*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
Electronically Filed
Supreme Court
SCCQ-15-0000300
13-JUN-2016
08:04 AM
IN THE SUPREME COURT OF THE STATE OF HAWAII
---oOo---
________________________________________________________________
PACIFIC RADIATION ONCOLOGY, LLC, a Hawaii Limited Liability
Corporation, et al., Plaintiffs-Appellants,
vs.
THE QUEEN’S MEDICAL CENTER, a Hawaii Non-Profit Corporation,
et al., Defendants-Appellees.
________________________________________________________________
SCCQ-15-0000300
CERTIFIED QUESTION FROM THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF HAWAII
(CIVIL NO. 12-00064 LEK-KSC)
JUNE 13, 2016
RECKTENWALD, C.J., NAKAYAMA, McKENNA, POLLACK, AND WILSON, JJ.,
WITH RECKTENWALD, C.J., CONCURRING SEPARATELY
OPINION OF THE COURT BY McKENNA, J.
I. Introduction
This court has been asked to provide guidance to the United
States District Court for the District of Hawaii (“District
Court”) on questions of Hawaii law. At issue is whether the
parties may use, or be compelled to produce, the confidential
medical records of over 100 cancer patients, in an effort to
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
prosecute or defend against claims that the Plaintiff doctors
steered these patients away from treatment at Defendant Queens
Medical Center. The patients are not parties to the underlying
lawsuit, although 19 of them have been granted intervenor
status. All of them have intervened solely to assert their
right to privacy and seek a prohibition on the use and
production of their medical records.
The District Court1 certified the following questions to
this court:
1. May a third party who is in lawful possession of a
patient’s confidential medical records use, or be compelled
to produce, these records in litigation where the patient
is not a party?
2. If a third party may use and/or produce a patient’s
confidential medical records in litigation, is a de-
identification process sufficient to protect the patient’s
privacy interests where the third party already allowed its
agents access to the patient’s records and its agents
inadvertently made part of the patient’s medical
information public?
This court may “reformulate the relevant state law questions as
it perceives them to be, in light of the contentions of the
parties.” Allstate Ins. Co. v. Alamo Rent-A-Car, Inc., 137 F.3d
634, 637 (9th Cir. 1998) (citations and quotation marks
omitted). To avoid confusion, we reformulate the certified
questions to clarify that the term “party” refers to the parties
to the litigation, not to the parties to the physician-patient
relationship. We believe that the “parties” in this case are
the plaintiffs and defendants, and the “third parties” in this
1
The Honorable Leslie E. Kobayashi, United States District Judge,
presided.
2
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
case are the patient intervenors. We also reformulate the
question so that a negative answer to the first certified
question will not preclude us from answering the second
certified question to the extent we can. Therefore, the
reformulated certified questions are:
1. May a party who is in lawful possession of a patient’s
confidential medical records use, or be compelled to
produce, these records in litigation where the patient is
not a party?
2. Is a de-identification process sufficient to protect
the patient’s privacy interests where the party already
allowed its agents access to the patient’s records and its
agents inadvertently made part of the patient’s medical
information public?2
Hawaii Rules of Appellate Procedure (“HRAP”) Rule 13 (2000)
governs certified questions. It provides, in relevant part,
“When a federal district . . . court certifies to the Hawaii
Supreme Court that there is involved in any proceeding before it
a question concerning the law of Hawaii that is determinative of
the cause and that there is no clear controlling precedent in
the Hawaii judicial decisions, the Hawaii Supreme Court may
answer the certified question by written opinion.” We therefore
confine our answer to the “law of Hawaii that is determinative
2
Defendant urges us to reformulate the certified questions to include
the following “threshold question”: “Does [Hawaii Revised Statutes (“HRS”) §
431:10C-]308.7(c) apply to all self-referral involving insured services
covered by H.R.S. Chapter 431 or only to those involving no-fault auto-
related services?” We decline to do so. We note that the District Court has
already concluded that that statute does not apply to health care provider
referrals and is “limited to the context of motor vehicle insurance” in an
Order Granting in Part and Denying in Part Plaintiffs’ Motion for Summary
Judgment on the Counterclaim. The present certified question is not the
proper vehicle through which Defendant may challenge that order.
3
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
of the cause,” namely article I, section 6 of the Hawaii
Constitution. That constitutional provision states, in relevant
part, “The right of the people to privacy is recognized and
shall not be infringed without the showing of a compelling state
interest.”
We answer the first certified question in the negative.
Article I, section 6 of the Hawaii Constitution protects the
health information of patient intervenors to this case.
Pursuant to that provision, and under the facts of this case,
the parties cannot use, or be compelled to produce, confidential
patient medical records in litigation where the patient is not a
party, absent a compelling state interest.
As to the second certified question, we do not address
whether sufficient de-identification is possible where one party
already allowed its agents access to the patient’s records and
its agents inadvertently made part of the patient’s medical
information public. The de-identification process and
requirements are set forth under the Health Insurance
Portability and Accountability Act of 1996 (“HIPAA”), Pub L. No.
104-191, 110 Stat. 1936 (1996), and its corresponding
regulations; therefore, the sufficiency of de-identification
does not “concern[] the law of Hawaii that is determinative of
the cause.” HRAP Rule 13. Whether the use and production of
4
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
de-identified medical records is “sufficient to protect the
patient’s privacy interests,” however, is a question this court
can address under article I, section 6. We hold that the use
and production of de-identified medical information of patients
who are not parties to the litigation violates those patients’
right to privacy under article I, section 6 of the Hawaii
constitution, as no compelling state interest has been shown in
this case.
II. Background
The Plaintiffs in this case are Pacific Radiation Oncology,
LLC; PRO Associates, LLC; John Lederer, M.D.; Vincent Brown,
M.D.; Paul DeMare, M.D.; Thanh Huynh, M.D.; Laeton Pang, M.D.;
and Eva Bieniek, M.D. (collectively, “PRO”). The Plaintiffs
filed an Amended Complaint for Declaratory and Injunctive Relief
and for Damages (“Amended Complaint”) against Defendants Queens
Medical Center and Queens Development Corporation (collectively
“QMC”).3 The Amended Complaint alleged that the Plaintiffs “had
a long-standing, 40-year relationship with QMC to provide
professional radiation oncology therapy services to PRO patients
at facilities owned by QMC, using equipment, technician support,
and other services provided by QMC.” QMC is the only Nuclear
Regulatory Commission-approved hospital at which radiation
3
The Plaintiffs also named as defendants the individual members of the
Queens Medical Center Board of Trustees. The parties later stipulated to
dismiss, without prejudice, these individuals.
5
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
oncologists can operate on patients. Plaintiffs also
acknowledged that they had “a one-third interest in The Cancer
Centers of Hawaii [‘TCCH’],” a competitor of QMC.
According to the Amended Complaint, QMC notified Plaintiffs
that the QMC Board had decided to convert QMC to a “closed
radiation therapy department,” meaning that only physicians
employed by QMC could exercise clinical privileges to provide
professional radiation oncology services at QMC. QMC explained
that it arrived at its decision to terminate PRO’s privileges
after determining that PRO had “transferr[ed] patients to other
facilities for no medical reason or patient request. . . .”
Plaintiffs alleged in their Amended Complaint that QMC’s action
was intended to destroy their ability to treat patients at
facilities competing with QMC.
Plaintiffs’ Amended Complaint raised ten claims for relief:
a claim of denial of procedural and substantive due process; a
claim of violation of QMC bylaws and governing regulations;
three separate claims of intentional and tortious interference;
four separate claims of unfair, deceptive, anti-competitive and
illegal trade practices in violation of HRS Chapter 480; and a
claim of breach of fiduciary duty and bad faith owed to a
partner.
QMC filed an Answer and Counterclaim. Relevant to this
certified question, QMC counterclaimed that Plaintiffs Lederer,
6
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
Brown, DeMare, Huynh, and Pang “consulted with and/or began
treatment of patients referred to them at QMC and then induced
the patients to receive treatment at TCCH without making timely
written disclosure of their ownership interests in TCCH,” which
constituted unfair competition in violation of HRS § 480-2.
During the course of the litigation, QMC’s law firm
publicly filed a list naming 132 patients PRO was alleged to
have diverted to TCCH; also included were the patients’ QMC
identification numbers and the PRO doctors who consulted and
treated each patient. The list was attached as an exhibit to
(1) a subpoena to TCCH’s custodian of records and (2) a
discovery request to PRO. The filing was subsequently sealed.
Plaintiffs then moved for a temporary restraining order or
preliminary injunction to prevent further violations of patient
privacy. In their moving papers, they alleged that QMC had
accessed the electronic medical records of 133 cancer patients,
without consent, to determine if Plaintiffs were directing
patients to TCCH, and, if so, how much revenue QMC lost as a
result. Plaintiffs argued that cancer patient medical records
would likely include “history and physicals” information
regarding “the most confidential and sensitive inquiries,
including prior pregnancies, abortions, sexual activities,
potency, drug use, psychological issues, depression, AIDS info,
family history, prior diseases, substance dependency, etc.,
7
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
etc.” QMC’s alleged breach of patient privacy culminated in the
disclosure of 132 of the patients’ names in the exhibits to the
subpoena and discovery request. Plaintiffs sought to enjoin
“QMC, its attorneys, and its consultants from reviewing and more
importantly from publishing the highly confidential information
including the names of these many, many cancer patients.”
The District Court granted in part, and denied in part, the
Plaintiffs’ motion. Construing the Plaintiffs’ pleading as a
discovery motion, the District Court granted it, in part, and
sanctioned defense counsel for publicly filing the list naming
the 132 cancer patients, in willful violation of the parties’
Amended Stipulated Protective Order. The District Court denied
the motion for a TRO and/or preliminary injunction, in part,
because the Plaintiffs’ Amended Complaint alleged no claims of
improper review and use of confidential patient information.4 As
to whether the Plaintiffs could prevent Defendants from
obtaining or using confidential patient information, the
District Court concluded that “the parties must address these
issues through the normal discovery process.”
The Magistrate Judge, in turn, issued his Order Regarding
Discovery Issues. He found the 132 cancer patients’
confidential medical records to be relevant to the parties’
4
The United States Court of Appeals for the Ninth Circuit affirmed the
denial. Pacific Radiation Oncology, LLC v. Queen’s Medical Center, 810 F.3d
631 (9th Cir. 2015).
8
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
claims and counterclaims. He ordered the records discoverable
as follows:
Although the patient medical records contain protected
health information (“PHI”), this does not preclude their
discovery. As noted by Judge Kobayashi in the TRO Order,
“[o]nce health information has been deidentified, it is no
longer protected by HIPAA” or state law. TRO Order at 29.
It reasonably follows that PHI is discoverable if de-
identified. Accordingly, the 132 patient medical records
shall be de-identified. Upon de-identification, the
medical records will be discoverable and shall be produced.
The Plaintiffs appealed the Magistrate Judge’s decision to the
District Court. After granting 19 affected patients’ motion to
intervene, the District Court reserved ruling on the Plaintiffs’
appeal and certified the instant questions to this court.
III. Discussion
Article I, section 6 of the Hawaii Constitution is entitled
“Right to Privacy,” and it provides, “The right of the people to
privacy is recognized and shall not be infringed without the
showing of a compelling state interest. The legislature shall
take affirmative steps to implement this right.” In the context
of patient medical records, this court has issued three
decisions construing article I, section 6 on petitions for writ
of mandamus: Brende v. Hara, 113 Hawaii 424, 153 P.3d 1109
(2007) (per curiam); Naipo v. Border, 125 Hawaii 31, 251 P.3d
594 (2011) (per curiam); and Cohan v. Ayabe, 132 Hawaii 408, 322
P.3d 948 (2014).
9
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
Each of the mandamus petitioners in these cases sought to
compel the respondent judges to issue orders limiting and/or
prohibiting the use of patient medical records. The mandamus
petitioners in Brende and Cohan were both plaintiffs in tort
litigation in which their medical condition and treatment were
at issue. The petitioner in Naipo, on the other hand, was not a
party to the litigation. Rather, in Naipo, the parties to a
dog-bite lawsuit sought discovery of a non-party’s patient
medical records. This distinction is key in the instant
proceedings, which involve patient intervenors who are not
parties to the lawsuit between Plaintiffs and QMC. Each of
these cases will be discussed in turn, below.
Brende, Cohan, and Naipo all provide strong privacy
protection over patient medical records. In Brende, this court
held, “Petitioners’ health information is ‘highly personal and
intimate’ information that is protected by the informational
prong of article I, section 6. The constitutional provision
protects the disclosure outside of the underlying litigation of
petitioners’ health information produced in discovery.” 113
Hawaii at 430, 153 P.3d at 1115 (footnote omitted). This
holding was reaffirmed in Cohan. See 132 Hawaii at 410, 322
P.3d at 950 (“[T]he privacy provision of the Hawaii
Constitution, article I, section 6, protects [the petitioner’s]
10
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
health information against disclosure outside the underlying
litigation.”)
The holding in Brende and Cohan applies to situations in
which a party to litigation seeks to limit and/or prohibit the
disclosure, outside of discovery, of his or her own patient
medical records. While that is not the situation in the present
case (where non-parties seek to prohibit the use and disclosure
of their patient medical records), we turn to Brende and Cohan
for their exploration of the constitutional history behind
article I, section 6.
Brende noted that the framers viewed the Hawaii
constitutional right to privacy as follows:
[T]he [article I, section 6] right of privacy encompasses
the common law right of privacy or tort privacy. This is a
recognition that the dissemination of private and personal
matters, be it true, embarrassing or not, can cause mental
pain and distress far greater than bodily injury. For
example, the right can be used to protect an individual
from invasion of [the individual’s] private affairs, public
disclosure of embarrassing facts, and publicity placing the
individual in a false light. In short, this right of
privacy includes the right of an individual to tell the
world to “mind your own business.”
113 Hawaii at 430, 153 P.3d at 1115 (quoting Stand. Comm. Rep.
No. 69, in Proceedings of the Constitutional Convention of
Hawaii of 1978 (“Proceedings”), Vol. 1, at 674).
So inviolable is this right that the framers sought to
shield individuals from “possible abuses in the use of highly
personal and intimate information in the hands of government or
private parties. . . .” Comm. Whole Rep. No. 15, in
11
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
Proceedings, at 1024 (emphasis added). In this way, article I,
section 6 provides Hawaii’s people with powerful protection
against any infringement of their right to privacy, by state and
private actors. In fact, we have previously noted that the
framers “equated privacy in the informational sense” with the
“common law right of privacy,” so that “[o]ne who gives
publicity to a matter concerning the private life of another is
subject to liability to the other for invasion of his [or her]
privacy, if the matter publicized is of a kind that (a) would be
regarded as highly offensive to a reasonable person, and (b) is
not of legitimate concern to the public.” State of Hawaii
Organization of Police Officers (“SHOPO”) v. Soc’y of Prof’l
Journalists, 83 Hawaii 378, 398, 927 P.2d 386, 406 (1996)
(citing Stand. Comm. Rep. No. 69, Proceedings, at 674; and
Restatement (Second) of Torts § 652D, 383 (1977)). There is no
requirement that the one invading another individual’s privacy
be a state actor. See, e.g., SHOPO, 83 Hawaii 378, 927 P.2d 386
(analyzing whether a non-state actor’s, e.g., an organization of
journalists, access to police officer disciplinary records would
violate the officers’ constitutional privacy rights).
Article I, section 6 generally provides greater privacy to
Hawaii’s people than its federal analogs. The Hawaii
constitutional right to privacy is a “fundamental right for
12
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
purposes of constitutional analysis.” Cohan, 132 Hawaii at 415,
322 P.3d at 955 (quoting Comm. Whole Rep. No. 15, in
Proceedings, at 1024). We view article I, section 6 as
“afford[ing] much greater privacy rights than the federal right
to privacy. . . .” Janra Enters., Inc. v. City & Cty. of
Honolulu, 107 Hawaii 314, 320, 113 P.3d 190, 196 (2005)
(citation omitted).
Article 1, section 6 also provides more stringent
protection5 over patient medical records than does HIPAA.6 This
conclusion was implicit in Cohan, where a provision in a
Stipulated Qualified Protection Order that provided that the
5
45 C.F.R. § 160.202(6) provides
More stringent means, in the context of a comparison of a
provision of State law and a standard, requirement, or
implementation specification adopted under subpart E of
part 164 of this subchapter, a State law that meets one or
more of the following criteria: . . . .
With respect to any other matter, provides greater privacy
protection for the individual who is the subject of the
individually identifiable health information.
That regulation also defines “state law” to include a state’s constitution
and common law. Id.
6
We therefore are not persuaded by QMC’s contention that “Hawaii’s
constitutional right of privacy is coextensive with HIPAA.” In support of
this argument, QMC points to HRS Chapter 323B, Hawaii’s Health Care Privacy
Harmonization Act, specifically section 3(a) in that chapter, which states in
relevant part that a covered entity or business associate’s use or disclosure
of individually identifiable health information that complies with HIPAA
“shall be deemed to comply with all state laws relating to the use,
disclosure, or confidentiality of such information.” HRS § 323B-4(6) (2010 &
Supp. 2012), however, provides, “Nothing in this chapter shall be construed
to . . . [l]imit or otherwise affect any evidentiary privilege, limitation on
discovery, or confidentiality protection provided by any state law, decision,
or order in relation to individually identifiable health information sought,
used, or produced in any judicial or administrative proceeding.” Therefore,
the intervenors’ constitutional right to privacy in their confidential
medical records is unaffected by Chapter 323B. In other words, honoring an
individual’s right to privacy in his or her protected health information
requires more than bare compliance with HIPAA.
13
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
defendant hotel could use a tort plaintiff’s health information
in its internal reviews was invalidated under article I, section
6, yet we noted that “[a]n analysis under HIPAA arguably may
lead to a different result.” 132 Hawaii at 419, 419 n.18, 322
P.3d at 959, 959 n.18.
The right to privacy is absolute where, as here, the
individuals seeking to protect patient medical records, in
discovery and beyond, are not parties to the litigation, have
not consented to the use of their patient medical records in
relation to the present lawsuit, and no compelling state
interest has been shown. Naipo is a case “on all fours” with
the instant case. In Naipo, plaintiff Eshell Mitchell sued the
Yuen family in state court for multiple leg injuries she
sustained when the Yuens’ dog, Braddah, bit her. 125 Hawaii at
33, 251 P.3d at 596. As part of her negligence claim, Mitchell
sought to establish that Braddah had previously bitten Jennifer
Naipo. See id. Mitchell issued a subpoena duces tecum to
Wahiawa General Hospital for production of Naipo’s medical
records. See id. The respondent judge denied Naipo’s motion to
quash the subpoena and ordered the hospital to turn over Naipo’s
medical records for an in camera inspection. 125 Hawaii at 34,
251 P.3d at 597.
14
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
Naipo then petitioned this court for a writ of mandamus,
arguing that her health information was protected by, inter
alia, her right to privacy under article I, section 6 of the
Hawaii constitution. Id. We granted Naipo’s petition for
mandamus relief and ultimately directed the respondent judge to
quash the subpoena duces tecum. 125 Hawaii at 37, 251 P.3d at
600. We unequivocally held, “Petitioner Jennifer Naipo is not a
party to Eshell Mitchell’s lawsuit against the Yuens. Her
health information in her medical records at Wahiawa General
Hospital is protected by her constitutional right to privacy.”7
125 Hawaii at 35, 251 P.3d at 598.
Naipo’s holding provides our answer to the first certified
question, which is, “May a party who is in lawful possession of
a patient’s confidential medical records use, or be compelled to
produce, these records in litigation where the patient is not a
party?” We hold that, pursuant to article I, section 6 of the
Hawaii Constitution, and under the facts of this case, the
parties cannot use, or be compelled to produce, confidential
patient medical records in litigation where the patient is not a
party, where no compelling state interest has been shown.
7
Our decision also rested on the twin holding that Naipo’s confidential
medical records “deserve[d] the protection of the physician-patient privilege
of [Hawaii Rules of Evidence] Rule 504,” which Naipo had not waived. 125
Hawaii at 35, 36, 251 P.3d at 598, 599. We therefore are not persuaded by
QMC’s argument that Naipo “held that the medical records were protected from
disclosure to the trial judge on physician patient privilege grounds rather
than privacy.”
15
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
The second certified question is, “Is a de-identification
process sufficient to protect the patient’s privacy interests
where the party already allowed its agents access to the
patient’s records and its agents inadvertently made part of the
patient’s medical information public?” We doubt, under the
circumstances of this case where there has been an egregious
breach of patient confidentiality by QMC both internally and
publicly, that de-identification is possible. However, the
question of the sufficiency of de-identification where one party
already allowed its agents access to the patient’s records and
its agents inadvertently made part of the patient’s medical
information public, is ultimately a matter of compliance with
HIPAA, which is a federal question we need not answer. We can
address under Hawaii law, however, that part of the second
certified question asking if de-identification could
sufficiently protect the patients’ privacy rights. We answer
that part of the second certified question in the negative.
In Cohan, we held, “To allow [a party’s medical]
information to be used outside the litigation, regardless of
whether it is de-identified or not, would reach beyond what the
Hawaii Constitution permits in the absence of a showing of a
compelling state interest.” 132 Hawaii at 419, 322 P.3d at 959.
16
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
In Cohan, we noted that the de-identification process under
HIPAA is “extremely complex and problematic,” and that, “[a]part
from these technical considerations, there is the very
complicated issue as to whether a patient has a legitimate basis
for being concerned about what happens to their personal health
information once it is de-identified.” 132 Hawaii at 417, 418,
322 P.3d at 957, 958 (footnote omitted). We quoted the
following observation from the Seventh Circuit Court of Appeals
with approval: “Even if there were no possibility that a
patient’s identity might be learned from a redacted medical
record, there would still be an invasion of privacy.” Cohan,
132 Hawaii at 418, 322 P.3d at 958 (citing Nw. Mem’l Hosp. v.
Ashcroft, 362 F.3d 923, 929 (7th Cir. 2004)). Such an invasion
could produce undesirable effects upon patient health care,
including “social and psychological harm through embarrassment,
economic harm through job discrimination and job loss, patient
difficulty in obtaining health insurance, health care fraud, and
patient reluctance to share sensitive information with their
doctors or pharmacists.” 132 Hawaii at 418, 322 P.3d at 958
(quoting Christopher R. Smith, Somebody’s Watching Me:
Protecting Patient Privacy in Prescription Health Information,
36 Vt. L. Rev, 931, 943 (2012)).
17
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
Further, we observed that “the risk of re-identification
remains, as there is ‘no national, uniform standard governing
the level of identifier-stripping necessary to guarantee that
de-identified data cannot be re-identified.” 132 Hawaii at 418
n.16, 322 P.3d at 958 n.16 (quoting Smith, supra, at 935). The
risk of re-identification poses “subjective privacy concerns”
for some patients, who object to the “dehumanization [in] having
one’s most intimate information circulated by an indifferent and
faceless infrastructure without any control over the process or
content.” Id. (quoting Will Thomas DeVries, Protecting Privacy
in the Digital Age, 18 Berkeley Tech. L.J., 283, 298 (2003)).
We believe the same concerns underlying the use of de-
identified medical records beyond litigation for parties to a
lawsuit exist for individuals who are not parties to litigation
and who have therefore not put their medical condition and/or
treatment at issue in the first instance. Just as article I,
section 6 protects parties from the use and production of their
de-identified information outside of litigation, we conclude
that article I, section 6 protects individuals from the use and
production of their de-identified information in litigation to
which they are not parties. Thus, the use and production of
even sufficiently de-identified medical records, under the
circumstances of this case, will not adequately protect the
patients from an invasion of their privacy.
18
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
We acknowledge that Cohan also stated the following:
Once health information has been de-identified, it is no
longer protected by HIPAA. Further, because HIPAA allows
“more stringent” state law to preempt federal law only when
it relates to the privacy of “individually identifiable
health information,” 45 C.F.R. § 160.203(b), this leads to
the conclusion that state law also does not protect de-
identified information. Nw. Mem’l Hosp., 362 F.3d at 926.
132 Hawaii at 417, 322 P.3d at 957 (latter emphasis added). We
consider the last statement to be an accurate summary of the
holding in Nw. Mem’l Hosp., which was, more specifically, that
Illinois’ medical-records privilege, while providing “more
stringent” state law protection of “individually identifiable
health information,” was no barrier to the discovery of de-
identified health information. See also Zyprexa Prods. Liab.
Litig., 254 F.R.D. 50, 52 (E.D.N.Y. 2008) (similarly concluding,
“the States’ [physician-patient] privilege laws pose no obstacle
to the discovery of [patient] medical records, provided those
records are de-identified.”).
By contrast, our express holding in Cohan was, “To allow [a
party’s medical] information to be used outside the litigation,
regardless of whether it is de-identified or not, would reach
beyond what the Hawaii Constitution permits in the absence of a
showing of a compelling state interest.” 132 Hawaii at 419, 322
P.3d at 959. Extending Cohan to cases in which parties seek to
use and produce the medical records of non-parties, we hold that
to allow an individual’s medical information, even if de-
19
*** FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER ***
identified, to be used in litigation to which that individual is
not a party, would reach beyond what the Hawaii Constitution
permits in the absence of a showing of a compelling state
interest. In this case, QMC has made no such showing, and we do
not believe that a compelling state interest exists in
infringing upon the Hawaii state constitutional privacy rights
of over 100 cancer patients in order to resolve what is
essentially a contract dispute between competing cancer
treatment providers.
IV. Conclusion
We answer both certified questions in the negative.
Article I, section 6 of the Hawaii Constitution protects the
health information of patient intervenors to this case.
Pursuant to that provision, the parties cannot use, or be
compelled to produce, confidential patient medical records, even
if sufficiently de-identified, in litigation where the patient
is not a party, as no compelling state interest has been shown.
/s/ Mark E. Recktenwald
/s/ Paula A. Nakayama
/s/ Sabrina S. McKenna
/s/ Richard W. Pollack
/s/ Michael D. Wilson
20