The Washington University, Respondent, v. Attorney General of the State of Missouri, Appellant.
This text of The Washington University, Respondent, v. Attorney General of the State of Missouri, Appellant. (The Washington University, Respondent, v. Attorney General of the State of Missouri, Appellant.) is published on Counsel Stack Legal Research, covering Missouri Court of Appeals primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.
Opinion
IN THE MISSOURI COURT OF APPEALS EASTERN DISTRICT DIVISION TWO THE WASHINGTON UNIVERSITY, ) No. ED113034 ) Respondent, ) ) Appeal from the Circuit Court of v. ) the City of St. Louis ) Cause No. 2322-CC09640 ATTORNEY GENERAL OF THE STATE ) OF MISSOURI, ) Honorable Joseph P. Whyte ) Appellant. ) ) Filed: September 16, 2025
Introduction
This appeal involves a complex discovery dispute between the Attorney General of the
State of Missouri (“Attorney General”),1 and the Washington University Pediatric Transgender
Center at St. Louis Children’s Hospital (“the Center”).2 The Attorney General launched an
investigation under the authority of the Missouri Merchandising Practices Act (“MMPA”), section
407.010 et seq.3 into the Center after a whistleblower issued a sworn affidavit detailing allegations
1 Andrew Bailey originally brought this appeal in his official capacity as Attorney General. Bailey ceased holding this office on September 8, 2025. Catherine L. Hanaway was appointed to fill this vacancy. Hanaway has recused herself in this appeal. See Rule 52.13(d) (directing when “a public officer is a party to an action in an official capacity and during its pendency … ceases to hold office, the action does not abate and the successor is automatically substituted as a party.” Further, “[w]hen a public officer sues or is sued in an official capacity, the officer may be described as a party by official title rather than by name….”); Conservation Comm’n v. Bailey, 669 S.W.3d 61, 66 n.7 (Mo. banc 2023) (finding Rule 52.13(d) provides for automatic substitution of parties under these circumstances). 2 This opinion addresses only the Attorney General’s administrative subpoena power to compel production of unredacted medical records under the MMPA during a pre-claim investigation. This Court expresses no opinion about the underlying merits of the Attorney General’s investigation against the Center’s alleged practices because he has not filed any formal charge or claim against it alleging any wrongdoing. 3 All statutory references are to RSMo 2016 unless otherwise indicated. involving pediatric transgender care the Center provided. The Attorney General issued three civil
investigative demands (“CIDs”) to the Center seeking 135 responses to requests for documents
and information and to depose two Center healthcare providers. The Center moved to modify the
CIDs to the extent they sought protected health information (“PHI”) as defined under the Health
Information Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule, 45 C.F.R. Parts
160 and 164. The Attorney General concurrently moved to enforce the CIDs as issued. The circuit
court entered judgment on the pleadings in the Center’s favor and modified the CIDs to prevent
disclosure of any medical records and PHI.
The Attorney General appeals, raising seven points. In Point I, the Attorney General argues
the circuit court erred in finding the PHI was irrelevant to the MMPA investigation because he
asserts it falls squarely within the MMPA’s scope. He contends the PHI contains evidence of
billing fraud and unlawful coercion relevant to whether the Center engaged in deception, coercion,
or fraud when urging parents and insurance providers to purchase irreversible gender transition
services. In Point II, the Attorney General contends the circuit court erred in precluding the Center
from producing PHI on privilege grounds because the Center waived this argument by not raising
it below, and the circuit court could not raise this affirmative defense sua sponte for the Center.
In Points III through VII, the Attorney General asks this Court to resolve whether HIPAA is an
affirmative defense, who has the burden of proving HIPAA applies, and whether four HIPAA
provisions compel disclosure of the Center’s medical records and PHI without redaction.
This Court holds the circuit court erred in sustaining the Center’s motion to modify the
CIDs to preclude disclosure of its patients’ medical records and PHI because, in a pre-claim
investigation, the Attorney General’s broad investigative power permits him to request discovery
into medical-related services which may involve coercive, fraudulent, and/or unlawful practices
2 under the MMPA. Point I is granted. The circuit court erred in ruling on privilege because the
Center did not raise it below. Point II is granted. Because the CIDs clearly stated the Attorney
General’s intent to investigate the Center for alleged unlawful practices under the MMPA and not
Chapter 191, HIPAA’s “health oversight agency” provision permitting disclosure cannot be
satisfied on remand as a matter of law under the facts presented. Point V is denied. Because the
CIDs are not independently enforceable orders, HIPAA’s “administrative tribunal” provision
permitting disclosure cannot be satisfied on remand as a matter of law under the facts presented.
Point VI is denied. Because the circuit court has not entered a court order determining which PHI
will be expressly authorized for disclosure while considering viable HIPAA provisions, Point IV
is denied in part and granted in part. Because the circuit court misapplied the first two prongs of
HIPAA’s “law enforcement purposes” provision but has not determined the merits of whether de-
identified information could not reasonably be used, Point VII is granted in part. Finally, although
the Center generally bears the burden of complying with HIPAA, the Attorney General bears the
burden on remand of demonstrating de-identified information could not reasonably be used to
authorize disclosure under HIPAA’s “law enforcement purposes” provision. Point III is denied.
The circuit court’s judgment is reversed, and the case is remanded for further proceedings
consistent with this opinion.
Factual and Procedural History
In 2017, Washington University opened the Center to provide medical care for transgender
youth. In 2023, a Center whistleblower issued an 86-paragraph sworn affidavit alleging the Center
engaged in misconduct, prompting the Attorney General to launch an investigation. The Attorney
General issued three CIDs to the Center and its employees, explaining he believed the Center had
3 “engaged in or [is] engaging in any practices declared to be unlawful [under the MMPA].”4 The
CIDs state, “The Attorney General has reason to believe that [the Center] may have used deception,
fraud, false promises, misrepresentation, unfair practices, and/or the concealment, suppression, or
omission of material facts within the scope of the [MMPA].” The Attorney General stated the
investigation was “based in part on, but is not limited to, allegations made in the sworn affidavit
by [the whistleblower].”
The first CID, issued in February 2023, provided instructions on how to respond, including
Instruction No. 9, which stated if the Center believed it had responsive materials which were
privileged, the Center had to produce a privilege log identifying the material, the basis for
withholding it, and sufficient information to permit the Attorney General to assess whether it is
privileged. The CID contained defined terms, including, “Client” to mean “all customers to whom
[the Center] ha[s] provided or [is] providing [its] services, Clients’ Parents, or Clients’ legal
guardians.” The CID then listed 135 individual requests for information and documents. These
requests sought information about the Center’s policies, procedures, guidelines, publications,
Free access — add to your briefcase to read the full text and ask questions with AI
IN THE MISSOURI COURT OF APPEALS EASTERN DISTRICT DIVISION TWO THE WASHINGTON UNIVERSITY, ) No. ED113034 ) Respondent, ) ) Appeal from the Circuit Court of v. ) the City of St. Louis ) Cause No. 2322-CC09640 ATTORNEY GENERAL OF THE STATE ) OF MISSOURI, ) Honorable Joseph P. Whyte ) Appellant. ) ) Filed: September 16, 2025
Introduction
This appeal involves a complex discovery dispute between the Attorney General of the
State of Missouri (“Attorney General”),1 and the Washington University Pediatric Transgender
Center at St. Louis Children’s Hospital (“the Center”).2 The Attorney General launched an
investigation under the authority of the Missouri Merchandising Practices Act (“MMPA”), section
407.010 et seq.3 into the Center after a whistleblower issued a sworn affidavit detailing allegations
1 Andrew Bailey originally brought this appeal in his official capacity as Attorney General. Bailey ceased holding this office on September 8, 2025. Catherine L. Hanaway was appointed to fill this vacancy. Hanaway has recused herself in this appeal. See Rule 52.13(d) (directing when “a public officer is a party to an action in an official capacity and during its pendency … ceases to hold office, the action does not abate and the successor is automatically substituted as a party.” Further, “[w]hen a public officer sues or is sued in an official capacity, the officer may be described as a party by official title rather than by name….”); Conservation Comm’n v. Bailey, 669 S.W.3d 61, 66 n.7 (Mo. banc 2023) (finding Rule 52.13(d) provides for automatic substitution of parties under these circumstances). 2 This opinion addresses only the Attorney General’s administrative subpoena power to compel production of unredacted medical records under the MMPA during a pre-claim investigation. This Court expresses no opinion about the underlying merits of the Attorney General’s investigation against the Center’s alleged practices because he has not filed any formal charge or claim against it alleging any wrongdoing. 3 All statutory references are to RSMo 2016 unless otherwise indicated. involving pediatric transgender care the Center provided. The Attorney General issued three civil
investigative demands (“CIDs”) to the Center seeking 135 responses to requests for documents
and information and to depose two Center healthcare providers. The Center moved to modify the
CIDs to the extent they sought protected health information (“PHI”) as defined under the Health
Information Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule, 45 C.F.R. Parts
160 and 164. The Attorney General concurrently moved to enforce the CIDs as issued. The circuit
court entered judgment on the pleadings in the Center’s favor and modified the CIDs to prevent
disclosure of any medical records and PHI.
The Attorney General appeals, raising seven points. In Point I, the Attorney General argues
the circuit court erred in finding the PHI was irrelevant to the MMPA investigation because he
asserts it falls squarely within the MMPA’s scope. He contends the PHI contains evidence of
billing fraud and unlawful coercion relevant to whether the Center engaged in deception, coercion,
or fraud when urging parents and insurance providers to purchase irreversible gender transition
services. In Point II, the Attorney General contends the circuit court erred in precluding the Center
from producing PHI on privilege grounds because the Center waived this argument by not raising
it below, and the circuit court could not raise this affirmative defense sua sponte for the Center.
In Points III through VII, the Attorney General asks this Court to resolve whether HIPAA is an
affirmative defense, who has the burden of proving HIPAA applies, and whether four HIPAA
provisions compel disclosure of the Center’s medical records and PHI without redaction.
This Court holds the circuit court erred in sustaining the Center’s motion to modify the
CIDs to preclude disclosure of its patients’ medical records and PHI because, in a pre-claim
investigation, the Attorney General’s broad investigative power permits him to request discovery
into medical-related services which may involve coercive, fraudulent, and/or unlawful practices
2 under the MMPA. Point I is granted. The circuit court erred in ruling on privilege because the
Center did not raise it below. Point II is granted. Because the CIDs clearly stated the Attorney
General’s intent to investigate the Center for alleged unlawful practices under the MMPA and not
Chapter 191, HIPAA’s “health oversight agency” provision permitting disclosure cannot be
satisfied on remand as a matter of law under the facts presented. Point V is denied. Because the
CIDs are not independently enforceable orders, HIPAA’s “administrative tribunal” provision
permitting disclosure cannot be satisfied on remand as a matter of law under the facts presented.
Point VI is denied. Because the circuit court has not entered a court order determining which PHI
will be expressly authorized for disclosure while considering viable HIPAA provisions, Point IV
is denied in part and granted in part. Because the circuit court misapplied the first two prongs of
HIPAA’s “law enforcement purposes” provision but has not determined the merits of whether de-
identified information could not reasonably be used, Point VII is granted in part. Finally, although
the Center generally bears the burden of complying with HIPAA, the Attorney General bears the
burden on remand of demonstrating de-identified information could not reasonably be used to
authorize disclosure under HIPAA’s “law enforcement purposes” provision. Point III is denied.
The circuit court’s judgment is reversed, and the case is remanded for further proceedings
consistent with this opinion.
Factual and Procedural History
In 2017, Washington University opened the Center to provide medical care for transgender
youth. In 2023, a Center whistleblower issued an 86-paragraph sworn affidavit alleging the Center
engaged in misconduct, prompting the Attorney General to launch an investigation. The Attorney
General issued three CIDs to the Center and its employees, explaining he believed the Center had
3 “engaged in or [is] engaging in any practices declared to be unlawful [under the MMPA].”4 The
CIDs state, “The Attorney General has reason to believe that [the Center] may have used deception,
fraud, false promises, misrepresentation, unfair practices, and/or the concealment, suppression, or
omission of material facts within the scope of the [MMPA].” The Attorney General stated the
investigation was “based in part on, but is not limited to, allegations made in the sworn affidavit
by [the whistleblower].”
The first CID, issued in February 2023, provided instructions on how to respond, including
Instruction No. 9, which stated if the Center believed it had responsive materials which were
privileged, the Center had to produce a privilege log identifying the material, the basis for
withholding it, and sufficient information to permit the Attorney General to assess whether it is
privileged. The CID contained defined terms, including, “Client” to mean “all customers to whom
[the Center] ha[s] provided or [is] providing [its] services, Clients’ Parents, or Clients’ legal
guardians.” The CID then listed 135 individual requests for information and documents. These
requests sought information about the Center’s policies, procedures, guidelines, publications,
studies relied upon and participated in, annual reports, solicitation and promotional materials,
organizational charts, personnel materials such as personnel files, resumes, and curricula vitae, and
requests for information related to 50 specific whistleblower allegations. There were also
numerous requests for individual patient medical records and PHI. For illustrative purposes, some
requests included:
31. Identify all Clients to whom You have provided Your Services …. For each Client, describe Your Services, the dates You provided Your services, the amounts
4 Section 407.040.1 empowers the Attorney General to issue and serve CIDs “upon any person who is believed to have information, documentary material, or physical evidence relevant to the alleged or suspected violation” or a person who has engaged in “any method, act, use, practice or solicitation declared to be unlawful by [the MMPA]” or it is in the “public interest that an investigation should be made to ascertain whether a person in fact has engaged in or is engaging in any such method, act, use, practice or solicitation ….”
4 Clients, their insurers, or other third-party payors paid for these Services, and any contracts related to these Services.
32. Produce access to all electronic health records of Clients.
67. List all mental-health diagnoses that were active in the record of each Client at the time when You prescribed the Client puberty blockers, cross-sex hormones, or other hormonal or surgical intervention.
77. For all Clients to whom You prescribed puberty blockers, cross-sex hormones, or other hormonal or surgical intervention, produce all documents related to parental consent for these Clients.
78. For all Clients to whom You prescribed puberty blockers, cross-sex hormones, or other hormonal or surgical intervention, produce all documents related to your disclosure of risk to these Clients.
The second and third CIDs, issued in November 2023, compelled a Center nurse and physician to
appear for depositions to testify about the information, documentary material, and/or physical
evidence relevant to the investigation including individual patients and PHI.
The Center and the Attorney General initially worked cooperatively to negotiate the
Center’s responses to the first CID. In its initial response, the Center catalogued its “general
qualifications and objections” to the CID, including:
The CID appears to seek information pertaining to both representations to the public regarding [the Center’s] services and the propriety of actual medical care delivered to patients. While representations to the public regarding services may be within the scope of the MMPA, requests directed to issues such as whether the care delivered by [the Center] met professional medical standards, including with regard to a specific patient’s care, are outside the proper scope of the MMPA.
The Center further claimed the CID was overly broad and unduly burdensome to the extent the
Attorney General sought “all” documents, records, or information. The Center also asserted, “The
patient records (and e-mails or other documents related to patients) contain highly sensitive,
private health and personal information. Any PHI … produced is protected by HIPAA.” The
Center nevertheless agreed to provide the Attorney General with remote, read-only access to its
5 electronic medical records system, EPIC, to further comply with the CID. The Center provided
voluminous responses to this CID with many individual responses directing the Attorney General
to find additional information in the electronic medical records.
A week later, the Center provided its first supplemental response, which incorporated by
reference its “general qualifications and objections” from its initial response. In response to
request No. 31, the Center provided the Attorney General with a detailed spreadsheet containing
the following data for all 1,165 patients:
• [Center] Clinic Pt List: This tab provides the patient list (1,165) for all patients who had an encounter with [the Center] sufficient to create an EPIC medical record for the patient, including those who attended a visit with a provider. The list provides demographic information for these patients, including Patient ID, Medical Record Number, date of birth, age at first [Center] encounter, first [Center] encounter date, last [Center] encounter date (including future events if already scheduled), total [Center] encounters, and total completed [Center] appointments.
• [Center] Encounter Data: This tab includes data for all encounters recorded in EPIC for transgender care for the 1,165 patients. It includes the date of the encounter and a description of the encounter (including patient name, date, type of encounter, and visit type). Accordingly, it describes the service provided on each date, although the medical records will have more detail.
• All [Center] Meds by Patient: This tab includes the date of every [Center] prescription for a [Center] patient, including the patient’s name and drug prescribed. This tab thus describes services if they included a prescription order by the provider.
• Charge Data for Encounter: This tab includes the [Center] charge for [Center] encounters described above. (Note that not all encounters result in a [Center] charge, so this tab includes fewer rows than the Encounter data.) The data includes the date of the charge, the patient’s name, the provider, the payor, the procedure code, the procedure name, diagnosis codes, the amount charged, and the amount paid.
In addition, the tabs provide information that permit cross reference, including dates, patient identifiers, and encounter numbers. More detail about the specific services provided can be found in the medical records.
6 The Center also directed the Attorney General to find more specific information in the electronic
medical records in response to several other supplemental requests.
On April 7, 2023, the Center provided a second supplemental response via email through
a password-protected link. The Attorney General did not “contemporaneously access[]” the link
and notified the Center the link no longer worked on August 7, 2023. The Center sent a letter
explaining it was obligated to ensure it provided tailored—and perhaps redacted—information to
protect its patients’ privacy rights. The Center requested a meeting to discuss tailoring the CID’s
requests to the MMPA’s stated purposes while taking steps to ensure patient privacy was consistent
with HIPAA’s minimum standards. The Attorney General declined this request and demanded all
documents be produced unredacted with their metadata. The Center indicated it would produce
the materials after redacting PHI, which occurred in September 2023. Some materials the Center
provided were heavily redacted. The parties continued to dispute whether: (1) the Attorney
General’s requests for PHI were within the MMPA’s scope; (2) the Center was obligated to provide
remote, read-only access to its electronic medical records; (3) HIPAA applied and to what extent;
and (4) redacted documents fulfilled the CID. The Center produced a privilege log, but the parties
could not resolve their disputes.
Having reached an impasse, the Center moved to modify the CIDs.5 The Center requested
guidance about whether the requests, including “patient medical records and information
concerning the medical standard of care; individualized medical assessments and treatment
decisions; patient records related to deliberations between patients, their parents and doctors about
the appropriate course of care; and mental health assessments” fell within the MMPA’s scope and
the Attorney General’s authority to investigate. The Center further alleged because HIPAA
5 Section 407.070 permits a party subject to a CID to file “a petition … to modify or set aside the [CID], stating good cause …” in the circuit court.
7 governed this information’s disclosure, it required guidance on its obligation under HIPAA when
complying with the CIDs. The Center alleged the Attorney General bore the burden of
demonstrating HIPAA permitted PHI disclosure. The Center further alleged it was disputed
whether two HIPAA provisions—the “health oversight agency” and “law enforcement
purposes”—permitted disclosure. Accordingly, the Center moved to modify the CIDs to exclude
any requests outside the MMPA’s scope or prohibited or narrowed by HIPAA. The Center did not
assert any privilege applied to prevent disclosure.
The Attorney General filed an answer and counterclaim requesting the CIDs be enforced
as written.6 The Attorney General contended the investigation concerned “whether [the Center]
used unfair or deceptive practices ‘in connection with the sale or advertisement’ of these
interventions.” The Attorney General denied “the MMPA forbids investigating medical
malpractice issues” and believed the medical malpractice exemption did not divest him of
investigative authority.7 Regarding the Center’s HIPAA assertions, the Attorney General noted
the MMPA included robust privacy protections prohibiting him from disclosing any documents
except in limited circumstances, and he was committed to maintaining the confidentiality
requirements imposed by law.8 The Attorney General generally contended HIPAA regulations did
not prohibit the Center from producing the PHI the CIDs requested. The Attorney General did not
respond to or address the applicability of any specific HIPAA provision permitting disclosure.
6 Section 407.090 permits the Attorney General to file a petition to require CIDs be enforced “[w]henever any person fails to comply with any [CID] duly served ….” 7 The medical malpractice exemption was added to the MMPA in 2020. See section 407.025.3, RSMo Cum. Supp. 2020 (“No action may be brought under this section to recover damages for personal injury or death in which a claim can be made [for medical malpractice] under chapter 538.”). The parties do not address this amendment on appeal. 8 Section 407.060.1 prohibits the production or disclosure of any “information, documentary material, or physical evidence requested pursuant to a [CID] issued under section 407.040” to any person other than an authorized Attorney General employee “unless otherwise ordered by a court for good cause shown[.]”
8 The parties both moved for judgment on the pleadings. After extensive briefing, a hearing,
and submission of proposed judgments, the circuit court issued judgment on the pleadings in the
Center’s favor for three reasons. First, the circuit court found the CIDs’ request for unredacted
medical records were outside the MMPA’s scope. Second, the circuit court found the PHI sought
was privileged because section 407.040.3(2) specified the CID could not “[r]equire the disclosure
of any documentary material which would be privileged or which, for any other reason, could not
be required by a subpoena duces tecum issued by a court of this state.” Third, the circuit court
determined the non-consenting patients’ medical records were not required for the Attorney
General to carry out his duties under the MMPA, and the requests were not limited in accordance
with HIPAA regulations. The Attorney General moved to amend the judgment seeking
clarification or alteration regarding the circuit court’s privilege finding, arguing the Center did not
assert privilege and HIPAA did “not amount to a ‘privilege’ under the MMPA.” The circuit court
overruled the Attorney General’s motion without further explanation.
This appeal follows.
Appellate Jurisdiction
This Court initially must determine whether it has jurisdiction over this appeal. After the
Attorney General filed his notice of appeal, this Court issued an order directing the parties to file
memoranda and address in their jurisdictional statements section 407.090’s applicability.
Section 407.090 states any final order adjudicating the Attorney General’s petition to enforce a
CID “shall be subject to appeal to the state supreme court.” Both parties assert this Court has
jurisdiction despite this statutory language. This Court agrees.
In State ex rel. Ashcroft v. Goldberg, 608 S.W.2d 385, 387 (Mo. banc 1980), the Supreme
Court of Missouri recognized this statutory provision was “enacted in 1967 at a time when
s[ection] 3 of Article V placed jurisdiction in this Court of ‘all civil cases where the state … is a
9 party’ or ‘any state officer as such is a party.’” Goldberg determined “the appellate procedure
designated therein has by constitutional change become obsolete” and held the outdated provision
did not render the statute unconstitutional. Id. Although section 407.090 has not been amended
to remove this language, this Court is bound by Goldberg’s determination this statutory language
is obsolete. Accordingly, this Court holds it has general jurisdiction over this appeal because none
of the Attorney General’s claims invoke the Supreme Court of Missouri’s exclusive appellate
jurisdiction under Missouri Constitution article V, section 3. See also Planned Parenthood of the
St. Louis Region & Sw. Mo. v. Bailey, 715 S.W.3d 167, 185 n.10 (Mo. App. E.D. 2025) (“Planned
Parenthood St. Louis”) (likewise holding this Court had jurisdiction over a related CID dispute).
Standard of Review
“Judgment on the pleadings is appropriate where the question before the court is strictly
one of law.” Eaton v. Mallinckrodt, Inc., 224 S.W.3d 596, 599 (Mo. banc 2007). “This Court
reviews a circuit court’s ruling on a motion for judgment on the pleadings de novo.” City of
St. Louis v. State, 682 S.W.3d 387, 396 (Mo. banc 2024). “In reviewing the grant of a motion for
judgment on the pleadings, this Court must decide whether the moving party is entitled to judgment
as a matter of law on the face of the pleadings.” Id. (quoting Emerson Elec. Co. v. Marsh &
McLennan Cos., 362 S.W.3d 7, 12 (Mo. banc 2012)). Here, the Center and the Attorney General
are both a movant and a non-movant on cross-motions for judgment on the pleadings. When “both
parties file dueling motions for judgment on the pleadings, ‘each party thereby admit[s] the facts
well pleaded in the pleadings of the other’ for purposes of the motions.” Planned Parenthood
Great Plains v. State ex rel. Bailey, 713 S.W.3d 213, 226 (Mo. App. W.D. 2025) (“Planned
Parenthood Great Plains”) (quoting Kerkemeyer v. Midkiff, 299 S.W.2d 409, 410 (Mo. banc
1957)). “However, this Court will not blindly accept the legal conclusions drawn by the pleaders
from the facts.” State ex rel. Love v. Cunningham, 689 S.W.3d 489, 494 (Mo. banc 2024) (quoting
10 City of St. Louis, 682 S.W.3d at 396). “Statutory interpretation in a motion for judgment on the
pleadings is a matter of law [this Court] review[s] de novo.” Planned Parenthood St. Louis,
715 S.W.3d at 177.
MMPA Scope, Applicability, and Privilege
Point I: MMPA’s Scope Party Positions
In Point I, the Attorney General argues the circuit court erred in finding the medical records
and other documents containing PHI were irrelevant to his investigation because he asserts the
documents fall squarely within the MMPA’s scope. The Attorney General contends the documents
potentially contain evidence of billing fraud, unlawful coercion, and other unlawful practices
relevant to whether the Center engaged in deception, unlawful pressure, or fraud when urging
parents and insurance providers to purchase irreversible gender transition services, which possibly
violate the MMPA.9
The Center argues its patients’ PHI is irrelevant to any issue within the MMPA’s scope.
The Center claims because the Attorney General’s allegations supporting the CIDs principally
challenge the Center’s practice of medicine—as opposed to the medical providers’ entrepreneurial
conduct—they cannot be characterized as “trade or commerce” under the MMPA. Thus, the
Center believes it need not disclose any medical records or PHI.
9 To the extent the Attorney General raises in his argument section separate legal claims concerning which party has the burden of proving a valid purpose and document relevancy and how section 191.910 alternatively would compel disclosure, these claims are not preserved for appeal. Rule 84.04(e) (2023) mandates, “The argument shall be limited to those errors included in the ‘Points Relied On.’” “Issues that are raised only in the argument portion of the brief and are not contained in the point relied on are not preserved for appellate review.” Abram v. TitleMax of Mo. Inc., 684 S.W.3d 74, 89 (Mo. App. E.D. 2023) (quoting Hawley v. Tseona, 453 S.W.3d 837, 842 n.6 (Mo. App. W.D. 2014)). This Court “will not afford even ex gratia review of an error raised in the argument section of an appellant’s brief but not captured in an associated point relied on.” Id. (quoting Wallace v. Byrne, 672 S.W.3d 96, 106 (Mo. App. E.D. 2023)).
11 The MMPA & the Attorney General’s CID Authority
“The MMPA, as first adopted by the legislature in 1967, protects consumers by expanding
the common law definition of fraud ‘to preserve fundamental honesty, fair play and right dealings
in public transactions.’” Conway v. CitiMortgage Inc., 438 S.W.3d 410, 414 (Mo. banc 2014)
(quoting State ex rel. Danforth v. Indep. Dodge, Inc., 494 S.W.2d 362, 368 (Mo. App. 1973)). The
MMPA’s “fundamental purpose is the ‘protection of consumers,’ and, to promote that purpose,
the act prohibits false, fraudulent or deceptive merchandising practices.” Huch v. Charter
Commc’ns, Inc., 290 S.W.3d 721, 724 (Mo. banc 2009) (internal citation omitted).
Section 407.020.1 states:
The act, use or employment by any person of any deception, fraud, false pretense, false promise, misrepresentation, unfair practice or the concealment, suppression, or omission of any material fact in connection with the sale or advertisement of any merchandise in trade or commerce … in or from the state of Missouri, is declared to be an unlawful practice.
“Sec[tion] 407.020 does not define deceptive practices; it simply declares unfair or deceptive
practices unlawful. This was done to give broad scope to the meaning of the statute and to prevent
evasion because of overly meticulous definitions.” Huch, 290 S.W.3d at 724 (quoting State ex rel.
Webster Areaco Inv. Co., 756 S.W.2d 633, 635 (Mo. App. E.D. 1988)). When construing the
MMPA’s plain and ordinary meaning, the Supreme Court of Missouri instructs courts to “consider
the object the legislature seeks to accomplish with an eye towards finding resolution to the
problems addressed therein.” Ports Petroleum Co. Inc. of Ohio v. Nixon, 37 S.W.3d 237, 240
(Mo. banc 2001) (quoting Gott v. Dir. of Revenue, 5 S.W.3d 155, 159 (Mo. banc 1999)). When
construing the MMPA’s plain statutory language, the words “are unrestricted, all-encompassing
and exceedingly broad. For better or worse, the literal words cover every practice imaginable and
every unfairness to whatever degree.” Id.
12 The Attorney General “is charged with investigating and prosecuting violations of
Missouri’s consumer protection laws, including the MMPA.” Planned Parenthood St. Louis,
715 S.W.3d at 179. Section 407.040.1 authorizes the Attorney General “to investigate possible
violations of the MMPA to promote the ‘laudable purpose’ of protecting Missouri consumers.”
Id. at 180 (emphasis added) (quoting Heinz v. Driven Auto Sales, LLC, 603 S.W.3d 890, 895
(Mo. App. E.D. 2020)); see also section 407.040.1 (authorizing the Attorney General to issue a
CID “when he [or she] believes it to be in the public interest that an investigation should be made
to ascertain whether a person in fact has engaged in or is engaging in any [unlawful practice…]”).
“Missouri’s CID proceeding ‘is patterned after the parallel provisions’ of the federal
proceedings set forth in the Federal Antitrust Civil Process Act, 15 U.S.C. § 1312 ….” State ex
rel. Koster v. Charter Commc’ns Inc., 461 S.W.3d 851, 856 (Mo. App. W.D. 2015) (quoting
Goldberg, 608 S.W.2d at 388). CIDs are administrative subpoenas. Planned Parenthood Great
Plains, 713 S.W.3d at 229; Planned Parenthood St. Louis, 715 S.W.3d at 186. “The purpose of
the [CID] procedure is to provide a form of pretrial discovery” for the Attorney General’s benefit.
Independence Dodge, 494 S.W.2d at 366. CIDs provide the Attorney General “with another tool
in his [or her] litigative kit, similar to the various discovery methods traditionally available after
suit is filed.” Id. While the Attorney General’s investigatory powers are broad, “the legislature
has not bestowed unbridled authority upon the Attorney General to pursue this mission at the
expense of any individual’s entitlement to procedural due process.” Lewandowski v. Danforth,
547 S.W.2d 470, 472 (Mo. banc 1977). Thus, “[a] CID issued by the Attorney General must
comport with the requirements of s[ection] 407.040 which requires reasonable notice of the
conduct under investigation and specific notice of the documents to be produced.” Id. at 473.
13 Analysis
The Center does not challenge the CIDs’ procedural form nor contend its procedural due
process rights were violated. Nor could it because it used the remedy available under
section 407.070 to challenge the Attorney General’s CIDs. See Planned Parenthood St. Louis,
715 S.W.3d at 186 (recognizing “[a]s a type of administrative subpoena, a CID generally does not
violate … protection[s] against unreasonable searches where the CID recipient has an opportunity
to seek ‘pre-compliance judicial review’” under section 407.070). Instead, the Center challenges
the CIDs on substantive grounds, arguing the Attorney General’s requests have exceeded the
MMPA’s scope by seeking unredacted medical records and PHI which are not contemplated as
“trade or commerce” under the MMPA, but rather, seek to investigate medical malpractice.
The MMPA’s scope to investigate these precise medical services-related claims was
addressed and resolved in Planned Parenthood Great Plains and Planned Parenthood St. Louis,
in which Planned Parenthood challenged the Attorney General’s issuance of CIDs to its clinics
related to the Center’s investigation.10 In Planned Parenthood Great Plains, the Western District
explained, “The MMPA defines ‘merchandise’ to include ‘any objects, wares, goods,
commodities, intangibles, real estate or services’” as defined by section 407.010(4). Planned
Parenthood Great Plains, 713 S.W.3d at 227 (emphasis in original). The Western District then
recognized, “Medical goods and services meet the statutory definition of merchandise as defined
by section 407.010(4).” Id. (quoting Freeman Health Sys. v. Wass, 124 S.W.3d 504, 507
(Mo. App. S.D. 2004)). In Planned Parenthood St. Louis, this Court also relied on Freeman to
find the MMPA’s broad language “covers medical goods and services.” Planned Parenthood
10 In those cases, the CIDs issued to Planned Parenthood stated the Attorney General had reason to believe the Center “or others in the state providing similar services” may have engaged in unlawful practices under the MMPA based in part on the whistleblower’s allegations regarding transgender care. Planned Parenthood Great Plains, 713 S.W.3d at 218; Planned Parenthood St. Louis, 715 S.W.3d at 176.
14 St. Louis, 715 S.W.3d at 181. Planned Parenthood St. Louis further explained, “Medical goods
and services are put into trade or commerce when they are advertised, sold, offered for sale or
distribution, or any combination thereof ‘directly or indirectly affecting the people of this state.’”
Id. (quoting section 407.010(7)).
Both districts rejected Planned Parenthood’s arguments that the Attorney General’s pre-
claim investigation targeted medical malpractice claims. In Planned Parenthood St. Louis, this
Court explained, “[W]e must reject [Planned Parenthood’s] argument that any overlap with
medical malpractice necessarily places a business’s practices outside the scope of the MMPA so
as to invalidate a CID issued under § 407.040.” Id. (emphasis in original). Hence, “by providing
and billing for medical services, [Planned Parenthood’s] business practices f[e]ll squarely within
the MMPA and [were] subject to the [Attorney General’s] oversight.” Id. Similarly, Planned
Parenthood Great Plains found:
[T]he Attorney General’s investigation does not target claims of medical malpractice …. Rather, the stated purpose of the investigation is focused squarely on what the MMPA prohibits—the “deception, fraud, false promises, misrepresentation, unfair practices, and/or the concealment, suppression, or omission of material facts” regarding the transgender care provided by … [the] Center and “others in the state providing similar services.” The requests set out in the corresponding CID demonstrate this intent. Planned Parenthood Great Plains, 713 S.W.3d at 228.
After finding the Attorney General could investigate these claims, the Western District
explained that, under section 407.040.1, “the Attorney General is authorized by the MMPA to
issue an enforceable CID to ‘any person who is believed to have information, documentary
material, or physical evidence relevant to the alleged or suspected violation.’” Id. at 230 (emphasis
in original). “[T]he question of an administrative subpoena’s relevance is not a question of
evidentiary relevance.” Id. (quoting United States v. Whispering Oaks Res. Care Facility, LLC,
15 673 F.3d 813, 818 (8th Cir. 2012)). “The standard for determining the relevance of a subpoena’s
requests is not particularly burdensome, and indeed, a subpoena ‘should be enforced when the
evidence sought by the subpoena is not plainly incompetent or irrelevant to any lawful purpose of
the agency in the discharge of its duties.’” Id. When examining the CID’s requests through this
lens, the Western District stated, “That the requests, in isolation, may well appear on the surface
to seek information related to the practice of medicine is not the end of our query but the starting
point.” Id. “To evaluate the relevance of the information sought, we first look at the nature of the
Attorney General’s investigation.” Id. The Western District found the CID “specifically
referenced the factual allegations giving rise to its investigation of [the Center] and ‘others’
providing similar services by referencing and incorporating the sworn affidavit of a whistleblower,
which detailed a variety of practices, that, if confirmed, could suggest deception and fraud in
violation of the MMPA.” Id. Hence, the CID’s requests, which “on their surface seek information
about the provision of medical care” were “appropriate when the gravamen of those requests is to
investigate conduct in violation of the MMPA related to the provision of healthcare services.” Id.
at 231.
This analysis compels the same result here. While the CIDs issued to the Center are more
numerous and more explicit in seeking individual medical records and information about matters
touching more firmly on the practice of medicine, they fall within the pre-claim investigative scope
of the MMPA. As in the Planned Parenthood cases, the CIDs here stated the Attorney General
“believes it to be in the public interest that an investigation be made to ascertain whether the
[Center] or its agents or employees have engaged in or are engaging in any practices declared to
be unlawful by § 407.020, RSMo.” The CID further advised “[t]he Attorney General has reason
to believe that [the Center] may have used deception, fraud, false promises, misrepresentation,
16 unfair practices, and/or concealment, suppression, or omission of material facts within the scope
of the [MMPA.]” The CID explained “[t]he Attorney General’s investigation is based in part on,
but is not limited to, allegations made in the” whistleblower’s sworn affidavit. As in Planned
Parenthood Great Plains, the whistleblower’s affidavit “detailed a variety of practices, that, if
confirmed, could suggest deception and fraud in violation of the MMPA.” Planned Parenthood
Great Plains, 713 S.W.3d at 230. Hence, the Attorney General “may validly use a CID to
investigate whether the Center, [Planned Parenthood], and others in the state have conducted the
business of providing and billing for gender-affirming medical care to minors using deception,
fraud, false promises, misrepresentation, or unfair practices prohibited by the MMPA.” Planned
Parenthood St. Louis, 715 S.W.3d at 190.
The Center finds itself in the same procedural posture as Planned Parenthood. This is a
pre-claim investigation with no claim pending against the Center before this Court alleging
wrongdoing. This Court was mindful of this procedural posture when acknowledging, “We must
underscore that there is no MMPA claim against [Planned Parenthood] before us—we are
reviewing only the validity of an administrative subpoena issued by the [Attorney General] in a
pre-claim investigation under the auspices of the MMPA.” Planned Parenthood St. Louis,
715 S.W.3d at 182 (emphasis in original). “The government may use its administrative subpoena
power to ‘investigate merely on suspicion that the law is being violated, or even just because it
wants assurance that it is not.” Id. (quoting Whispering Oaks, 673 F.3d at 818); see also Planned
Parenthood Great Plains, 713 S.W.3d at 230 (same).
This opinion should not be read to conclusively foreclose the Center from litigating at a
later date—if and when the Attorney General chooses to bring a formal MMPA claim—that
specific allegations do not state a claim for relief because they are medical malpractice claims
17 masquerading as consumer protection and billing fraud claims. At this juncture, however, this
Court reiterates it is adjudicating only a discovery dispute about an administrative subpoena issued
under the Attorney General’s broad pre-claim investigatory powers to determine if the Center has
possibly violated the MMPA. Accordingly, the parties’ desire to litigate the nuanced merits of
whether these general requests are investigating unlawful consumer practices or medical
malpractice is premature. Planned Parenthood St. Louis, 715 S.W.3d at 182.
This Court holds the Attorney General’s pre-claim, investigatory CIDs sought information
within the MMPA’s “unrestricted, all-encompassing and exceedingly broad” scope. Ports
Petroleum, 37 S.W.3d at 240 (quoting Gott, 5 S.W.3d at 159). The circuit court erred in entering
judgment on the pleadings for the Center when it found the CID requests were not within the
MMPA’s scope.
Point I is granted.
Point II: Privilege Party Positions
In Point II, the Attorney General argues the circuit court erred in finding the Center did not
have to produce the medical records because they were privileged. The Attorney General contends
because the Center did not assert any privilege below, the issue was waived, and the circuit court
could not sua sponte raise privilege on the Center’s behalf as an affirmative defense.11
The Center argues the circuit court’s analysis of whether the medical records were
privileged was based on the MMPA’s plain language, the statutory limits on CIDs under
section 407.040.3(2), and its repeated assertions the Attorney General’s demands for PHI invaded
11 As this Court found with Point I, the Attorney General asserts additional arguments concerning the merits of whether the medical records were privileged in Point II which were not captured in his point relied on. These arguments are not preserved for appeal and will not be addressed. Abram, 684 S.W.3d at 89. This Court confines its analysis to the procedural argument presented in the point relied on: whether privilege was properly presented to the circuit court for adjudication.
18 its patients’ protected privacy interests. Alternatively, the Center asserts if the circuit court’s
waiver finding was improper, reversal is not warranted because the finding was not necessary for
the circuit court’s judgment.
Analysis
Section 407.090 states when the Attorney General petitions the circuit court to enforce a
CID, the circuit court “shall have jurisdiction to hear and determine the matter so presented, and
to enter such order or orders as may be required to carry into effect the provisions of
section 407.040.” Section 407.040.3(2) states, “No [CID] … shall [r]equire the disclosure of any
documentary material which would be privileged or which, for any other reason, could not be
required by a subpoena duces tecum issued by a court of this state.” Planned Parenthood Great
Plains found this section’s prohibition on producing privileged materials was “consistent with the
protections afforded the physician-patient relationship under Missouri law” because this privilege
“applies to medical records and all aspects of discovery.” Planned Parenthood Great Plains,
713 S.W.3d 221 n.5 (quoting State ex rel. Dean v. Cunningham, 182 S.W.3d 561, 567 (Mo. banc
2006)).
Section 407.090 specifically contemplates the circuit court will construe and apply
section 407.040, which includes determining whether the CID impermissibly requests privileged
information when rendering an order adjudicating an enforcement action. See id. Hence, the issue
of privilege was before the circuit court as a matter of law through the Attorney General’s
counterclaim seeking to enforce the CIDs.12
12 At oral argument, the Attorney General argued the circuit court could not address privilege as a matter of law even if it were explicitly raised because privilege does not override an MMPA consumer investigation into medical services fraud. This interpretation would render meaningless section 407.040.3(2)’s prohibition on disclosure of privileged material in response to a CID. See Missouri Bond Co., LLC v. Devore, 641 S.W.3d 397, 403 (Mo. App. E.D. 2022) (holding appellate courts “must avoid statutory interpretations that are unjust, absurd, unreasonable, or render statutory language meaningless.”).
19 This does not end this Court’s inquiry, however, because the parties filed competing
motions for judgment on the pleadings in which the Center sought to modify the CIDs. At no
point below did the Center assert the CIDs should be modified because they requested privileged
materials under section 407.040.3(2). In fact, the word “privilege” does not appear in any of the
Center’s pleadings. Although the parties’ correspondence indicated the Center produced a
privilege log at the Attorney General’s request, it is unclear whether the circuit court was provided
the privilege log to review. See Planned Parenthood of St. Louis, 715 S.W.3d at 192 (finding
Planned Parenthood failed to “produce a privilege log, which would have aided the [circuit] court
in ruling on [Planned Parenthood’s] request to consider its objections.”). Nor was the privilege
log made a part of this Court’s record. Counsel for both parties attempted to clarify the privilege
log contents during oral argument but this Court cannot consider those clarifications. “An
appellate court cannot accept counsels’ statements or averments as substitute for record proof even
if there is no reason to doubt counsels’ accuracy.” Abram, 684 S.W.3d at 91 (quoting Bertocci v.
Thoroughbred Ford, Inc., 530 S.W.3d 543, 551 (Mo. App. W.D. 2017)). Hence, the Center waived
the issue of privilege before the circuit court because it did not raise privilege in its pleadings nor
produce a privilege log for the circuit court to examine. See Planned Parenthood Great Plains,
713 S.W.3d at 221 (declining to review Planned Parenthood’s potential privilege claim absent any
demand for privileged information because “there can be no review of a matter which has not been
presented to or expressly decided by the [circuit] court.”) (quoting Barkley v. McKeever Enters.,
Inc., 456 S.W.3d 829, 839 (Mo. banc 2015)). The circuit court erred in entering judgment on the
pleadings for the Center to the extent it considered privilege, which the Center did not raise.
Point II is granted.
20 Because the circuit court erred in modifying the CIDs to prevent disclosure of the medical
records and PHI based on the requests being outside the MMPA’s scope and privileged, this Court
must reverse the circuit court’s judgment.
HIPAA Disclosure Provisions
The Attorney General’s remaining five points ask this Court to resolve whether HIPAA is
an affirmative defense, who has the burden of proving HIPAA provisions permit or prevent
disclosure, and whether four HIPAA provisions permit or compel the Center to disclose its medical
records and PHI to the Attorney General. In finding the medical records were outside the MMPA’s
scope and privileged, the circuit court did not address three of the four HIPAA provisions the
parties raised regarding disclosure, and incorrectly analyzed a fourth provision. Because these
issues will arise again on remand, this Court must address them.
“By its text, HIPAA promotes a renewed awareness of, or emphasis upon, the principle of
patient privacy.” State ex rel. Proctor v. Messina, 320 S.W.3d 145, 150 (Mo. banc 2010).
“Missouri courts are bound to follow HIPAA’s statutory and regulatory mandate ….” Id. at 153.
The HIPAA Privacy Rule defines PHI as:
“individually identifiable health information” that is “created or received by a health care provider” that “[r]elates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual.” Planned Parenthood St. Louis, 715 S.W.3d at 192 (citing 45 C.F.R. § 160.103). “Health
information that does not identify an individual and with respect to which there is no reasonable
basis to believe that the information can be used to identify an individual is not individually
identifiably health information.” 45 C.F.R. § 164.514(a).
To comply with HIPAA generally, “a covered entity may not use or disclose [PHI] without
an authorization that is valid” “except as otherwise permitted or required[.]” 45 C.F.R.
21 § 164.508(a)(1). When disclosing PHI, the covered entity generally “must make reasonable efforts
to limit [PHI] to the minimum necessary to accomplish the intended purpose of the use, disclosure,
or request.” 45 C.F.R. § 164.502(b). This minimum standard does not apply, however, to “[u]ses
or disclosures that are required by law, as described by 45 C.F.R. § 164.512(a).” 45 C.F.R.
§ 160.502(b)(2)(v). Hence, “[a] covered entity may use or disclose [PHI] to the extent that such
use or disclosure is required by law and the use or disclosure complies with and is limited to the
relevant requirements of such law.” 45 C.F.R. § 164.512(a)(1). Section 164.512 further states
“[a] covered entity must meet the requirements described in paragraph (c), (e), or (f) of this section
for uses or disclosures required by law.” 45 C.F.R. § 164.512(a)(2).
This section then sets forth permissible and required uses and disclosures including four
provisions the parties dispute apply here and which will be addressed in Points IV through VII.
The Attorney General’s HIPAA-related points will be analyzed out of order for clarity.
Point V: Disclosure under HIPAA’s “Health Oversight Agency” Provision Party Positions
In Point V, the Attorney General argues the circuit court erred in finding the Center did not
have to produce HIPAA-protected documents because HIPAA expressly permits disclosure under
the “health oversight agency” provision. The Attorney General maintains his office is a health
oversight agency, and the CIDs were issued for health oversight activities authorized by law.
The Center argues the Attorney General’s reliance on the health oversight agency provision
ignores the fact the Attorney General initiated this investigation under the MMPA, not
Chapter 191. By doing so, the Center contends the Attorney General’s MMPA investigation is
limited to conduct concerning the advertisement or sale of goods or services in trade or commerce,
not conduct related to enforcing the healthcare fraud and abuse act.
22 Analysis
“A covered entity may disclose [PHI] [without individual authorization] to a health
oversight agency for oversight activities authorized by law, including … civil [or] administrative
… investigations … or other activities necessary for appropriate oversight of … [t]he health care
system[.]” 45 C.F.R. § 164.512(d)(1)(i). This Court has recognized the Attorney General “has
specific statutory authority to investigate Medicaid billing fraud using the powers [he] is granted
under the MMPA” as stated in Chapter 191. Planned Parenthood St. Louis, 715 S.W.3d at 182
n.9. However, the CIDs’ plain language reflects the Attorney General did not choose to proceed
or investigate the Center under this authority.
Section 407.040.2 governs what information shall be included in a lawfully issued CID to
provide notice to the investigation’s target. The Attorney General is required to “[s]tate the statute
and section thereof, the alleged violation of which is under investigation, and the general subject
matter of the investigation.” Section 407.040.2(1). Here, the CIDs stated the Attorney General
believed an investigation was appropriate to determine whether the Center, “its agents or
employees have engaged in or are engaged in any practice declared to be unlawful by
[section] 407.020 …” and “within the scope of the [MMPA].” The CIDs do not cite Chapter 191
nor state they were issued under any purported “health oversight agency” investigative powers as
section 407.040.2(1) requires. The Attorney General’s argument the CIDs were relevant to his
authority as a health oversight agency is belied by the CIDs’ plain language: the CIDs sought
information relevant to an investigation into whether the Center engaged in unlawful practices
under the MMPA. There may be overlap between the subject matter and the investigative
mechanisms if launching an investigation under Chapter 191. However, the Attorney General was
required to “state the statute and section” the Center allegedly violated. See section 407.040.2(7).
The CIDs state the Center allegedly violated the MMPA, not under Chapter 191.
23 Because the CIDs clearly stated the Attorney General’s intent to investigate the Center for
alleged unlawful practices under the MMPA and not Chapter 191, this provision cannot be satisfied
on remand as a matter of law under the facts presented.
Point V is denied.
Point VI: Disclosure under HIPAA’s “Administrative Tribunal Order” Provision Party Positions
In Point VI, the Attorney General argues the circuit court erred in finding the Center did
not have to produce HIPAA-protected documents responsive to the CIDs because HIPAA
expressly permits disclosure in response to an “administrative tribunal,” and the CIDs were
“orders” issued by the Attorney General. The Attorney General contends its office is an
“administrative tribunal” exercising “quasi-judicial authority” when issuing CIDs because CIDs
are “the civil equivalent to a criminal grand jury.”
The Center argues a CID is not a “quasi-judicial order,” and the Attorney General is not an
“administrative tribunal” within the meaning of this HIPAA provision. The Center further argues
the grand jury analogy fails because HIPAA addresses grand jury disclosures under the law
enforcement purposes provision.
“A covered entity may disclose [PHI] [without individual authorization] in the course of
any judicial or administrative proceeding [i]n response to an order of … [an] administrative
tribunal ….” 45 C.F.R. § 164.512(e)(1)(i). “[A]lthough the [Attorney General’s] office is not an
administrative agency, when issuing CIDs under section 407.040, the [Attorney General] is
performing an administrative function. It is the functional equivalent of a civil enforcement agency
enforcing the civil consumer protection laws of Missouri.” Charter Communications, 461 S.W.3d
at 857. Even if this Court broadly read Charter Communications’ holding to extrapolate the
24 Attorney General acts as “an administrative tribunal exercising quasi-judicial authority” when
issuing CIDs, his argument fails because a CID is not an “order” contemplated under this
provision.
The Attorney General is correct that section 407.040.1 “require[s]” a CID recipient “to
appear and testify, or to produce relevant documentary material or physical evidence or
examination ….” However, “the Attorney General, pursuant to section 407.090, must seek a court
order to require a recalcitrant recipient of the CID to respond.” Planned Parenthood Great Plains,
713 S.W.3d at 220 (citing Charter Communications, 461 S.W.3d at 857). Section 407.080 also
mandates a CID recipient “shall comply with the terms thereof” but this compliance is excused
“unless otherwise provided by an order of a court.” (Emphasis added). Accordingly, “CIDs are
not independently enforceable” orders. Id. This provision cannot be satisfied on remand as a
matter of law under the facts presented.
Point VI is denied.
Point IV: Disclosure under HIPAA’s “Court Order” Provision Party Positions
In Point IV, the Attorney General argues the circuit court erred in finding the Center did
not have to produce HIPAA-protected documents because HIPAA expressly permits disclosure in
response to a “court order.” The Attorney General contends the circuit court should have simply
upheld the CIDs and ordered disclosure because any court order finding a CID lawful under
section 407.040 “automatically resolves HIPAA” without further analysis.13
13 The Attorney General tangentially argues this circuit court error, if affirmed, “would decimate the State’s ability to investigate healthcare fraud.” Not only is this argument not encompassed in his point relied on, but it also raises additional arguments regarding his purported power as a “health oversight agency” which were not the auspices under which the CIDs were issued as addressed in Point V.
25 The Center argues this HIPAA provision does not authorize disclosure of all patients’ PHI
because the Attorney General’s argument rests on a misunderstanding of the circuit court’s
judgment. The Center asserts the circuit court did not uphold the CIDs, but instead, found the PHI
requests did not relate to any issue within the MMPA’s scope and were not subject to disclosure.
HIPAA permits a covered entity to disclose PHI without individual authorization “in the
course of any judicial or administrative proceeding [i]n response to an order of a court … provided
that the covered entity discloses only the [PHI] expressly authorized by such order[.]” 45 C.F.R.
§ 164.512(e)(1)(i). Neither party disputes this HIPAA provision would require disclosure if a
court so orders, but the circuit court did not so order here.14 This provision contemplates the circuit
court determining which PHI will be expressly authorized for disclosure when crafting its order.
Because the circuit court has not entered an order to disclose PHI, it has not made this
determination or considered if and how HIPAA may apply. This must occur on remand.
Point IV is denied in part and granted in part.
14 At oral argument, the Attorney General argued the Planned Parenthood cases determined these CIDs were valid and, therefore, this Court need not reach whether HIPAA applied here. While the Attorney General is correct the CIDs issued here mirror the CIDs issued in the Planned Parenthood cases in many respects, he disregards the crucial difference between the CIDs issued there and issued to the Center: the Planned Parenthood CIDs did not seek wholesale, unredacted access to every single patient medical record held by those clinics. Hence, the validity of the Center’s CIDs has not been fully resolved until today.
26 Point VII: Disclosure under HIPAA’s “Law Enforcement Purposes” Provision Party Positions
In Point VII, the Attorney General argues the circuit court erred in finding the Center did
not have to produce HIPAA-protected documents because HIPAA expressly permits disclosure
under the “law enforcement purposes” provision. The Attorney General argues the Center did not
disprove: (1) the Attorney General issued a CID requiring it to respond; (2) the CID seeks
information relevant and material to a legitimate law enforcement inquiry; (3) the CID was specific
and limited in scope to the extent reasonably practicable in light of the purpose for which the
information was sought; and (4) de-identified information could not reasonably be used.
The Center argues the circuit court appropriately found this HIPAA provision did not apply
because: (1) patient PHI is irrelevant and immaterial to a legitimate MMPA investigation; (2) a
request for all medical records for all Center patients is not specific or limited in scope; and (3) the
Attorney General has not shown why de-identified information could not reasonably be used.
HIPAA permits a covered entity to disclose PHI without individual authorization “for law
enforcement purposes” in response to “an administrative request for which response is required by
law, including an administrative subpoena …, a civil or an authorized investigative demand …
provided that: (1) [t]he information sought is relevant and material to a legitimate law enforcement
inquiry; (2) [t]he request is specific and limited in scope to the extent reasonably practicable in
light of the purpose for which the information is sought; and (3) [d]e-identified information could
not reasonably be used.” 45 C.F.R. § 164.512(f)(1)(ii)(C)(1)–(3).
First, this Court has already determined the CIDs seek information which is relevant and
material to a legitimate law enforcement inquiry. The Attorney General has broad pre-claim
27 investigatory power under the MMPA to ascertain whether the Center has possibly engaged in
unlawful practices.
Second, the Center argues the requests are not specific and limited in scope because the
Attorney General is seeking access to all 1,165 patient records during the Center’s operation. The
Center does not read this prong in its entirety. This prong requires the request to be “specific and
limited in scope to the extent reasonably practicable in light of the purpose for which the
information is sought.” 45 C.F.R. § 164.512(f)(1)(ii)(C)(2) (emphasis added). This inquiry is
limited by the wide-ranging purpose for which the information is sought under the MMPA. See
United States v. Wilson, 98 F.4th 1204, 1220 (10th Cir. 2024) (finding the DEA’s modified
administrative “subpoena was sufficiently specific and limited in scope to comply” with this prong
“given the DEA’s overall purpose in evaluating [the target’s] controlled-substance prescription
practices, and [the] specific goals of [its investigation in] examining” patients’ medical, billing,
and communication records).
Third, the parties disagree whether de-identified information could not reasonably be used
to comply with the CIDs. “Although HIPAA prohibits wrongful disclosure of PHI, de-identified
health information is not protected under the act.” Planned Parenthood St. Louis, 715 S.W.3d at
193 (citing 45 C.F.R. §§ 160.103, 164.502, .508 and .514). Accordingly, “de-identified health
information is a recognized safe harbor for disclosure.” Id. PHI may be de-identified when
specific “identifiers of the individual or of relatives … or household members of the individual are
removed[.]” 45 C.F.R. § 164.514(b)(2)(i). This section lists identifiers which, if removed, “de-
identifies” medical records. See 45 C.F.R. § 164.514(b)(2)(i)(A)–(R) (listing 18 identifiers).
The parties hotly disputed whether disclosing de-identified information would satisfy the
CIDs. Initially, the Center agreed much of the information responsive to the CIDs could be found
28 in the medical records, which it offered to the Attorney General with remote, read-only access on
multiple occasions. The Center abruptly changed its position, which prompted the Attorney
General to insist on receiving unredacted medical records with their metadata included. When the
parties reached an impasse and filed suit, they maintained their diametrically opposed positions:
The Center asserted the Attorney General was entitled to no medical records, redacted or
otherwise, while the Attorney General contended he was entitled to all medical records with no
redaction. The circuit court ultimately found the Attorney General was entitled to no records
because the requests went beyond the MMPA’s scope.
In his briefing, the Attorney General argues “de-identified records are suboptimal given
the scope of the investigation and allegations by the whistleblower” regarding specific patients.
Without de-identified information, the Attorney General argues his ability to cross-reference the
Center’s previous disclosures with the whistleblower’s allegations will impede his ability to
determine their veracity. Yet, in the last pages of his appellant’s brief, the Attorney General
concedes he would accept de-identified records, despite his position before the circuit court.
During oral argument, this Court sought to clarify the Attorney General’s position.
Initially, the Attorney General reaffirmed he was entitled to unredacted medical records. When
questioned further regarding the importance of receiving information encompassed by HIPAA’s
safe harbor provision, the Attorney General agreed he “certainly could use” anonymized
information and it would help him identify potential claims, but he maintained unredacted medical
records were preferable.
“Parties are bound by the position they took in the trial court and will not be heard on a
different theory on appeal.” City of St. Louis v. Bertels, 699 S.W.3d 221, 227 n.3 (Mo. App. E.D.
2024) (quoting Weber v. Fed. Home Loan Mortg. Corp., 675 S.W.3d 728, 733 (Mo. App. E.D.
29 2023)). “Further, this Court ‘will generally not convict a lower court of error on an issue that was
not put before it to decide.’” Id. (quoting Clarksboro, LLC v. City of Overland, 678 S.W.3d 139,
145 (Mo. App. E.D. 2023)). Here, the circuit court incorrectly analyzed the law enforcement
purposes provision because it erroneously determined no records could be disclosed, as it found
the requests were outside the MMPA’s scope. In practical terms, this means the circuit court has
not determined the merits whether de-identified information could not reasonably be used and
must answer this question on remand.
To answer this question requires this Court to resolve Point III, which seeks clarity on the
burden of proof and affirmative defenses when asserting HIPAA to modify or limit disclosure
when responding to a CID.
Point III: HIPAA as an Affirmative Defense and Burden of Proof Party Positions
The Attorney General argues the circuit court erred in placing the burden regarding
HIPAA’s scope and applicability on the State because it should have been placed on the Center.
The Attorney General contends because the Center raised HIPAA as an affirmative defense to
preclude disclosure, the Center had the burden of establishing its affirmative defense applies. The
Center argues the circuit court did not place an improper burden on the Attorney General because
the Attorney General cited no authority demonstrating HIPAA was an affirmative defense and the
circuit court’s analysis was appropriate under HIPAA regulations.
HIPAA confidentiality is not an affirmative defense. Planned Parenthood St. Louis,
715 S.W.3d at 193. This Court has also recognized “a blanket HIPAA-based objection does not
make the CID unenforceable, as the burden is on [the covered entity] to comply with HIPAA when
responding to subpoenas.” Id. (citing 45 C.F.R. §§ 164.502(a), .508 and .512). In certain
30 instances, however, the covered entity must consider additional provisions when confronted with
a request for PHI to determine whether disclosure is permitted.
For example, “If a disclosure is conditioned by this subpart on particular documentation,
statements, or representations from the person requesting the [PHI], a covered entity may rely, if
such reliance is reasonable under the circumstances, on documentation, statements, or
representations that, on their face, meet the applicable requirements.” 45 C.F.R. § 164.514(h)(2)(i)
(emphasis added). Specifically, when complying with the law enforcement purposes provision at
issue here, this subsection states, “The conditions in § 164.512(f)(1)(ii)(C) may be satisfied by the
administrative subpoena or similar process or by a separate written statement that, on its face,
demonstrates that the applicable requirements have been met.” 45 C.F.R. § 164.514(h)(2)(i)(A).
The Center interprets this language to place the burden on the Attorney General to demonstrate he
meets the three prongs of the law enforcement purposes provision for an administrative subpoena
before the Center must disclose any PHI. The Attorney General interprets this language to mean
the Center “can take the State’s word at face value” and may rely on this safe harbor to disclose
the PHI after receiving the CIDs.
This Court finds the Attorney General’s interpretation unpersuasive because the CIDs, on
their faces, do not state § 164.512(f)(1)(ii)(C)’s provisions have been satisfied so the Center can
“take the State’s word” and disclose the PHI in unredacted form. Compare Wilson, 98 F.4th at
1218–20 (finding a government agent’s declaration—attached to an administrative subpoena
seeking medical records—providing attestations demonstrating satisfaction of the law
enforcement purposes’ three prongs compelled a psychologist to disclose certain patient records).
Because the Attorney General is not required to disclose the full scope of his investigation, a
covered entity attempting to comply with a CID cannot know whether de-identified information
31 could not reasonably be used in a vacuum so as to comply with its obligation to “make reasonable
efforts to limit [PHI] to the minimum necessary to accomplish the intended purpose of the use,
disclosure, or request.” 45 C.F.R. § 164.502(b). Hence, this Court finds when seeking HIPAA-
protected PHI under the law enforcement purposes provision, the entity seeking the PHI must carry
the burden of proving it has satisfied the three prongs of § 164.512(f)(1)(ii)(C) as contemplated by
45 C.F.R. § 164.514(h)(2)(i)(A).
Because the circuit court has not determined whether the Attorney General has satisfied
the third prong of the law enforcement purposes provision, it must do so on remand.
Point III is denied.
Because the circuit court misapplied the first two prongs of HIPAA’s “law enforcement
purposes” provision but has not determined the merits of whether de-identified information could
not reasonably be used, which the Attorney General bears the burden of proving, Point VII is
granted in part.
Remand
As this Court stated in its introduction, this case, at its essence, is a complex discovery
dispute. “The circuit court retains broad discretion in conducting discovery.” Main v. Main,
685 S.W.3d 620, 631 (Mo. App. E.D. 2024) (quoting State ex rel. Ford Motor Co. v. Messina,
71 S.W.3d 602, 607 (Mo. banc 2002)). “The permissible scope of a production request contained
in a subpoena duces tecum is governed by the general discovery provisions of Rule 56.01 and
58.01.” Planned Parenthood St. Louis, 715 S.W.3d at 192 n.15. Hence, “the general discovery
rules [are] incorporated by reference when litigating a claim filed by a CID recipient under
§ 407.070 or by the [Attorney General] seeking enforcement under § 407.090.” Id.
This Court is very mindful of the breadth and depth of the Attorney General’s requests to
examine 1,165 minor patients’ most personal medical information. Thus, the circuit court is
32 empowered to modify the CIDs as it deems appropriate under state and federal law. In its sound
discretion, the circuit court may employ any of its discovery management tools, such as in-camera
review or the appointment of a special master, to resolve any further dispute regarding de-
identification or redaction given the sensitive nature and volume of PHI requested. See State ex
rel. Chance v. Sweeney, 70 S.W.3d 664, 668 (Mo. App. S.D. 2002) (recognizing in camera review
or the appointment of a special master is “appropriate in order to protect one who may be subjected
to harm or humiliation upon unwarranted invasion by another who is seeking information.”). The
circuit court, in its sound discretion, can enter appropriate protective orders or other orders
reiterating the importance of compliance with section 407.060.1’s confidentiality requirements.
See State ex rel. Health Midwest Dev. Group, Inc. v. Daugherty, 965 S.W.2d 841, 844 (Mo. banc
1998) (holding protective orders are appropriate to protect patients “against humiliation,
embarrassment or disgrace”). In sum, on remand, the circuit court has the discretion to fashion
discovery orders it deems appropriate to balance the Attorney General’s need to investigate
possible MMPA violations and the 1,165 minor patients’ medical privacy rights.
Conclusion
The circuit court’s judgment is reversed, and the cause is remanded for further proceedings
_______________________________ Philip M. Hess, Judge
Michael S. Wright, P.J. and Virginia W. Lay, J. concur.
Related
Cite This Page — Counsel Stack
The Washington University, Respondent, v. Attorney General of the State of Missouri, Appellant., Counsel Stack Legal Research, https://law.counselstack.com/opinion/the-washington-university-respondent-v-attorney-general-of-the-state-of-moctapp-2025.