ORDER ON APPLICABILITY OF MEDICAL PRIVACY LAWS TO MOTIONS TO QUASH SUBPOENAS BROUGHT BY NON-PARTY LAW FIRMS (DEs 129, 130,133, 138, 139,143,157, 200, 206, 232)
JAMES M. HOPKINS, United States Magistrate Judge.THIS CAUSE has come before this Court upon an Order referring discovery matters to the undersigned United States Magistrate Judge for final disposition. (DE 5).
BACKGROUND
Plaintiffs State Farm Mutual Automobile Insurance Company and State Farm Fire & Casualty Company (collectively “State Farm” or “Plaintiffs”) commenced *1325this action on January 18, 2011 and allege that since 2004 Defendants have been engaged in a scheme to defraud Plaintiffs by performing medically unnecessary procedures known as provocative discograms (“diseograms”) and percutaneous discectomies (“PDs”), and using materially false billing codes to describe these procedures. Amended Compl. ¶¶ 1-136. The list of 198 claims involving alleged fraud is attached to the Amended Complaint. Amended Compl., Exh. A. Plaintiffs invoked diversity, federal question, and supplemental jurisdiction.1 Amended Compl. ¶ 5.
The Defendants are several physicians who performed the procedures, their medical practices, Palm Beach Lakes Surgery Center where the procedures took place, two (2) lay people and the management company who coordinated the alleged scheme, and another doctor who was a partial owner of the Palm Beach Lakes Surgery Center and of the company that supplied the surgical tool for the procedures in question. Amended Compl. ¶ ¶ 1-136. Plaintiffs also allege that the scheme depended heavily on the relationship between the Defendants and other healthcare providers, such as Bethesda Memorial Hospital, and personal injury law firms, all of whom referred patients to the Defendants. Id. However, Bethesda Memorial Hospital and the personal injury law firms are not named parties in this case.
Plaintiffs seek a declaratory judgment that Defendants are not entitled to payments for unpaid claims (Count I); as well as damages for violation of the RICO Act, 18 U.S.C. § 1962 (Counts II and III), common law fraud (Count IV), violation of Florida Deceptive and Unfair Trade Practices Act (Count V), and unjust enrichment (Count VI). Amended Compl. ¶¶ 137-170. Several of the Defendants counterclaimed for violations of the RICO Act; malicious prosecution; defamation; defamation per se; and bad faith and unfair claims settlement practices. See DEs 154, 155, 162.
On April 21, 2011, the District Court granted Defendants’ Motions to Stay Discovery Pending Resolution of Defendants’ Motion to Dismiss (DE 77). After the Court denied Defendants’ Motions to Dismiss, the stay was lifted on October 3, 2011 (DE 113).
As part of its discovery process, State Farm issued nearly identical subpoenas to produce documents to nine (9) non-party law firms.2 The document requests in question cover the period of 2004 to present and call for production of fourteen (14) categories of documents. These categories relate to State Farm insureds’ (without expressly limiting the requests to the allegedly fraudulent claims, the list of which was attached to the Amended Complaint) and non-State Farm insureds’ claims involving PD and discogram procedures; law firms’ financial and general dealings *1326with the Defendants and other non-parties; documents relating to loans made to any State Farm insureds who received services; and any complaints against the firms and their attorneys by any client who received a PD or a discogram. See DE 129 as an example.
All of the law firms subject to the subpoenas, as well as Defendants Jeffrey L. Kugler, M.D. and National Orthopedics, filed3 motions to quash the subpoenas served on the non-party law firms or for a protective order (collectively “Motions”). DEs 129, 130, 133, 138, 139, 143, 157, 200, 206, 232. The non-party law firms object to State Farm’s document requests on largely the same bases: overboard and unduly burdensome requests; attorney-client and work product privilege; HIPAA and Florida medical privacy laws; trade secrets; and confidentiality of settlement agreements. Steinger, Iscoe, and Greene, P.A. also adds joint-defense privilege. Some firms are asking for State Farm to pay for the costs of producing documents, and Cooksey & Cooksey, P.A. is asking for sanctions against State Farm.
With the exception of Steinger, Iscoe & Greene, P.A. and its affiliates’ and Ellis, Ged & Bodden, P.A.’s motions, all Motions have either been fully briefed or the time for filing has expired. In opposition to the issues raised by the non-party law firms, State Farm argues that the firms have the burden of establishing that the subpoenas must be quashed and failed to do so because their objections are not specific, fail to establish any applicable privileges and undue burden and do not dispute relevancy of the documents sought. DEs 134, 135,173,174, 217.
The undersigned United States Magistrate Judge held the first hearing on the issues raised by the non-party law firms on November 17, 2011,4 and, when it appeared from the filings that no progress was being made and more non-party law firms raised objections, the second hearing on December 15, 2011. According to State Farm’s counsel at the last hearing, Plaintiffs received absolutely no documents in response to the subpoenas from any of the law firms as of that date.
The law firms argue that State Farm’s document requests call for production of the law firms’ client’s medical records.5 State Farm filed a Motion for Entry of Protective Order in an effort to resolve confidentiality issues relating to medical records (DE 238), to which Defendants Jane E. Bistline, M.D. and Jane E. Bistline, M.D., P.A. responded in opposition (DE 256). The instructions to the document requests also specify that all patient identifying information can be redacted from any responsive documents not involv*1327ing a patient with a claim against State Farm or a State Farm policy holder. See DB 129, p. 14.
The most contentious debate between non-party law firms and State Farm, so far, centered around the issue of whether non-party law firms’ clients’ medical records are afforded protection by HIPAA and Florida medical privacy laws. This opinion addresses this issue.
DISCUSSION
Federal Rule of Civil Procedure 26 allows the parties to “obtain discovery regarding any nonprivileged matter that is, relevant to any party’s claim or defense.” Fed.R.Civ.P. 26(b)(1). Accordingly, an issuing court must quash or modify a subpoena which requires disclosure of privileged or other protected matter, if no exception or waiver applies, or subjects the person to undue burden under Rule 45. Fed.R.Civ.P. 45(c)(3)(A)(iii-iv). At the outset, it is necessary to describe the privileges that non-party law firms argue provide protection for their clients’ medical records.
I. Privileges implicated
A. Florida medical privacy laws
In Florida, a patient’s medical record is deemed confidential under the right to privacy clause contained in Article I, Section 23 of the Florida Constitution. State v. Johnson, 814 So.2d 390 (Fla.2002). Accordingly, Florida Statutes provide certain protections to patients whose medical records are being subpoenaed, although there is no complete bar to discovery of medical records. See Fla. Stat. § 456.057. Specifically, section 456.057 defines medical records as ones generated after “making any physical or mental examination of, or administering treatment or dispensing legend drugs to, any person,” and defines records custodian as any person or entity that obtained medical records from a records owner.6 Fla. Stat. § 456.057(1), (3). Records custodians are obligated to maintain medical records as provided in the statute, which, in turn, forbids discussing patient’s medical conditions or furnishing of medical records without patient’s written authorization unless it is done “upon the issuance of a subpoena from a court of competent jurisdiction and proper notice to the patient or the patient’s legal representative by the party seeking such records” in any civil or criminal action. Fla. Stat. § 456.057(4), (7)(a)(3) (emphasis added). The purpose of giving notice to non-party patients is to provide them an opportunity to be heard in the proceedings. Graham v. Dacheikh, 991 So.2d 932, 933 (Fla. 2nd DCA 2008). While it has been held that redacting the records does not cure a lack of notice, see Crowley v. Lamming, 66 So.3d 355, 359 (Fla. 2nd DCA 2011), Florida Supreme Court had stated that patient’s constitutional right to privacy of medical records may be protected by removing all identifying information from the records. See Amente v. Newman, 653 So.2d 1030, 1033 (Fla.1995) (interpreting Fla. Stat. § 455.241, and holding that when notice cannot be given because the identity of the non-party patients is unknown, redacting the records can protect patients’ privacy).
Therefore, if the statute applies here, non-party law firms, having received the medical records from their clients, are records custodians and would be bound by the terms of the statute, and State Farm, as the party seeking medical records, would be obligated to give notice to the patients whose records are being subpoenaed to *1328afford them an opportunity to be heard in this proceeding. This adds procedural hurdles and would significantly prolong and complicate discovery.
Arguably, the notice requirement may essentially serve as a bar for State Farm to discover medical records of non-State Farm insureds, whose identities are unknown to State Farm, but whose records State Farm seeks in its third request for production if redacting cannot cure this lack of notice. However, their rights to privacy may be protected according to Amente v. Newman, 653 So.2d 1030 (Fla. 1995) by redacting the documents.
B. Federal rules governing confidentiality of medical records
Federal courts have long been mindful of preserving confidentiality of medical information. See Farnsworth v. Procter and Gamble Co., 758 F.2d 1545, 1547 (11th Cir.1985) (upholding district court’s protective order designed to maintain confidentiality of medical information of participants of a study prior to the enactment of HIPAA,7). Today, federal regulations enacted pursuant to the authority granted by HIPAA govern privacy of medical records. HIPAA applies only to “covered entities,” which are health plans, health care clearinghouses, healthcare providers who transmit health information electronically, and business associates of covered entities who perform functions on behalf of these entities. See 45 C.F.R. §§ 160.102, 160.103. Law firms who are not representing covered entities are not regulated under HIPAA. See Graham v. Fleissner Law Firm, 2008 WL 2169512, at *3 (E.D.Tenn. May 22, 2008).
Moreover, under HIPAA disclosure without written authorization of the individual or the opportunity for the individual to object is permitted pursuant to a subpoena or discovery request when the healthcare provider receives satisfactory assurance from the party seeking information that reasonable efforts have been made by that party to secure a qualified protective order. In re Zyprexa Prod. Liab. Litig., 254 F.R.D. 50, 53-58 (E.D.N.Y.2008) (citing 45 C.F.R. § 164.512). The party seeking protected health information can provide satisfactory assurances if it requests a qualified protective order from a court with the jurisdiction over the dispute. 45 C.F.R. § 164.512(e)(1). “Protected health information” means individually identifiable health information. 45 C.F.R. § 160.103. Generally, HIPAA does not constitute a bar to discovery of medical records, and it has been held that it is a purpose of the Act that health information which may eventually be used in litigation should be made available during the discovery phase. Bayne v. Provost, 359 F.Supp.2d 234, 237 (N.D.N.Y.2005).
Here, production of documents by personal injury law firms will not be regulated by HIPAA because such law firms are not “covered entities.” However, if HI-PAA’s protections are applied because the Court is mindful of the need to protect patients’ privacy, HIPAA does not bar production and does not require procedural steps beyond the ones already taken, but will require a HIPAA qualified protective order. State Farm has filed its Motion for Entry of Protective Order (DE 238), and a HIPAA qualified protective order can be entered by this Court once the issue is fully developed. As to non-State Farm insureds, State Farm is not seeking “protected health information” *1329covered by HIPAA because the document request specifies that patient identifying information can be redacted.
II. Federal law of privileges applies
When determining whether information requested in discovery is privileged, the courts apply the rules of privilege used in the law of evidence. United States v. Reynolds, 345 U.S. 1, 6, 73 S.Ct. 528, 97 L.Ed. 727 (1953). Federal Rule of Evidence 501 states:
The common law — as interpreted by United States courts in the light of reason and experience — governs a claim of privilege unless any of the following provides otherwise:
• the United States Constitution;
• a federal statute; or
• rules prescribed by the Supreme Court.
But in a civil case, state law governs privilege regarding a claim or defense for which state law supplies the rule of decision.
Fed.R.Evid. 501.8
Therefore, the general rule is that federal common law governs privileges in federal question cases. Id.; Hancock v. Hobbs, 967 F.2d 462, 466 (11th Cir.1992) (partially abrogated on other grounds by Jaffee v. Redmond, 518 U.S. 1, 116 S.Ct. 1923, 135 L.Ed.2d 337 (1996)); Northwestern Memorial Hospital v. Ashcroft, 362 F.3d 923, 924 (7th Cir.2004). Further, only federal law of privilege governs in a civil proceeding where the court’s jurisdiction is based on a federal question even if the evidence is relevant to a pendent state law claim, which may be controlled by a contrary state law of privilege. Hancock, 967 F.2d at 467 (11th Cir.1992) (partially abrogated on other grounds by Jaffee v. Redmond, 518 U.S. 1, 116 S.Ct. 1923, 135 L.Ed.2d 337 (1996)).
The drafters of the Federal Rules of Evidence envisioned two different regimes: only federal law of privilege will apply in a federal question case even if it contains pendent state law claims; and state law of privilege will govern in a diversity case unless proof is directed at a federal claim. 1974 Advisory Comm. Notes, Fed.R.Evid. 501.9 Essentially, state law of privileges will only apply to state law claims in a diversity case as an exception to the general rule that federal law of privileges governs because federal policy is not *1330strong enough in such situations to prevent the use of state law. Id. However, the Rule does not address what law should be applied in a diversity case when the same piece of evidence is relevant to both federal and state law claims. 23 Charles Alan Wright & Kenneth W. Graham, Jr., Federal Practice and Procedure § 5434 (1st ed. 2011).
Congressional intent as to which law to apply in such situations is unclear, and there are only three ways10 to resolve this issue if a clear cut rule is employed. See id. The first is to always use the federal rules because this is the general rule. Id. The second is to always use the state law. Id. And the last is to apply the rule that would admit the evidence, which would in essence favor federal rules which recognize fewer privileges. Id. Overall, it is suggested that rather than use a bright line rule, courts should balance state and federal interests in each particular case using such relevant factors as the nature of the privilege being asserted, the identity of the person claiming the privilege, the relative importance of the state and federal issues in the case, the existence of alternate forms of proof and the need for the evidence claimed to be privileged, and the nature of the conflict between state and federal rules. Id.
The Amended Complaint here contains both federal (RICO) and state law (common law fraud, violation of Florida Deceptive Trade Practices Act, and unjust enrichment) claims, and invokes diversity, federal question and supplemental jurisdiction. If this case is treated as a federal question case with pendent state law claims, only federal law of privileges will apply. However, if this case is treated as a diversity one, federal law of privileges will apply to federal claims, and state law to state claims. Further, medical records are relevant to both federal RICO claims predicated upon mail fraud and to the Florida common law fraud claim. For example, State Farm has to prove that the procedures in question were medically unnecessary to establish that bills submitted to State Farm by the Defendants were fraudulent to establish both federal mail fraud and state fraud claims. See Memorandum Opinion and Order Denying Defendants’ Motions to Dismiss (DE 102). The records sought here may reveal medical information tending to prove that the procedure a claimant received was not medically necessary making the bills fraudulent. Therefore, this case falls squarely within the category not addressed directly by Rule 501, and a balancing of interests should be performed.
It appears that Florida medical privacy law is fairly unequivocal, broad and the notice requirement can only be ignored if no discovery at all can be had because the identity of the patients is unknown and cannot be ascertained because of the privacy rules. Further, Florida medical privacy stems from the Florida Constitution, which, unlike the U.S. Constitution, contains an express right to privacy. Therefore, state interest in protecting patients’ privacy is rather strong.
The persons claiming the privilege are non-parties in this case. While patients whose records are being sought seem to be even farther removed from this litigation, they filed claims with State Farm and other similar insurance companies allowing review of their medical conditions. In the cases of State Farm-insured patients and those for whose treatment State Farm paid, State Farm already has the bulk of their medical records, which had been provided to it to facilitate resolution of the claims. Plaintiffs argue that production of *1331the records from law firms’ files is necessary because law firms, as advocates of their clients, may retain more complete medical records than were provided to State Farm. Records of non-State Farm insureds can be redacted. While the law firms have argued that redacting will inevitably result in mistakes and will inadvertently let some information slip, redacting is routinely used to maintain privacy. Therefore, patients’ privacy concerns here, while significant, are not as high as concerns of those patients, whose medical conditions would have been released to the adverse party for the first time, and do not weigh in favor of applying the Florida statute.
It appears that federal RICO claims are relatively more important to this case than state law claims. At the hearings, the bulk of State Farm’s arguments related to RICO, which likewise favors application of the federal privileges under the general rule.
Non-party law firms have argued that State Farm’s need for the medical records, a large majority of which it already has, is not great, and that the records can be obtained from the Defendants. As previously mentioned, State Farm counters by stating that law firms’ records may turn out to be more complete. Therefore, if previously unreviewed by State Farm records are discovered, they will likely be very relevant to the issue of medical necessity of the procedures and of State Farm’s reliance upon the records. Non-party law firms argue that employing a medical expert is a better way of proving lack of medical necessity. However, as long as patients’ medical privacy can be managed, review of medical records is likewise a valid avenue for establishing such facts.
The conflict between state medical privacy privilege and federal lack of privilege or procedural safeguards when HIPAA does not apply may appear great at first. However, given that federal courts have been mindful of preserving patients’ privacy even before HIPAA was enacted, the difference between state and federal schemes is not significant. In this case, both State Farm and some of the Defendants provided their versions of a proposed protective order, and one can certainly be entered.
On balance, the facts of this case do not necessitate application of the Florida medical subpoena rule requiring notice and an opportunity to be heard for patients whose medical records are being subpoenaed. Such precautions will result in great complications to this case, prolonged discovery process and unnecessary expense in terms of attorneys fees and judicial resources. Additionally, patients’ privacy concerns can be managed with the use of redacting and of a protective order.
CONCLUSION
In light of the foregoing, IT IS HEREBY ORDERED that Florida medical privacy privilege DOES NOT APPLY in this case. The Court reserves ruling on non-party law firms’ Motions (DEs 129, 130, 133, 138, 139, 143, 157, 200, 206, 232) in all other respects.
. The Amended Complaint states:
Pursuant to 28 U.S.C. § 1332(a)(1), this Court has jurisdiction over all claims because the matter in controversy exceeds the sum or value of $75,000, exclusive of interest and costs, and is between citizens of different states. Pursuant to 28 U.S.C. § 1331, this Court also has jurisdiction over the claims brought under 18 U.S.C. § 1961 et seq. (“RICO”) because they arise under the laws of the United States. This Court also has jurisdiction over the state law claims because they are so related to the RICO claims as to form part of the same case and controversy.
Amended Compl. ¶ 5.
. According to the Defendants, see DE 130 at p. 2, identical subpoenas were served on Fetterman & Associates, P.A.; Schiller, Kessler & Gomez, P.L.C.; Cooksey & Cooksey, P.A.; Ellis, Ged & Bodden, P.A.; and Kanner & Pintaluga, P.A. The subpoenas issued to Steinger, Iscoe and Greene, P.A. and three of its affiliates included additional categories of requests.
. Fetterman & Associates, P.A. did not file its motion with the Court. Instead, Plaintiffs filed a Notice of Fetterman & Associates, P.A.’s Motion with the actual Motion attached. DE216.
. Fetterman & Associates, P.A.’s and Steinger, Iscoe and Greene, P.A. and its affiliates’ motions had not been filed yet at that point.
. In fact, the first three document requests in question call for
1.All documents relating to any claim involving any State Farm insured who received a discogram and/or PD from any of the Defendants.
2. All documents that refer to or contain discograms procedures or results, including, but not limited to, any bills relating to the same, for any non-State Farm insured who received a discogram and/or PD, or a recommendation for a discogram and/or PD at the Palm Beach Lakes Surgery Center from 2004 through present.
3. All documents that refer to or contain PD procedures or results, including, but not limited to, any bills relating to the same, for any non-State Farm insured who received a discogram and/or PD, or a recommendation for a discogram and/or PD at the Palm Beach Lakes Surgery Center from 2004 through present. DE 129, p. 15.
. While the statute defines "records owner” only as healthcare practitioners or their employers, see Fla. Stat. § 456.057(1), it follows from the Florida Constitution, and it is not disputed here, that patients themselves are owners of their medical records.
. Health Insurance Portability and Accountability Act ("HIPAA”) is found at Pub. L. 104-191, 110 Stat. 1936.
. Federal Rules of Evidence were drafted in 1974, and took effect in 1975. The current version of Rule 501 became effective December 1, 2011. Advisory Committee Notes state that 2011 changes were meant to be stylistic only, and did not intend to change any result of any ruling on admissibility. Advisory Comm. Notes, Fed.R.Evid. 501.
. The Advisory Committee Notes state that the enacted version of the rule provides that in criminal and Federal question civil cases, federally evolved rules on privilege should apply since it is Federal policy which is being enforced. [It is also intended that the Federal law of privileges should be applied with respect to pendent State law claims when they arise in a Federal question case.] Conversely, in diversity' cases where the litigation in question turns on a substantive question of State law, and is brought in the Federal courts because the parties reside in different States, the committee believes it is clear that State rules of privilege should apply unless the proof is directed at a claim or defense for which Federal law supplies the rule of decision (a situation which would not commonly arise.) [While such a situation might require use of two bodies of privilege law, federal and state, in the same case, nevertheless the occasions on which this would be required are [...] confined to situations where the Federal and State interests are such as to justify application of neither privilege law to the case as a whole. If the rule proposed here results in two conflicting bodies of privilege law applying to the same piece of evidence in the same case, it is contemplated that the rule favoring reception of the evidence should be applied.
1974 Advisory Comm. Notes, Fed.R.Evid. 501.
. The other suggested way of instructing the jury on which claims the evidence should be applied to cannot be employed in a discovery dispute.