In re Barron

*697OPINION OF THE COURT

The issue presented to this court is whether the confidentiality provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) prevent a director of community services from obtaining a patient’s medical records pursuant to the procedures set forth in Mental Hygiene Law § 9.60 for use at a Kendra’s Law hearing to determine whether assisted outpatient treatment (AOT) should be authorized.

On October 19, 2007 petitioner, the director of the Department of Psychiatry at Elmhurst Hospital Center, commenced this proceeding pursuant to Mental Hygiene Law § 9.60 authorizing AOT for respondent for a period not to exceed six months. In preparation therefor, petitioner requested release of respondent’s complete medical records from Elmhurst Hospital Center and Holliswood Hospital. No authorizations were provided by respondent. Both hospitals delivered certified copies of the medical records which were to be reviewed by Elmhurst’s AOT program psychiatrist during the course of formulating his opinion that respondent is in need of AOT. Petitioner seeks to introduce these records and the testimony of the psychiatrist to support his prima facie case at the AOT hearing.

On October 25, 2007 the matter came on for a hearing before this court. At that time, Mental Hygiene Legal Service (MHLS), acting on behalf of respondent, made an oral in limine motion to preclude the introduction of respondent’s medical records and the testimony of the petitioner’s psychiatric expert who relied on or will rely on said records. MHLS contends that petitioner’s failure to comply with the provisions of federal law under HIPAA renders such evidence inadmissible for the purpose of establishing petitioner’s prima facie case under Mental Hygiene Law § 9.60 (c).

For the reasons set forth below, the motion is denied.

Contentions of the Parties

Oral argument was conducted and trial memoranda were submitted to the court. MHLS contends that, absent respondent’s consent or a court order, his protected medical records cannot be used to support petitioner’s case. Further, the psychiatrist should not be allowed to testify because his testimony is not based upon personal knowledge or admissible records. Respondent asserts that HIPAA permits disclosure under certain *698circumstances. (45 CFR 164.501 et seq.) Records may be disclosed without written authorization to the extent it is required by law and its use complies with and is limited to the relevant requirement of such law. (45 CFR 164.512 [a] [1].) Records may also be disclosed in a judicial or administrative proceeding if there is a court order (45 CFR 165.512 [e] [1] [i]) under certain guidelines. Mental Hygiene Law § 33.13 (c) provides that records shall not be released except to a director of community services provided it is in the exercise of his statutory functions pursuant to Mental Hygiene Law § 9.60.

MHLS argues that Mental Hygiene Law § 33.13 is preempted by HIPAA so that use of respondent’s records is precluded due to the failure to obtain his consent and absent a court order. HIPAA is contrary to the state law in Mental Hygiene Law § 33.13 and is much more stringent, so that the federal regulation preempts the state law. There is no mention in the state law as to the manner in which the confidentiality of the records must be maintained, how the patient is notified thereof or as to the right of a hearing. Also, 14 NYCRR 510.9, with respect to the Office of Mental Health’s right to deny access to its records, is a general list of circumstances and does not set forth a process for insuring confidentiality.

In contrast, MHLS argues that HIPAA is designed to insure that the patient is aware of the manner in which entities seek to use or disclose his records and to insure the confidentiality thereof. In the instant case, it is undisputed that petitioner did not seek respondent’s consent, a protective order or a court order or that any satisfactory assurances were made to the two hospitals that respondent had consented or there was a protective order. While it might be argued that Mental Hygiene Law § 9.31 (f) requires that article 9 proceedings be sealed, such provision only covers those records submitted into the court’s files.

Absent respondent’s consent or a court order, MHLS argues that the use of the records already obtained by mere request and the testimony of the psychiatrist who relied thereon should be found inadmissible. If the expert derived factual information from another source, the court should make inquiry as to such source prior to determining if a prima facie case has been made.

In opposition, petitioner argues that HIPAA does not preempt state law where the specific provision of the state law provides for the conduct of a public health investigation, intervention, public health activity, treatment or as otherwise required by state law. Under Mental Hygiene Law § 9.47 (b), the director of *699community services (DCS) has a legal obligation to investigate and file petitions in accordance with Kendra’s Law and has been given the legal right to obtain records without the patient’s express consent. Mental Hygiene Law § 33.13 (c) (12) expressly authorizes disclosure to a DCS in an investigation under Mental Hygiene Law § 9.60. Without such provision, the ACT program could not function as it is an involuntary program where consent of the patient would not be forthcoming.

Petitioner further argues that HIPAA contains an exception which permits disclosure to conduct a public health investigation or intervention. (45 CFR 160.203 [c].) The ACT program would qualify. It is also a public health activity and a part of treatment activities. As disclosure is required by law under Mental Hygiene Law §§ 9.60 and 33.13, it also falls under a HIPAA exception. As a Kendra’s Law hearing for ACT treatment is a public health activity, the disclosure of records by a physician testifying thereat is authorized as in the course of a judicial proceeding. To the extent that section 164.512 (e) (1) requires a court order or other lawful process, the order to show cause setting the date and time of the hearing provided more than adequate notice to the respondent that the psychiatrist would be relying on such records.

In reply, MHLS argues that petitioner is incorrect in arguing that Mental Hygiene Law §§ 9.47 and 33.13 fall within exceptions to the HIPAA preemption regulation. The authorization to the DCS to investigate does not qualify for HIPAA exception. The Department of Health and Human Services does not view public health surveillance, investigation and intervention as focused upon a single individual. Rather it relates to systemic health issues that affect the public as a whole. Mental Hygiene Law § 9.47 is directed to a specific individual. Petitioner does not address respondent’s argument that the medical records sharing provision of Mental Hygiene Law § 33.13 (c) does not fall within the HIPAA preemption exceptions because such state law is not more stringent than the federal regulations. Mental Hygiene Law §§ 9.47 and 33.13 (c) (12) do not provide any specific mechanism to protect the privacy of the individual while the federal procedure is quite detailed. Therefore, the state law does not pass the HIPAA preemption test as set forth in 45 CFR 160.203 (b) and HIPAA must be applied to protect the records here. Even in a judicial proceeding, there are significant protective mechanisms mandated by HIPAA with which petitioner failed to comply. As petitioner is not currently engaged in treat*700ing the respondent, disclosure of his records was improper. He is not in an AOT program nor subject to an AOT order.

Finally, MHLS argues that, absent compliance with the HIPAA provisions pertaining to judicial proceedings, the records cannot be used to support the issuance of an AOT order. Under 45 CFR 164.512 there are significant rules to which a health care provider must conform before records can be disclosed. None were performed here. The notice of investigation and the petition papers offer no evidence that, prior to the transmission of his records, respondent was ever placed on notice that his records were going to be obtained (45 CFR 164.512 [e]) nor that the satisfactory written assurance procedure of 45 CFR 164.512 (e) (1) (i), (ii) (A); (iii) was followed.

Decision of the Court

Initially, the court finds that it is not necessary to determine the preemption issue of Mental Hygiene § 33.13 as the question of whether disclosure of respondent’s records is appropriate is capable of determination under the provisions of the Health Insurance Portability and Accountability Act itself.

45 CFR 164.512 provides that a covered entity may use or disclose protected health information without the written authorization of the individual or the opportunity for the individual to agree or object in situations covered by this section and subject to the applicable requirements of this section. Under subdivision (a) thereof, it is permissible to disclose when it is required by law and when such disclosure complies with and is limited to the relevant requirements of such law.

Required by law is defined in 45 CFR 164.103 as meaning a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or triable inspector general, or an administrative body authorized to require the production of information; and a civil or an authorized investigative demand.

In the instant case, the request for respondent’s medical information could be found to qualify as an authorized investigative demand under Mental Hygiene Law § 9.60. Even if it so qualified, the required bylaw provision mandates that the covered entity must comply with the requirements described in three other paragraphs in order to qualify for disclosure.

*701The pertinent provision, subdivision (e) of section 164.512, with respect to disclosures for judicial and administrative proceedings, allows a response during the course of any judicial or administrative proceeding in response to a discovery request or other lawful process. However, even if it so qualified, the covered entity was still required to receive satisfactory assurances from the party seeking the information that reasonable efforts have been made to ensure that the respondent has been given notice of the request or that reasonable efforts have been made to secure a qualified protective order. Here, no such assurances were provided.

In any event, this court finds that disclosure of respondent’s records is allowed.

45 CFR 164.512 (b) allows disclosure for certain public health activities and purposes. Paragraph (1) (i) states that disclosure is allowed by a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the conduct of public health investigations and public health interventions.

Pursuant to 45 CFR 164.501 public health authority means, in pertinent part, an agency or authority of a state, a political subdivision of a state, or a person or entity acting under a grant of authority from such public agency, including the employees or agents of such public agency or persons or entities to whom it is granted authority, that is responsible for public health matters as part of its official mandate.

Mental Hygiene Law § 9.60 (a) (2) defines director as the director of community services of a local governmental unit, or the director of a hospital licensed or operated by the office of mental health which operates, directs and supervises an assisted outpatient program.

As the assisted outpatient treatment program can be considered a public health intervention, which also includes public health investigation, disclosure by the covered entity to petitioner is appropriate.

The court notes that no information has been provided to it concerning whether or not the Secretary of Health and Human Services has made a determination that the subject provision of state law is necessary under 45 CFR 160.203 so that preemption would not be an issue. If such a request has not, in fact, been made, this court recommends to the executive branch of *702the state government that such a determination would be worthwhile and should be requested.

Accordingly, the in limine motion by MHLS on behalf of respondent to preclude petitioner from introducing respondent’s medical records obtained from Elmhurst Hospital Center and Holliswood Hospital and testimony by the psychiatrist who reviewed and relied and would rely upon said records is denied.