[Med-privacy] LA case

[peter marshall]

Court blocks broad subpoena of patient records
Physicians successfully fought a pharmaceutical company's request for 
the records of 6,000 Medicaid patients in Louisiana.

By Amy Lynn Sorrel, AMNews staff. April 21, 2008.

Louisiana physicians who were getting roped into the state's lawsuit 
against a pharmaceutical company won a recent victory in their effort 
to defend their patients' privacy. But doctors' involvement in the case 
may not be over just yet.

The Louisiana attorney general is suing Janssen Pharmaceutica Inc., 
owned by Johnson & Johnson, for alleged illegal off-label promotion of 
Risperdal (risperidone). The state also claims the drug manufacturer 
defrauded Louisiana's Medicaid program, which reimbursed for the drug.

Neither doctors nor patients are a party to the lawsuit. But the 
medical community contested what it called an overly broad trial court 
order allowing Janssen to subpoena doctors for the medical records of 
up to 6,000 Medicaid patients who were prescribed Risperdal.

The order also allowed Janssen to depose individual doctors about any 
aspect of their decision to prescribe Risperdal or any other 
antipsychotic medication to their patients. Physicians said the company 
went too far in its request and did not obtain proper consent.

Janssen contends in court papers that it cannot adequately defend the 
case without the patient information. The company argued that the 
Health Insurance Portability and Accountability Act privacy provisions 
allow access to medical records as long as the files are safeguarded 
under a court order, which it had obtained.

Doctors feared that if the court order was allowed to stand, it would 
set a bad precedent, especially at a time when pharmaceutical 
litigation is increasingly prevalent.

"This was about protecting patients' rights, and trying to get 
non-party records like that is just above and beyond what is necessary 
for the case and not in compliance with Louisiana law," said Amy 
Phillips, Louisiana State Medical Society general counsel and director 
of legal affairs.

Doctors were particularly concerned because the case involved sensitive 
mental health records belonging to Medicaid patients, who may not have 
the resources to defend themselves against improper disclosures, stated 
the LSMS, in a friend-of-the-court brief.

In addition, Phillips said, "[the records request] was going to be very 
onerous for our physicians" in terms of time and cost.

Gregory D. Frost, a HIPAA expert with Breazeale, Sachse & Wilson LLP in 
Baton Rouge, La., said the state's physician-patient privilege law 
precludes doctors from disclosing private medical records in a lawsuit 
to which patients are not a party. In addition, if Janssen wanted the 
patient files, a medical records statute entitled individual patients 
to separate hearings on whether their privileged records should be 
produced.

The court order essentially left patients without any say and put 
doctors in the middle, said Frost, who assisted the LSMS in the case.

Janssen, in a statement, said: "Patient privacy is of the utmost 
importance to [the company], and is protected during the discovery 
process and throughout litigation by court order." The drug 
manufacturer declined to comment further.

Louisiana's Office of the Attorney General also declined comment due to 
the ongoing case. The state argued in court papers that the patient 
records were not relevant to the case and that the data it turned over 
to Janssen were sufficient. Following the protests from the LSMS and 
from several nursing home organizations, the trial court reversed 
itself in February and struck down Janssen's record requests. It 
revised its original court order in March.
State law has stronger safeguards

The court found that HIPAA does not preempt the more stringent state 
laws governing access to medical records for patients who are not 
parties in a case.

"The court said you can't just subpoena these records and ignore state 
law," Frost said.

HIPAA does not create a privilege, he said. Rather, it provides a 
procedural protection meant to ensure patients are notified that their 
information is being requested and gives them a chance to assert their 
privacy rights.

HIPAA creates a floor for privacy protections, but statutes like that 
in Louisiana were meant to add an additional layer of protection and 
override the federal privacy law, he said.

Despite the recent victory, however, doctors still may be called upon 
to participate in the case. Frost said Janssen may still depose doctors 
but without asking for patient-specific information.

Following a request by Janssen, the trial court in its revised order 
said that Louisiana's Dept. of Health and Hospitals, as a party in the 
lawsuit, could subpoena doctors for patient records related to the case 
and turn them over to the company. Frost said it is unlikely doctors 
can contest such a request.

The state is appealing the latest order to Louisiana's Third Circuit 
Court of Appeal, citing privacy concerns. The attorney general in court 
papers criticized Janssen's move as another attempt to circumvent state 
medical records privilege.

Frost said HIPAA and state laws generally require physicians to comply 
with a court order or other legal request for protected information. 
But as a precaution, he suggests doctors try to notify patients or get 
their authorization. If physicians aren't sure what is being requested 
of them, they should seek legal help, the LSMS' Phillips recommended. 
She said the medical society found out about the case when internists, 
family physicians and psychiatrists across the state started receiving 
subpoenas for patient records.

  ADDITIONAL INFORMATION:
Case at a glance

Can a pharmaceutical company subpoena doctors for patients' medical 
records when the patients are not involved in the case?

A trial court said no. The court blocked the company's requests, saying 
HIPAA does not preempt stricter state laws.

Impact: Physicians said such an overly broad request would have 
jeopardized patient privacy. Janssen Pharmaceutica Inc., the drug 
manufacturer involved, said it needed the files to defend itself 
against a state-initiated lawsuit.