If this opinion indicates that it is “FOR PUBLICATION,” it is subject to revision until final publication in the Michigan Appeals Reports.
STATE OF MICHIGAN
COURT OF APPEALS
VS, a legally incapacitated individual, by Next UNPUBLISHED Friend ELITHA SUMMERVILLE, August 13, 2026 11:02 AM
Plaintiff-Appellee,
v No. 373270 Wayne Circuit Court
ST. MARY MERCY LIVONIA HOSPITAL and LC No. 23-000930-NO TRINITY HEALTH-MICHIGAN,
Defendants-Appellants.
Before: BAZZI, P.J., and M. J. KELLY and LIEVENSE, JJ.
PER CURIAM.
In this action involving claims of negligence and discriminatory denial of public services under the Elliott-Larsen Civil Rights Act, MCL 37.2201 et seq., defendants appeal by leave granted1 the trial court’s order granting plaintiff’s motion to permit the parties to “use, discuss, and elicit testimony” regarding disclosed medical records of a nonparty patient (the male patient). Finding no errors warranting reversal, we affirm.
I. BASIC FACTS AND PROCEDURAL HISTORY
This case arises out of plaintiff’s claim that she was sexually assaulted by the male patient while hospitalized at St. Mary Mercy Livonia Hospital (St. Mary) for psychiatric care. In February 2022, plaintiff and the male patient were both receiving treatment in the hospital’s mental-health unit. Plaintiff alleged that the male patient coerced her into performing oral sex on him. The incident was reported to hospital staff and the Livonia Police Department (LPD), but no charges were ever filed.
1 VS v St Mary Mercy Livonia Hosp, unpublished order of the Court of Appeals, entered March 10, 2025 (Docket No. 373270).
2
In January 2023, plaintiff filed a complaint against defendants, in part alleging negligence for their failure to protect plaintiff and prevent the sexual assault while she was under defendants’ care. The male patient was not a party to this action. During the course of discovery, plaintiff received the “exact same” productions of the male patient’s medical records on two separate occasions. The first production occurred on April 13, 2023, which the LPD provided pursuant to a subpoena from plaintiff.2
Plaintiff also sought the records from defendants, who continually asserted that disclosure of the male patient’s medical records violated the Health Insurance Portability and Accountability Act (HIPAA), 42 USC 1320d et seq., and the physician-patient privilege. Defendants therefore filed motions in late 2023 to prevent plaintiff from questioning defendants’ employees about the male patient during depositions and for a protective order.
On January 25, 2024, plaintiff’s counsel met with the male patient to obtain authorizations to access his medical records.3 Included with the authorizations was a “General Authorization for Use or Disclosure of Health Information” (General Authorization) that allowed St. Joseph Mercy Health System (St. Joseph)4 to disclose the male patient’s protected health information to plaintiff’s counsel, which was signed by the male patient at 3:40 p.m. The second page of the authorization allowed the male patient to “revoke this limited authorization in writing at any time at the address found below, except to the extent that action has been taken in reliance on this authorization,” and provided that the revocation be mailed to St. Joseph. It is undisputed that the male patient signed the revocation page the same day he signed the General Authorization, however, plaintiff’s filings in the trial court reflected an unsigned revocation page. The male patient also signed a “HIPAA Privacy Authorization For Disclosure of Protected Health Information Relevant to Litigation, Pending Claims or Intent to Sue” (HIPAA Authorization) authorizing the release of his medical records to plaintiff’s counsel. In addition to his authorizations, the male patient signed an affidavit stating the following:
9. I have signed numerous forms and authorizations because I want the lawyers and the court involved in [plaintiff]’s case in Wayne County to be able to freely and opening [sic: openly] talk about me, my medical records, and my time as a patient at St. Mary Mercy Livonia Hospital and elsewhere.
10. I do not need any lawyers or doctors to protect any of my privacy rights, including any privacy rights related to my time as a patient at St. Mary Mercy Livonia Hospital or any other hospital or medical facility.
2 The LPD previously received the medical records pursuant to its criminal investigation.
3 Questions have been raised about the manner and method in which the male patient’s authorizations were obtained at this meeting. Without a full record of what transpired, we decline to comment on whether any ethical violation occurred. However, we caution that although this is an adversarial system, attorneys are expected to follow the Michigan Rules of Professional Conduct. 4 St. Mary is a member of the St. Joseph healthcare system.
3
* * *
12. My privacy rights are mine and mine alone and I do not want to enforce them.
The male patient’s General Authorization was eventually provided to defendants, and according to defendants, plaintiff’s counsel omitted the signed revocation page. On April 9, 2024, the parties stipulated to a protective order that defendants would produce the male patient’s medical records to plaintiff because he waived his privacy protections. The order contained protective conditions, including that the records be used solely for the lawsuit. Defendants sent plaintiff the second production of the male patient’s medical records shortly thereafter.
The male patient was deposed on April 30, 2024. During the deposition, he confirmed that he previously waived and continued to waive his HIPAA and privacy rights. However, at some point, defendants’ counsel recognized the potential impact of the signed revocation page. The revocation was presented to the male patient, who interpreted it as a “sign from God” and decided that he wanted to revoke his waivers. He acknowledged that at the time he signed the General Authorization, HIPAA Authorization, and affidavit, he knew he was releasing his “information rights” and gave plaintiff’s counsel permission to access his records, “but if the revoke was there, then [he was] going with the revoke.” The male patient confirmed that he intended to revoke his waiver, and that it was the first time he “actually intend[ed] on revoking.”
On May 24, 2024, plaintiff filed the instant motion to allow use of the male patient’s medical records when questioning witnesses. Following a four-day motion hearing, the trial court granted plaintiff’s motion in an oral ruling in June 2024, permitting plaintiff to ask questions about the male patient and his medical records while deposing defendants’ agents. The trial court concluded that HIPAA and the physician-patient privilege did not prohibit disclosure of the information sought. It reasoned the parties “cannot unring the bell” of the LPD’s initial disclosure. Further, the male patient waived his privacy protections. The trial court found that waiver “occurred by the verbal authorization of the male patient, both at the time of his execution of the authorizations and his execution of the affidavit . . . .” It also found that several HIPAA exceptions allowed for unauthorized disclosure of the records. In its written order, which was entered in October 2024, the trial court included protective provisions, including that the information obtained “shall only be used for purposes of this litigation and shall be returned or destroyed after the litigation concludes.” Defendants appealed.
II. DISCLOSURE OF MEDICAL INFORMATION
Defendants argue that the trial court erred by granting plaintiff’s motion because HIPAA, the physician-patient privilege, and the Mental Health Code, MCL 330.1001 et seq., protected
4
disclosure of the male patient’s medical information and prohibit plaintiff’s use of the information in eliciting testimony from witnesses. We disagree.5
Generally, “a trial court’s decision on a motion regarding discovery is reviewed for an abuse of discretion.” Holman v Rasak, 486 Mich 429, 436; 785 NW2d 98 (2010). However, this case involves questions of statutory interpretation, which are reviewed de novo. Id. “The applicability of the physician-patient privilege is a legal question that this Court reviews de novo. Once we determine whether the privilege is applicable to the facts of this case, we determine whether the trial court’s order was proper or an abuse of discretion.” Baker v Oakwood Hosp Corp, 239 Mich App 461, 468; 608 NW2d 823 (2000). A trial court has abused its discretion “when the decision results in an outcome falling outside the principled range of outcomes.” Stokes v Swofford, 514 Mich 423, 441; 22 NW3d 97 (2024).
Whether a waiver occurred presents a mixed question of fact and law. Reed Estate v Reed, 293 Mich App 168, 173; 810 NW2d 284 (2011). “The definition of waiver is a question of law, but whether the facts of a particular case constitute a waiver is a question of fact. We review for clear error a trial court’s findings of fact and review de novo its conclusions of law.” Id. (quotation marks and citations omitted). “A finding is clearly erroneous when, although there is evidence to support it, the reviewing court on the entire record is left with the definite and firm conviction that a mistake has been committed.” Id. at 173-174 (quotation marks and citation omitted).
A. HIPAA
HIPAA governs when a “covered entity” may “use or disclose” the protected health information of an individual. 45 CFR 164.502(a). A “covered entity” includes health plans, health care clearinghouses, and health care providers who transmit any electronic health information. 45 CFR 160.103. Protected health information “is any health information, oral or recorded, that is individually identifiable and transmitted or maintained by a covered entity in any form or medium.” Holman, 486 Mich at 435-436. The general rule governing disclosure of protected health information under HIPAA “is that a covered entity may not use or disclose protected health information without a written authorization from the individual as described in 45 CFR 164.508, or alternatively, the opportunity for the individual to agree or object as described in 45 CFR 164.510.” Id. at 438-439.
Defendants, as a hospital and healthcare system, are covered entities under 45 CFR 160.103.6 Therefore, there must be a valid HIPAA waiver or applicable exception in order for
5 Defendants do not meaningfully address the application of the Mental Health Code and the psychiatrist-patient privilege, merely stating that no exceptions to disclosure apply. We therefore decline to address this issue. See Seifeddine v Jaber, 327 Mich App 514, 520; 934 NW2d 64 (2019) (“Failure to adequately brief an issue constitutes abandonment.”). 6 Because the medical records produced by the LPD and defendants were the “exact same,” we do not make any determinations regarding the LPD’s disclosure and analyze only defendants’ disclosure. However, we note that a police department is not a covered entity, so the LPD’s
5
plaintiff to discover from defendants the male patient’s protected health information through his medical records and question defendants’ employees about their content.
We need not address whether the male patient’s General Authorization was valid in light of his signed revocation because the disclosure of his medical information was permitted under an exception to HIPAA’s authorization requirement. 45 CFR 164.512(e)(1) allows a covered entity to disclose protected health information in judicial proceedings. Disclosure may be made in response to a court order “provided that the covered entity discloses only the protected health information expressly authorized by such order[.]” 45 CFR 164.512(e)(1)(i). Disclosure may also be made “[i]n response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court,” as long as “[t]he covered entity receives satisfactory assurance . . . from the party seeking the information that reasonable efforts have been made by such party” to ensure the individual whose health information is sought has been notified of the request or to secure a qualified protective order. 45 CFR 164.512(e)(1)(ii)(A) and (B). A qualified protective order is an order that:
(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and
(B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding. [45 CFR 164.512(e)(1)(v)(A) and (B).]
Here, the trial court entered the stipulated protective order, which limited the use of the documents to the instant litigation. The trial court’s subsequent written order on the motion limited use of the information to the instant litigation and provided that the information would be returned or destroyed after litigation is complete. This is sufficient to constitute a qualified protective order. 45 CFR 164.512(e)(1)(v). Therefore, defendants’ disclosure of the male patient’s medical records was appropriate even considering the inconsistencies between the General Authorization, revocation, HIPAA Authorization, and affidavit all signed the same day. Accordingly, HIPAA does not otherwise prohibit defendants from discussing the male patient’s protected health information.
We note that the trial court erred with respect to its HIPAA analysis. Notably, the trial court determined that waiver “occurred by the verbal authorization of the male patient” when he executed the authorizations and signed his affidavit. While HIPAA authorizes oral authorizations for facility directories, 45 CFR 164.510(a), and certain individuals involved in a patient’s care, 45 CFR 164.510(b), none of these circumstances are applicable. As for the applicability of HIPAA exceptions, the trial court also determined that unauthorized disclosure of medical records was allowed under 45 CFR 164.512(c) and (f). 45 CFR 164.512(c) allows for disclosure “about an individual whom the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority . . . .” However, plaintiff sought the protected health
disclosure of the male patient’s medical records would not implicate HIPAA, per se, though other law and regulations irrelevant here may limit the LPD. See 45 CFR 160.103.
6
information of the alleged perpetrator and plaintiff’s counsel is not a government authority. 45 CFR 164.512(f) allows for disclosure to a law-enforcement official, which again does not include plaintiff’s counsel. While the trial court’s analysis was flawed, reversal is not necessary because it ultimately reached the right result in determining that the judicial-proceedings exception applied under 45 CFR 164.512(e). See Gleason v Mich Dep’t of Transp, 256 Mich App 1, 3; 662 NW2d 822 (2003) (“A trial court’s ruling may be upheld on appeal where the right result issued, albeit for the wrong reason.”).
B. PHYSICIAN-PATIENT PRIVILEGE
The physician-patient privilege in Michigan is set forth by MCL 600.2157,7 which states, in relevant part:
Except as otherwise provided by law, a person duly authorized to practice medicine or surgery shall not disclose any information that the person has acquired in attending a patient in a professional character, if the information was necessary to enable the person to prescribe for the patient as a physician, or to do any act for the patient as a surgeon.
The privilege “broadly and clearly” prohibits physicians from disclosing information obtained under the circumstances provided in MCL 600.2157. Baker, 239 Mich App at 475. As summarized by the Michigan Supreme Court:
[MCL 600.2157] imposes an absolute bar. It protects, within the veil of privilege, whatever in order to enable the physician to prescribe, was disclosed to any of his senses, and which in any way was brought to his knowledge for that purpose. Such veil of privilege is the patient’s right. It prohibits the physician from disclosing, in the course of any action wherein his patient or patients are not involved and do not consent, even the names of such noninvolved patients. [Schechet v Kesten, 372 Mich 346, 351; 126 NW2d 718 (1964) (quotation marks and citation omitted).]
The privilege exists “to protect the confidential nature of the physician-patient relationship and encourage a patient to make a full disclosure of symptoms and condition[s].” Meier v Awaad, 299 Mich App 655, 666; 832 NW2d 251 (2013) (quotation marks and citation omitted).
The physician-patient privilege “belongs solely to the patient,” and “can only be waived by the patient.” Id. The statute and court rules set forth multiple situations where waiver of the
7 Application of the physician-patient privilege is not preempted by HIPAA in this lawsuit because the case involves a “discovery issue involving the privacy rights of [a] nonparty patient[].” Meier v Awaad, 299 Mich App 655, 665; 832 NW2d 251 (2013). Because Michigan law is more protective of a nonparty patient’s privacy rights than HIPAA, it is appropriate to examine application of the privilege. See id. at 664-665 (comparing nonparty privacy protections under HIPAA and the physician-patient privilege).
7
privilege may occur, specifically where a patient is a party in judicial proceedings. MCL 600.2157 provides:
If the patient brings an action against any defendant to recover for any personal injuries, or for any malpractice, and the patient produces a physician as a witness in the patient’s own behalf who has treated the patient for the injury or for any disease or condition for which the malpractice is alleged, the patient shall be considered to have waived the privilege provided in this section as to another physician who has treated the patient for the injuries, disease, or condition.
MCL 600.2157 also provides for waiver in certain circumstances where a patient has died. Further, under MCR 2.314(B)(1):
A party who has a valid privilege may assert the privilege and prevent discovery of medical information relating to his or her mental or physical condition. The privilege must be asserted in the party’s disclosure under [MCR] 2.302(A), in written response to a request for production of documents under MCR 2.310, in answers to interrogatories under MCR 2.309(B), before or during the taking of a deposition, or by moving for a protective order under MCR 2.302(C). A privilege not timely asserted is waived in that action, but is not waived for the purposes of any other action.
Notably, under MCR 2.314(E), “Medical information concerning persons not parties to the action is not discoverable under this rule.”
As a nonparty, the foregoing waiver provisions are inapplicable to the male patient.
However, “[a] patient may intentionally and voluntarily waive the privilege.” Dorris v Detroit Osteopathic Hosp Corp, 460 Mich 26, 39; 594 NW2d 455 (1999). “A true waiver is an intentional, voluntary act and cannot arise by implication. It has been defined as the voluntary relinquishment of a known right.” Kelly v Allegan Co Circuit Judge, 382 Mich 425, 427; 169 NW2d 916 (1969). Waiver of the physician-patient privilege can occur where a patient voluntarily releases or authorizes the use of medical records. See People v Sullivan, 231 Mich App 510, 516-517; 586 NW2d 578 (1998) (determining that the physician-patient privilege was waived where a “defendant voluntarily released his medical records to the prosecution for the purpose of an independent evaluation”), aff’d 461 Mich 992 (2000). Further, Michigan courts have applied the doctrine of estoppel to treat the physician-patient privilege as waived: “There are some circumstances . . . wherein justice requires that a person be treated [a]s though he had waived a right where he has done some act inconsistent with the assertion of such right and without regard to whether he knows he possessed it.” Kelly, 382 Mich at 427.
Here, the trial court did not clearly err by concluding that the male patient waived his physician-patient privilege, notwithstanding his signed revocation and subsequent attempt to orally revoke the authorizations during his deposition. On January 25, 2024, the male patient executed the General Authorization for St. Joseph that authorized “the disclosure and/or use of individually identifiable health information, consistent with applicable State and Federal law.” He also completed a HIPAA Authorization that allowed the release of “any and all medical records and information from [his] date of birth to the present” to plaintiff’s counsel. While the male
8
patient also inconsistently signed the revocation page of the General Authorization, his signed affidavit affirmed his desire to allow “the lawyers and the court involved in [plaintiff]’s case in Wayne County to be able to freely and opening [sic: openly] talk about [him], [his] medical records, and [his] time as a patient at St. Mary Mercy Livonia Hospital and elsewhere.” The male patient’s deposition testimony makes clear that he did not intend to revoke at the time he signed his authorizations. He confirmed that he waived his HIPAA and privacy rights at the time he signed the authorizations. He also confirmed that his revocation at the deposition was the first time he actually intended on revoking.
Under these circumstances, it is appropriate to treat the male patient’s physician-patient privilege as waived. Because the male patient’s conduct was entirely inconsistent with the assertion of his physician-patient privilege, this is a circumstance where “justice requires that a person be treated [a]s though he had waived [his] right . . . .” Kelly, 382 Mich at 427.
The male patient’s attempt to reinvoke the privilege at his deposition does not change the analysis. The Supreme Court has explicitly held that where a plaintiff patient voluntarily authorizes the release of medical information, the physician-patient privilege is waived and can no longer be asserted in the action because voluntary disclosure removes the need for confidentiality. See Domako v Rowe, 438 Mich 347, 357; 475 NW2d 30 (1991) (“After the patient voluntarily allows discovery of the medical information, the plaintiff is not thereafter free to assert the privilege because the plain language of MCR 2.314(B)(1) declares that the privilege is waived for that action.”). While Domako relied on MCR 2.314(B)(1), which is inapplicable to the male patient as a nonparty, the general principle that “the voluntary disclosure of the information takes away the need for confidentiality” applies with equal force here. Id.
Indeed, Michigan Courts have rejected assertion of the privilege in multiple contexts involving nonparty patients. In Landelius v Sackellares, 453 Mich 470, 481; 556 NW2d 472 (1996), the Supreme Court applied the doctrine of estoppel to prevent the assertion of a nonparty patient’s privilege where the patient disclosed his medical records in an earlier proceeding to which he was a party. While the Court noted that the patient was a party to an earlier lawsuit, which could invoke MCR 2.314(B)(1), the patient nonetheless expressly waived his physician-patient privilege, which was distinct from the default circumstances provided by the court rule. Id. The Court determined that the patient’s free and knowing disclosure of medical information in the earlier case precluded assertion of the privilege in the subsequent case. Id. It reasoned, “[h]aving authorized the disclosure of his medical records in that case, and having given deposition testimony about his care and treatment, [the patient] is estopped to recapture the physician-patient privilege in the Washtenaw Circuit Court case involving the university defendants.” Id.
This Court has applied similar principles to reject the assertion of the privilege even where a nonparty did not voluntarily disclose the medical records at issue. Landin v Healthsource Saginaw, Inc, 305 Mich App 519, 534-536; 854 NW2d 152 (2014), involved the unauthorized disclosure of medical records concerning a deceased nonparty patient. The plaintiff obtained the records by copying and removing them from the hospital. Id. at 536. The defendant also claimed to have inadvertently produced relevant medical documents during discovery. Id. This Court affirmed the trial court’s denial of the defendant’s motion to return the records, reasoning:
9
This is not a case similar to those cited by defendant wherein a party sought to compel the production of privileged information and was refused. Instead, this is a case wherein defendant sought to unring a bell. The materials were already disclosed and used by both parties, for better or worse. As indicated by the trial court, defendant was aware of plaintiff’s possession of the records for well over a year before contending that they were protected by privilege and seeking their return. In addition, plaintiff and defendant placed the reason for plaintiff’s termination at issue. The reason for his termination would be proved only by reference to patient records . . . . [Id. at 536-537.]
As the trial court found here, defendants cannot unring the bell with respect to the male patient’s medical records. The records were already disclosed pursuant to the stipulated protective order. While this Court has emphasized the importance of nonparty patient confidentiality because “nonparty patients are unlikely to even be aware of [a] pending lawsuit,” Meier, 299 Mich App at 669, this case is distinct from those where a nonparty patient is uninvolved or significantly removed from the litigation. Indeed, defendants moved for leave to file a notice of nonparty fault implicating the male patient, which the trial court ultimately denied. Nonetheless, the trial court recognized the relevance of the male patient’s medical information to the lawsuit, noting that “it is impossible for there to be appropriate discovery without this information.” Given the male patient’s initial participation as a witness in the lawsuit and the relevance of his medical information to the issues being litigated, his attempt to reassert the privilege following the voluntary disclosure of his medical records is insufficient to bar their disclosure or use.
Additionally, the trial court did not abuse its discretion by determining that plaintiff could use the male patient’s medical records for the purpose of eliciting witness testimony. In Sullivan, 231 Mich App at 517, this Court determined that physician testimony was properly admitted where the defendant waived physician-patient privilege by authorizing the release of his medical records:
[D]efendant voluntarily released his medical records to the prosecution for the purpose of an independent evaluation regarding defendant’s sanity at the time of the offense. The voluntary release of this information waived the privilege with respect to such information. . . . Hence, the testimony of Drs. Foster and Kondapaneni was properly admitted because the physician-patient privilege was waived when defendant released his medical records.
Here, the male patient voluntarily waived his physician-patient privilege with respect to the information contained in his medical records. It follows that plaintiff may ask questions and elicit testimony about the contents of the records. This Court has held similarly in the context of disclosures pursuant to the psychotherapist-patient privilege. See People v Carrier, 309 Mich App 92, 120; 867 NW2d 463 (2015) (reasoning that where a communication has been properly disclosed, it is inappropriate to preclude testimony or evidence concerning the communication because the assurance of confidentiality has already been eroded). Because the privilege has been waived, the trial court properly allowed plaintiff to use the male patient’s medical records to elicit testimony from witnesses.
Defendants challenge whether the male patient’s waivers were knowing and voluntary because at the time he signed the authorizations, he was incarcerated, not represented by counsel,
10
and taking psychiatric medication. When determining whether a person has waived a legal right, “a court must determine if a reasonable person would have understood that he or she was waiving the interest in question.” Reed Estate, 293 Mich App at 176. The waiving party must have known of the existing rights and had the intention to waive them. Id. A waiver “must simply be explicit, voluntary, and made in good faith.” Id. (quotation marks and citation omitted).
Although the circumstances regarding the male patient’s authorizations do raise some concerns, the record supports that his waiver was knowingly and voluntarily made. In the presence of a notary public, the male patient signed the authorizations. His General Authorization provided that he understood he could refuse to sign the authorization, and his HIPAA Authorization provided that he “underst[ood] that authorizing the release of this health information is voluntary . . . .” In his affidavit, the male patient stated that he could read and understand English; was not threatened, bribed, or intimidated into signing the affidavit; and “fully read and understood everything that is typed out in this Affidavit.” During his deposition, the male patient confirmed that when he signed the authorizations, he “knew what HIPAA was already, the release of information rights,” and still consented to the disclosure of information. Accordingly, we are unpersuaded by defendants’ argument that the male patient’s waiver was not knowing or voluntary.
Affirmed.
/s/ Mariam S. Bazzi /s/ Michael J. Kelly /s/ Andrew J. Lievense