STIPULATED ADDENDUM TO FEBRUARY 8, 2018 STIPULATED HIPAA QUALIFIED PROTECTIVE ORDER [DKT. 109]; [PROPOSED] ORDER THEREON

EDMUND F. BRENNAN, Magistrate Judge.

RECITALS

WHEREAS, on September 21, 2017, Plaintiff-Intervenor State of California ("California") filed its Complaint-in-Intervention in the above-captioned False Claims Act qui tam matter;

WHEREAS, the parties stipulated to and the Court entered a Stipulated HIPAA Qualified Protective Order ("HIPAA QPO") on February 8, 2018 [Dkt. 109];

WHEREAS, nothing in this Addendum shall be construed as an alteration and/or expansion of the parties' duties to preserve the confidentiality of Protected Health Information as required by the HIPAA QPO and/or as required by the applicable regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (45 C.F.R. § 164), as amended ("HIPAA");

WHEREAS, on May 29, 2018, the Court issued a Status (Pretrial Scheduling) Order [Dkt. 128], adopting California's and Relator Loyd F. Schmuckley, Jr.'s request to conduct discovery in phases, the first phase evaluating the validity of California's statistical sampling methodology, and ordering California to make disclosures concerning its statistics experts and the design of the statistical sample at the earliest feasible point during the first stage of discovery so that Defendant Rite Aid Corporation ("Rite Aid") can conduct discovery concerning the same;

WHEREAS, in connection with the design of the statistical sample in this matter and the Court's Case Status Order of May 29, 2018 [Dkt. 128], California's investigation prior to filing its Complaint-in-Intervention involved obtaining and reviewing Medi-Cal claims data that contain social security numbers and other potentially individually identifiable health information of more than 120,000 Medi-Cal beneficiaries for whom Rite Aid submitted claims for payment;

WHEREAS, California has provided the same unredacted, non-anonymized Medi-Cal claims data described above to its testifying expert, Michael J. Petron, CPA, CFE, whom California retained to provide expert opinion supporting the validity of California's sampling methodology in this matter;

WHEREAS, Rite Aid claims that California's provision of the same unredacted, non-anonymized Medi-Cal claims data described above to its testifying sampling methodology expert requires the same production of such unredacted, non-anonymized Medi-Cal claims data to Rite Aid under Federal Rule of Civil Procedure 26(a)(2).

STIPULATION

Pursuant to Federal Rule of Civil Procedure 26(c), 45 C.F.R. § 164.512, and the applicable local rules, the parties stipulate to and petition the Court to enter the following Addendum to the currently effective Stipulated HIPAA Qualified Protective Order ("HIPAA QPO") [Dkt. 109].

The parties acknowledge that nothing in this stipulation expands, diminishes or otherwise alters any of the duties and procedures required under the terms of the HIPAA QPO [Dkt. 109] and/or any applicable regulations promulgated under HIPAA or related California privacy law. This stipulated Addendum only addresses the need for protection of Personally Identifying Information, such as, but not limited to, social security numbers, of Medi-Cal beneficiaries and/or Rite Aid pharmacy customers that may be reflected and/or contained in the documents, records and data relevant to this matter.

ADDENDUM TO HIPAA QPO

The parties agree to the following addendum to the Stipulated HIPAA Qualified Protective Order [Dkt. 109], as follows:

1. The parties agree to adopt and add to the Stipulated HIPAA Qualified Protective Order all the above-mentioned recitals;

2. The parties agree to supplement section 2. DEFINITIONS by adding the following provision:

2.17 Personally Identifying Information/PII: This term shall encompass both (i) the definition of "personal information" set forth in California Civil Code § 1798.3 and (ii) the definition of "patient identifying information" set forth in 42 C.F.R. § 2.11.

3. The parties agree to modify definition 2.2 "CONFIDENTIAL" Information or Items to now read as follows:

4. The parties agree that wherever it appears within Section 5.2 and Section 8 of the HIPAA QPO, the defined term "PHI" shall now be read to mean "PHI and/or PII."

5. The parties agree to supplement section 10. MISCELLANEOUS by adding the following provision:

10.4 Filing Confidential Personally Identifying Information/PII. A Party seeking to file in the public record any Protected Material that reflects or contains PII shall comply with Civil Local Rule 140(a) regarding the redaction of "personal data identifiers."

IT IS SO STIPULATED, THROUGH COUNSEL OF RECORD.

[PROPOSED] ORDER

The above modifications having been stipulated by all parties, and the Court having found good cause,

IT IS SO ORDERED that the above stipulated addendum to the Stipulated HIPAA Qualified Protective Order [Dkt. 109] is approved.