26 Fla. L. Weekly Supp. 874a

Online Reference: FLWSUPP 2611RUIZInsurance — Personal injury protection — Discovery — Trial court departed from essential requirements of law by requiring medical provider to disclose nonparty medical bills, insurance claim forms, and reimbursement information without requiring statutorily mandated notification to affected nonparties

CORAL GABLES CHIROPRACTIC P.L.L.C. a/a/o Bemilda Ruiz, Petitioner, v. UNITED AUTOMOBILE INSURANCE COMPANY, Respondent. Circuit Court, 11th Judicial Circuit (Appellate) in and for Miami-Dade County. Case No. 14-247 AP. L.T. Case No. 12-20187 SP 25. December 12, 2018. On Petition for Writ of Certiorari from the County Court in and for Miami-Dade County, Florida. Counsel: George A. David, for Petitioner. Michael J. Neimand, for Respondent.

(Before TRAWICK, ARZOLA, and GORDO, JJ)

(TRAWICK, J.) This matter came before this Court on a common law petition for writ of certiorari from a county court non-final discovery order. This Court, having reviewed the briefs of the parties, the applicable case law and the Florida Rules of Civil Procedure, finds that the lower court departed from the essential requirements of law. As a result, this petition must be granted for the reasons discussed below.

Statement of Facts

United Automobile Insurance Company (“United Auto”), the Respondent, issued an automotive insurance policy which covered Bemilda Ruiz (“Ruiz”). Ruiz was involved in an automobile accident on October 7, 2009 and sought treatment for injuries resulting from that accident. Ruiz assigned her Personal Injury Protection (“PIP”) benefits to Coral Gables Chiropractic P.L.L.C. (“CGC”), the Petitioner. CGC submitted an insurance claim to United Auto for the payment of PIP benefits on medical bills incurred by Ruiz. United Auto made a partial payment which it asserted was based on applying a $1,000 deductible, and paying only those benefits which were reasonable, necessary and related. GCG subsequently filed the underlying claim seeking to recover the unpaid balance which it asserts was due under the terms of the policy.

Upon the commencement of discovery, United Auto filed a request for the production of records related to the reasonableness of the medical bills. In this request, United Auto asked CGC to produce certain records for a 30 day period before and after the dates of service at issue in the claim, including: a) copies of any and all Health Insurance Claim 1500 Forms (HCFA 1500); b) Center for Medicare & Medicaid Services 1500 Forms (CMS 1500); c) Common Procedural Technology codes (CPT) used or billed; d) Uniform/Universal Billing 92 Forms (UB 92); e) International Classification of Diseases Codes, 9th and 10th Editions (ICD-9 and ICD-10); f) explanations of benefits. (E0Bs); g) any other statements issued to or from uninsured persons, PIP insurers, HMO patients, PPO patients, Medicare and Medicaid patients.¹, ² United Auto did indicate that certain information could be redacted to protect patient privacy. CGC objected to the disclosure of these records, asserting that the information requested 1) involved trade secrets, 2) was not likely to lead to admissible evidence, and 3) that it would be invasive to patient privacy. CGC also objected to the request as being overly burdensome, vague and ambiguous.

The trial court held a hearing on United Auto’s motion to compel regarding its request to produce which asked the court to overrule CGC’s objections. The court entered an order directing CGC to provide to United Auto all of the above referenced documents. As a result, CGC filed the subject petition seeking to have the trial court’s non-final discovery order quashed.

Analysis

Florida law provides that “[p]arties may obtain discovery regarding any matter, not privileged, that is relevant to the subject matter of the pending action, whether it relates to the claim or defense of the party seeking discovery or the claim or defense of any other party, including the existence, description, nature, custody, condition, and location of any books, documents, or other tangible things and the identity and location of persons having knowledge of any discoverable matter.” Fla. R. Civ. P. 1.280(b)(1). Rule 1.280(c) of the Florida Rules of Civil Procedure provides that the court may restrict or deny discovery “for good cause shown.” It is not enough to raise a mere conclusory assertion that the information sought to be discovered would be irrelevant. See Sabol v. Bennett, 672 So. 2d 93, 94 (Fla. 3d DCA 1996) [21 Fla. L. Weekly D978a]. Similarly, a reviewing court will not entertain, absent some other basis, “orders that deny ‘a party’s overbreadth or burdensomeness objections to discovery.’ ” Id. (Board of Trustees of the Internal Improvement Trust Fund v. American Educational Enterprises, 99 So.3d 450, 456 [37 Fla. L. Weekly S589a], quoting Katzman v. Rediron Fabrication, Inc., 76 So. 3d 1060, 1062 (Fla. 4th DCA 2011) [36 Fla. L. Weekly D2790a]).

A petition for certiorari is appropriate to review a discovery order when the “order departs from the essential requirements of law, causing material injury to a petitioner throughout the remainder of the proceedings below and effectively leaving no adequate remedy on appeal.” Allstate Ins. Co. v. Langston, 655 So. 2d 91, 94 (Fla.1995) [20 Fla. L. Weekly S217a] (citing Martin-Johnson, Inc. v. Savage, 509 So. 2d 1097, 1099 (Fla. 1987)). A trial court has wide discretion in addressing discovery disputes and a reviewing court will not ordinarily disturb that discretion. Abelson v. Bosem, 329 So. 2d 330 (Fla. 3d DCA 1976), cert. denied 341 So. 2d 289.

Article I, Section 23 of the Florida Constitution provides a well-established right to privacy on behalf of citizens of Florida. Section 456.057, Florida Statutes further provides statutory protection for medical records. §456.057(7)(a), Fla. Stat. (2018) (“Except as otherwise provided in this section and in §440.13(4)(c), such records may not be furnished to, and the medical condition of a patient may not be discussed with, any person other than the patient, the patient’s legal representative, or other health care practitioners and providers involved in the patient’s care or treatment, except upon written authorization from the patient …”).

The Code of Federal Regulations concerning the Health Insurance Portability and Accountability Act (HIPAA), states that a “designated record set” falling within the scope of HIPPA includes items such as medical records, medical billing, enrollment, payment, claims adjudication, and case or medical management record systems for a health plan, as well as records maintained to make decisions about individuals. 45 C.F.R. § 164.501. A designated record constitutes protected health information. 45 C.F.R. § 164.502(a) (“A covered entity . . . may not use or disclose protected health information, except as permitted or required by [these regulations].”); id. § 164.512 (enumerating exceptions).

Thus, the federal scheme provides an additional layer of patient privacy protection. In the event of a conflict between the medical privacy provisions of state law and more stringent provisions of federal law, the federal HIPAA law will supersede any contrary state law. 42 U.S.C. § 1320d-7(a)(1).

United Auto suggests that the requested records could be redacted to eliminate any identifying information that would link the records to any particular patient. Consequently, they maintain that the notice requirements of §456.057(7)(a) would not be triggered. However, redaction of records may not be used to make an “end run” around the Florida medical privacy statute’s notice requirements until there has been a proper showing of what efforts a party has made to obtain contact information and a list of the affected nonparties. Crowley v. Lamming, 66 So. 3d 355, 359 (Fla. 2d DCA 2011) [36 Fla. L. Weekly D1567a].

In fact, our analysis does not end there. Where discovery affects a large of a group of people, even with redaction of private details, discovery is not considered narrowly tailored for such a group if their identities could be compromised to some degree by their involvement in other litigation. The requesting party could piece together the redacted details with other readily available information. Graham v. Dacheikh, 991 So. 2d 932, 936-937 (Fla. 2d DCA 2008) [33 Fla. L. Weekly D2015a]. To further protect affected parties, “[i]n those cases where mere redaction of the medical records is deemed insufficient to protect the patients’ right of privacy, the trial court, in its discretion, may also order the medical records sealed and allow only the parties’ attorneys and medical experts to have access to the medical records.” Amente v. Newman, 653 So. 2d 1030, 1033 (Fla. 1995) [20 Fla. L. Weekly S172a]. See also USAA Casualty Insurance Co. v. Callery), 66 So. 3d 315 (Fla. 2d DCA 2011) [36 Fla. L. Weekly D1230a] (a court may in appropriate situations override the notice requirement “by providing adequate alternative means to protect other patients’ privacy rights when a party has made a showing that the court cannot comply with the statute under circumstances that justify disobeying the statute.”).

A review of the record in the hearing on United Auto’s motion to compel leads us to conclude that United Auto did not make the required showing of notice to affected parties under §456.057(7)(a). The records being requested here, even if redacted, may be amenable to having the missing information filled in using information that may be obtained through other sources. For example, one of the requested records is a CMS 1500. A blank copy of the form is attached to this opinion [Editor’s note: form omitted]. The forms ask for the patient’s name, date of birth, sex, the name of the policyholder, the patient’s address, the relationship between the patient and the policyholder, the policyholder’s address, the name of the insurer, the type of accident involved, the insurance policy number, and the policyholder’s date of birth. Arguably, much of this information could be redacted before a disclosure is made. However, the form goes on to ask for the date of injury (question 14); any dates the patient was unable to work (question 16); the diagnoses or nature of illness or injury (question 21); and the dates of service, the procedures that were performed, and what the charges for those procedures were (question 24). Considered as a whole, this CMS 1500 form, as well as an HCFA or UB-92 claim form (which each require a significant amount of information to be disclosed) constitute protected health information under Section 456.057, Florida Statutes as well as 45 C.F.R. §§ 164.501 and 164.502(a). These records are entitled to just as much protection as a patient’s medical report.³

Moreover, United Auto failed to show that the need for this discovery would override the privacy rights of the affected nonparties. National Sec. Fire & Cas. Co. v. Dunn, 705 So. 2d 605, 607-608 (Fla. 5th DCA 1997) [23 Fla. L. Weekly D27a] (quashing order granting discovery of other claims files in which bad faith had been asserted against insurer, as it improperly allowed accident victim access to nonparty medical records; order was issued in absence of showing need sufficient to overcome privacy rights of nonparties and without in camera inspection).

For these reasons, the trial court departed from the essential requirements of the law by requiring CGC to disclose medical bills, HCFA 1500 forms, CMS 1500 forms and UB 92 forms, reimbursement information, and claim forms as per question numbers 5-8 of United Auto’s Reasonableness Request to Produce. The trial court ordered the release of medical information and record portions (albeit redacted), that would impact a large group of individuals without the required statutory notification to the affected parties. This release without such notification would deprive affected nonparties a chance to raise objections alleging the violation of their privacy rights. See Coopersmith v. Perrine, 91 So. 3d 246 (Fla. 4th DCA 2012) [37 Fla. L. Weekly D1513a]. The record before us is devoid of the requisite justification that may provide a basis or exception to the nonparty notification.

Consequently, to protect against any intrusion into the privacy rights of nonparties, the petition for certiorari is GRANTED. That portion of the trial court’s order requiring Petitioner to produce information concerning nonparty medical information as outlined in the discovery order including but not limited to HCFA 1500 forms, CMS 1500 forms, UB 92 forms, ICD-9 and ICD-10 codes and CPT codes is hereby QUASHED. This matter is hereby REMANDED for further proceedings consistent with this opinion.⁴

__________________

¹While it is not clear how many nonparties billing or other medically related information would have been impacted by this request, it does appear that if the Petitioner had provided these records to the Respondent, a significant number of uninsured persons, PIP insurers or patients would have had information related to their own or others’ medical treatment disclosed.

²The full names for the codes and forms were only referenced in the record by their acronyms. This Court has taken judicial notice of the full names associated with these forms from government and provider references to the forms contained on the internet.

³It should be noted that United Auto offered no authority supporting its argument that a claim form is not a patient record and that it may be disclosed without prior written authorization from the patient.

⁴Given the findings in this opinion, we do not address the issues of the disclosure of trade secrets, overbreadth or burdensomeness of the requests, or that the requests are not calculated to lead to the discovery of admissible evidence. However, on remand, the trial court should address these issues if necessary and make appropriate findings.