OPINION OF THE COURT
Santucci, J.P.This appeal arises out of a dispute concerning the extent of disclosure required by a hospital in a civil lawsuit which stems from a physical attack upon one of its patients by an intruder. To determine this issue we are called upon to examine the scope of the disclosure exemption created by the interplay of two statutes: Public Heath Law § 2805-Z and Education Law § 6527 (3). The former requires hospitals to report to the Department of Health the death of or injury to a patient other than that related to his or her illness, while the latter provides that neither any “quality assurance review” record nor any reports which are required to be filed under Public Health Law § 2805-Z shall be subject to disclosure under CPLR article 31. The defendant Brooklyn Hospital Center (hereinafter the Hospital) moved for a protective order contending that the interplay of these statutes prohibits it from disclosing the material demanded by the plaintiff. In opposition, the plaintiff argues that the material sought relates only to the Hospital’s security function and, therefore, is not exempt from disclosure. Based upon its interpretation of the above statutes, the Supreme Court, inter alia, granted the Hospital’s motion for a protective order.
Factual Background
On January 10, 2002, the plaintiff, Catiuska Marte (hereinafter the plaintiff), was a patient in a room in a ward on the fourth floor of the Caledonian campus of the Hospital when the third-party defendant, Ferdinand Santiago, entered the room through an open door and attempted to sexually assault her. The plaintiff, alleging that Santiago was an intruder upon the Hospital’s premises and that the Hospital provided negligent security by allowing him to remain in a patient ward after visiting *43hours had concluded, commenced this action against the Hospital which, in turn, filed a third-party complaint against Santiago.
Following commencement of the action, the plaintiff served a notice for discovery and inspection listing various demands. In response, the Hospital objected to the following demands, asserting, inter alia, that the items were protected by a statutory privilege “pursuant to Education Law § 6527 (3) and Public Health Law § 2805-Z for quality assurance by hospitals”:
“3. . . . copies of any and all reports or memoranda made of the aforementioned occurrence, in the normal course of business . . .
“5. Names, addresses, captions and index numbers, of . . . legal proceedings concerning and/or alleging the negligence of the defendants regarding security of the premises . . . for a period of three years prior to January 10, 2002.
“6. Incident reports and records of rape, attempted rape, sexual assault . . . and other crimes which took place at [the premises] for a period of three years prior to January 10, 2002.
“7. Records of complaints received by visitors concerning security of the premises for a period of 3 years prior to January 10, 2002.
“8. Internal directives, memoranda, orders and the like concerning security measures for the premises . . . for a period of three years prior to January 10, 2002.
“9. Copies of the Brooklyn Hospital Center’s internal investigation, including but not limited to incident reports, photos, interviews, and other records of the incident and assault made in the regular course of business involving Catiuska Marte which took place on January 10, 2002.
“10. Statements, tapes, recordings, and records of any type of Catiuska Marte . . .
“12. Names and addresses of witnesses to the incident including but not limited to patients at the ward, visitors, volunteers and/or employees. For em*44ployees no longer employed, copies of their last known addresses . . .
“15. Records and logs of visitors to the Caledonian campus of Brooklyn hospital center including but not limited to such relating to visitors to the wards and to the fourth floor of the Caledonian campus of Brooklyn hospital center designated as 4C on the date in question.”
To the extent that these demands sought disclosure of medical records of “other patients and visitors,” the Hospital argued that under Public Health Law § 18 and CPLR 4504, it was prohibited from revealing such information absent authorization from the individuals involved.
By order to show cause dated November 14, 2002, the Hospital moved for a protective order with respect to the demands numbered 3, 5-10, 12, and 15. By order dated April 30, 2002, the Supreme Court granted the Hospital’s motion, reasoning in part as follows:
“It is apparent that the Education Law § 6527 (3) exempts three categories of documents from disclosure: records relating to medical review and quality assurance functions; records reflecting participation in a medical and dental malpractice prevention program; and reports required by the Department of Health pursuant to Public Health Law § 2805-l, including incident reports prepared pursuant to Mental Hygiene Law § 29.29. See Katherine F. v State of New York, 94 NY2d 200.
“The Court of Appeals defined incident reports as ‘reports of accidents and injuries affecting patient health and welfare’. See Katherine F. supra. . . . [T]he reports of the attempted assault herein and the related material fall within the above category.”
The court did not address the Hospital’s claims of privilege under Public Health Law § 18 (6) and CPLR 4504.
On appeal, the plaintiff argues that the Education Law privilege against disclosure is limited only to material generated for a peer review or quality assurance purpose aimed at reducing incidents of malpractice, and that the court improperly expanded the scope of the privilege to include material which deals solely with a hospital’s security functions.
*45Discussion
Education Law § 6527 (3) pertains to the practice of medicine. The statute covers the liability of individuals who serve on medical review committees, such as committees formed for the prevention of medical malpractice under Public Health Law § 2805-j, and persons who participate in the preparation of incident reports required by the Department of Health under Public Health Law § 2805-l (see Education Law § 6527 [3] [d], [e]). The section states:
“[n] either the proceedings nor the records relating to performance of a medical or a quality assurance review function or participation in a medical and dental malpractice prevention program nor any report required by the department of health pursuant to [Public Health Law § 2805-l] . . . including the investigation of an incident reported pursuant to [Mental Hygiene Law § 29.29], shall be subject to disclosure under [CPLR article 31] except as hereinafter provided or as provided by any other provision of law.” (Education Law § 6527 [3].)
Public Health Law § 2805 pertains to hospitals. Section 2805-l requires hospitals to report certain incidents to the Department of Health. Among the “reportable” incidents set forth are the following:
“2. . .. (a) patients’ deaths or impairments of bodily functions in circumstances other than those related to the natural course of illness, disease or proper treatment . . . ;
“(b) fires in the hospital which disrupt the provision of patient care services or cause harm to patients or staff;
“(c) equipment malfunction during treatment or diagnosis of a patient which did or could have adversely affected a patient or hospital personnel;
“(d) poisoning occurring within the hospital;
“(e) strikes by hospital staff;
“(f) disasters or other emergency situations external to the hospital environment which affect hospital operations.”
In our opinion, the language of Public Health Law § 2805-l, when examined as a whole, including the expansive list of *46“reportable” incidents set forth therein, leads to the conclusion that the Hospital would be required to report the assault of the plaintiff “as an impairment to the patient’s bodily functions in circumstances other than those related to the natural course of [her] illness.” In this regard, we note that in the Department of Health Notice of Adoption found in the New York State Register (vol. VII, issue 39, at 17 [Sept. 25, 1985]), the stated legislative objective behind the Public Health Law requirement that hospitals report incidents affecting patient welfare was “to assure quality care to all patients in hospitals” by requiring the “timely reporting of emergencies and other incidents that threaten the safety of the patients or staff in a hospital.” It was further noted that such legislation was necessary since “[o]n numerous occasions, the [Department of Health’s Office of Health Systems Management] ha[d] learned of emergencies or other situations that threaten the safety and well-being of the patients or the staff in hospitals, well after the emergency or incident has occurred, or through the news media.” Certainly, an alleged assault upon a patient is one of these “other situations” which threatens the safety of patients and staff, and would therefore be required to be reported.
In the case of Katherine F. v State of New York (94 NY2d 200, 205 [1999]), the Court of Appeals recognized that Education Law § 6527 (3), by incorporating Public Health Law § 2805-l, “require[s] hospitals to report incidents that extend well beyond medical care and treatment.” Therefore, the Hospital was required to investigate and report the assault of the plaintiff to the Department of Health under Public Health Law § 2805-l.
However, the fact that the Hospital was required to report the incident does not necessarily mean that it did so, or that all the documents sought by the plaintiff are exempt from disclosure. It is the burden of the entity seeking to invoke the privilege to establish that the documents sought were prepared in accordance with the relevant statutes (see Orner v Mount Sinai Hosp., 305 AD2d 307 [2003]; Crawford v Lahiri, 250 AD2d 722 [1998]; Van Caloen v Poglinco, 214 AD2d 555 [1995]). A review of the affirmation in support of the Hospital’s motion for a protective order and the attached documents does not reveal any statement by the Hospital that it actually prepared any committee review incident reports for the Department of Health as required under Public Health Law § 2805-l. The Hospital thus failed to establish its burden that any documents were prepared under Public Health Law § 2805-l and/or Education Law *47§ 6527 (3). Moreover, some of the documents demanded are not the type that would be subject to the privilege, such as records of complaints made by visitors, and the production of visitor logs. Accordingly, the Hospital is not entitled to a blanket protective order with respect to the demands set forth above.
On the other hand, the plaintiff was not entitled to all the documents requested in her discovery demands. Many of the demands are overbroad and seek records pertaining to a campus of the Hospital which is not the subject of this litigation. In addition, in her brief on appeal, the plaintiff has significantly circumscribed the scope of numerous demands. In particular, the plaintiff limits demand number 8 to rules, regulations, and procedures concerning security measures that were in place at the time of the incident, rather than the original broad request for internal directives, memoranda, and orders for both campuses of the Hospital for a three-year period preceding the incident. Furthermore, the plaintiff now asserts that demand number 10 for “[statements, tapes, recordings, and records of any type of [the plaintiff]” merely seeks her own statement under CPLR 3101 (e). This is duplicative of demand number 1, which has not been challenged by the Hospital. In addition, in demand number 15, the plaintiff originally sought records and logs of visitors to the Hospital’s Caledonian campus on the date of the incident, including the fourth floor ward, but now asserts that the purpose of this demand is to establish the movements of the assailant. Clearly, the document demand can be limited to fulfill that purpose.
Furthermore, some of the demanded documents may, in fact, be subject to privileges under Public Health Law § 2805-Z and Education Law § 6527 (3) and/or under Public Health Law § 18 (6), which prevents disclosure of third-party health records without authorization, and/or CPLR 4504, the physician/patient privilege, and/or the federal Health Insurance Portability and Accountability Act of 1996 (hereinafter HIPAA), colloquially known as the Patient Privacy Act. For example, if the revelation of a patient’s location in a hospital would, by simple deduction, also reveal that patient’s medical status, such discovery would run afoul of CPLR 4504 and the intent behind HIPAA (see Gunn v Sound Shore Med. Ctr. of Westchester, 5 AD3d 435 [2004]).
Therefore, upon remand, the Supreme Court, in the exercise of its discretion, should limit the scope of discovery as it deems proper. If the Hospital can establish that it conducted a review process in accordance with Public Health Law § 2805-l, then the *48Supreme Court should conduct an in camera review of the documents for which the Hospital asserts a privilege under Education Law § 6527 (3) and Public Health Law § 2805-l, as well as CPLR 4504 and Public Health Law § 18 (6).
A recent decision by the Court of Appeals entitled Matter of Subpoena Duces Tecum to Doe (99 NY2d 434 [2003]) provides guidance regarding which records utilized by a hospital quality assurance committee would be privileged and which would be subject to disclosure. Records generated at the behest of a quality assurance committee for quality assurance purposes, including compilations, studies or comparisons derived from multiple records, should be privileged, whereas records simply duplicated by the committee are not necessarily privileged. The Court of Appeals also stated:
“We recommend that a party seeking to protect documents from disclosure compile a privilege log in order to aid the court in its assessment of a privilege claim and enable it to undertake in camera review. The log should specify the nature of the contents of the documents, who prepared the records and the basis for the claimed privilege.” (Matter of Subpoena Duces Tecum to Doe, supra at 442.)
Accordingly, we reverse the order insofar as appealed from, on the law and in the exercise of discretion, deny the defendant’s motion, and remit the matter to the Supreme Court, Kings County, for further proceedings consistent herewith.
Krausman, Schmidt and Rivera, JJ., concur.
Ordered that the order is reversed insofar as appealed from, on the law and as a matter of discretion, with costs, the motion is denied, and the matter is remitted to the Supreme Court, Kings County, for further proceedings consistent herewith.