We granted leave to consider whether the Health Insurance Portability and Accountability Act (HIPAA), 42 USC 1320d et seq., permits ex parte interviews by defense counsel with treating physicians under a qualified protective order. We hold that ex parte interviews, which are permitted under Michigan law, are also consistent with HIPAA regulations, provided that “reasonable efforts have been made ... to secure a qualified protective order that meets the requirements of [45 CFR 164.512(e)(l)(v)].” 45 CFR 164.512(e)(l)(ii)(B). Accordingly, we affirm the judgment of the Court of Appeals.
I. FACTS AND PROCEEDINGS
The Court of Appeals summarized the relevant facts and trial court proceedings:
Plaintiff filed this wrongful-death medical-malpractice action alleging that defendant had failed to properly diagnose or treat plaintiffs decedent, Linda Clippert, thereby proximately causing her death. Defendant sought to interview Clippert’s treating physician, but plaintiff refused to waive Clippert’s confidentiality rights under the Health Insurance Portability and Accountability Act (HIPAA), 42 USC 1320d et seq. Plaintiff signed a waiver allowing the release of medical records, but refused to provide a release for oral communications. Defendant moved for a qualified protective order to permit an ex parte interview with Clippert’s treating physician, but the circuit court denied the motion. The court concluded that “the HIPAA provision relative to a protective order only... pertains to documentary evidence” and “that HIPAA does not authorize ex parte oral interviews.” [Holman v Rasak, 281 Mich App 507, 508; 761 NW2d 391 (2008).]
The Court of Appeals granted defendant’s application for leave to appeal and concluded that defense counsel may conduct an ex parte interview with a *433plaintiffs treating physician “if a qualified protective order, consistent with 45 CFR 164.512(e)(1), is first put in place.” Id. at 513. The Court “agree[d] with plaintiff that HIPAA supersedes Michigan law to the extent that its protections and requirements are more stringent than those provided by state law,” but disagreed with the trial court’s conclusion “that a defendant’s ex parte interview with a treating physician may not be the subject of a qualified protective order under HIPAA.” Id. at 511-512. It reasoned that the relevant HIPAA regulation, 45 CFR 164.512 (e) (1) (ii), does not exclude oral communication from the regulations governing disclosure of protected health information. Id. at 512. Moreover, “45 CFR 160.103 specifically provides that HIPAA applies to both oral and written information, and 45 CFR 164.512(e)(2) makes clear that the regulations concerning qualified protective orders ‘do not supersede other provisions of this section that otherwise permit or restrict uses or disclosures of protected health information.’ ” Id., quoting 45 CFR 164.512(e)(2). The panel also rejected plaintiffs argument that defendants may rely on written medical records and conduct depositions if more information is required. It quoted this Court’s observation in Domako v Rowe, 438 Mich 347, 361; 475 NW2d 30 (1991), that informal interviews are “ ‘routine practice’ ” and that “ ‘[t]here is no justification for requiring costly depositions . . . without knowing in advance that the testimony will be useful.’ ” Holman, 281 Mich App at 512-513. The panel reversed the trial court’s order and remanded for further proceedings.
We granted plaintiffs application for leave to appeal to consider whether HIPAA permits defense counsel to seek ex parte interviews with a plaintiffs treating physicians.
*434II. HIPAA
Congress enacted the Health Insurance Portability and Accountability Act in 1996. HIPAA provided that if Congress did not enact “legislation governing standards with respect to the privacy of individually identifiable health information within 36 months after HIPPA was enacted,” the Secretary of Health and Human Services would be required to “promulgate final regulations containing such standards. . . .” PL 104-191, § 264(c)(1), 110 Stat 2033. Pursuant to that legislative mandate, 45 CFR 164.502(a) provides that “[a] covered entity may not use or disclose protected health information, except as permitted or required by this sub-part ____"1
*435“[C]overed entity” means: (1) “[a] health plan”; (2) “[a] health care clearinghouse,” or (3) “[a] health care provider who transmits any health information in electronic form in connection with a transaction” for which the Department of Health and Human Services (HHS) has adopted standards under HIPAA. 45 CFR 160.103. With exceptions not relevant here, “protected health information” means “individually identifiable health information” transmitted by or maintained in electronic media or “[transmitted or maintained in any other form or medium.” 45 CFR 160.103. “Health information” includes both “oral” information and information that is “recorded in any form or medium . ...” Id. “Individually identifiable health information”
is information that is a subset of health information, including demographic information collected from an individual, and:
(1) [i]s created or received by a health care provider, health plan, employer, or health care clearinghouse; and
(2) [r] elates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
(i) [t]hat identifies the individual; or
(ii) [w]ith respect to which there is a reasonable basis to believe the information can be used to identify the individual. [Id.]
Thus, “protected health information” is any health information, oral or recorded, that is individually iden*436tillable and transmitted or maintained by a covered entity in any form or medium. 45 CFR 160.103.2
III. STANDARD OF REVIEW
Although a trial court’s decision on a motion regarding discovery is reviewed for an abuse of discretion, People v Phillips, 468 Mich 583, 587; 663 NW2d 463 (2003), this case presents questions of statutory interpretation, which we review de novo as questions of law, In re Investigation of March 1999 Riots, 463 Mich 378, 383; 617 NW2d 310 (2000).
IV ANALYSIS
Under Michigan law, defense counsel in a medical malpractice action is permitted to seek an ex parte interview with a plaintiffs treating physician once the plaintiff has waived the physician-patient privilege with respect to that physician. Domako, 438 Mich at 361. MCL 600.2157 establishes the physician-patient privilege and also sets forth the rule on waiver of the privilege. It provides, in relevant part:
Except as otherwise provided by law, a person duly authorized to practice medicine or surgery shall not disclose any information that the person has acquired in attending a patient in a professional character, if the information was necessary to enable the person to prescribe for the patient as a physician, or to do any act for the patient as a surgeon. If the patient brings an action against any defendant to recover for any personal injuries, or for any malpractice, and the patient produces a physician as a
*437witness in the patient’s own behalf who has treated the patient for the injury or for any disease or condition for which the malpractice is alleged, the patient shall be considered to have waived the privilege provided in this section as to another physician who has treated the patient for the injuries, disease, or condition. [Emphasis added.]
In Domako, we explained that
“[N]o party to litigation has anything resembling a proprietary right to any witness’s evidence. Absent a privilege no party is entitled to restrict an opponent’s access to a witness ....” While we recognize that the physician is different from an ordinary witness as a result of the confidential nature of the physician’s potential testimony, that confidentiality is adequately preserved by the physician-patient privilege. Once the privilege is waived, there are no sound legal or policy grounds for restricting access to the witness. [Domako, 438 Mich at 361, quoting Doe v Eli Lilly & Co, 99 FRD 126, 128 (D DC, 1983) (emphasis added).]
With respect to ex parte interviews, we explained:
Although the rules are silent on informal methods of discovery, prohibition of all ex parte interviews would be inconsistent with the purpose of providing equal access to relevant evidence and efficient, cost-effective litigation. The omission of interviews from the court rules does not mean that they are prohibited, because the rules are not meant to be exhaustive. See MCR 2.302(F)(2) (permitting parties to modify the court rules to use other methods of discovery). Their absence from the court rules does indicate that they are not mandated and that the physician cannot be forced to comply, but there is nothing in the court rules precluding an interview if the physician chooses to cooperate. [Domako, 438 Mich at 361-362.]
After we decided Domako, the Legislature enacted MCL 600.2912f,3 which provides that a defendant in a *438medical malpractice action or the defendant’s attorney or representative “may communicate” with persons or entities with respect to whom the plaintiff has waived the physician-patient privilege “in order to obtain all information relevant to the subject matter of the claim or action and to prepare the person’s or entity’s defense to the claim or action.” MCL 600.2912f(2). The statute also makes clear that a person who discloses such information “does not violate [MCL 600.2157] or any other similar duty or obligation created by law and owed to the claimant or plaintiff.” MCL 600.2912f(3).
Under HIPAA, the general rule pertaining to the disclosure of protected health information is that a covered entity may not use or disclose protected health *439information without a written authorization from the individual as described in 45 CFR 164.508, or, alternatively, the opportunity for the individual to agree or object as described in 45 CFR 164.510. 45 CFR 164.512, however, enumerates several specific situations in which “[a] covered entity may use or disclose protected health information without the written authorization of the individual, as described in [45 CFR] 164.508, or the opportunity for the individual to agree or object as described in [45 CFR] 164.510 ....” 45 CFR 164.512.4 This regulation provides alternative requirements for disclosures in specific situations. Relevant here is paragraph (e), “[disclosures for judicial and administrative proceedings,” which permits a covered entity to disclose protected health information in response to “an order of *440a court or administrative tribunal,” or “[i]n response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if”:
(A) [t]he covered entity receives satisfactory assurance, as described in paragraph (e)(l)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or
(B) [t]he covered entity receives satisfactory assurance, as described in paragraph (e)(l)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(l)(v) of this section. [45 CFR 164.512(e)(1)(i) and (ii).][5]
A “qualified protective order” is an order of a court or administrative tribunal or a stipulation by the parties that:
(A) [plrohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and
(B) [rlequires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding. [45 CFR 164.512(e)(l)(v).]
Under HIPAA, “[a] standard, requirement, or implementation specification” of HIPAA “that is contrary to a *441provision of State law preempts the provision of State law” unless, among other exceptions, “[t]he provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under” HIPAA. 45 CFR 160.203 (emphasis added). “Contrary” means either that “[a] covered entity would find it impossible to comply with both the State and federal requirements” or that “[t]he provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of” HIPAA. 45 CFR 160.202. “More stringent,” in this context, means “provides greater privacy protection for the individual who is the subject of the individually identifiable health information.” 45 CFR 160.202.
We hold that HIPAA does not preempt Michigan law permitting ex parte interviews because Michigan law is not “contrary” to HIPAA under either definition of that term. Michigan law is not “contrary” to HIPAA under the first definition because it is possible for a covered entity to comply with both Michigan law and HIPAA. As the parties acknowledge, HIPAA contains no express mention of ex parte interviews. Thus, the New York Court of Appeals has concluded that New York law permitting ex parte interviews and HIPAA could coexist because HIPAA “merely superimposed procedural requirements” onto state law:
In addition, HHS has pointedly advised that where “there is a State provision and no comparable or analogous federal provision, or the converse is the case,” there is no possibility of preemption because in the absence of anything to compare “there cannot be ... a ‘contrary’ requirement” and so “the stand-alone requirement — be it State or federal — is effective” (64 Fed Reg 59918, 59995). As a result, there can be no conflict between New York law and *442HIPAA on the subject of ex parte interviews of treating physicians because HIPAA does not address this subject. Accordingly, the Privacy Rule does not prevent this informal discovery from going forward, it merely superimposes procedural prerequisites. As a practical matter, this means that the attorney who wishes to contact an adverse party’s treating physician must first obtain a valid HIPAA authorization or a court or administrative order; or must issue a subpoena, discovery request or other lawful process with satisfactory assurances relating to either notification or a qualified protective order. [Arons v Jutkowitz, 9 NY3d 393, 415; 880 NE2d 831; 850 NYS2d 345 (2007) (emphasis added).]
We agree with the Arons court’s analysis. Ex parte interviews are permitted under Michigan law, and nothing in HIPAA specifically precludes them. Because it is possible for defense counsel to insure that any disclosure of protected health information by the covered entity complies with 45 CFR 164.512(e) by making “reasonable efforts” to obtain a qualified protective order, HIPAA does not preempt Michigan law concerning ex parte interviews.
Plaintiff raises several arguments in support of her position that 45 CFR 164.512(e) does not permit ex parte interviews. First, she claims that HIPAA does not authorize informal discovery and that its provision for disclosure of protected health information pursuant to a qualified protective order applies only when a party seeks protected health information in the context of formal discovery. We disagree. Under 45 CFR 164.512(e)(l)(ii), a covered entity is permitted to “disclose protected health information in the course of any judicial or administrative proceeding”:
(ii) [i]n response to a subpoena, discovery request, or other lawful process that is not accompanied by an order of a court or administrative tribunal, if:
*443(A) [t]he covered entity receives satisfactory assurance, as described in paragraph (e)(l)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or
(B) [t]he covered entity receives satisfactory assurance, as described in paragraph (e)(1) (iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(l)(v) of this section. [Emphasis added.]
As previously discussed, ex parte interviews are permitted under Michigan law as a means of informal discovery. Thus, even if “discovery request” contemplates formal discovery, a request for an ex parte interview is at least “other lawful process” within the meaning of 45 CFR 164.512(e)(l)(ii). Therefore, as long as “[t]he covered entity receives satisfactory assurance ... that reasonable efforts have been made ... to secure a qualified protective order” that meets the requirements of subsection (e)(l)(v), disclosure of protected health information by a covered entity during an ex parte interview is consistent with both Michigan law and HIPAA. The HIPAA regulations were “not intended to disrupt current practice whereby an individual who is a party to a proceeding and has put his or her medical condition at issue will not prevail without consenting to the production of his or her protected health information.” 65 Fed Reg 82462-01, 82530 (December 28, 2000), discussing 45 CFR 164.512(e).6
*444Plaintiff and the dissent also argue that an ex parte interview is not a proper subject of a qualified protective order because 45 CFR 164.512(e)(l)(v)(B) requires the “return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.” Plaintiff argues that this provision thus contemplates that only “documentary” evidence will be the subject of a qualified protective order.7 We disagree. The distinction plaintiff makes between “documentary” information and other types of information is not one that exists in HIPAA. As previously discussed, “health information” explicitly includes “oral information,” and all individually identifiable health information transmitted or maintained in any form or medium is “protected health information” under HIPAA. 45 CFR 160.103. We see no logical reason that “protected health information” maintained in a physician’s records and conveyed verbally by a physician during an ex parte interview cannot be the subject of a qualified protective order under 45 CFR 164.512(e)(l)(v). The requirement in subsection (e)(l)(v)(B) to return or destroy “protected health information” applies to all protected health information, as the term is defined under HIPAA and its regulations.
Moreover, plaintiffs argument proceeds from the assumption that an ex parte interview never generates a physical record. This is simply incorrect. For instance, if the ex parte interview is conducted orally, a recording *445of the conversation could be produced. Alternatively, defense counsel and a physician might choose to conduct an ex parte interview via e-mail. And written documents may be exchanged at an ex parte interview. All of these records could be “returned” or “destroyed,” thus making the requirement of 45 CFR 164.512(e)(l)(v)(B) applicable, and defeating the argument that a qualified protective order cannot be fashioned for an ex parte interview under the plain meaning of the statute.
Plaintiff also argues that 45 CFR 164.512(e) does not allow ex parte interviews because defense counsel does not particularize the specific health information being sought in the interview, and that ex parte interviews lack adequate protections and limitations on the scope of disclosure. She argues that 45 CFR 164.512(e) “presumes that the parties are aware of the [protected health information] that has been requested before entry of a qualified protective order.” (Plaintiffs Reply Brief, pp 1-2.) She relies on the following language from 45 CFR 164.512(e)(l)(v): “ ‘For purposes of paragraph (e)(1) of this section, a qualified protective order means, with respect to protected health information requested under paragraph (e)(l)(ii) of this section, an order of the court....’” (Emphasis added by plaintiff.) 45 CFR 164.512(e)(1)(h), however, makes no reference to a request for specific health information. It simply provides that a covered entity may disclose protected health information “[i]n response to a subpoena, discovery request, or other lawful process” if the other requirements of the section are met. This is in contrast to 45 CFR 164.512(e)(l)(i), which permits disclosure in response to a court order. “provided that *446the covered entity discloses only the protected health information expressly authorized by such order[.]” (Emphasis added.)
Accordingly, we conclude that Michigan’s approach to informal discovery, which permits defense counsel to seek an ex parte interview with a plaintiffs treating physician, is not “contrary” to HIPAA. An ex parte interview may be conducted and a covered entity may disclose protected health information during the interview in a manner that is consistent with HIPAA, as long as “[t]he covered entity receives satisfactory assurance . . . that reasonable efforts have been made ... to secure a qualified protective order that meets the requirements of [45 CFR 164.512(e)(l)(v)].” 45 CFR 164.512(e)(l)(ii)(B).8
Nor does Michigan law concerning ex parte interviews “stand[] as an obstacle to the accomplishment and execution of the full purposes and objectives of” HIPAA — the second definition of “contrary” under 45 CFR 160.202. Plaintiff claims that allowing ex parte interviews frustrates HIPAA’s purpose of protecting the privacy of an individual’s health information. While HIPAA is obviously concerned with protecting the privacy of individuals’ health information, it does not enforce that goal to the exclusion of all other interests. Rather, it balances the protection of individual privacy with the need for disclosure in some situations. Thus, a covered entity may disclose pro*447tected health information: (1) to “[a] public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability,” 45 CFR 164.512(b)(i); (2) to an employer, if “[t]he covered entity is a covered health care provider who is a member of the workforce of such employer or who provides health care to the individual at the request of the employer” in order “[t]o evaluate whether the individual has a work-related illness or injury,” 45 CFR 164.512(b)(v)(A)(2); (3) “to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions,” 45 CFR 164.512(d)(1); and (4) “to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities authorized by the National Security Act,” 45 CFR 164.512(k)(2). Given HIPAA’s interest in balancing the need for disclosure in certain contexts with the importance of individual privacy, we cannot conclude that ex parte interviews are “contrary” to the objectives of HIPAA, as long as the interviews are sought according to the specific requirements of 45 CFR 164.512(e). Because we conclude that HIPAA does not preempt state law, we affirm the judgment of the Court of Appeals.
Finally, we emphasize that while we have been asked in this case to decide whether HIPAA permits defense counsel to seek an ex parte interview with a plaintiffs treating physician, 45 CFR 164.512(e)(1) is directed at covered entities, not parties or trial courts. HIPAA does not require a trial court to grant a motion for a protective order. Therefore, a trial court retains its discretion under *448MCR 2.302(C)9 to issue protective orders and to impose conditions on ex parte interviews.10
Similarly, 45 CFR 164.512(e)(1) addresses the circumstances under which a covered entity may disclose protected health information. Nothing in that provision, or in Michigan law, requires a covered entity to consent to an ex parte interview or to disclose protected health information during such an interview. See Domako, 438 Mich at 362 (“[TJhere is nothing in the court rules precluding an interview if the physician chooses to cooperate.”). As one commenter pointed out, “[t]he *449breadth of HIPAA and the substantial repercussions for HIPAA violations undoubtedly will cause healthcare providers to think twice before agreeing to ex parte interviews, even if defense counsel has a strong argument that HIPAA should not apply.” Comment, Don’t ask, don’t tell: HIPAA’s effect on informal discovery in products liability and personal injury cases, 2006 BYU L Rev 1075, 1098.
V CONCLUSION
Under Michigan law, nothing precludes defense counsel from seeking an ex parte interview with a plaintiffs treating physician once the plaintiff has waived the physician-patient privilege. Michigan law is not “contrary” to HIPAA within the first definition of that term under 45 CFR 160.202 because, under HIPAA, a covered entity may disclose protected health information during an ex parte interview if “[t]he covered entity receives satisfactory assurance... that reasonable efforts have been made... to secure a qualified protective order that meets the requirements of [45 CFR 164.512(e)(l)(v)].” 45 CFR 164.512(e) (1) (ii) (B); see also 45 CFR 160.202. Nor does Michigan law concerning ex parte interviews “stand as an obstacle to the accomplishment and execution of the full purposes and objectives of” HIPAA — the second meaning of “contrary” under 45 CFR 160.202 — given the balance HIPAA strikes between the protection of individual privacy and the necessity of disclosure in some contexts. Thus, HIPAA does not preempt Michigan law concerning ex parte interviews. Nothing in either HIPAA or Michigan law, however, requires a covered entity to agree to an informal ex parte interview with defense counsel, or to disclose protected health information during such an interview.
*450Accordingly, the trial court abused its discretion by denying defendant’s request for a qualified protective order on the grounds that HIPAA precludes ex parte interviews. The result reached by the Court of Appeals is affirmed, and this case is remanded to the trial court for further proceedings consistent with this opinion.
Kelly, C.J., and Cavanagh, Young, and Markman, JJ., concurred with Corrigan, J.Additionally, the Department of Health and Human Services (HHS), the federal agency charged with administering HIPAA, has provided the following gloss on its role under HIPAA:
The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, was enacted on August 21, 1996. Sections 261 through 264 of HIPAA require the Secretary of HHS to publicize standards for the electronic exchange, privacy and security of health information. Collectively these are known as the Administrative Simplification provisions. HIPAA required the Secretary to issue privacy regulations governing individually identifiable health information, if Congress did not enact privacy legislation within three years of the passage of HIPAA. Because Congress did not enact privacy legislation, HHS developed a proposed rule and released it for public comment on November 3, 1999. .. . The final modifications were published in final form on August 14, 2002. [U.S. Dept, of Health and Human Services, Office for Civil Rights, Summary of the HIPAA Privacy Rule at 1-2 (“HHS Summary”) (footnotes omitted). Available at: <http://www.hhs.gov/ ocr/privacy/hipaa/understanding/summary/privacysummary.pdf> (accessed May 14, 2010.)]
The HIPAA “Privacy Rule” promulgated by the HHS Secretary “establishes ... a set of national standards for the protection of certain health information.” Id. at 1. “The Privacy Rule standards address the use and disclosure of individuals’ health information— called ‘protected health information’ by organizations subject to the *435Privacy Rule — called ‘covered entities,’ as well as standards for individuals’ privacy rights to understand and control how their health information is used.” Id.
See also HHS Summary, supra at 3, citing 45 CFR 160.103 (“The Privacy Rule protects all ‘individually identifiable health information’ held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information ‘protected health information (PHI).’ ”).
MCL 600.2912Í, which became effective April 1, 1994, provides:
*438(1) A person who has given notice under [MCL 600.2912b] or who has commenced an action alleging medical malpractice waives for purposes of that claim or action the privilege created by [MCL 600.2157] and any other similar privilege created by law with respect to a person or entity who was involved in the acts, transactions, events, or occurrences that are the basis for the claim or action or who provided care or treatment to the claimant or plaintiff in the claim or action for that condition or a condition related to the claim or action either before or after those acts, transactions, events, or occurrences, whether or not the person is a party to the claim or action.
(2) Pursuant to subsection (1), a person or entity who has received notice under [MCL 600.2912b] or who has been named as a defendant in an action alleging medical malpractice or that person’s or entity’s attorney or authorized representative may communicate with a person specified in [MCL 600.5838a] in order to obtain all information relevant to the subject matter of the claim or action and to prepare the person’s or entity’s defense to the claim or action.
(3) A person who discloses information under subsection (2) to a person or entity who has received notice under [MCL 600.2912b] or to a person or entity who has been named as a defendant in an action alleging medical malpractice or to the person’s or entity’s attorney or authorized representative does not violate [MCL 600.2157] or any other similar duty or obligation created by law and owed to the claimant or plaintiff.
The dissent concludes that the introductory paragraph of 45 CFR 164.512, and the second sentence in particular, “specifically limits when a covered entity may disclose protected health information orallyl.Y We respectfully disagree. The paragraph provides, in full:
A covered entity may use or disclose protected health information without the written authorization of the individual, as described in § 164.508, or the opportunity for the individual to agree or object as described in § 164.510, in the situations covered by this section, subject to the applicable requirements of this section. When the covered entity is required by this section to inform the individual of, or when the individual may agree to, a use or disclosure permitted by this section, the covered entity’s information and the individual’s agreement may be given orally. [Emphasis added.]
The purpose of the introductory paragraph is to explain that, for the uses and disclosures described in the lettered subsections of 45 CFR 164.512, the general requirements of a “written authorization of the individual as described in § 164.508” and “the opportunity for the individual to agree or object as described in § 164.510” need not be met. The second sentence explains how the covered entity may inform the individual of the use or disclosure when required to do so, and how the individual may agree to the use or disclosure. This introductory paragraph does not govern the form of a use or disclosure of protected health information.
Alternatively, “a covered entity may disclose protected health information in response to lawful process described in [45 CFR 164.512(e)(l)(ii)] without receiving satisfactory assurance ... if the covered entity makes reasonable efforts... to seek a qualified protective order sufficient to meet the requirements of [45 CFR 164.512(e)(l)(iv)].” 45 CFR 164.512(e)(l)(vi) (emphasis added).
Other jurisdictions, which, like Michigan, permitted ex parte interviews before HIPAA, are in accord in determining that HIPAA did not disrupt state law practice and that this type of informal discovery request is permitted under HIPAA. See, e.g., Arons, supra; Reutter v Weber, 179 *444P3d 977 (Colo, 2007); Holmes v Nightingale, 2007 OK 15; 158 P3d 1039 (Okla, 2007); Smith v American Home Prod Corp, 372 NJ Super 105; 855 A2d 608 (NJ Super, 2003).
The dissent apparently agrees. It observes that “[a] verbal ex parte interview cannot be returned or destroyed at the conclusion of the litigation.”
The “reasonable efforts” language comes directly from 45 CFR 164.512(e), which unquestionably governs disclosures of protected health information for judicial or administrative proceedings. We disagree with the dissent’s unsupported assertion that 45 CFR 164.512(e) is “only applicable if there is a corresponding judicial or administrative procedure available under state law or court rule.” The dissent would apparently hold that 45 CFR 164.512(e) is not “applicable” in Michigan under any circumstances.
MCR 2.302(C) provides in relevant part:
On motion by a party or by the person from whom discovery is sought, and on reasonable notice and for good cause shown, the court in which the action is pending may issue any order that justice requires to protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense, including one or more of the following orders:
(1) that the discovery not be had;
(2) that the discovery may be had only on specified terms and conditions, including a designation of the time or place;
(3) that the discovery may be had only by a method of discovery other than that selected by the party seeking discovery;
(4) that certain matters not be inquired into, or that the scope of the discovery be limited to certain matters;
(5) that discovery be conducted with no one present except persons designated by the court[.]
A trial court’s decision on a motion for a protective order is reviewed for an abuse of discretion. PT Today, Inc v Comm’r of the Office of Fin. & Ins Servs, 270 Mich App 110, 151; 715 NW2d 398 (2006). Because we have determined that ex parte interviews can be the subject of a qualified protective order under HIPAA, where, as here, a trial court bases its denial of such a motion on the erroneous conclusion that such interviews are not allowed under HIPAA, its decision constitutes an abuse of discretion because it falls outside the range of reasonable and principled outcomes. Saffian v Simmons, 477 Mich 8, 12; 727 NW2d 132 (2007).