IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF ALABAMA SOUTHERN DIVISION
TRUBRIDGE, INC., ) Plaintiff/Counter Defendant, ) ) v. ) CIVIL ACTION NO. 1:24-00190-KD-N ) CROOK COUNTY MEDICAL ) SERVICES DISTRICT, ) Defendant/Counter Claimant. ) ORDER
This civil action is before the Court on the “Motion for Protective Order” filed February 25, 2025, by the Plaintiff/Counterdefendant, TruBridge, Inc. (Doc# 40). Defendant/Counterclaimant Crook County Medical Services District (“the District”) filed a response (Doc# 42) to said motion, Trubridge filed a reply (Doc# 45) to the response, and the District has filed a motion for leave to file a surreply to the reply (Doc# 46), with proposed surreply brief attached (Doc# 46-1).1 TruBridge requests that the Court enter its proposed protective order (Doc# 40-1) to govern the production and handling of confidential materials and electronically stored information produced as part of discovery in this action. The District’s response makes clear that it does not object to any of the provisions in the proposed order, but wishes to include an additional provision, which TruBridge opposes, stating as follows:
1 The assigned District Judge has referred said motions to the undersigned Magistrate Judge for appropriate action under 28 U.S.C. § 636(a)-(b), Federal Rule of Civil Procedure 72, and S.D. Ala. GenLR 72(a). See S.D. Ala. GenLR 72(b); (2/25/2025 & 3/5/2025 electronic reference notations). Special Provision for “Protected Health Information”: During the course of this litigation, it may be necessary for the parties to disclose certain patient protected health information (“PHI”) as that term is defined under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Federal Regulations enacted pursuant to HIPAA. All PHI, inclusive of medical records and related information, including but not limited to patient account numbers, visit numbers, and Medicare or Medicaid Numbers, shall be automatically deemed “CONFIDENTIAL” regardless of whether they are so marked. The parties hereby agree that all PHI disclosed by either party shall be used for the sole purpose of preparing for or conducting this litigation, including, but not limited to investigation, consultation, discovery, depositions, trial preparation, trial, appeal, resolution, mediation, or uses incidental to the proceeding in the case and shall not be disclosed or revealed to anyone not authorized by this Order. Further, it is expressly agreed that following the resolution of the litigation, all PHI shall be returned or destroyed as provided for herein. (Doc# 42, PageID.356). The District argues that this provision should be included because “thousands of…pages [of] emails” that it intends to produce as part of discovery “include an account number in the subject line and other protected health information (‘PHI’) as that term is defined under the Health Insurance Portability and Accountability Act (‘HIPAA’) which prohibits disclosure without patient consent.” (Id.). “The inclusion of this provision in the protective order[,]” the District claims, “would obviate the necessity of [the District]’s reviewing and re-Bates stamping the thousands of pages it is ready to produce as confidential or redacting the PHI in those pages.” (Id.). In support, the District cites—with pin cite, but without providing a relevant quotation or any explanation of that case’s significance—to Murphy v. Dulay, 768 F.3d 1360, 1368-70 (11th Cir. 2014). (Id.). “The HIPAA regulations generally prohibit covered entities from using or disclosing ‘protected health information.’ ” Murphy, 768 F.3d at 1368–69 (citing 45 C.F.R. §§ 164.508(a)(1), 164.502(a), 164.512). “The regulations, however, permit
covered entities to disclose protected health information when certain requirements are met,” including, relevant here, “through the judicial process.” Id. at 1369 (citing 45 C.F.R. § 164.512(e)). See also 45 C.F.R. § 164.512(e)(1) (providing that “[a] covered entity may disclose protected health information in the course of any judicial or administrative proceeding”). But certain procedures must be followed. Information may be released only in response to: (1) an “order of a court or administrative tribunal,” or (2) a “subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal,” when certain conditions are met. [45 C.F.R.] § 164.512(e)(1)(i)-(ii). For the latter, information may be disclosed only if the covered entity receives satisfactory assurance from the party seeking the information that reasonable efforts have been made to either (1) ensure that the individual whose information is to be shared has been given notice of the request, or (2) secure a qualified protective order. Id. § 164.512(e)(1)(ii). Id. “[A] qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii)…, an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that: (A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and (B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.” 45 C.F.R. § 164.512(e)(1)(v). TruBridge does not contest the District’s assertion that some of the discovery
material it intends to produce will contain “protected health information” subject to HIPAA. However, it objects to that portion of the District’s proposed provision “that ‘automatically deem[s]’ information confidential[,]” arguing that the District “should not be relieved of its obligation to review and properly designate information it believes should be protected because it is inconvenient.” (Doc# 45, PageID.361). TruBridge asserts that two provisions of its proposed protective order make the District’s proposed provision “unnecessary” (id., PageID.362)—specifically,
paragraph 2 which states in relevant part that “[a]ll Protected Material in this case shall be kept confidential by the Parties and used solely for the purpose of investigating the claims and defenses asserted in this matter and for the purpose of prosecuting the Parties’ claims and defenses in this matter and for no other purpose[;]” and paragraph 18, which states in relevant part that “all documents designated as ‘Confidential’ or ‘Confidential -- Attorneys’ Eyes Only’, including all
copies which may have been disclosed to expert witnesses, shall be returned to the party producing it or destroyed, with a written certificate of such destruction being provided by counsel for the receiving party,” within 30 days of the conclusion of this case, either in this Court or on appeal if one is filed. (Doc# 40-1, PageID.340, 347). While TruBridge claims those provisions “satisf[y] the requirements of the HIPAA regulation” (Doc# 45, PageID.362), that is not quite right.
Free access — add to your briefcase to read the full text and ask questions with AI
IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF ALABAMA SOUTHERN DIVISION
TRUBRIDGE, INC., ) Plaintiff/Counter Defendant, ) ) v. ) CIVIL ACTION NO. 1:24-00190-KD-N ) CROOK COUNTY MEDICAL ) SERVICES DISTRICT, ) Defendant/Counter Claimant. ) ORDER
This civil action is before the Court on the “Motion for Protective Order” filed February 25, 2025, by the Plaintiff/Counterdefendant, TruBridge, Inc. (Doc# 40). Defendant/Counterclaimant Crook County Medical Services District (“the District”) filed a response (Doc# 42) to said motion, Trubridge filed a reply (Doc# 45) to the response, and the District has filed a motion for leave to file a surreply to the reply (Doc# 46), with proposed surreply brief attached (Doc# 46-1).1 TruBridge requests that the Court enter its proposed protective order (Doc# 40-1) to govern the production and handling of confidential materials and electronically stored information produced as part of discovery in this action. The District’s response makes clear that it does not object to any of the provisions in the proposed order, but wishes to include an additional provision, which TruBridge opposes, stating as follows:
1 The assigned District Judge has referred said motions to the undersigned Magistrate Judge for appropriate action under 28 U.S.C. § 636(a)-(b), Federal Rule of Civil Procedure 72, and S.D. Ala. GenLR 72(a). See S.D. Ala. GenLR 72(b); (2/25/2025 & 3/5/2025 electronic reference notations). Special Provision for “Protected Health Information”: During the course of this litigation, it may be necessary for the parties to disclose certain patient protected health information (“PHI”) as that term is defined under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Federal Regulations enacted pursuant to HIPAA. All PHI, inclusive of medical records and related information, including but not limited to patient account numbers, visit numbers, and Medicare or Medicaid Numbers, shall be automatically deemed “CONFIDENTIAL” regardless of whether they are so marked. The parties hereby agree that all PHI disclosed by either party shall be used for the sole purpose of preparing for or conducting this litigation, including, but not limited to investigation, consultation, discovery, depositions, trial preparation, trial, appeal, resolution, mediation, or uses incidental to the proceeding in the case and shall not be disclosed or revealed to anyone not authorized by this Order. Further, it is expressly agreed that following the resolution of the litigation, all PHI shall be returned or destroyed as provided for herein. (Doc# 42, PageID.356). The District argues that this provision should be included because “thousands of…pages [of] emails” that it intends to produce as part of discovery “include an account number in the subject line and other protected health information (‘PHI’) as that term is defined under the Health Insurance Portability and Accountability Act (‘HIPAA’) which prohibits disclosure without patient consent.” (Id.). “The inclusion of this provision in the protective order[,]” the District claims, “would obviate the necessity of [the District]’s reviewing and re-Bates stamping the thousands of pages it is ready to produce as confidential or redacting the PHI in those pages.” (Id.). In support, the District cites—with pin cite, but without providing a relevant quotation or any explanation of that case’s significance—to Murphy v. Dulay, 768 F.3d 1360, 1368-70 (11th Cir. 2014). (Id.). “The HIPAA regulations generally prohibit covered entities from using or disclosing ‘protected health information.’ ” Murphy, 768 F.3d at 1368–69 (citing 45 C.F.R. §§ 164.508(a)(1), 164.502(a), 164.512). “The regulations, however, permit
covered entities to disclose protected health information when certain requirements are met,” including, relevant here, “through the judicial process.” Id. at 1369 (citing 45 C.F.R. § 164.512(e)). See also 45 C.F.R. § 164.512(e)(1) (providing that “[a] covered entity may disclose protected health information in the course of any judicial or administrative proceeding”). But certain procedures must be followed. Information may be released only in response to: (1) an “order of a court or administrative tribunal,” or (2) a “subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal,” when certain conditions are met. [45 C.F.R.] § 164.512(e)(1)(i)-(ii). For the latter, information may be disclosed only if the covered entity receives satisfactory assurance from the party seeking the information that reasonable efforts have been made to either (1) ensure that the individual whose information is to be shared has been given notice of the request, or (2) secure a qualified protective order. Id. § 164.512(e)(1)(ii). Id. “[A] qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii)…, an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that: (A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and (B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.” 45 C.F.R. § 164.512(e)(1)(v). TruBridge does not contest the District’s assertion that some of the discovery
material it intends to produce will contain “protected health information” subject to HIPAA. However, it objects to that portion of the District’s proposed provision “that ‘automatically deem[s]’ information confidential[,]” arguing that the District “should not be relieved of its obligation to review and properly designate information it believes should be protected because it is inconvenient.” (Doc# 45, PageID.361). TruBridge asserts that two provisions of its proposed protective order make the District’s proposed provision “unnecessary” (id., PageID.362)—specifically,
paragraph 2 which states in relevant part that “[a]ll Protected Material in this case shall be kept confidential by the Parties and used solely for the purpose of investigating the claims and defenses asserted in this matter and for the purpose of prosecuting the Parties’ claims and defenses in this matter and for no other purpose[;]” and paragraph 18, which states in relevant part that “all documents designated as ‘Confidential’ or ‘Confidential -- Attorneys’ Eyes Only’, including all
copies which may have been disclosed to expert witnesses, shall be returned to the party producing it or destroyed, with a written certificate of such destruction being provided by counsel for the receiving party,” within 30 days of the conclusion of this case, either in this Court or on appeal if one is filed. (Doc# 40-1, PageID.340, 347). While TruBridge claims those provisions “satisf[y] the requirements of the HIPAA regulation” (Doc# 45, PageID.362), that is not quite right. By their terms those provisions only apply to documents either containing “trade secrets, proprietary information, and/or…otherwise privileged” information, or deemed “Confidential” under the procedures in the protective order. (Doc# 40-1, PageID.339).
HIPAA, on the other hand, requires such treatment for all “protected health information” produced, regardless of whether a party has specifically designated it “confidential.” Nevertheless, TruBridge is correct that HIPAA does not justify the District’s proposed automatic-confidentiality provision. As noted previously, a qualified HIPAA protective order need only “(A) [p]rohibit[] the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and (B) [r]equire[] the
return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.” 45 C.F.R. § 164.512(e)(1)(v). No other protections for “protected health information”—for instance, restrictions on how the information is to be treated or handled when used or disclosed in the relevant “litigation or proceeding”—are required by § 164.512(e)(1), and the District has cited no other authority as requiring further protections.
HIPAA protects “protected health information,” as that term is defined by the Act and its regulations. TruBridge’s proposed protective order, on the other hand, is written to protect “trade secrets, proprietary information, and/or…otherwise privileged” information, as well as any other information a party deems confidential. TruBridge’s protective order, rightly, puts the burden of proof for confidentiality on the party asserting it. (Doc# 40-1, PageID.347). Cf. United States v. Schaltenbrand, 930 F.2d 1554, 1562 (11th Cir. 1991) (“The party invoking the attorney-client privilege has the burden of proving that an attorney-client relationship existed and that the particular communications were confidential.”). The undersigned agrees
with TruBridge that the District’s proposed “automatic confidentiality” provision for HIPAA “protected health information” would cause unnecessary overlap between the distinct issues, leaving TruBridge to guess as to whether the District labeled a document “confidential” simply because it is HIPAA-protected information or for some other reason allowed by its proposed protective order. The District’s provision would also unduly burden TruBridge by forcing it to treat as “confidential,” with all the attendant responsibilities that entails under the protective order, potentially
large amounts of discovery material that HIPAA does not require be so treated, and which the District would not otherwise so designate.2 Accordingly, the undersigned declines to add the District’s proposed “automatic confidentiality” provision to TruBridge’s proposed protective order. However, because TruBridge has not contested the District’s claim that its discovery responses will include HIPAA protected health information, and because
the other provisions of the District’s proposed provision meet the requirement for a qualified HIPAA order, see 45 C.F.R. § 164.512(e)(1)(v), the undersigned will add
2 The District complains that omitting its proposed provision will necessitate “reviewing and re-Bates stamping the thousands of pages it is ready to produce as confidential or redacting the PHI in those pages.” (Doc# 42, PageID.356). However, the District has cited no provision of HIPAA that requires PHI to be redacted when used in the case for which it has been authorized. Moreover, the District should not be allowed to escape its burden to designate discovery as “confidential” based on a non-existent requirement in HIPAA. those provisions to TruBridge’s proposed order in a separate section at the end.3 Additionally, having independently considered TruBridge’s proposed order, the undersigned finds it appropriate to sua sponte modify certain sections, as follows:
• Sections 6, 12, 13 will be modified to remove their applicability to court hearings and transcripts thereof. Any issues of confidentiality arising at court hearings must be raised by motion of a party and will be handled by the Court at its discretion on a case-by-case basis. • Section 6 will also be modified to make clear that any private court reporter or videographer is not bound by the protective order unless he or she voluntarily
agrees to be. • Section 17 will be modified to clarify the Court’s requirements and expectations with regard to filing material under seal. Accordingly, TruBridge’s “Motion for Protective Order” filed February 25, 2025 (Doc# 40), is GRANTED in part and DENIED in part, in that the undersigned will separately enter the substantive provisions of TruBridge’s proposed protective order (Doc# 40-1) as an order of the Court, with the
above-described modifications. Any party who believes it is entitled to an award of reasonable expenses under Federal Rule of Civil Procedure 37(a)(5) in connection with the disposition of the present motion for protective order must file a motion for such expenses, properly
3 The District’s motion for leave to file a sur-reply (Doc# 46) is GRANTED. The undersigned has considered the proposed sur-reply attached to that motion, but it does not alter the conclusions reached herein. supported to show both amount and reasonableness, no later than APRIL 16, 2025.4 Failure to do so will be deemed a forfeiture of the right to seek such expenses in connection with the subject motion for protective order.
DONE and ORDERED this the 2nd day of April 2025. /s/ Katherine P. Nelson KATHERINE P. NELSON UNITED STATES MAGISTRATE JUDGE
4 See Fed. R. Civ. P. 26(c)(3) (“Rule 37(a)(5) applies to the award of expenses” in connection with a motion for protective order under Federal Rule of Civil Procedure 26(c).).