In a recent Missouri Supreme Court opinion, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule was found to prohibit ex parte discussions between attorneys for defendants (hospital and treating physician) and other nonparty medical providers in a medical malpractice case, notwithstanding a lower state court's order previously allowing such communications to occur. The Missouri Supreme Court held that while HIPAA generally permits disclosure of protected health information (PHI) in judicial or administrative proceedings, an informal disclosure of PHI by a nonparty covered entity (provider) to attorneys for defendants, ordered to occur outside of formal discovery channels (e.g., depositions, interrogatories, etc.), is not a sufficient "judicial proceeding" contemplated under HIPAA because (1) both plaintiff and defendant parties would not be present to object to any specific disclosures, and (2) the trial court would have no oversight or control over the disclosures.
In narrowly construing the HIPAA exception for disclosures in judicial or administrative proceedings, the court focused on Missouri state law which, while not expressly prohibiting informal ex parte disclosures, nevertheless could not compel such disclosures of PHI to defense counsel without a patient's authorization. Further, the court found under Missouri law, the informal ex parte meetings would not be considered judicial proceedings, and that the same information could be obtained through the state's formal discovery rules. Because neither HIPAA nor state law expressly authorized such disclosures without the patient's authorization, the Missouri Supreme Court held that the lower court's ruling allowing such disclosures was incorrect and exceeded its authority. The Missouri Supreme Court declined to address the specific issue of HIPAA federal preemption as unnecessary in the case.
Injured patients bringing suit for state medical malpractice claims and defendant providers may take note of this decision for its narrow interpretation of the HIPAA Privacy Rule provision authorizing disclosures of PHI without a patient's authorization in judicial and administrative proceedings. Sate ex rel. Proctor v. Messina, No. SC90610, 2010 Mo. LEXIS 199 (August 31, 2010).