Angulo v. Providence Health & Services Washington

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE 10 CAROLINE ANGULO, et al., CASE NO. C22-0915JLR 11 Plaintiffs, ORDER v. PROVIDENCE HEALTH & SERVICES WASHINGTON, et al., Defendants.

I. INTRODUCTION Before the court is the parties’ joint motion requesting that the court enter either Plaintiffs Caroline Angulo, Eric Keller, Isabel Lindsey, and Charles Lindsey’s (collectively, “Plaintiffs”) or Defendant Providence Health & Services Washington’s (“Providence”) proposed protective order. (Joint Statement (Dkt. # 67); Pls’ Prop. Order (Dkt. # 67-5); Providence’s Prop. Order (Dkt. # 67-4).) The parties indicate that they reached agreement on the terms of a protective order with seven exceptions. (See Joint Statement at 3-10; see also infra §§ II.A-G.) The court has reviewed the parties’ joint submissions and directs the parties to enter a proposed stipulated protective order consistent with this order.

4 II. ANALYSIS 5 The court reviews each of the parties’ disputed proposed revisions to the Western District of Washington’s model protective order and resolves the disputes.

7 A. Scope 8 The parties have agreed to add a paragraph to the model order’s “Scope” paragraph (Section 3) that explicitly places certain material beyond the scope of the protective order. (See Pls’ Prop. Order at 2-3; Providence’s Prop. Order at 2-3.)

11 However, the parties disagree about some of the language in that paragraph.

12 Providence’s proposed order provides that certain material will be exempt from the order “except as required by [the Health Insurance Portability and Accountability Act (‘HIPAA’)], RCW Ch. 70.02, or other statutory or regulatory privacy protections.”

15 (Providence’s Prop. Order at 2-3.) Providence’s proposed order further exempts material “lawfully and properly” in the public domain. (Id.) Providence argues that both clauses are necessary to comply with its obligations to protect its patients’ protected healthcare information (“PHI”).1 (Joint Statement at 3-4.) Plaintiffs’ proposed order does not HIPAA and its implementing regulations define the information within their ambit as “protected health information,” while Washington’s Uniform Health Care Information Act (“UHCIA”) refers to “health care information.” Compare 45 C.F.R. § 160.103 (defining “protected health information” as individually identifiable health information”), with RCW 70.02.010(17) (defining “health care information” as “any information . . . that identifies or can include either of these phrases. (See Pls’ Prop. Order at 2-3; see generally Joint Statement (raising specific arguments regarding the “lawfully and properly” language but not the patient privacy laws clause).)

4 The court agrees with Providence that the spirit of its proposed revision to this section regarding compliance with state and federal patient privacy laws is necessary to ensure it complies with its obligations to protect PHI, but finds Providence’s wording too vague. Instead, the court concludes that Providence’s objectives are accomplished if this clause is limited to HIPAA, RCW CH. 70.02, and each statute’s implementing regulations.

10 Plaintiffs contend that Providence’s “lawfully and properly” language would impose an undue burden on them to determine whether information entered the public domain unlawfully or unproperly. (See Joint Statement at 3.) Providence argues that this language is necessary to allow it “to designate as confidential information/documents that become public in violation of the protective order or were improperly or unlawfully acquired or disclosed.” (Id.) The court agrees with Plaintiffs that the “lawfully and properly” language would impose an undue burden on a party seeking to introduce material that was already in the public domain, and further finds it unnecessary to accomplish Providence’s objectives; information or documents that become public in violation of the order will be subject to the procedures set forth in Sections 8 and 9 of the readily be associated with the identity of a patient and directly relates to the patient’s health care”). Here, the court refers to both categories as “PHI.”

1 parties’ protective order. (See, e.g., Providence’s Prop. Order at 10-11.) The parties must file a protective order that does not include “lawfully and properly.”

3 Therefore, the second paragraph in Section 3 of the parties’ protective order shall state, “However, except as required by HIPAA, RCW Ch. 70.02, or either statute’s implementing regulations, the protections conferred by this agreement do not cover information that (a) is in the public domain through trial or otherwise . . . .” The remainder of that section shall reflect the parties’ agreed-upon language. (See id. at 2-3; Pls’ Prop. Order at 2-3.)

9 B. Basic Principles Regarding Access to and Use of Confidential Material and Non-Termination and Return of Confidential Material Plaintiffs propose changes to Sections 4.1 (“Basic Principles Regarding Access to and Use of Confidential Material”) and 10 (“Non-Termination and Return of Confidential Material”) of this District’s model protective order that would allow the parties or class members to use confidential materials obtained here for collateral litigation in which the parties “have an interest” (Joint Statement at 4) and in subsequent, related, or derivative actions (id. at 10.) Providence opposes both changes, arguing both would violate their patients’ privacy interests under federal law. (Id. at 4-5, 10.) The court agrees with Providence and declines to enter an order allowing any party to use this discovery in collateral or subsequent proceedings, or for any reason other than the present litigation.

HIPAA typically prevents a covered entity from disclosing PHI without first providing the patient with notice and an opportunity to object to the disclosure. See 45 21 C.F.R. § 164.512. A covered entity may nevertheless disclose PHI without prior notice in discovery where a qualifying protective order is in place. See, e.g., Ehrlich v. Union Pac. R.R. Co., 302 F.R.D. 620, 628 (D. Kan. 2014); In re Nat’l Hockey League Players’ Concussion Injury Litig, 120 F. Supp. 3d 942, 953 (D. Minn. 2015); 45 C.F.R. § 164.512(e)(1)(ii)(B), (e)(1)(v). A protective order satisfies HIPAA’s requirements if it (1) prohibits the parties from using or disclosing the PHI for any purpose other than the litigation for which the information was requested and (2) requires the return or destruction of the PHI at the conclusion of the litigation. 45 C.F.R. § 164.512(1)(e)(v); In re Nat’l Hockey League, 120 F. Supp. 3d at 953. Were the court to enter a protective order with Plaintiffs’ proposed revisions to Sections 4.1 and 10, the protective order would not comply with HIPAA; any disclosure of PHI would require compliance with HIPAA’s notice procedures.

12 Moreover, the Ninth Circuit has not adopted a policy that permits collateral litigants automatic access to confidential information produced during discovery in another action. See Foltz v. State Farm Mut. Auto. Ins. Co., 331 F.3d 1122, 1131-32 (9th Cir. 2003). Instead, where collateral litigants seek access to discovery materials subject to a protective order, they must move to modify the protective order and “demonstrate the relevance of the protected discovery to the collateral proceedings and its general discoverability therein.” Id. (discussing the issuing court and collateral court’s involvement in determining whether such access should be granted). By allowing use of discovery in collateral litigation in their proposed protective order, Plaintiffs effectively seek an end-run around the procedures set forth in Foltz because they would be allowed to share and use confidential health information without seeking leave to modify the protective order and obtaining a relevancy determination from this court. See id. at 1132; see also HDT Bio Corp. v. Emcure Pharms., Ltd., Case No. C22-0334JLR, 2022 WL 3 4131589, at *1 (W.D. Wash. Sept. 9, 2022) (relying on Foltz’s reasoning to enter non-sharing protective orders).

5 Accordingly, the court declines to adopt Plaintiffs’ proposed revisions to Sections 4.1 and 10 of this District’s model protective order. The parties shall enter a proposed stipulated protective order with the versions of Sections 4.1 and 10 proposed by Providence.

9 C. Disclosure of Confidential Material to Deposition Witnesses 10 Plaintiffs propose diverting from the requirement in Section 4.2(f) of the model order that witnesses sign the “Acknowledgment and Agreement to Be Bound” before receiving confidential material during a deposition. (See Joint Statement at 5.) Plaintiffs argue that a verbal acknowledgment is “less unwieldy” and preferable in Zoom depositions and for lay witnesses. (Id.) Providence disagrees, arguing the revision “is vague and fails to ensure that a witness clearly understands” their obligations under the protective order. (See id. at 5-6.) The court agrees with Providence and orders the parties to enter a proposed stipulated protective order that maintains the model order’s signature requirement in Section 4.2(f).

19 D. Filing Confidential Material 20 Plaintiffs propose replacing Section 4.3 (“Filing Confidential Material”) of the model order with a procedure that eliminates the meet-and-confer requirement imposed by the model order and allows any party to file materials marked “Confidential” under seal so long as no party has attempted to challenge the materials’ confidential status. (See Joint Statement at 5.) Providence argues that this revision would allow the parties to circumvent the procedures for filing documents under seal outlined in this District’s local rules and instead proposes the parties’ protective order maintains the model order’s procedures for filing confidential material. (See id.); see also Local Rules W.D. Wash. 6 LCR 5(g). Because of the “strong presumption of public access to the court’s files,” see Local Rules W.D. Wash. LCR 5(g), the court declines to adopt Plaintiffs’ proposed changes to Section 4.3. The parties shall enter a proposed stipulated protective order that maintains the procedures for filing confidential information under seal set forth in Section 4.3 of the model order.

11 E. Compliance with State and Federal Health Care Information Laws 12 The parties vigorously dispute the language in their proposed protective order that should govern the use of PHI. (See Joint Statement at 7-10.) Plaintiffs propose using portions of a sample HIPAA protective order from the United States District Court for the Northern District of Illinois. (See id. at 4; Pls.’ Prop. Order at 7.) Plaintiffs’ proposed language includes a blanket authorization for the use and disclosure of PHI in connection with the lawsuit. (See Pls’ Prop. Order at 4-5.) Providence proposes the addition of two subsections to the model order, requiring parties seeking discovery of PHI to comply with the UHCIA and HIPAA. (See Providence’s Prop. Order at 5 (creating new Section 4.4 requiring compliance with UHCIA and new Section 4.5 requiring compliance with HIPAA).)

1 Providence argues that its proposed language complies with both the UHCIA’s requirement that a party seeking PHI in discovery must provide advanced notice to the patient and provider and with HIPAA’s requirements for qualifying protective orders.

4 (See Joint Statement at 7-8 (first citing RCW 70.02.060; and then citing 45 C.F.R. § 164.512(e)(1)(ii)); see also supra § II.B.) Providence argues that Plaintiffs’ proposed language fails to comply with these requirements and eliminates the language from the Northern District of Illinois’s model order required by HIPAA. (Joint Statement at 8-10.)

8 The court agrees that Providence’s proposed subsections requiring compliance with the UHCIA and HIPAA are best suited to ensure proposed class members’ privacy interests are protected in this litigation. Accordingly, the court orders the parties to enter a protective order with Sections 4.4 and 4.5 of Providence’s Proposed Order.

12 F. Inadvertent Production of Privileged or Otherwise Protected Material 13 Plaintiffs propose adding an additional section to the model order specifying that inadvertent disclosures will not constitute waivers of privilege or other protection. (Pls’ Prop. Order at 9.) Providence opposes the addition as unnecessary because Section 9 of the model order already sets forth procedures following inadvertent production of privileged information and enters a non-waiver order. (See Joint Statement at 10.)

18 Plaintiffs do not address this argument. (See id.) The court agrees with Providence that Section 9 of the model order succinctly and thoroughly protects inadvertent privileged disclosures and Plaintiffs’ addition is unnecessary. The court therefore orders the parties to enter a stipulated protective order that does not include Plaintiffs’ proposed Section 11.

1 III. CONCLUSION 2 For the foregoing reasons, the court ORDERS the parties to file a proposed stipulated protective order that complies with this order no later than April 20, 2023.

4 Specifically, the parties shall file a proposed stipulated protective order that conforms with Providence’s Proposed Protective Order (Dkt. # 67-4) EXCEPT that Section 3 (“Scope”) of the proposed stipulated protective order shall use the language prescribed by the court (see supra § II.A).

8 Dated this 13th day of April, 2023.

A 11 JAMES L. ROBART United States District Judge