OPINION OF THE COURT
Arlene P. Bluth, J.Plaintiff’s motion to compel defendant to provide full and complete responses to demand No. 5 of plaintiffs sixth demand for the production of documents is granted.
Background
This whistleblower action arises out of plaintiff’s termination from his job as a transplant coordinator for defendant. Plaintiff alleges that he was fired after making complaints that defendant’s employees were procuring organs from individuals without performing legally-required tests. Plaintiff further claims that in some instances, organs were taken from individuals who were still showing clear signs of life. Plaintiff claims that he was fired in violation of Labor Law § 740.
Defendant denies plaintiff’s allegations relating to the procurement of organs. Defendant claims that plaintiff was fired for poor performance in November 2011 while he was still a probationary employee.
*469In the instant motion, plaintiff seeks the production of medical records of four specific patients whom plaintiff alleges showed signs of life right before defendant procured these individuals’ organs. The parties attempted to resolve this issue at various court conferences. Defendant provided plaintiff with the last known address for the next of kin for all four individuals in order to allow plaintiff to secure consent to release the patients’ medical records. Plaintiff contends that he was unable to obtain consent from the next of kin despite his diligent efforts. Plaintiff now brings this motion to obtain the medical records from defendant.
Plaintiff argues that defendant is not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and, therefore, defendant should turn over the medical records of the four individuals. Plaintiff maintains that these records are material and necessary because plaintiff insists that each person showed signs of brain activity when their organs were harvested, a fact that he must prove in order to prevail on his asserted cause of action. Plaintiff also observes that even if defendant were a covered entity under HIPAA, it could still turn over records pursuant to the parties’ confidentiality agreement.
In opposition, defendant acknowledges that it is not a covered entity under HIPAA but that it must maintain patient confidentiality. Defendant also points out that it has entered into memorandums of understanding (MOUs) with hospitals in which defendant gains access to confidential patient information in order to facilitate the organ donor process. Defendant maintains that it would defeat the purpose of HIPAA if it were required to comply with plaintiff’s requests. Defendant argues that its status as a nonprofit organ procurement organization (OPO) would be at risk if it were required to turn over these records.
Discussion
“CPLR 3101 (a) entitles parties to full disclosure of all matter material and necessary in the prosecution or defense of an action, regardless of the burden of proof” (Andon v 302-304 Mott St. Assoc., 94 NY2d 740, 746 [2000] [internal quotation marks omitted])- “What constitutes material and necessary should be construed liberally to require disclosure of any facts bearing on the controversy which assist by sharpening the issues and reducing delay” (Polygram Holding, Inc. v Cafaro, 42 AD3d 339, 340-341 [1st Dept 2007] [internal quotation marks *470omitted]). “The test is one of usefulness and reason” (id. at 341). “A trial court is vested with broad discretion in its supervision of disclosure” (MSCI Inc. v Jacob, 120 AD3d 1072, 1075 [1st Dept 2014]).
In order to prevail on a claim under Labor Law § 740 (2) (a), a plaintiff must show that an employer took:
“retaliatory personnel action against an employee because such employee . . . discloses, or threatens to disclose to a supervisor or . . . public body an activity, policy or practice of the employer that is in violation of [the] law, rule or regulation which violation creates and presents a substantial and specific danger to the public health or safety.”
Labor Law § 740 (4) (c) provides that “[i]t shall be a defense to any action brought pursuant to this section that the personnel action was predicated upon grounds other than the employee’s exercise of any rights protected by this section.”
As an initial matter, contrary to defendant’s claims, the discovery requested is not “needless.” The medical records of these four individuals is material and necessary because plaintiff asserts that these patients exhibited signs of life or were improperly determined to be brain-dead when their organs were harvested. Plaintiff insists that these records would help prove a violation of law, a requirement in order to prevail in this case. Therefore, the requested information is discoverable.
HIPAA’s Privacy Protections
“Congress enacted HIPAA principally to increase the portability and continuity of health insurance and to simplify administrative procedures so as to reduce health care costs” (Arons v Jutkowitz, 9 NY3d 393, 411 [2007]). “HIPAA mandated national standards for electronic medical data management” and “authorized the Secretary of the United States Department of Health and Human Services (HHS) to promulgate standards governing disclosure of patient health information in the event Congress did not pass privacy legislation” (id. at 412).
When Congress failed to pass legislation,
“HHS proposed and subsequently adopted a Privacy Rule (see 45 CFR parts 160, 164). When devising the Privacy Rule, HHS sought to strike a balance that permits important uses of information, while protecting the privacy of people who seek care and healing; and to fashion a scheme sufficiently flex*471ible and comprehensive to cover the variety of uses and disclosures that need to be addressed” (id. [internal quotations and citations omitted]).
HIPAA provides that “[e]xcept as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section” (45 CFR 164.508 [a] [1]). Health plans, health care clearinghouses and certain health care providers are identified as “covered entities” under HIPAA (45 CFR 160.103). “A covered entity may use or disclose protected health information to organ procurement organizations” (45 CFR 164.512 [h]). A covered entity may also disclose health information protected under HIPAA in a judicial proceeding (45 CFR 164.512 [e]).
The instant motion appears to raise an issue of first impression—whether an OPO that is not covered by HIPAA must produce medical records it obtained from a covered entity because this information is required in order to run its organization. The reason that defendant receives medical records is that it needs the information to process organ donations. Defendant must know certain information about a donor’s medical history in order to ensure that a donation is successful.
However, defendant is not a covered entity and, therefore, must turn over the requested information. Defendant failed to identify a federal regulation or case law that would prevent this court from requiring disclosure. Defendant cites Liew v New York Univ. Med. Ctr. (55 AD3d 566 [2d Dept 2008]) in support of its argument that it need not produce the requested medical records. That case, however, is inapposite because in Liew, the defendant, a hospital, sought to compel third-party defendant St. Luke’s Hospital to produce medical records of a nonparty organ donor. The Supreme Court’s opinion in Liew, which the Second Department affirmed without modification, noted that the “HIPAA Privacy Rule protects the confidentiality of these records” (Liew v New York Univ. Med. Ctr., 2007 WL 6122885 [Sup Ct, Queens County, May 29, 2007, Nos. 10449/04, 350400/05]). This suggests that, although not mentioned in the Appellate Division’s decision, St. Luke’s Hospital was a covered entity under HIPAA. Because defendant is not a covered entity, this case is not binding based on the facts of this case.
Further, other courts have found that where a party is not a covered entity, HIPAA does not prevent the disclosure of docu*472ments (see Miller v Allstate Fire & Cas. Ins. Co., 73 Fed R Serv 3d 394, 2009 WL 700142, 2009 US Dist LEXIS 21225 [WD Pa, Mar. 17, 2009]; Aubain v Kazi Foods of the VI Inc., 2013 WL 3155804, 2013 VI LEXIS 40 [Super Ct, VI, June 14, 2013, Case No. ST-12-CV-461]; see also Landerman v Tarpon Operating and Dev., LLC, 2014 WL 6332824, 2014 US Dist LEXIS 158397 [ED La, Nov. 10, 2014, Civil Action No. 14-381]).
Certainly, HHS is aware that OPOs receive protected health information from covered entities subject to HIPAA—HHS has promulgated regulations allowing covered entities to disclose information to OPOs (see 45 CFR 164.512 [h]). HHS could have promulgated a rule stating that any protected health information received by an OPO from a covered entity must remain subject to HIPAA’s privacy protections as if the OPO were a covered entity. Or HHS could have included OPOs in its definition of a covered entity. These suggested rules would fulfill the stated purpose of HIPAA to protect patient information and would codify the best practices of OPOs, including defendant, regarding the confidentiality of protected health information (see Lucas aff, exhibit B).
However, if this court were to deny plaintiffs motion based on HIPAA, then it would be, in effect, promulgating a new federal rule. This court is not the proper forum to enact this type of change especially where HHS has addressed OPOs in other HIPAA regulations.
For similar reasons, the MOUs between defendant and certain hospitals do not compel this court to deny plaintiff’s motion. These MOUs serve to assure the covered entities who provide information to defendant that protected health information will be kept confidential (see Lucas aff, exhibit B at 4-5). They do not prevent plaintiff from accessing relevant information. Providing this information might negatively impact these MOUs. But that possibility merely underscores the need for additional federal regulations clarifying OPO’s relationship with HIPAA.
Confidentiality
The parties’ confidentiality order (NY St Cts Elec Filing Doc No. 13) prohibits plaintiff from using these medical records for any other purpose than this litigation and requires the return or destruction of information after the termination of the litigation. These provisions would satisfy the criteria for a qualified protective order required for disclosures in judicial proceed*473ings in the event that defendant were a covered entity under HIPAA (see 45 CFR 164.512 [e] [1] [v]).*
Accordingly, it is hereby ordered that plaintiff’s motion is granted and defendant must produce the requested medical records of the four individuals in accordance with the parties’ confidentiality order on or before April 26, 2017.
The court observes that a covered entity may make a disclosure in judicial proceedings but it is not necessarily required to disclose such information (45 CFR 164.512 [e]).