services and prescription refills, and to assess privacy risks related to the disclosure of the Medicaid Dataset. This work is consistent with many other projects she has worked on to demonstrate privacy vulnerabilities. Dr. Sweeney cited her own work as well as published papers reporting re-identification experiments. She also reviewed Dr. Marais’ declaration and noted that it did not provide any evidence or detailed analysis, and did not address a large body of evidence contrary to his opinion.
Dr. Sweeney conducted an analysis using the same information that had been provided to Janssen, the Medicaid Dataset as well as the Death Dataset, which is from the official death registry for the State of Washington. Dr. Sweeney explained that while not all decedents who appear in the Death Dataset are in the Medicaid Dataset, almost all decedents in the Medicaid Dataset should be in the Death Dataset. 3 Dr. Sweeney described the Death Dataset as “semi-publicly available,” noting that the term is used when there is an associated cost for acquisition that limits its availability or requires a lengthy or involved review or application process that limits access. She first measured the identifiability of the Death Dataset, because doing so “describes the overall ground
2 Latanya Sweeney, Only You, Your Doctor, and Many Others May Know, TECH. SCI.
(Sept. 28, 2015), https://techscience.org/a/2015092903 [https://perma.cc/K3Q5-L3P2].
3 The Death Dataset is from the years 2007 through 2017.
11
truth of the identifiability of death data in subsets that could link to it, such as the Medicaid Dataset.” Dr. Sweeney started with the Death Dataset “because matches of records in the Medicaid Dataset to records in the Death Dataset puts names and addresses, as well as Social Security numbers, to the health data.” Dr. Sweeney further explained:
If each decedent record in the Medicaid Dataset matches lots of other records in the Death Dataset ambiguously, then the identifiability of the decedent records in the Medicaid Dataset is low. On the other hand, if decedent records in the Medicaid Dataset match one or few of the namebearing records in the Death Dataset, then the identifiability of the Medicaid Dataset is high. The following experiment reports how low or high the identifiability can be based on the identifiability of the Death Dataset.
Through progressive experiments Dr. Sweeney was able to demonstrate how 191 hospice patients in the Medicaid Dataset uniquely matched 191 named records in the Death Dataset. Dr. Sweeney focused on hospice patients in the Medicaid claims reasoning that patients who receive services at hospice facilities will soon decease and can expect their claims for hospice to appear in the Medicaid Dataset and death to appear in the Death Dataset. Dr. Sweeney compared the 23,013 records for distinct patients who received hospice care that contained year of birth, gender, and the first three digits of their zip code (3-digit zip code). Then by using the last year of hospice service as a proxy for year of death, Dr. Sweeney, found 191 unique matches in the Death Dataset. This constituted a .83 percent match of the 23,013 hospice records. Observing that HIPAA allows health data to be shared that has more than a zero risk, Dr. Sweeney stated “in the case of HIPAA, the risk was quantified experimentally to be acceptable at 0.04% and 0.02% for [unique one to one matches] based on dates in years and only the first three digits of the ZIP code.” When Dr. Sweeney added
12
race/ethnicity data to the analysis, the unique matches increased to 1,275. Dr. Sweeney opined that if Janssen were to obtain the full dates for service claims in the Medicaid Dataset and if the full date of the last day of service for hospice patients matched the date of death, then identifiability would increase further. When using month, day, and year of death, year of birth, gender, 3-digit zip code and race/ethnicity, Dr. Sweeney was able to identify 90 percent of the 574,058 records in the death Dataset as unique. Dr. Sweeney opined that “Defendant’s request for complete dates in the Medicaid Dataset would allow inferences that can put names to a substantial number of records in the Medicaid Dataset.”
Dr. Sweeney explained that the “risk is not limited to the Death Dataset alone.
There are a multitude of possibilities, especially considering publicly and privately held data.” Dr. Sweeney concluded that
Defendant’s request does not seem to understand the privacy risks involved in releasing personal health information under today’s standards.
The fact is that grave risks exist in the data as proposed for release, even without lowering the standard to include complete and full dates of medical services and prescription refills. Lowering the standard would not even adhere to federal and best practices standards for the sharing of personal health.
Dr. Sweeney explained that it is not impossible to anonymize the data and that the proper way requires the use of “scientifically proven methods, not ad hoc guess work (see Declaration of Defendant’s expert). [Janssen]’s request comes nowhere close to meeting those established standards or otherwise assuring individuals whose sensitive health information is in the Medicaid Dataset cannot be re-identified.” 4
4 Dr. Sweeney’s report discussed two of methods of anonymizing data: k-anonymity and differential privacy.
13
Alongside the submission of Dr. Sweeney’s report, the State submitted a declaration from Christopher Purdy of Celerity Consulting Group explaining that an alternative to providing Janssen with the full dates of service, it could provide a “sequenced” dataset. Purdy explained that the sequenced dataset “would indicate the sequence of [Medicaid claims] events within a given year without revealing any day and month information for those events.” He explained that the group had previously provided sequenced datasets of L&I data for use in discovery production in the State’s litigation with other opioid manufacturers.
The Special Master held another hearing in January 2022, allowing the parties to argue their positions regarding the expert opinions. The Special Master ordered the State to provide sequencing of the Medicaid Dataset, but denied Janssen’s request to supplement the Medicaid Dataset with month and date of servicing and prescription filling. The Special Master reasoned that it was persuaded from Dr. Sweeney’s opinion that re-identification is a substantial risk if this additional information is produced by the State.
The Special Master held an additional hearing in February 2022 after Janssen moved for reconsideration of his prior ruling denying the motion to compel the production of full Medicaid service dates. The Special Master ruled that both Dr. Marais and Dr. Sweeney were qualified experts under 45 C.F.R. § 164.514(b)(2). The Special Master then concluded that it found “Dr. Marais’ conclusions stating such a risk is de minimis if indeed any nonzero risk at all is ipse dixit” and that Janssen did not meet its burden of showing the “risk is very small” under §164.514(b).
14
Janssen then filed an objection to the Special Master’s ruling and order denying its motion to compel the supplemental Medicaid claims data. Janssen asserted in the motion that Dr. Sweeney had incorrectly calculated the risk of re-identification stating,
Dr. Sweeney’s analyses of DOH mortality data were limited to identifying potential matches (not reasonably accurate matches) in a limited subset of hospice patients’ Medicaid data. And she found that just 191 hospice patients in the Medicaid data had a birth year, gender, and a three-digit zip code that corresponded to the same demographic information for a decedent in the DOH death data. Even assuming those were true matches (an assumption unsupported by the record), Dr. Sweeney showed nothing more than a re-identification risk of 0.0004% (191 of over 4.5 million Medicaid patients).
The trial court, without oral argument, 5 sustained Janssen’s objection and reversed the Special Master’s ruling. The trial court believed the State and Special Master had applied an incorrect standard and each had suggested that “any risk of re- identification is unacceptable.” The trial court noted that neither the State nor Special Master had addressed “how the Court could minimize, if not entirely eliminate, the risk of re-identification, and the burden to the State.” The trial court specifically found that the expert opinion of Dr. Marais provided by Janssen “is compliant with the certification requirement in 45 C.F.R. § 164.514” and that “the most probative portion of [Dr. Marais’] analysis largely boiled down to one similar to the State’s expert’s, but with a different denominator.” The court then concluded there was no justification of using the total number of hospice patients as opposed to the total number of Medicaid patients, followed the change in the formula proposed in Janssen’s brief and found that “the resulting risk of re-identification is 0.004%, which this Court finds is acceptably a ‘very small’ risk of identification pursuant to 45 C.F.R. § 164.514.” The record is devoid of
5 The parties did not request oral argument.
15
any expert supporting the assertion that it was proper to substitute the entire Medicaid patient population in a formula designed to match Medicaid patients in hospice whose last date of service matched the date of death in the Death Database.
The trial court granted Janssen’s motion and followed its recommendations to further mitigate risk of re-identification. The court ruled:
• The State is ordered to produce the Medicaid claims data with full dates of service and dispensing, but without birth year, gender, marital status, and race/ethnicity variables.
• The Defendants are prohibited from making any effort whatsoever to take this data or any other data and link it up to any named data, permitting re-identification.
• The distribution of this data would be strictly restricted to Defendants’ counsel and Defendants’ expert and the fewest number of people from his office needed to assist him with the data analysis. The newly produced data will be maintained otherwise subject to the Protective Order entered in this matter.
• The Defendants are required to contemporaneously destroy, and certify the destruction of, the prior Medicaid dataset produced by the State and provided to the Defendants’ expert, prior to the provision of this data.
• The Defendants are prohibited from providing the DOH mortality data set or any other “naming data source” to the expert who will conduct this analysis.
• Defendants will pay for additional redaction and costs incurred as a result of providing this data.
The trial court denied the State’s motion for reconsideration. The State filed a notice of discretionary review to this court. Interlocutory review under RAP 2.3(b)(2) requires a showing of “probable error” in a trial court decision that “substantially alters the status quo or substantially limits the freedom of a party to act.” Review may be granted where the superior court has departed from the usual course of judicial proceedings. RAP 2.3(b)(3). A commissioner of this court granted discretionary review.
16
DISCUSSION
Standard of Review
It is within the trial court’s discretion to deny a motion to compel discovery and we will not disrupt the ruling absent an abuse of discretion. Clarke v. State Att’y Gen.'s Off., 133 Wn. App. 767, 777, 138 P.3d 144 (2006) (citing Shields v. Morgan Fin., Inc., 130 Wn. App. 750, 759, 125 P.3d 164 (2005)). “A trial court abuses its discretion if its decision is manifestly unreasonable or based on untenable grounds or untenable reasons.” Marriage of Littlefield, 133 Wn.2d 39, 46-47, 940 P.2d 1362 (1997).
Timeliness
As a threshold matter, Janssen contends that the State failed to timely file a notice for discretionary review, time barring review. Janssen claims that the State was required under RAP 5.2(b)(1) to file a notice for discretionary review within 30 days after the entry of the order granting Janssen’s motion to compel, on which the State seeks review here. Respondent argues that review is time-barred because the State only filed its notice for discretionary review 30 days after the trial court’s entry of the order denying the State’s motion for reconsideration of the order to which the State assigns error. Janssen asserts the State is limited to review of the denial of its motion for reconsideration, not the underlying order.
A timely motion for reconsideration will extend the 30-day deadline to appeal the original order. Singleton v. Naegeli Reporting Corp., 142 Wn. App. 598, 603, 175 P.3d 594 (2008). Under CR 59, an aggrieved party may move for reconsideration of a decision or order “not later than 10 days” after the entry of the order or decision. CR 59(b). Here, the trial court entered its order on April 13, 2022 sustaining Janssen’s
17
objection to the special master’s ruling and order denying its request for the State to produce the Medicaid claims database with supplemental data fields. The State moved for reconsideration on April 29, 2022, outside the 10-day limit permitted under CR 59(b).
In its response to the State’s motion for discretionary review, Janssen argued that the State’s notice for discretionary review was barred under RAP 5.2(b) as untimely because it was filed more than 30 days after entry of the trial court’s decision. The commissioner of this court did not address the issue of timeliness in its Ruling Granting Discretionary Review. Janssen did not move to modify the order.
Consideration of a motion for discretionary review is governed by the regular motion procedure, RAP 6.2(c), requiring an aggrieved party to object to a ruling only by way of a motion to modify. RAP 17.7(a). See City of Spokane v. Marquette, 103 Wn. App. 792, 797, 14 P.3d 832 (2000), rev’d on other grounds, 146 Wn.2d 124, 43 P.3d 502 (2002). Because Janssen did not move to modify the commissioner’s ruling, it has waived any argument that the granting of discretionary review was improper because the request was untimely.
Expert Determination
The State contends that the trial court erred in ordering it to produce the supplemental Medicaid claims data to include the day and month in the date of service field, rather than just the year. The State argues that Janssen’s expert failed to comply with the requirements of the Expert Determination method of producing HIPAA protected information. We agree.
The parties agree that 45 C.F.R. § 164.514(b)(1) provides the requirements for the Expert Determination method. Releasing the full dates in the Medicaid Dataset is
18
contrary to 45 C.F.R. § 164.514(b)(2)(i)(C) under the Safe Harbor method. Thus, for the court to be satisfied that the release of full dates would not create a “reasonable basis to believe that the information can be used to identify an individual,” 45 C.F.R. § 164.514(a), a qualified expert, applying principles and methods for rendering information not individually identifiable, had to document the methods and results of its analysis that determined the “the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information.” 45 C.F.R. § 164.514(b)(1)(i) and (ii).
It appears the trial court misread the record. First, it incorrectly found that the State and the Special Master applied an incorrect risk level of “any risk” instead of the correct standard of a “very small risk” under 45 C.F.R. § 164.514(b)(1)(i). The State submitted Dr. Sweeney’s declaration where she acknowledged that HIPAA does not require the risk to be zero before health data may be shared. The Special Master expressly found that Janssen did not meet its burden of showing the “risk is very small” under §164.514(b).
Second, the trial court incorrectly attributed to Dr. Marais an analysis and formula that he did not make or suggest. Nowhere does Dr. Marais propose replacing the denominator of Medicaid hospice patients in Dr. Sweeney’s analysis with the entire number of Medicaid patients in the Dataset. That suggestion instead came from the Janssen attorneys in their brief.
Janssen argues that “Dr. Marais considered all of the ‘data sets produced in this proceeding’ and publicly available dataset.” First, Dr. Marais made no such claim. His
19
declaration reveals that he did not review or consider the consequences of the Death Dataset before opining that the risk was “nil.” He based his opinion on the “simple fact” that Janssen does not have “another, complementary data source that could reveal the identifies of individual patients” that could be compared to the Medicaid claims database to provide identifying information. It is undisputed that the Death Dataset included identifiable information, including names. Dr. Marais did not document having applied principles and methods for rendering information not individually identifiable. Dr. Marais’ declaration simply states “Based on my education, pertinent experience, and pertinent background knowledge, it is my opinion that the re-identification risk associated with the production Janssen seeks, whether arising from the completed dates alone or in combination with other demographic information produced to date, or with other publicly accessible information, is de minimis.”
The trial court adopted the suggestion by Janssen’s attorneys that Dr. Sweeney’s analysis should be changed to replace the denominator in her risk assessment formula from the total number of hospice patients in the Medicaid Dataset to the entire 4.5 million people in the Dataset in order to get to a lower risk percentage. This is without any support from any expert that doing so is a proper measurement of calculating the risk of re-identifying the subset of hospice patients in the Medicaid Dataset.
In contrast, Dr. Sweeney provided detailed explanations of the generally accepted method she applied in making her determinations regarding the risk of re- identification. Dr. Sweeney also demonstrated how the ability to identify unique individuals increased as more datapoints were included in the analysis. She also applied the methods in five separate applications and considered how the additional
20
information requested could be compared with datasets previously provided to Janssen in discovery and how such information is publicly available.
It appears the trial court also reasoned that changing Dr. Sweeney’s analysis was appropriate because there was no justification to looking at only hospice patients. The trial court appeared to misunderstand why Dr. Sweeney focused on hospice patients. The concern under HIPAA is whether there is a “reasonable basis to believe that the information can be used to identify an individual.” 45 C.F.R. § 164.514(a) (emphasis added). The question is whether “the risk is very small that the information could be used . . . to identify an individual who is a subject of the information.” 45 C.F.R. § 164.514(b)(1)(i) (emphasis added). That is a different question than whether the percentage of identifiable people out of the total number of people whose records are released is very small. OCR’s guidance notes that “experts are advised to consider how data sources that are available to a recipient of health information . . . could be utilized for identification of an individual.” (Emphasis added.) Dr. Sweeney demonstrated through her analysis that, even before using full dates, the data sources could be used to identify 191 unique individuals. Janssen cites to no authority that suggests an analysis under the Expert Determination method must calculate the risk of identifying the entire population within the data set.
Regardless, the trial court could not substitute its opinion or the opinion of the Janssen attorneys for that of a qualified expert under 45 C.F.R. § 165.514(b)(1)(i) and (ii). Because the record establishes that Dr. Marais’ expert opinion did not satisfy 45 C.F.R. § 165.514(b)(1)(i) and (ii), we hold that the trial court’s reliance on Dr. Marais’ opinion was untenable and that the court abused its discretion in determining that the
21
Expert Determination method was satisfied under HIPAA as a basis to grant Janssen’s motion to compel HCA, a covered entity, to disclose full dates in the Medicaid claims database.
Release Under Court Order While HIPAA controls what a “covered entity” may release, it does allow disclosure of protected health information in the course of a judicial proceeding if certain requirements are met. 45 C.F.R. § 164.512(e)(1). Disclosures are permitted in “response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order” and that a “qualified protective order means” one that
(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and
(B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.
45 C.F.R. § 164.512(e)(1)(v). However, the parties do not dispute that because the Medicaid Dataset includes substance use disorder patient records, 42 C.F.R. part 2 also applies to the requested records.
Records identifying any patient receiving treatment or rehabilitation for a substance use disorder under a federally conducted or funded program, such as Medicaid, are required to be “confidential”. 42 U.S.C. § 290dd-2(a); See Daybreak Youth Servs. v. Clark County Sheriff's Off., 19 Wn. App. 2d 879, 892, 498 P.3d 571 (2021). Disclosure is only permitted through means expressly authorized under 42 U.S.C. § 290dd-2. The statute generally requires patient consent to disclose the
22
records, but makes express exceptions for disclosure in limited circumstances. 42 U.S.C. § 290dd-2(b)(2)(A)-(D). One such exception is permitted “if authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefor.” 42 U.S.C. § 290dd-2(b)(2)(C); Daybreak Youth Servs., 19 Wn. App. 2d at 889. A court granting such an order must “weigh the public interest and the need for disclosure against the injury to the patient, to the physician-patient relationship, and to the treatment services” in assessing good cause. 42 U.S.C. § 290dd-2(b)(2)(C). Federal regulations further explain the process for disclosure of identifying information.
The restrictions under 42 U.S.C. § 290dd-2 apply to any records which “would identify a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person.” 42 C.F.R. § 2.12(a)(i).
Janssen does not attempt to argue that the trial court weighed the public interest and need for disclosure or assessed good cause. Instead, Janssen contends the information requested is de-identified so neither HIPAA nor part 2 prohibits disclosure. 6 The trial court imposed “conditions in compliance with 42 C.F.R. § 2.11” as part of its order to compel. In addition to HIPAA concerns, a commissioner of this court granted discretionary review to consider whether the trial court committed error by ordering release of protected health information which could be further used to identify
6 Janssen also contends that the parties had entered into a qualifying protective order that satisfies HIPAA for patients who did not have a substance use disorder. We granted Janssen’s request to supplement the record with a copy of this protective order, but this order was entered prior to Janssen’s motion to compel disclosure of the full service and prescription dates and the trial court did not rule on whether the HIPAA-compliant Protective Order previously entered by the court overrides the application of the Safe Harbor provision. That issue is not before us.
23
substance-use disorder patients in violation of 42 U.S.C. § 290dd-2(b)(1) and (b)(2)(C), and implementing regulations at 42 C.F.R. §§ 2.1-2.67.
As the trial court recognized, 42 C.F.R. § 2.11 defines patient identifying information to include “information by which the identity of a patient, as defined in this section, can be determined with reasonable accuracy either directly or by reference to other information.”
“42 C.F.R. § 2.61 defines the legal effect of a court order entered under the regulations. The order’s ‘only purpose is to authorize a disclosure or use of patient information which would otherwise be prohibited.’” Daybreak Youth Servs., 19 Wn. App. 2d at 889 (quoting 42 C.F.R. § 2.61(a)).
If the court decides to issue an order authorizing disclosure, the court must determine that good cause for the disclosure exists. 42 C.F.R. § 2.64(d). To find good cause, the court must determine that
(1) Other ways of obtaining the information are not available or would not be effective; and
(2) The public interest and need for the disclosure outweigh the potential injury to the patient, the physician-patient relationship and the treatment services.
42 C.F.R. § 2.64(d). Prior to an order authorizing disclosure, both the patient and the record holder must be provided with
(1) Adequate notice in a manner which does not disclose patient identifying information to other persons; and
(2) An opportunity to file a written response to the application, or to appear in person, for the limited purpose of providing evidence on the statutory and regulatory criteria for the issuance of the court order as described in § 2.64(d).
42 C.F.R. § 2.64(b).
24
In addition to the required findings and notice, the order itself must:
(1) Limit disclosure to those parts of the patient’s record which are essential to fulfill the objective of the order;
(2) Limit disclosure to those persons whose need for information is the basis for the order; and
(3) Include such other measures as are necessary to limit disclosure for the protection of the patient, the physician-patient relationship and the treatment services; for example, sealing from public scrutiny the record of any proceeding for which disclosure of a patient’s record has been ordered.
42 C.F.R. § 2.64(e). 7 Because the trial court ruled that Janssen’s expert satisfied the Expert Determination method, 8 the court presumably believed the requested information under the motion to compel was not individually identifiable health information as defined in 42 C.F.R. § 2.11. Because we conclude this record does not support the trial court’s determination that the Expert Determination was satisfied, in order for the trial court to order release of any identifiable health information otherwise protected under 42 C.F.R. part 2, the trial court was required to find good cause under 42 C.F.R. § 2.64(d) and require notice be provided under 42 C.F.R. § 2.64(b) before ordering disclosure and imposing limitations and conditions under 42 C.F.R. § 2.64(e). It is undisputed that the
7 The court order alone does not compel disclosure, but must be accompanied by “a subpoena or a similar legal mandate” in order to compel the disclosure. 42 C.F.R. § 2.61(a).
8 Though the trial court adopted Dr. Marias’ suggestion to grant Janssen’s request for full dates in the Medicaid Dataset while limiting other data points, the record is absent of any Expert Determination analysis as to whether release of such a combination of data satisfies HIPAA.
25
court did not grant the motion to compel under 42 C.F.R. § 2.64.
Accordingly, we reverse.
WE CONCUR: