***      FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER     ***




                                                                Electronically Filed
                                                                Supreme Court
                                                                SCCQ-15-0000300
                                                                13-JUN-2016
                                                                08:04 AM
              IN THE SUPREME COURT OF THE STATE OF HAWAII

                            ---oOo---
________________________________________________________________

      PACIFIC RADIATION ONCOLOGY, LLC, a Hawaii Limited Liability
              Corporation, et al., Plaintiffs-Appellants,

                                      vs.

  THE QUEEN’S MEDICAL CENTER, a Hawaii Non-Profit Corporation,
                  et al., Defendants-Appellees.
________________________________________________________________

                               SCCQ-15-0000300

       CERTIFIED QUESTION FROM THE UNITED STATES DISTRICT COURT
                      FOR THE DISTRICT OF HAWAII
                     (CIVIL NO. 12-00064 LEK-KSC)

                                JUNE 13, 2016

 RECKTENWALD, C.J., NAKAYAMA, McKENNA, POLLACK, AND WILSON, JJ.,
          WITH RECKTENWALD, C.J., CONCURRING SEPARATELY

                   OPINION OF THE COURT BY McKENNA, J.

I.     Introduction

        This court has been asked to provide guidance to the United

States District Court for the District of Hawaii (“District

Court”) on questions of Hawaii law.          At issue is whether the

parties may use, or be compelled to produce, the confidential

medical records of over 100 cancer patients, in an effort to
    ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER    ***


prosecute or defend against claims that the Plaintiff doctors

steered these patients away from treatment at Defendant Queens

Medical Center.        The patients are not parties to the underlying

lawsuit, although 19 of them have been granted intervenor

status.       All of them have intervened solely to assert their

right to privacy and seek a prohibition on the use and

production of their medical records.

          The District Court1 certified the following questions to

this court:

               1. May a third party who is in lawful possession of a
               patient’s confidential medical records use, or be compelled
               to produce, these records in litigation where the patient
               is not a party?
               2. If a third party may use and/or produce a patient’s
               confidential medical records in litigation, is a de-
               identification process sufficient to protect the patient’s
               privacy interests where the third party already allowed its
               agents access to the patient’s records and its agents
               inadvertently made part of the patient’s medical
               information public?

This court may “reformulate the relevant state law questions as

it perceives them to be, in light of the contentions of the

parties.”       Allstate Ins. Co. v. Alamo Rent-A-Car, Inc., 137 F.3d

634, 637 (9th Cir. 1998) (citations and quotation marks

omitted).       To avoid confusion, we reformulate the certified

questions to clarify that the term “party” refers to the parties

to the litigation, not to the parties to the physician-patient

relationship.        We believe that the “parties” in this case are

the plaintiffs and defendants, and the “third parties” in this
1
      The Honorable Leslie E. Kobayashi, United States District Judge,
presided.

                                         2
    ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


case are the patient intervenors.            We also reformulate the

question so that a negative answer to the first certified

question will not preclude us from answering the second

certified question to the extent we can.             Therefore, the

reformulated certified questions are:

               1. May a party who is in lawful possession of a patient’s
               confidential medical records use, or be compelled to
               produce, these records in litigation where the patient is
               not a party?
               2. Is a de-identification process sufficient to protect
               the patient’s privacy interests where the party already
               allowed its agents access to the patient’s records and its
               agents inadvertently made part of the patient’s medical
               information public?2

          Hawaii Rules of Appellate Procedure (“HRAP”) Rule 13 (2000)

governs certified questions.           It provides, in relevant part,

“When a federal district . . . court certifies to the Hawaii

Supreme Court that there is involved in any proceeding before it

a question concerning the law of Hawaii that is determinative of

the cause and that there is no clear controlling precedent in

the Hawaii judicial decisions, the Hawaii Supreme Court may

answer the certified question by written opinion.”               We therefore

confine our answer to the “law of Hawaii that is determinative


2
      Defendant urges us to reformulate the certified questions to include
the following “threshold question”: “Does [Hawaii Revised Statutes (“HRS”) §
431:10C-]308.7(c) apply to all self-referral involving insured services
covered by H.R.S. Chapter 431 or only to those involving no-fault auto-
related services?” We decline to do so. We note that the District Court has
already concluded that that statute does not apply to health care provider
referrals and is “limited to the context of motor vehicle insurance” in an
Order Granting in Part and Denying in Part Plaintiffs’ Motion for Summary
Judgment on the Counterclaim. The present certified question is not the
proper vehicle through which Defendant may challenge that order.

                                         3
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


of the cause,” namely article I, section 6 of the Hawaii

Constitution.    That constitutional provision states, in relevant

part, “The right of the people to privacy is recognized and

shall not be infringed without the showing of a compelling state

interest.”

       We answer the first certified question in the negative.

Article I, section 6 of the Hawaii Constitution protects the

health information of patient intervenors to this case.

Pursuant to that provision, and under the facts of this case,

the parties cannot use, or be compelled to produce, confidential

patient medical records in litigation where the patient is not a

party, absent a compelling state interest.

       As to the second certified question, we do not address

whether sufficient de-identification is possible where one party

already allowed its agents access to the patient’s records and

its agents inadvertently made part of the patient’s medical

information public.      The de-identification process and

requirements are set forth under the Health Insurance

Portability and Accountability Act of 1996 (“HIPAA”), Pub L. No.

104-191, 110 Stat. 1936 (1996), and its corresponding

regulations; therefore, the sufficiency of de-identification

does not “concern[] the law of Hawaii that is determinative of

the cause.”    HRAP Rule 13.     Whether the use and production of


                                      4
    ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


de-identified medical records is “sufficient to protect the

patient’s privacy interests,” however, is a question this court

can address under article I, section 6.             We hold that the use

and production of de-identified medical information of patients

who are not parties to the litigation violates those patients’

right to privacy under article I, section 6 of the Hawaii

constitution, as no compelling state interest has been shown in

this case.

II.       Background

          The Plaintiffs in this case are Pacific Radiation Oncology,

LLC; PRO Associates, LLC; John Lederer, M.D.; Vincent Brown,

M.D.; Paul DeMare, M.D.; Thanh Huynh, M.D.; Laeton Pang, M.D.;

and Eva Bieniek, M.D. (collectively, “PRO”).              The Plaintiffs

filed an Amended Complaint for Declaratory and Injunctive Relief

and for Damages (“Amended Complaint”) against Defendants Queens

Medical Center and Queens Development Corporation (collectively

“QMC”).3      The Amended Complaint alleged that the Plaintiffs “had

a long-standing, 40-year relationship with QMC to provide

professional radiation oncology therapy services to PRO patients

at facilities owned by QMC, using equipment, technician support,

and other services provided by QMC.”            QMC is the only Nuclear

Regulatory Commission-approved hospital at which radiation

3
      The Plaintiffs also named as defendants the individual members of the
Queens Medical Center Board of Trustees. The parties later stipulated to
dismiss, without prejudice, these individuals.

                                         5
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


oncologists can operate on patients.         Plaintiffs also

acknowledged that they had “a one-third interest in The Cancer

Centers of Hawaii [‘TCCH’],” a competitor of QMC.

       According to the Amended Complaint, QMC notified Plaintiffs

that the QMC Board had decided to convert QMC to a “closed

radiation therapy department,” meaning that only physicians

employed by QMC could exercise clinical privileges to provide

professional radiation oncology services at QMC.            QMC explained

that it arrived at its decision to terminate PRO’s privileges

after determining that PRO had “transferr[ed] patients to other

facilities for no medical reason or patient request. . . .”

Plaintiffs alleged in their Amended Complaint that QMC’s action

was intended to destroy their ability to treat patients at

facilities competing with QMC.

       Plaintiffs’ Amended Complaint raised ten claims for relief:

a claim of denial of procedural and substantive due process; a

claim of violation of QMC bylaws and governing regulations;

three separate claims of intentional and tortious interference;

four separate claims of unfair, deceptive, anti-competitive and

illegal trade practices in violation of HRS Chapter 480; and a

claim of breach of fiduciary duty and bad faith owed to a

partner.

       QMC filed an Answer and Counterclaim.        Relevant to this

certified question, QMC counterclaimed that           Plaintiffs Lederer,

                                      6
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


Brown, DeMare, Huynh, and Pang “consulted with and/or began

treatment of patients referred to them at QMC and then induced

the patients to receive treatment at TCCH without making timely

written disclosure of their ownership interests in TCCH,” which

constituted unfair competition in violation of HRS § 480-2.

        During the course of the litigation, QMC’s law firm

publicly filed a list naming 132 patients PRO was alleged to

have diverted to TCCH; also included were the patients’ QMC

identification numbers and the PRO doctors who consulted and

treated each patient.      The list was attached as an exhibit to

(1) a subpoena to TCCH’s custodian of records and (2) a

discovery request to PRO.       The filing was subsequently sealed.

       Plaintiffs then moved for a temporary restraining order or

preliminary injunction to prevent further violations of patient

privacy.    In their moving papers, they alleged that QMC had

accessed the electronic medical records of 133 cancer patients,

without consent, to determine if Plaintiffs were directing

patients to TCCH, and, if so, how much revenue QMC lost as a

result.    Plaintiffs argued that cancer patient medical records

would likely include “history and physicals” information

regarding “the most confidential and sensitive inquiries,

including prior pregnancies, abortions, sexual activities,

potency, drug use, psychological issues, depression, AIDS info,

family history, prior diseases, substance dependency, etc.,

                                      7
    ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


etc.”       QMC’s alleged breach of patient privacy culminated in the

disclosure of 132 of the patients’ names in the exhibits to the

subpoena and discovery request.              Plaintiffs sought to enjoin

“QMC, its attorneys, and its consultants from reviewing and more

importantly from publishing the highly confidential information

including the names of these many, many cancer patients.”

          The District Court granted in part, and denied in part, the

Plaintiffs’ motion.         Construing the Plaintiffs’ pleading as a

discovery motion, the District Court granted it, in part, and

sanctioned defense counsel for publicly filing the list naming

the 132 cancer patients, in willful violation of the parties’

Amended Stipulated Protective Order.              The District Court denied

the motion for a TRO and/or preliminary injunction, in part,

because the Plaintiffs’ Amended Complaint alleged no claims of

improper review and use of confidential patient information.4                As

to whether the Plaintiffs could prevent Defendants from

obtaining or using confidential patient information, the

District Court concluded that “the parties must address these

issues through the normal discovery process.”

          The Magistrate Judge, in turn, issued his Order Regarding

Discovery Issues.        He found the 132 cancer patients’

confidential medical records to be relevant to the parties’


4
      The United States Court of Appeals for the Ninth Circuit affirmed the
denial. Pacific Radiation Oncology, LLC v. Queen’s Medical Center, 810 F.3d
631 (9th Cir. 2015).

                                         8
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER    ***


claims and counterclaims.       He ordered the records discoverable

as follows:

            Although the patient medical records contain protected
            health information (“PHI”), this does not preclude their
            discovery. As noted by Judge Kobayashi in the TRO Order,
            “[o]nce health information has been deidentified, it is no
            longer protected by HIPAA” or state law. TRO Order at 29.
            It reasonably follows that PHI is discoverable if de-
            identified. Accordingly, the 132 patient medical records
            shall be de-identified. Upon de-identification, the
            medical records will be discoverable and shall be produced.

The Plaintiffs appealed the Magistrate Judge’s decision to the

District Court.      After granting 19 affected patients’ motion to

intervene, the District Court reserved ruling on the Plaintiffs’

appeal and certified the instant questions to this court.

III.    Discussion

       Article I, section 6 of the Hawaii Constitution is entitled

“Right to Privacy,” and it provides, “The right of the people to

privacy is recognized and shall not be infringed without the

showing of a compelling state interest.          The legislature shall

take affirmative steps to implement this right.”            In the context

of patient medical records, this court has issued three

decisions construing article I, section 6 on petitions for writ

of mandamus:    Brende v. Hara, 113 Hawaii 424, 153 P.3d 1109

(2007) (per curiam); Naipo v. Border, 125 Hawaii 31, 251 P.3d

594 (2011) (per curiam); and Cohan v. Ayabe, 132 Hawaii 408, 322

P.3d 948 (2014).




                                      9
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER    ***


       Each of the mandamus petitioners in these cases sought to

compel the respondent judges to issue orders limiting and/or

prohibiting the use of patient medical records.            The mandamus

petitioners in Brende and Cohan were both plaintiffs in tort

litigation in which their medical condition and treatment were

at issue.    The petitioner in Naipo, on the other hand, was not a

party to the litigation.       Rather, in Naipo, the parties to a

dog-bite lawsuit sought discovery of a non-party’s patient

medical records.     This distinction is key in the instant

proceedings, which involve patient intervenors who are not

parties to the lawsuit between Plaintiffs and QMC.            Each of

these cases will be discussed in turn, below.

       Brende, Cohan, and Naipo all provide strong privacy

protection over patient medical records. In Brende, this court

held, “Petitioners’ health information is ‘highly personal and

intimate’ information that is protected by the informational

prong of article I, section 6.        The constitutional provision

protects the disclosure outside of the underlying litigation of

petitioners’ health information produced in discovery.”             113

Hawaii at 430, 153 P.3d at 1115 (footnote omitted).            This

holding was reaffirmed in Cohan.          See 132 Hawaii at 410, 322

P.3d at 950 (“[T]he privacy provision of the Hawaii

Constitution, article I, section 6, protects [the petitioner’s]


                                     10
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER    ***


health information against disclosure outside the underlying

litigation.”)

       The holding in Brende and Cohan applies to situations in

which a party to litigation seeks to limit and/or prohibit the

disclosure, outside of discovery, of his or her own patient

medical records.     While that is not the situation in the present

case (where non-parties seek to prohibit the use and disclosure

of their patient medical records), we turn to Brende and Cohan

for their exploration of the constitutional history behind

article I, section 6.

       Brende noted that the framers viewed the Hawaii

constitutional right to privacy as follows:

            [T]he [article I, section 6] right of privacy encompasses
            the common law right of privacy or tort privacy. This is a
            recognition that the dissemination of private and personal
            matters, be it true, embarrassing or not, can cause mental
            pain and distress far greater than bodily injury. For
            example, the right can be used to protect an individual
            from invasion of [the individual’s] private affairs, public
            disclosure of embarrassing facts, and publicity placing the
            individual in a false light. In short, this right of
            privacy includes the right of an individual to tell the
            world to “mind your own business.”

113 Hawaii at 430, 153 P.3d at 1115 (quoting Stand. Comm. Rep.

No. 69, in Proceedings of the Constitutional Convention of

Hawaii of 1978 (“Proceedings”), Vol. 1, at 674).

       So inviolable is this right that the framers sought to

shield individuals from “possible abuses in the use of highly

personal and intimate information in the hands of government or

private parties. . . .”       Comm. Whole Rep. No. 15, in

                                     11
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


Proceedings, at 1024 (emphasis added).          In this way, article I,

section 6 provides Hawaii’s people with powerful protection

against any infringement of their right to privacy, by state and

private actors.     In fact, we have previously noted that the

framers “equated privacy in the informational sense” with the

“common law right of privacy,” so that “[o]ne who gives

publicity to a matter concerning the private life of another is

subject to liability to the other for invasion of his [or her]

privacy, if the matter publicized is of a kind that (a) would be

regarded as highly offensive to a reasonable person, and (b) is

not of legitimate concern to the public.”          State of Hawaii

Organization of Police Officers (“SHOPO”) v. Soc’y of Prof’l

Journalists, 83 Hawaii 378, 398, 927 P.2d 386, 406 (1996)

(citing Stand. Comm. Rep. No. 69, Proceedings, at 674; and

Restatement (Second) of Torts § 652D, 383 (1977)).            There is no

requirement that the one invading another individual’s privacy

be a state actor.     See, e.g., SHOPO, 83 Hawaii 378, 927 P.2d 386

(analyzing whether a non-state actor’s, e.g., an organization of

journalists, access to police officer disciplinary records would

violate the officers’ constitutional privacy rights).

       Article I, section 6 generally provides greater privacy to

Hawaii’s people than its federal analogs.          The Hawaii

constitutional right to privacy is a “fundamental right for


                                     12
    ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER     ***


purposes of constitutional analysis.”            Cohan, 132 Hawaii at 415,

322 P.3d at 955 (quoting Comm. Whole Rep. No. 15, in

Proceedings, at 1024).         We view article I, section 6 as

“afford[ing] much greater privacy rights than the federal right

to privacy. . . .”        Janra Enters., Inc. v. City & Cty. of

Honolulu, 107 Hawaii 314, 320, 113 P.3d 190, 196 (2005)

(citation omitted).

          Article 1, section 6 also provides more stringent

protection5 over patient medical records than does HIPAA.6                  This

conclusion was implicit in Cohan, where a provision in a

Stipulated Qualified Protection Order that provided that the


5
      45 C.F.R. § 160.202(6) provides
            More stringent means, in the context of a comparison of a
            provision of State law and a standard, requirement, or
            implementation specification adopted under subpart E of
            part 164 of this subchapter, a State law that meets one or
            more of the following criteria: . . . .
            With respect to any other matter, provides greater privacy
            protection for the individual who is the subject of the
            individually identifiable health information.
That regulation also defines “state law” to include a state’s constitution
and common law. Id.
6
      We therefore are not persuaded by QMC’s contention that “Hawaii’s
constitutional right of privacy is coextensive with HIPAA.” In support of
this argument, QMC points to HRS Chapter 323B, Hawaii’s Health Care Privacy
Harmonization Act, specifically section 3(a) in that chapter, which states in
relevant part that a covered entity or business associate’s use or disclosure
of individually identifiable health information that complies with HIPAA
“shall be deemed to comply with all state laws relating to the use,
disclosure, or confidentiality of such information.” HRS § 323B-4(6) (2010 &
Supp. 2012), however, provides, “Nothing in this chapter shall be construed
to . . . [l]imit or otherwise affect any evidentiary privilege, limitation on
discovery, or confidentiality protection provided by any state law, decision,
or order in relation to individually identifiable health information sought,
used, or produced in any judicial or administrative proceeding.” Therefore,
the intervenors’ constitutional right to privacy in their confidential
medical records is unaffected by Chapter 323B. In other words, honoring an
individual’s right to privacy in his or her protected health information
requires more than bare compliance with HIPAA.

                                        13
 ***     FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


defendant hotel could use a tort plaintiff’s health information

in its internal reviews was invalidated under article I, section

6, yet we noted that “[a]n analysis under HIPAA arguably may

lead to a different result.”        132 Hawaii at 419, 419 n.18, 322

P.3d at 959, 959 n.18.

       The right to privacy is absolute where, as here, the

individuals seeking to protect patient medical records, in

discovery and beyond, are not parties to the litigation, have

not consented to the use of their patient medical records in

relation to the present lawsuit, and no compelling state

interest has been shown.        Naipo is a case “on all fours” with

the instant case.       In Naipo, plaintiff Eshell Mitchell sued the

Yuen family in state court for multiple leg injuries she

sustained when the Yuens’ dog, Braddah, bit her.             125 Hawaii at

33, 251 P.3d at 596.       As part of her negligence claim, Mitchell

sought to establish that Braddah had previously bitten Jennifer

Naipo.    See id.     Mitchell issued a subpoena duces tecum to

Wahiawa General Hospital for production of Naipo’s medical

records.    See id.     The respondent judge denied Naipo’s motion to

quash the subpoena and ordered the hospital to turn over Naipo’s

medical records for an in camera inspection.            125 Hawaii at 34,

251 P.3d at 597.




                                      14
    ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


          Naipo then petitioned this court for a writ of mandamus,

arguing that her health information was protected by, inter

alia, her right to privacy under article I, section 6 of the

Hawaii constitution.        Id.   We granted Naipo’s petition for

mandamus relief and ultimately directed the respondent judge to

quash the subpoena duces tecum.           125 Hawaii at 37, 251 P.3d at

600.       We unequivocally held, “Petitioner Jennifer Naipo is not a

party to Eshell Mitchell’s lawsuit against the Yuens.                Her

health information in her medical records at Wahiawa General

Hospital is protected by her constitutional right to privacy.”7

125 Hawaii at 35, 251 P.3d at 598.

          Naipo’s holding provides our answer to the first certified

question, which is, “May a party who is in lawful possession of

a patient’s confidential medical records use, or be compelled to

produce, these records in litigation where the patient is not a

party?”       We hold that, pursuant to article I, section 6 of the

Hawaii Constitution, and under the facts of this case, the

parties cannot use, or be compelled to produce, confidential

patient medical records in litigation where the patient is not a

party, where no compelling state interest has been shown.

7
       Our decision also rested on the twin holding that Naipo’s confidential
medical records “deserve[d] the protection of the physician-patient privilege
of [Hawaii Rules of Evidence] Rule 504,” which Naipo had not waived. 125
Hawaii at 35, 36, 251 P.3d at 598, 599. We therefore are not persuaded by
QMC’s argument that Naipo “held that the medical records were protected from
disclosure to the trial judge on physician patient privilege grounds rather
than privacy.”

                                        15
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER    ***


       The second certified question is, “Is a de-identification

process sufficient to protect the patient’s privacy interests

where the party already allowed its agents access to the

patient’s records and its agents inadvertently made part of the

patient’s medical information public?”         We doubt, under the

circumstances of this case where there has been an egregious

breach of patient confidentiality by QMC both internally and

publicly, that de-identification is possible.           However, the

question of the sufficiency of de-identification where one party

already allowed its agents access to the patient’s records and

its agents inadvertently made part of the patient’s medical

information public, is ultimately a matter of compliance with

HIPAA, which is a federal question we need not answer.             We can

address under Hawaii law, however, that part of the second

certified question asking if de-identification could

sufficiently protect the patients’ privacy rights.            We answer

that part of the second certified question in the negative.

       In Cohan, we held, “To allow [a party’s medical]

information to be used outside the litigation, regardless of

whether it is de-identified or not, would reach beyond what the

Hawaii Constitution permits in the absence of a showing of a

compelling state interest.”       132 Hawaii at 419, 322 P.3d at 959.




                                     16
 ***   FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER     ***


In Cohan, we noted that the de-identification process under

HIPAA is “extremely complex and problematic,” and that, “[a]part

from these technical considerations, there is the very

complicated issue as to whether a patient has a legitimate basis

for being concerned about what happens to their personal health

information once it is de-identified.”         132 Hawaii at 417, 418,

322 P.3d at 957, 958 (footnote omitted).         We quoted the

following observation from the Seventh Circuit Court of Appeals

with approval: “Even if there were no possibility that a

patient’s identity might be learned from a redacted medical

record, there would still be an invasion of privacy.”            Cohan,

132 Hawaii at 418, 322 P.3d at 958 (citing Nw. Mem’l Hosp. v.

Ashcroft, 362 F.3d 923, 929 (7th Cir. 2004)). Such an invasion

could produce undesirable effects upon patient health care,

including “social and psychological harm through embarrassment,

economic harm through job discrimination and job loss, patient

difficulty in obtaining health insurance, health care fraud, and

patient reluctance to share sensitive information with their

doctors or pharmacists.”      132 Hawaii at 418, 322 P.3d at 958

(quoting Christopher R. Smith, Somebody’s Watching Me:

Protecting Patient Privacy in Prescription Health Information,

36 Vt. L. Rev, 931, 943 (2012)).




                                    17
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER    ***


       Further, we observed that “the risk of re-identification

remains, as there is ‘no national, uniform standard governing

the level of identifier-stripping necessary to guarantee that

de-identified data cannot be re-identified.”           132 Hawaii at 418

n.16, 322 P.3d at 958 n.16 (quoting Smith, supra, at 935).               The

risk of re-identification poses “subjective privacy concerns”

for some patients, who object to the “dehumanization [in] having

one’s most intimate information circulated by an indifferent and

faceless infrastructure without any control over the process or

content.”   Id. (quoting Will Thomas DeVries, Protecting Privacy

in the Digital Age, 18 Berkeley Tech. L.J., 283, 298 (2003)).

       We believe the same concerns underlying the use of de-

identified medical records beyond litigation for parties to a

lawsuit exist for individuals who are not parties to litigation

and who have therefore not put their medical condition and/or

treatment at issue in the first instance. Just as article I,

section 6 protects parties from the use and production of their

de-identified information outside of litigation, we conclude

that article I, section 6 protects individuals from the use and

production of their de-identified information in litigation to

which they are not parties.       Thus, the use and production of

even sufficiently de-identified medical records, under the

circumstances of this case, will not adequately protect the

patients from an invasion of their privacy.

                                     18
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


       We acknowledge that Cohan also stated the following:

           Once health information has been de-identified, it is no
           longer protected by HIPAA. Further, because HIPAA allows
           “more stringent” state law to preempt federal law only when
           it relates to the privacy of “individually identifiable
           health information,” 45 C.F.R. § 160.203(b), this leads to
           the conclusion that state law also does not protect de-
           identified information. Nw. Mem’l Hosp., 362 F.3d at 926.

132 Hawaii at 417, 322 P.3d at 957 (latter emphasis added).             We

consider the last statement to be an accurate summary of the

holding in Nw. Mem’l Hosp., which was, more specifically, that

Illinois’ medical-records privilege, while providing “more

stringent” state law protection of “individually identifiable

health information,” was no barrier to the discovery of de-

identified health information.        See also Zyprexa Prods. Liab.

Litig., 254 F.R.D. 50, 52 (E.D.N.Y. 2008) (similarly concluding,

“the States’ [physician-patient] privilege laws pose no obstacle

to the discovery of [patient] medical records, provided those

records are de-identified.”).

       By contrast, our express holding in Cohan was, “To allow [a

party’s medical] information to be used outside the litigation,

regardless of whether it is de-identified or not, would reach

beyond what the Hawaii Constitution permits in the absence of a

showing of a compelling state interest.”          132 Hawaii at 419, 322

P.3d at 959.    Extending Cohan to cases in which parties seek to

use and produce the medical records of non-parties, we hold that

to allow an individual’s medical information, even if de-


                                     19
 ***    FOR PUBLICATION IN WEST’S HAWAII REPORTS AND PACIFIC REPORTER   ***


identified, to be used in litigation to which that individual is

not a party, would reach beyond what the Hawaii Constitution

permits in the absence of a showing of a compelling state

interest.    In this case, QMC has made no such showing, and we do

not believe that a compelling state interest exists in

infringing upon the Hawaii state constitutional privacy rights

of over 100 cancer patients in order to resolve what is

essentially a contract dispute between competing cancer

treatment providers.

IV.    Conclusion

       We answer both certified questions in the negative.

Article I, section 6 of the Hawaii Constitution protects the

health information of patient intervenors to this case.

Pursuant to that provision, the parties cannot use, or be

compelled to produce, confidential patient medical records, even

if sufficiently de-identified, in litigation where the patient

is not a party, as no compelling state interest has been shown.

                                   /s/ Mark E. Recktenwald

                                   /s/ Paula A. Nakayama

                                   /s/ Sabrina S. McKenna

                                   /s/ Richard W. Pollack

                                   /s/ Michael D. Wilson




                                     20
