OPINION OF THE COURT
Joel K. Asarch, J.*839The defendant, Lumbermans Mutual Insurance Company, moves pursuant to CPLR 3103 (a) for a protective order denying the plaintiff disclosure of the contents of the defendant’s entire no-fault file with respect to its assignor. The defendant contends that it has provided the plaintiff with NF-10s, payment letters and bills, “both the bills at issue in this lawsuit, and for those services defendant believes to represent overlapping and concurrent care, which was the basis for denial” (affirmation of Steven D. Rhodes, Esq., dated Oct. 31, 2003 [emphasis supplied]). The defendant objects to the plaintiff being able to review the entire contents of its no-fault claims file. The plaintiff, on the other hand, relying in part on prior decisions issued by this court, contends that a review of the entire no-fault file will aid in the prosecution of the action and will permit it to discover those documents that led to the denial of the claim.
In this no-fault action, the plaintiff (a health service provider) seeks a judgment for health services allegedly rendered to Elaine McKeithan (the assignor) as a result of an automobile accident occurring on July 14, 2000. The defendant provided no-fault insurance benefits to Ms. McKeithan at the time of the accident under a policy of insurance. The plaintiff is seeking recovery of no-fault benefits from the defendant insurer in the sum of $2,950.36, together with statutory interest and attorney’s fees, due to medical services provided to the plaintiffs assignor.
This action was commenced on or about March 14, 2002 by service of a summons and complaint upon the defendant. The defendant answered the complaint on or about April 23, 2002, denying the central allegations in the complaint and raising several affirmative defenses. The court notes that the basis for the denial of claim was that the “fees [were] not in accordance with fee schedules” and that “concurrent care involves overlapping/ excessive and/or common services.”
This court stated in Ostia Med., P.C. v Government Empls. Ins. Co. (1 Misc 3d 907[A], 2003 NY Slip Op 51560[U] [Nassau County Dist Ct 2003]):
“A protective order is designed to guard against disclosure abuses. CPLR 3103(a) states, in relevant part, that:
“ ‘ . . . The Court may at any time on its own initiative, or on motion of any party or of any person from whom discovery is sought, make a protective order denying, limiting, conditioning or regulating the use of any disclosure device. Such order shall be *840designed to prevent unreasonable annoyance, expense, embarrassment, disadvantage, or other prejudice to any person or the courts.’
“Thus, pursuant to the CPLR and UDCA, a protective order may be used, no matter what disclosure device is implicated . . .
“The Court can regulate discovery, pursuant to a protective order, by directing the time, order, place and questions to be asked in an EBT, or dictating the disclosure devices to be used or combination thereof, and even by defraying the costs of a party’s participation in the disclosure (see, Church [&] Dwight Co. Inc. v [UDDO] & Associates, Inc., 159 A.D.2d 275, 552 N.Y.S.2d 277 [1st Dept 1990]; Weeks Office Products, Inc. v Chemical Bank, 178 A.D.2d 113, 577 N.Y.S.2d 10 [1st Dept 1991]).
“Moreover, the Court has broad discretion in limiting or regulating the use of disclosure devices (see, Brignola v Pe[i]-Fei Lee, M.D).[,] P.C., 192 A.D.2d 1008, 597 N.Y.S.2d 250 [3d Dept 1993]).”
The arguments raised by the defendant concerning the purported immateriality and irrelevancy of the materials contained in the defendant’s no-fault file have been addressed by this court in CPT Med. Servs., P.C. v Allstate Ins. Co. (NYLJ, July 1, 2003, at 20, col 3). For the reasons stated in that decision, the court rejects this argument of the defendant and need not repeat itself here. (See also Hudson Med. v Allstate Ins. Co., 183 Misc 2d 749 [App Term, 2d Dept 1999].)
However, the defendant has now raised a further argument concerning the release of the entire no-fault file — that to do so would violate the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 USC § 1320d; 45 CFR parts 160, 164).
“The modern-day legislative trend is to protect a medical patient’s privacy. Under HIPAA, ‘protected health information’ is broadly defined as any individually-identifiable health information which was created by, among others, a health care provider, and which relates to, inter alia, the past, present, or future physical or mental health or condition of an individual. HIPAA and its supporting regulations, inter alia, established standards and procedures for the collection and disclosure of protected health information to prevent its wrongful disclosure” (Gunn *841v Sound Shore Med. Ctr. of Westchester, 5 AD3d 435, 437 [2d Dept 2004] [citations omitted]).
“HIPAA provides that a party deemed to be a ‘covered entity’ may not use or disclose protected health information except for in treatment, or for payment or health care operations of the individual patient, or to the individual patient, without receiving a proper authorization. A ‘covered entity’ is defined as (1) a health plan, (2) a health care clearinghouse, or (3) a health care provider who transmits any health information in electronic form, as prescribed by the regulation” (Lewis v Clement, 1 Misc 3d 464, 466 [Sup Ct, Monroe County 2003]).
“Except as otherwise provided herein, the standards, requirements, and implementation specifications of this subpart apply to covered entities with respect to protected health information” (45 CFR 164.500 [a]).
The plaintiff argues that the defendant is not a “covered entity” under HIPAA in that automobile medical payment insurance is an excepted benefit (see 42 USC § 300gg-91 [c] [1] [E]), and hence not subject to the requirements of HIPAA. This court respectfully disagrees. The defendant is a “health plan” as defined under 45 CFR 160.103 in that it is “an individual or group plan that provides, or pays the cost of, medical care,” which is defined elsewhere as amounts paid for “the diagnosis, cure, mitigation, treatment, or prevention of disease, or amounts paid for the purpose of affecting any structure or function of the body” (42 USC § 300gg-91 [a] [2] [A]). The New York State Insurance Department, in an opinion letter dated July 8, 2003, indicated that “[a]n insurer that offers health insurance, in addition to either Workers’ Compensation or No-Fault insurance, would, unless it opts to be a hybrid entity, 45 C.F.R. § 164.103 (2003), be a covered entity.” Thus, the court finds Lumbermans Mutual Insurance Company, a member of the Kemper Insurance Companies and Unitrin, Inc., to be a covered entity. As a result, the release of protected health information must be limited “to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request” (45 CFR 164.502 [b] [1]). While the provider may (and, in fact, must if it wants payment under no-fault) transmit protected health information (see, e.g. 11 NYCRR 65.12), the defendant is more restricted with its disclosure under HIPAA. The form NF-2 does not permit a blanket release of medical information, either to the plaintiff or otherwise.
*842It is apparent to this court that there are two competing principles at work here. On the one hand, a claimant has the right under HIPAA to avoid unnecessary disclosure of his or her protected medical information and condition. To permit the release of medical information on conditions completely unrelated to the no-fault treatment by a provider without the express authorization of the claimant would fly directly in the face of HIPAA. On the other hand, to permit the defendant to be the gatekeeper of all medical information and to permit its release only after further proceedings before an already taxed court would run afoul of the full disclosure premises of CPLR article 31. This is not a situation where a health care provider is receiving protected health information in order to treat the claimant. Rather, the information is being sought to be used by the plaintiffs attorneys in order to secure payment.
Thus, it is the holding of this court that if the plaintiff presents a valid authorization complying with the HIPAA regulations, to wit, 45 CFR 164.508 (a) (1), the plaintiff is entitled to review the defendant’s no-fault claims file, subject to privileged and protected material as specified in the Ostia and OPT decisions (supra). It is clear to this court that a claimant must be made aware that his or her medical information will be revealed to the plaintiff — something a claimant may or may not want. The core elements of a valid authorization contain the information to be disclosed, the name of the recipient, a description of “each purpose of the requested use or disclosure” and an expiration date, together with statements concerning the signer’s right to revoke the authorization et al. (45 CFR 164.508 [c].) The mere submission of an NF-2 is insufficient to comply with HIPAA. (See 45 CFR 164.508 [a] [1].) The privacy rights of the patient need to be preserved under HIPAA.
However, as the claimant is seeking third-party payment for services rendered, a more limited assignment signed by the claimant will permit the medical provider to obtain from the defendant those items directly bearing on the services rendered and any denial issued. It is clear that by seeking payment of the medical costs, the claimant has placed her condition in controversy with respect to those services rendered by the provider and for which payment is sought (CPLR 3121 [a]). The plaintiff has attached to its complaint an opinion letter by the New York Insurance Department, dated May 11, 1998. The letter reads, in relevant part,
“based on the foregoing definition, as long as the *843two providers are performing two different and distinct treatments it should not be classified as concurrent care. If the insurer and medical provider disagree on what should be classified as concurrent care, and a denial is then issued, the dispute may be brought before an arbitrator or court of competent jurisdiction for final resolution.” (See also Universal Acupuncture Pain Servs. v Lumbermens Mut. Cas. Co., 195 Misc 2d 352 [Civ Ct, Queens County 2003].)
Thus, in the present case, the motion of the defendant is granted in part. As the assignment does not constitute a valid authorization under HIPAA,* the plaintiff is entitled to disclosure of all documents and materials specifically concerning the alleged concurrent treatment only. This case does not involve medical necessity of treatment — rather, concurrent care. The plaintiff is entitled to those documents in this case which concern the issue of concurrent care, whether relied upon by other providers or in peer reviews. Within 30 days of the date of this order, the defendant shall provide the plaintiff, if not already provided, with copies of all documents, independent medical examinations, bills et al. which concern treatment to the claimant’s right shoulder, lower back, cervical or lumbar spine or neck. Such therapies shall include massage, ultrasound, mechanical traction, electric stimulation, hot and cold packs and therapeutic exercises and activities performed by any provider. If the defendant fails to turn over any such documents or materials, it shall be precluded from offering such materials and items at trial, whether through direct use or through the *844testimony of an expert witness who has reviewed such documents in the formulation of his or her opinion.
Based on the foregoing, this court declines in this case to permit the disclosure of protected health information of the entire no-fault file. (See 45 CFR 164.512 [e].)
The assignment reads, in relevant part, that “I hereby instruct and direct the_Insurance Company to pay by check made out to . . . mailed directly to . . . or if my current policy prohibits direct payment to doctor, then I hereby also instruct and direct you to make out the check to me and mail it as follows . . . For professional or medical expense benefits allowable and otherwise payable to me under my current insurance policy as payment toward the total charges for professional services rendered. THIS IS A DIRECT ASSIGNMENT OF MY RIGHTS AND BENEFITS UNDER THE POLICY ... I also authorize the release of any information pertinent to my case to any insurance company, adjuster, or attorney involved in this claim.” Further, the application for no-fault benefits provides that “This authorization or photocopy hereof will authorize you to furnish all information you may have regarding my condition while under your observation or treatment, including the history obtained, X-ray and physical findings, diagnosis and prognosis. You are authorized to provide this information in accordance with the NEW YORK COMPREHENSIVE AUTOMOBILE REPARATIONS ACT (NO-FAULT LAW).” Neither statement complies with 45 CFR 164.508 (c).