After the death of their mother, Destinie Harris and David Mitchell, as the next of kin, and Harris, as the administratrix of the estate (collectively, “plaintiffs”), filed a medical malpractice suit against the following defendants: Tenet Healthsystem Spalding, Inc. d/b/a Spalding Regional Medical Center; Griffin Clinic; South Atlanta Lung and Sleep Clinic, Inc.; Sanjeeva Rao, M.D.; Appaswamy Gowda, M.D., P.C.; Hari G. Madichetty, M.D., P.C.; and HariMadichetty, M.D. (collectively, “defendants”). To aid in their discovery, the defendants filed a joint motion for a qualified protective order under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), requesting that they be permitted to conduct ex parte interviews with the health care providers who treated the decedent, Mary Mitchell. After oral argument, the trial court granted the defendants’ motion. We now review this matter on an interlocutory basis to evaluate the following enumerations of error asserted by the plaintiffs: (1) that the trial court’s qualified protective order is overly broad; (2) that the trial court’s qualified protective order fails to adequately protect plaintiff’s right to access and amend personal health information; and, (3) that the trial court erred in granting defendant’s motion for a qualified protective order because the defendants did not make a showing of good cause as required by OCGA § 9-11-26 (c). Because we find that the trial court did not abuse its discretion, we affirm.
Factual Background
The plaintiffs’ complaint contains the following relevant allegations. On February 1, 2009, Mary became nauseated and began to vomit what appeared to be blood. On February 2, 2009, she was taken by ambulance to Spalding Regional Medical Center (“Spalding”) suffering symptoms of a gastrointestinal bleed, chest pain, and back pain. Mary was admitted into Spalding’s emergency room, and a single-view chest x-ray was ordered and performed. During the first three days of her stay at Spalding, the radiologist reviewing Mary’s case advised her attending physician on several occasions to perform a two-view x-ray or a CT scan. However, a two-view x-ray was not performed until February 7, 2009, which showed that her condition was worsening. Based on these results, the radiologist recommended a CT scan and other tests on February 7, 2009. No CT scan was ordered until February 12, 2009, which revealed that the decedent had a possible perforation of her esophagus.
On February 13, 2009, Mary was transferred to Emory Crawford Long Hospital in Atlanta (“Emory”), where it was discovered that she *895had a perforated esophagus and a paraesophageal hernia, necessitating the excision of her esophagus and resection of her stomach. While at Emory, she was treated for an array of conditions, including streptoccocal septicemia, acute respiratory failure, severe sepsis, septic shock, abscess of the mediastinum, acute renal failure, empyema, pleural effusions, asthma, hypertension, cardiomegaly, hypotension, anemia, steroid-induced hyperglycemia, various infections including klebsiella and MRS A, hypopotassemia, hypocalcaemia, hemoptysis, and dysthymia. Mary also received treatment and medications for depression and anxiety. Mary was released from the hospital, but returned to Emory on September 11, 2009, for reconstructive surgery. She remained a patient there until her death on May 13, 2010.
After their mother’s death, the plaintiffs filed the present complaint against the defendants alleging that during the decedent’s stay at Spalding that the defendants were negligent in failing to order or fully perform necessary imaging and diagnostic tests, and in failing to diagnose the decedent’s medical conditions, with the result that they did not recognize her worsening condition. The plaintiffs also contend that Spalding deviated from the standard of care when treating decedent.
During discovery, the plaintiffs consented to the release of the decedent’s medical records in paper and electronic format. The defendants filed a joint motion for a qualified protective order. After a hearing, the trial court granted the motion, authorizing the defendants to engage in ex parte communications with named health care providers for the limited purpose of discussing “the medical condition^) [pjlaintiffs have placed in issue in this civil proceeding.” The trial court’s order narrowed the scope of the defendants’ right to conduct ex parte communications by imposing the following limitations on the ex parte communications: (1) by providing an exclusive list of the health care providers who are authorized to engage in ex parte communications with defendants; (2) by limiting the communications to discussing only 40 specific medical conditions; (3) by ordering that the decedent’s past medical conditions could be discussed only to the extent that they are relevant to the medical conditions placed at issue in this case; (4) by forbidding defendants from engaging in any ex parte communications regarding any mental health treatment the decedent had undergone at any time; and, (5) by limiting the discussion of the decedent’s consumption of alcohol to an inquiry regarding the effect it had on the gastrointestinal conditions suffered by decedent. Plaintiffs filed the present interlocutory appeal challenging this order.
1. Plaintiffs first argue that the trial court erred in granting the qualified protective order because any ex parte communications *896between the defendants and her treating physicians may lead to disclosure of Mary’s psychological or other mental health issues, which had not been placed at issue in the present action.
Georgia law has long held that once a plaintiff puts her medical condition at issue in a case, she waives her right to privacy with regard to any medical records that are relevant to that medical issue. Moreland v. Austin, 284 Ga. 730, 732 (670 SE2d 68) (2008). Accord Orr v. Sievert, 162 Ga. App. 677, 678-679 (292 SE2d 548) (1982). However, our Supreme Court has held that HIPAA “preempts Georgia law with regard to ex parte communications between defense counsel and plaintiff’s prior treating physicians.” Moreland, supra at 733. Accordingly, since the passage of HIPAA, “in order for defense counsel to informally interview plaintiff’s treating physicians, they must first obtain a valid authorization, or court order or otherwise comply with the provisions of 45 CFR § 164.512 (e).” Id. at 734. Under 45 CFR § 164.512 (e), the disclosure of protected health information is authorized in the course of judicial proceedings if the party seeking the information provides “satisfactory assurance” of its “reasonable efforts... to secure a qualified protective order.” 45 CFR § 164.512 (e) (1) (ii) (B). However, simply obtaining a qualified protective order is not sufficient to comply with HIPAA. In Baker v. Wellstar Health Systems, Inc., 288 Ga. 336 (703 SE2d 601) (2010), our Supreme Court held that it is insufficient for a trial court to “sign[ ] off on a broad, blanket order authorizing ex parte contacts with any number of unnamed physician-witnesses without further notice to the patient-plaintiff.” Id. at 339 (3) (a). Therefore, the Baker Court held that in order to comply with Georgia law and HIPAA, a trial court’s order authorizing ex parte interviews should be narrowly tailored by limiting the scope of the interview to “matters relevant to the medical condition [s] [the plaintiff] has placed at issue in this proceeding.” Id. at 338 (2).
Additionally, the Baker Court requires that the order state the following with particularity:
(1) the name(s) of the health care provider(s) who may be interviewed; (2) the medical condition(s) at issue in the litigation regarding which the health care provider(s) may be interviewed; (3) the fact that the interview is at the request of the defendant, not the patient-plaintiff, and is for the purpose of assisting defense counsel in the litigation; and (4) the fact that the health care provider’s participation in the interview is voluntary.
*897(Citations omitted.) Id. at 339 (3) (b). The Baker Court further held that a trial court issuing such a qualified protective order should determine whether the circumstances of the case, including
any evidence indicating that ex parte interviews have or are expected to stray beyond their proper bounds — warrant requiring defense counsel to provide the patient-plaintiff with prior notice of, and the opportunity to appear at, scheduled interviews or, alternatively, requiring the transcription of the interview. . . .
(Citation omitted.) Id. at 340 (3) (b). In explaining its rationale behind imposing such requirements, our Supreme Court noted that
the use of carefully crafted orders specifying precise parameters within which ex parte interviews may be conducted will serve to enforce the privacy protections afforded under state law and advance HIPAA’s purposes while at the same time preserving a mode of informal discovery that may be helpful in streamlining litigation in this State.
Id. at 340 (3) (b).
On appeal, this Court reviews the trial court’s decision to grant or deny a motion for a qualified protective order under an abuse of discretion standard. See Tender Loving Health Care Svcs. of Ga., LLC v. Ehrlich, 318 Ga. App. 560, 573 (2) (b) (734 SE2d 276) (2012), overruled on other grounds by Wellstar Health System, Inc. v. Jordan, 293 Ga. 12, 17, n. 6 (743 SE2d 375) (2013).
In the present case, the plaintiffs contend that the trial court’s order did not provide adequate protections to safeguard the decedent’s privacy regarding her mental conditions. Specifically, the plaintiffs note that the decedent had received treatment for depression and anxiety prior to the injuries referenced in the complaint, but that these conditions were not at issue in the litigation because they were not mentioned in the complaint. In support of this argument, the plaintiffs note that one of the individuals listed in the trial court’s order is Stacie Anita Hamilton, who, as a social worker, would necessarily have been privy to issues relating to the decedent’s mental conditions. The plaintiffs also argue that several of the named medical care providers listed in the qualified protective order potentially provided treatment to the decedent for depression, anxiety, and *898panic attacks as evidenced by prescriptions to treat these medical disorders.1
However, we find that the plaintiffs’ privacy right as to the decedent’s mental conditions is adequately safeguarded by the terms of the qualified protective order which sufficiently complies with all of the procedural requirements set forth in Moreland and Baker. The trial court’s order specifically names the health care providers that may be interviewed, sets forth the medical conditions at issue in the litigation, includes that the interview is at the request of the defendants and is for the purpose of assisting defense counsel, and that the health care providers’ participation in the interview is voluntary. See Baker at 339. The order also addresses the plaintiffs’ concerns regarding the defendants’ ability to obtain information regarding the decedent’s mental condition by specifically forbidding the defendants from engaging in ex parte communication with the health care providers “regarding any mental health treatment that [decedent] may have undergone at any time” (Emphasis supplied). The order also states that the defendants “shall not make any inquiry as to treatment that [decedent] may have undergone for alcohol or other substance abuse.” (Emphasis omitted.)
The plaintiffs correctly note that the Baker Court identified several dangers associated with the ex parte interviews by defendants of health care providers, including:
(1) the potential for unwarranted probing into matters irrelevant to the litigation yet highly sensitive and possibly prejudicial to the patient-plaintiff; (2) the potential for disclosure of information, such as mental impressions not documented in the medical record, that the health care provider has never actually communicated to the patient-plaintiff; and (3) the potential for defense counsel to influence the health care provider’s testimony, unwittingly or *899otherwise, by encouraging solidarity or arousing sympathy for a defendant health care provider.
Id. at 339 (3) (a). However, the Baker Court found that a trial court can avoid these dangers by issuing a qualified protective order that is fashioned “carefully and with specificity as to scope.” Id. Here, given the length of the decedent’s hospital stay, the number of medical conditions placed in issue in the case, the number of health care providers involved in her care, and the complicated nature of the case, the trial court has fashioned an adequately narrow protective order.2 Compare Tender Loving Health Care Svcs. of Ga., LLC, supra at 575 (2) (b) (holding that trial court’s denial of defendant’s motion seeking a qualified protective order allowing defendants to question the patient-plaintiff’s health care providers about “any and all medical care she received” during a three-month period was not an abuse of discretion because the qualified protective order was not sufficiently tailored to limit the defendants to discussing only “the medical condition(s) at issue in the litigation” when the plaintiff’s complaint involved only the “cause, extent, treatment, and consequences” of the patient’s wound) (punctuation and emphasis omitted).
The Baker Court also instructed that a trial court could, in its discretion, consider whether the circumstances in the present case “warrant requiring defense counsel to provide the patient-plaintiff with prior notice of, and the opportunity to appear at, scheduled interviews or, alternatively, requiring the transcription of the interview by the court reporter at the patient-plaintiff’s request.” (Citation omitted.) Baker, supra at 340 (3) (b). In the present case, the plaintiffs argue that they should be able to appear at scheduled interviews because the defendants sought information regarding the decedent’s mental condition earlier in the litigation. Specifically, the plaintiffs point to the defendants’ proposed qualified protective order, which sought to be able to question the health care providers about the decedent’s alcohol and substance abuse and mental conditions. However, considering the plaintiffs’ argument at the motions hearing, the trial court elected in its qualified protective order to forbid any ex parte discussions of these matters. Plaintiffs next point to evidence that the defendants previously requested information regarding the decedent’s mental condition in general interrogatories and at the plaintiffs’ depositions. However, none of these questions were directed at health care providers. The transcript of the motions *900hearing reveals that the trial court heard and considered this evidence and determined that the additional precautions proposed by the Baker Court were not required in the present circumstances. Because the trial court’s qualified protective order is narrowly tailored to the relevant conditions at issue in the case, and specifically prohibits the disclosure of such information, we find no abuse of discretion in the trial court’s decision to decline to adopt additional precautionary measures set forth in Baker 3
2. Plaintiffs next argue that the trial court’s qualified protective order allowing defendants to engage in ex parte communications with the decedent’s health care providers denies the plaintiffs their right to access and to amend the decedent’s health information as guaranteed by 45 CFR §§ 164.524 (a) and 164.526 (a). This argument is misguided.
HIPAA does provide patients with a right to access or amend protected health information. See 45 CFR §§ 164.524 (a) (1); 164.526 (a) (1). However, that right to access and amend applies only to information collected in a “designated record set.”4 HIPAA defines a “[designated record set” as a set of records maintained by or for a covered entity, including:
(i) [t]he medical records and billing records about individuals maintained by or for a covered health care provider; (ii) [t]he enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) [u]sed, in whole or in part, by or for the covered entity to make decisions about individuals.
45 CFR § 164.501 (1). The right to access and to amend granted by HIPAA does not, as argued by the plaintiffs, guarantee a patient or her representatives the right to access or amend any information within the health care provider’s memory or mental impressions *901about the care received by the patient. Accordingly, this enumeration is without merit.
Decided July 15, 2013 Parks, Chesin & Walbert, Thomas D. Trask, for appellants. Commander & Pound, Scott C. Commander, Lori E. Jolly, Insley & Race, Kevin P. Race, Brian K. Mathis, Huff, Powell & Bailey, Anna B. Fretwell, Taylor C. Tribble, Carlock, Copeland & Stair, Wayne D. McGrew III, Heather H. Miller, for appellees.3. Plaintiffs contend that the trial court erred in granting the defendants’ motion for a qualified protective order because the defendants failed to make a showing of good cause as required by OCGA § 9-11-26 (c).
OCGA § 9-11-26 (c) states that a trial court may grant a motion for a protective order only if “good cause [is] shown.” In support of their motion for a qualified protective order, defendants argued that they should be granted the right to conduct ex parte interviews with the decedent’s health care providers for the following reasons: (1) they are entitled to “equal access” to potential trial witnesses; (2) ex parte interviews would protect the attorney work-product, mental impressions, and trial strategy of defendants; and (3) ex parte interviews would be more efficient and less costly than formal depositions or joint meetings with plaintiffs’ counsel.
“What constitutes ‘good cause’ must be left largely to the trial judge who has a latitude of discretion in determining whether the showing has been made.” Sorrells v. Cole, 111 Ga. App. 136, 142 (2) (c) (141 SE2d 193) (1965). See Tender Loving Health Care Svcs. of Ga., LLC, supra at 573 (2) (a) (ii) (upholding trial court’s decision to deny defendant’s motion for a qualified protective order and rejecting “the defendants’ request to adopt a new rule that effectively strips trial courts of all discretion in deciding whether to issue [qualified protective orders]”) (footnote omitted). Further, as noted above, this Court reviews a trial court’s decision to grant or deny a motion for a qualified protective order under an abuse of discretion standard. See id. at (2) (b). Reviewing the entirety of the record, we find that the trial court did not abuse its discretion in determining that the defendants provided good cause and in subsequently granting defendants’ motion for a qualified protective order.
Judgment affirmed.
Barnes, P. J., and Miller, J., concur.In support of these arguments, plaintiffs rely on documents they attached as exhibits to their notice of appeal. Plaintiffs argue that these documents show that the decedent was prescribed certain medications that were commonly prescribed to treat both medical issues and mental conditions such as anxiety, sleep disorders, and depression. However, it appears from the appellate record properly before this Court that these documents were not made a part of the record in the trial court before the trial court granted the defendants’ motion, and were not part of the trial court’s record prior to appeal. Accordingly, we decline to consider these records. See In re Estate of Dorroh, 255 Ga. App. 366 (565 SE2d 565) (2002) (exhibits contained in an appellate brief which do not appear in the record or transcript on file with this Court cannot be considered by this Court). See also Piedmont Hosp., Inc. v. Reddick, 267 Ga. App. 68, 72 (2) (599 SE2d 20) (2004) (“in reviewing a grant of summary judgment, this Court will only consider evidence presented to the trial court before that court ruled on the motion”) (footnote omitted).
As noted above, the plaintiff’s complaint alleged that while at Emory the decedent was treated for at least twenty medical conditions.
We further note that our Supreme Court has held that even if a trial court’s protective order requires the transcription of such ex parte interviews, such interviews are not always discoverable by the patient-plaintiff. It is possible for the trial court to order the preparation of transcripts, not for the benefit of the patient-plaintiff’s discovery, but rather to provide a method for determining through an in camera inspection whether the court’s protective order had been violated. See Wellstar Health System, Inc. v. Jordan, supra.
45 CFR § 164.524 (a) (1) provides that a patient has a “right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set....” (Emphasis supplied). 45 CFR § 164.526 (a) (1) also grants patients the right to “amend protected health information or a record about the individual in a designated record set for as long as the protected health information is maintained in the designated record set." (Emphasis supplied.)