Reset A A Font size: Print

District Court, Nassau County, New York.


Decided: August 23, 2004

Lawrence N. Rogak, LLC, Oceanside, for defendant. Dash & Burns, Jericho, for plaintiff.

The defendant, Lumbermans Mutual Insurance Company, moves pursuant to CPLR 3103(a) for a protective order denying the plaintiff disclosure of the contents of the defendant's entire no-fault file with respect to this assignor.   The defendant contends that it has provided the plaintiff with NF-10's, payment letters and bills, “both the bills at issue in this lawsuit, and for those services defendant believes to represent overlapping and concurrent care, which was the basis for denial,” (affirmation of Steven D. Rhodes, Esq., dated October 31, 2003, emphasis supplied).   The defendant objects to the plaintiff being able to review the entire contents of its no-fault claims file.   The plaintiff, on the other, relying in part on prior decisions issued by this Court, contends that a review of the entire no-fault file will aid in the prosecution of the action and will permit it to discover those documents that led to the denial of the claim.

In this no-fault action, the plaintiff (a health service provider) seeks a judgment for health services allegedly rendered to Elaine McKeithan (the assignor) as a result of an automobile accident occurring on July 14, 2000.   The defendant provided no-fault insurance benefits to Ms. McKeithan at the time of the accident under a policy of insurance.   The plaintiff is seeking recovery of no-fault benefits from the defendant insurer in the sum of $2,950.36, together with statutory interest and attorneys fees, due to medical services provided to the plaintiff's assignor.

This action was commenced on or about March 14, 2002 by service of a summons and complaint upon the defendant.   The defendant answered the complaint on or about April 23, 2002, denying the central allegations in the complaint and raising several affirmative defenses.   The Court notes that the basis for the denial of claim was that the “fees [were] not in accordance with fee schedules” and that “concurrent care involves overlapping/excessive and/or common services”.

This Court stated in Ostia Medical, PC v. GEICO, 1 Misc.3d 907(A), 2003 N.Y. Slip Op. 51560(U), 2003 WL 23152964 (District Court Nassau County 2003):

“[a] protective order is designed to guard against disclosure abuses.   CPLR 3103(a) states, in relevant part, that:

“․ The Court may at any time on its own initiative, or on motion of any party or of any person from whom discovery is sought, make a protective order denying, limiting, conditioning or regulating the use of any disclosure device.   Such order shall be designed to prevent unreasonable annoyance, expense, embarrassment, disadvantage, or other prejudice to any person or the courts.”

Thus, pursuant to the CPLR and UDCA, a protective order may be used, no matter what disclosure device is implicated․

 The Court can regulate discovery, pursuant to a protective order, by directing the time, order, place and questions to be asked in an EBT, or dictating the disclosure devices to be used or combination thereof, and even by defraying the costs of a party's participation in the disclosure (see, Church & Dwight Co., Inc. v. UDDO & Associates, Inc., 159 A.D.2d 275, 552 N.Y.S.2d 277 [1st Dept. 1990];  Weeks Office Products, Inc. v. Chemical Bank, 178 A.D.2d 113, 577 N.Y.S.2d 10 [1st Dept. 1991] ).

Moreover, the Court has broad discretion in limiting or regulating the use of disclosure devices (see, Brignola v. Pei-Fei Lee, M.D., P.C., 192 A.D.2d 1008, 597 N.Y.S.2d 250 [3d Dept. 1993] ).

The arguments raised by the defendant concerning the purported immateriality and irrelevancy of the materials contained in the defendant's no-fault file have been addressed by this Court in CPT Medical Services PC a/o Sinchi v. Allstate Insurance Company, N.Y.L.J., July 1, 2003, p. 20, col. 3.   For the reasons stated in that decision, the Court rejects this argument of the defendant and need not repeat itself here.   See also Hudson Medical, P.C. v. Allstate Ins. Co., 183 Misc.2d 749, 704 N.Y.S.2d 437 (App. Term 2nd Dept. 1999).

However, the defendant has now raised a further argument concerning the release of the entire no-fault file that to do so would violate the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”, 42 USC 1320d;  45 CFR Part 160 and 164.).

“The modern-day legislative trend is to protect a medical patient's privacy (citation omitted).   Under HIPAA, ‘protected health information’ is broadly defined as any individually-identifiable health information which was created by, among others, a health care provider, and which relates to, inter alia, the past, present, or future physical or mental health or condition of an individual (citations omitted).   HIPAA and its supporting regulations, inter alia, established standards and procedures for the collection and disclosure of protected health information to prevent its wrongful disclosure,” Gunn v. Sound Shore Medical Center of Westchester, 5 A.D.3d 435, 772 N.Y.S.2d 714 (2nd Dept. 2004).  “HIPAA provides that a party deemed to be a ‘covered entity’ may not use or disclose protected health information except for in treatment, or for payment or healthcare operations of the individual patient, or to the individual patient, without receiving a proper authorization.   A ‘covered entity’ is defined as (1) a health plan, (2) a health care clearinghouse, or (3) a health care provider who transmits any health information in electronic form, as prescribed by the regulations,” Lewis v. Clement, 1 Misc.3d 464, 766 N.Y.S.2d 296 (Supreme Court Monroe County 2003).

 “Except as otherwise provided herein, the standards, requirements, and implementation specifications of this subpart apply to covered entities with respect to protected health information,” 45 CFR 164.500(a).   The plaintiff argues that the defendant is not a “covered entity” under HIPAA in that automobile medical payment insurance is an excepted benefit, see 42 USC 300gg(c)(1)(E), and hence not subject to the requirements of HIPAA. This Court respectfully disagrees.   The defendant is a “health plan” as defined under 45 CFR 160.103 in that it is “an individual or group plan that provides, or pays the cost of, medical care”, which is defined elsewhere as amount paid for “the diagnosis, cure, mitigation, treatment, or prevention of disease, or amounts paid for the purpose of affecting any structure or function of the body,” 42 USC 300gg-91(a)(2)(A).   The New York State Insurance Department, in an opinion letter dated July 8, 2003, indicated that “[a]n insurer that offers health insurance, in addition to either worker's compensation or No-Fault insurance, would, unless it opts to be a hybrid entity, 45 CFR 164.103, be a covered entity.”   Thus, the Court finds that Lumbermans Mutual Casualty Company, a member of the Kemper Insurance Companies and Unitrin, Inc., to be a covered entity.   As a result, the release of protected health information must be limited to “to the minimum necessary to accomplish the intended purpose of the use, disclosure or request,” 45 CFR 164.502.   While the provider may (and in fact must if it wants payment under no-fault) transmit protected health information, see, e.g. 11 NYCRR 65.12, the defendant is more restricted with its disclosure under HIPAA.   The form NF-2 does not permit a blanket release of medical information, either to the plaintiff or otherwise.

 It is apparent to this Court that there are two competing principles at work here.   On the one hand, a claimant has the right under HIPAA to avoid unnecessary disclosure of his or her protected medical information and condition.   To permit the release of medical information on conditions completely unrelated to the no-fault treatment by provider 1 without the express authorization of the claimant would fly directly in the face of HIPAA.   On the other hand, to permit the defendant to be the gatekeeper of all medical information and to permit its release only after further proceedings before an already taxed court would run afoul of the full disclosure premises of Article 31 of the CPLR. This is not a situation where a health care provider is receiving protected health information in order to treat the claimant.   Rather, the information is being sought to be used by the plaintiff's attorneys in order to secure payment.

Thus, it is the holding of this Court that if the plaintiff presents a valid authorization complying with the HIPAA regulations, to wit:  45 CFR 164.508(a)(1), the plaintiff is entitled to review the defendant's no-fault claims file, subject to privileged and protected material as specified in the Ostia and CPT decisions, supra.   It is clear to this Court that a claimant must be made aware that his or medical information will be revealed to the plaintiff something a claimant may or may not want.   The core elements of a valid authorization contain the information to be disclosed, the name of the recipient, a description of “each purpose of the requested use or disclosure”, an expiration date, together with statements concerning the signer's right to revoke the authorization, et al.  45 CFR 164.508(c).  The mere submission of an NF-2 is insufficient to comply with HIPAA.   See 45 CFR 164.508(a)(1).   The rights of the patient's privacy need to be preserved under HIPAA.

However, as the claimant is seeking third-party payment for services rendered, a more limited assignment signed by the claimant will permit the medical provider to obtain from the defendant those items directly bearing on the services rendered and any denial issued.   It is clear that by seeking payment of the medical costs, the claimant has placed her condition in controversy with respect to those services rendered by the provider and for which payment is sought, CPLR 3121(a).   The plaintiff has attached to its complaint an opinion letter by the New York Insurance Department, dated May 11, 1998.   The letter reads, in relevant part, “based on the foregoing definition, as long as the two providers are performing two different and distinct treatments it should not be classified as concurrent care.   If the insurer and medical provider disagree on what should be classified as concurrent care, and a denial is then issued, the dispute may be brought before an arbitrator or court of competent jurisdiction for final resolution.”   See also Universal Acupuncture Pain Services, P.C. v. Lumbermens Mutual Casualty Company, 195 Misc.2d 352, 758 N.Y.S.2d 795 (N.Y.C. Civil Court Queens County 2003).

Thus, in the present case, the motion of the defendant is granted in part.   As the assignment does not constitute a valid authorization under HIPAA 1 , the plaintiff is entitled to disclosure of all documents and materials specifically concerning the alleged concurrent treatment only.   This case does not involve medical necessity of treatment rather, concurrent care.   The plaintiff is entitled to those documents in this case which concern the issue of concurrent care, whether relied upon by other providers or in peer reviews.   Within thirty (30) days of the date of this Order, the defendant shall provide the plaintiff, if not already provided, with copies of all documents, independent medical examinations, bills, et al. which concern treatment to the claimant's right shoulder, lower back, cervical or lumbar spine or neck.   Such therapies shall include massage, ultrasound, mechanical traction, electric stimulation, hot and cold packs and therapeutic exercises and activities performed by any provider.   If the defendant fails to turn over any such documents or materials, it shall be precluded from offering such materials and items at trial, whether through direct use or through the testimony of an expert witness who has reviewed such documents in the formulation of his or her opinion.

Based on the foregoing, this Court declines in this case to permit the disclosure of protected health information of the entire no-fault file.   See 45 CFR 164.512(e).

This constitutes the decision and Order of the Court.


1.   The assignment reads, in relevant part, that “I hereby instruct and direct the _ Insurance Company to pay by check made out to mailed directly to ․ or if my current policy prohibits direct payment to doctor, then I hereby also instruct and direct you to make out the check to me and mail it as follows․ For professional or medical expense benefits allowable and otherwise payable to me under my current insurance policy as payment toward the total charges for professional services rendered.   THIS IS A DIRECT ASSIGNMENT OF MY RIGHTS AND BENEFITS UNDER THE POLICY.․  I also authorize the release of any information pertinent to my case to any insurance company, adjuster, or attorney involved in this claim.”   Further, the application for No-Fault benefits provides that “This authorization or photocopy hereof will authorize you to furnish all information you may have regarding my condition while under your observation or treatment, including the history obtained, X-ray and physical findings, diagnosis and prognosis.   You are authorized to provide this information in accordance with the NEW TO COMPREHENSIVE AUTOMOBILE REPARATIONS ACT (NO-FAULT LAW).”   Neither statement complies with 45 CFR 164.508(c).