ORDER CONCERNING COURT'S ABILITY TO REQUIRE PLAINTIFFS TO SIGN HIPAA MEDICAL AUTHORIZATION FORMS

JONATHAN GOODMAN, District Judge.

The parties in both cases designated above are simultaneously involved in an identical discovery issue: whether the Court can require Plaintiffs to sign a HIPAA1 medical authorization form for the release of medical records from third party healthcare providers because they have placed the physical and/or mental conditions at issue. In fact, the discovery hearings in these two otherwise unrelated cases fortuitously occurred on the very same afternoon. All parties in both cases filed supplemental legal memoranda analyzing the same issue. Rather than write two separate opinions discussing the same legal issues, the Undersigned decided it would be more efficient to simply issue one order applicable to both cases.

As all parties recognize, there is no binding legal authority. Neither the United States Supreme Court nor the Eleventh Circuit Court of Appeals has decided the issue. This results in a scenario where the parties are relying on non-binding cases (from district courts both within and out of this Circuit and from different circuit courts as well). Some courts say that federal trial courts lack authority to require a plaintiff to sign a HIPAA authorization even when the plaintiff's physical or mental condition is at issue; some say that Federal Rules of Civil Procedure 34 and 37 collectively generate the requisite authority; some hold that courts are appropriately authorized without analyzing the specific reasons underlying the order compelling compliance; and some hold that trial courts are empowered to issue a HIPAA order pursuant to 45 C.F.R. 164.512(e)(1) — which is distinct from an order requiring a plaintiff to sign a broad HIPAA authorization.

The plaintiffs and the defendants, in both cases, have both offered sound policy reasons to support their positions. Given the lack of precedent and the competing policy rationales, the Undersigned is adopting a practical result. As outlined below, this result avoids the need to conclusively decide whether a federal trial court can force a plaintiff to waive the plaintiff's HIPAA-based right to medical records privacy by compelling a signed HIPAA authorization. However, the ruling here also simultaneously provides protection to defendants (who will be able to obtain relevant medical records and who will not be sandbagged at trial or other stages of the litigation with alleged medical or emotional/mental damages which cannot be adequately probed through a medical records assessment).

By way of summary, the parties will jointly submit a proposed order which the Undersigned will execute pursuant to the federal HIPAA regulation. The order will encompass the relevant medical records at issue in the specific lawsuit but will not be a broad and sweeping authorization for all medical records dating back to an unreasonably old date for each plaintiff's medical history. The defendants, in each case, will be able to attach this court order to subpoenas issued to the healthcare providers. The subpoenas will be limited to the specific topics permitted by the order.

In addition, the plaintiffs, in each case, will not be permitted to introduce evidence at trial or other stages of the case concerning medical/emotional/mental health issues beyond the topics authorized by the HIPAA order. Likewise, they will not be permitted to use any expert testimony on those beyond-the-HIPAA-order issues for any purpose. Therefore, the plaintiffs will, in effect, be the master of the discovery obtained from third party healthcare providers concerning their alleged damages.

If the plaintiffs, in each case, permit only a crabbed and blinkered inquiry into their records and refuse to agree to an order providing broader discovery, then they will undermine their ability to collect damages. If, on the other hand, they agree to the submission of a comparatively broad HIPAA order permitting discovery into myriad medical and mental health issues, then they will not risk an order foreclosing them from pursuing damages for certain alleged injuries.

Factual Background

Sherlock v. Fontainebleau, Case No. 15-24593

Plaintiff Anitra Sherlock field a lawsuit against her former employer, Defendant Fontainebleau Florida Hotel, LLC, alleging national origin discrimination and retaliation under Title VII and 42 U.S.C. § 1981. Plaintiff Sherlock's Complaint seeks damages, inter alia, for "suffering, mental anguish, loss of enjoyment of life, and other non-pecuniary losses." [ECF No. 32, p. 13]. During discovery, on July 22, 2016, Defendant Fontainebleau asked Plaintiff Sherlock to identify medical providers from whom she sought treatment and for production of medical records related to the treatment. Plaintiff Sherlock objected based on relevance.

Following a discovery hearing, the Court issued a post-hearing administrative Order on November 1, 2016 and instructed Plaintiff Sherlock to clarify whether her claim for emotional distress/mental anguish was limited to the normal embarrassment and humiliation associated with being harassed at work or whether Plaintiff Sherlock was seeking other types of damages (such as depression, anxiety, high blood pressure, inability to sleep well, etc.). [ECF No. 48, pp. 1-2]. If the latter, then Plaintiff Sherlock would be required to disclose her medical history. On November 11, 2016, Plaintiff Sherlock served her supplemental interrogatory answer, identifying seventeen providers from whom she sought treatment during the relevant period. Plaintiff Sherlock also produced approximately sixty pages of medical records related to these seventeen providers.

Seeking to ensure that it had all records related to Plaintiff Sherlock's treatment, Defendant Fontainebleau asked Plaintiff Sherlock to execute HIPAA releases for each of the providers. In response, Plaintiff Sherlock executed only three waivers and refused to sign the remaining fourteen. Defendant Fontainebleau contends that the Court has legal authority to compel Plaintiff Sherlock to sign HIPAA authorizations and that, even if it does not, then Plaintiff Sherlock waived her medical records privacy interest by signing three waivers. Plaintiff Sherlock disagrees with both contentions.

Incardone v. Royal Caribbean, Case No. 16-20924

There are twenty-three plaintiffs to this personal injury action, which arises from a cruise aboard the "Anthem of the Seas" and is brought by a group of forty families with children that have Autism Spectrum Disorder ("ASD"). According to the Amended Complaint, Defendant Royal Caribbean decided to sail the cruise ship into the path of a storm with hurricane force winds even though the National Ocean/Land Atmospheric Administration warned of severe conditions in the ship's route. [ECF No. 30, p. 4]. Also, the amended complaint describes itself as a class action and the plaintiffs allege that they were permanently "injured about their bodies and extremities," suffered "permanent physical disability," "impairment," the "aggravation of pre-existing neurological conditions," "suffered additional physical handicap," and that they will need "life care" as a result. [ECF No. 30, pp. 10-13].

The plaintiffs collectively claim that Defendant Royal Caribbean's negligence caused them severe mental and emotional harm and distress, resulting in physical manifestations such as "sickness, nausea, exhaustion, fatigue, headaches, insomnia, lack of sleep, poor sleep, nightmares and aggravation of pre-existing neurological conditions." [ECF No. 30, p. 11]. Many of the plaintiffs have stated in written discovery that they were diagnosed with Post-Traumatic Stress Disorder ("PTSD") as a result of the incident, as well as anxiety, depression, and insomnia.2 Others have indicated that they are unsure of whether they have been diagnosed with a condition.3 And the majority of the plaintiffs have indicated that they suffer from a pre-existing mental or physical condition.4

Defendant Royal Caribbean requested medical records from the plaintiffs in Requests for Production. The records were not produced because the plaintiffs do not have them. Defendant Royal Caribbean sent records subpoenas to the plaintiffs' out-of-state medical providers and Defendant Royal Caribbean represents that several of them have been rejected for failure to contain a signed HIPAA authorization. Defense counsel asked opposing counsel for HIPAA authorizations for each plaintiff, as he believes it is the most reasonable, convenient, judicially expeditious, and fair method to obtain records for the twenty-three plaintiffs. Plaintiffs' counsel refused.

At a January 6, 2017 discovery hearing, Plaintiffs' counsel argued that Defendant Royal Caribbean is not entitled to a court order requiring them to sign HIPAA authorizations and that Defendant Royal Caribbean should not be able to review them in any event without the plaintiffs having an advance opportunity to screen and selectively produce certain documents and records. In their post-hearing memorandum, though, the plaintiffs appear to have abandoned the "we-want-to-first-review-the-documents-before-they-are-sent-to-defense-counsel" position, as it is not mentioned at all. Nevertheless, the Court is not convinced by the argument and would not have adopted it.

Applicable Legal Principles and Analysis

All parties in both lawsuits agree that the plaintiffs have placed their physical and mental health at issue. But the plaintiffs in the Royal Caribbean lawsuit contend that they "have not brought every facet of their medical history from birth into question." [ECF No. 48, p. 2]. In addition, the plaintiffs challenge the efforts which Defendant Royal Caribbean has made, arguing that it attempted only four subpoenas and that the record does not reflect actual refusals from the healthcare providers themselves — only written notice from the process servers summarizing the position of the particular health care provider served with a subpoena.

All parties agree that there is no binding precedent in the Eleventh Circuit. In addition, the parties acknowledge that there is a split of authority across the country. See generally Cameron v. Supermedia, LLC, No. 4:15cv315-MW/CAS, 2016 WL 1572952, at *3 (N.D. Fla. Apr. 19, 2016) ("The law governing discovery of a plaintiff's medical records for purposes of emotional distress damages . . . is, frankly, all over the map"); see also Cupp v. United States, No. CV512-005, 2015 WL 510134, at *3 (S.D. Ga. Feb. 6, 2015) (noting no on-point ruling from the Eleventh Circuit but further noting that several district courts have recognized that a court has authority to require a plaintiff to sign HIPAA authorization form); cf. Chase v. Nova Se. Univ., Inc. No. 11-61290-CIV, 2012 WL 1936082, at *1 (S.D. Fla. May 29, 2012) (denying motion to compel execution of medical release forms, and explaining that "[t]his Court agrees with the courts that have ruled that they do not possess the authority to routinely require a plaintiff to execute a release for medical records") (citations omitted);5 Wymore v. Nail, No. 5:14-CV-3493 2016 WL 1452437, at *3 (W.D. La. Apr. 13, 2016) ("Rule 34, along with rule 37, empowers federal courts to copel parties to sign written authorizations consenting to the production of various document.s").

From the practical perspective, some courts have recognized that "federal courts have held that obtaining a party's written consent for the release of medical records `represents the least expensive and most efficient means of procuring information from medical or counseling providers.'" Equal Emp't Opportunity Comm'n v. Sheffield Fin. LLC, No. 1:06CV00889, 2007 WL 1726560, at *6 (M.D.N.C. June 13, 2007) (citation omitted). On the other hand, some courts are not persuaded by the efficiency argument. See e.g., Miller v. Kastelic, No. 12-cv-02677, 2015 WL 4431102, at *3 (D. Colo. Aug. 16, 2013) ("authorization for the release of medical records should not be routinely compelled, even when it may be the most efficient manner for such discovery").

To be sure, "[a] defendant is entitled to the production of medical records that have `a logical connection to the Plaintiff's claim of injuries.'" Cameron, 2016 WL 1572952, at *3 (citation omitted). But Federal Rule of Civil Procedure 346 "does not expressly authorize a court to order a party to sign a release concerning any kind of record." Enchon v. Sackett, 14-cv-03420, 2016 WL 1732708, at *1 (D. Col. May 2, 2016) (regarding analogous demand that party sign a Freedom of Information Act release). Nevertheless, some courts still rely on Rule 34 while others hold that it is insufficient to justify an order compelling a HIPAA authorization. Compare Doye v. Martin, No. CV408-174, 2010 WL 3463614, at *2 n.2 (S.D. Ga. Aug. 31, 2010) (compelling execution of medical release), with Klugel v. Clough, 252 F.R.D. 53, 54-55 (D.D.C. 2008) (finding that a Rule 34 request for production of documents cannot be used as a vehicle to compel a party to sign a medical records release).

Given the absence of controlling authority and the broad discretion afforded to trial courts in discovery matters, the Undersigned is persuaded by the approach used by the magistrate judge in Graham v. S Carroll, No. 5-10-cv-65, 2011 WL 855331, at *2 (N.D. Fla. Mar. 9, 2013).

In Graham, the plaintiff refused the defendants' request to sign a HIPAA release. While ruling on the defendants' motion to compel the execution of the HIPAA release, the Graham court acknowledged that the plaintiff placed his medical condition at issue by alleging he suffered injuries due to the defendants' actions — yet also emphasized that, "under HIPAA the filing of a lawsuit does not waive the confidentiality of health information, and unless the patient gives written consent the medical provider may only disclose confidential health information under the steps outlined in HIPAA." Id. According to Graham, the defendants could "obtain a court order which allows the health care provider to disclose `only the protected health information expressly authorized by such order.'" Id. (citing 45 C.F.R. 164.512(e)(1)(i)).7

Similar to Graham, the Cameron Court held that "[i]f a party refuses to sign a release for discoverable medical records, a requesting party must comply with the procedures set forth in [HIPAA] and implementing regulations. . . . A court order under that provision would issue from this Court. See Fed. R. Civ. P. 45(a)(2)." 2016 WL 1572952 at *6 n. 9 (emphasis added).

Under the HIPAA regulations, a health care provider is authorized to produce records in response to a subpoena accompanied by a court order. Therefore, the plaintiffs' healthcare providers in both lawsuits should produce records when served with a records subpoena accompanied by a court order. The parties are more familiar than the Undersigned with the specific medical and mental health issues involved in this case, so they are in the best position to craft the order under 45 C.F.R. 164.512(e)(1).

Once the Undersigned uploads an order in each case, then each defendant will be able to successfully serve a records subpoena on the health care providers. Because there will be a specific court order pinpointing the precise information to be produced, the health care provider should not refuse to produce records by saying a further HIPAA authorization signed by the plaintiff patient is required.8 Serving a records subpoena, the to-be-issued order and (if necessary) a copy this order on a healthcare provider should be more than sufficient to cause a provider to turn over the responsive medical records.

To provide the defendants with protection, the Undersigned is also ordering that consequences flow from any plaintiff-initiated narrowing of the medical and mental health issues surrounding the alleged damages. Specifically, the plaintiffs will not be able to use at trial (or for any other purpose in these lawsuits) any medical records or testimony, including expert testimony, unless the topic is included in the jointly submitted HIPAA order which the Court will be asked to sign. That way, the plaintiffs will not be tempted to adopt an unreasonably tight scope of the issues relating to the alleged injuries.

If Plaintiffs restrict the scope of the court order because they do not want certain medical records produced, then they will not be allowed to present records or documents concerning those specific topics. If, for example, the court order omits records relating to complaints about difficulty sleeping, then the plaintiffs would not be able to testify that they have difficulty sleeping.

If plaintiffs refuse to agree to an issue to be included in the court order and the issue is negative or likely negative to the plaintiffs' claims, then the defendants can revisit the issue with the Court and I will determine whether to expand the list of topics the absence of a signed HIPAA authorization because they will be receiving records from the providers through a HIPAA-authorized court order. in the HIPAA order. For purposes of illustration, assume that the defendants want the order to include medical records evidencing the plaintiffs' alcohol or substance abuse, but the plaintiffs refuse to agree (presumably because that sub-issue would adversely affect their damages claims and they might decide to not discuss it on their own at trial in any event). The ruling outlined above would, in the absence of any further action, generate an unfair advantage to the plaintiffs (because they would be barred from testifying about their substance abuse, a result which would hardly be detrimental to them).

To avoid this technically conceivable scenario, the Undersigned is permitting the defendants to raise with me the plaintiffs' refusal to include a topic, such as substance abuse, in the proposed agreed HIPAA order (so that I can amend the proposed order to include medical records about an abuse, even if the plaintiffs do not agree to it).

Conclusion

The plaintiffs in these two cases are not required to sign medical records authorization forms, but the parties will by January 30, 2017 jointly submit a proposed HIPAA order under 45 C.F.R. 164.512(e)(1) and the defendants will be able to obtain relevant medical records from the healthcare providers through that mechanism and will also have protection in case the plaintiffs are not reasonable about the scope of the order. If the defendants contend that the proposed order is unfairly limited, then they may raise the issue with me within five (5) days of the submission of the joint proposed order. Alternatively, they can allow the plaintiffs to restrict the issues and sub-issues without interposing an objection, knowing that the plaintiffs will not be able to introduce evidence on omitted issues and sub-issues.9

DONE AND ORDERED.