Court blocks broad subpoena of patient records
■ Physicians successfully fought a pharmaceutical company's request for the records of 6,000 Medicaid patients in Louisiana.
By Amy Lynn Sorrel — Posted April 21, 2008
Louisiana physicians who were getting roped into the state's lawsuit against a pharmaceutical company won a recent victory in their effort to defend their patients' privacy. But doctors' involvement in the case may not be over just yet.
The Louisiana attorney general is suing Janssen Pharmaceutica Inc., owned by Johnson & Johnson, for alleged illegal off-label promotion of Risperdal (risperidone). The state also claims the drug manufacturer defrauded Louisiana's Medicaid program, which reimbursed for the drug.
Neither doctors nor patients are a party to the lawsuit. But the medical community contested what it called an overly broad trial court order allowing Janssen to subpoena doctors for the medical records of up to 6,000 Medicaid patients who were prescribed Risperdal.
The order also allowed Janssen to depose individual doctors about any aspect of their decision to prescribe Risperdal or any other antipsychotic medication to their patients. Physicians said the company went too far in its request and did not obtain proper consent.
Janssen contends in court papers that it cannot adequately defend the case without the patient information. The company argued that the Health Insurance Portability and Accountability Act privacy provisions allow access to medical records as long as the files are safeguarded under a court order, which it had obtained.
Doctors feared that if the court order was allowed to stand, it would set a bad precedent, especially at a time when pharmaceutical litigation is increasingly prevalent.
"This was about protecting patients' rights, and trying to get non-party records like that is just above and beyond what is necessary for the case and not in compliance with Louisiana law," said Amy Phillips, Louisiana State Medical Society general counsel and director of legal affairs.
Doctors were particularly concerned because the case involved sensitive mental health records belonging to Medicaid patients, who may not have the resources to defend themselves against improper disclosures, stated the LSMS, in a friend-of-the-court brief.
In addition, Phillips said, "[the records request] was going to be very onerous for our physicians" in terms of time and cost.
Gregory D. Frost, a HIPAA expert with Breazeale, Sachse & Wilson LLP in Baton Rouge, La., said the state's physician-patient privilege law precludes doctors from disclosing private medical records in a lawsuit to which patients are not a party. In addition, if Janssen wanted the patient files, a medical records statute entitled individual patients to separate hearings on whether their privileged records should be produced.
The court order essentially left patients without any say and put doctors in the middle, said Frost, who assisted the LSMS in the case.
Janssen, in a statement, said: "Patient privacy is of the utmost importance to [the company], and is protected during the discovery process and throughout litigation by court order." The drug manufacturer declined to comment further.
Louisiana's Office of the Attorney General also declined comment due to the ongoing case. The state argued in court papers that the patient records were not relevant to the case and that the data it turned over to Janssen were sufficient. Following the protests from the LSMS and from several nursing home organizations, the trial court reversed itself in February and struck down Janssen's record requests. It revised its original court order in March.
State law has stronger safeguards
The court found that HIPAA does not preempt the more stringent state laws governing access to medical records for patients who are not parties in a case.
"The court said you can't just subpoena these records and ignore state law," Frost said.
HIPAA does not create a privilege, he said. Rather, it provides a procedural protection meant to ensure patients are notified that their information is being requested and gives them a chance to assert their privacy rights.
HIPAA creates a floor for privacy protections, but statutes like that in Louisiana were meant to add an additional layer of protection and override the federal privacy law, he said.
Despite the recent victory, however, doctors still may be called upon to participate in the case. Frost said Janssen may still depose doctors but without asking for patient-specific information.
Following a request by Janssen, the trial court in its revised order said that Louisiana's Dept. of Health and Hospitals, as a party in the lawsuit, could subpoena doctors for patient records related to the case and turn them over to the company. Frost said it is unlikely doctors can contest such a request.
The state is appealing the latest order to Louisiana's Third Circuit Court of Appeal, citing privacy concerns. The attorney general in court papers criticized Janssen's move as another attempt to circumvent state medical records privilege.
Frost said HIPAA and state laws generally require physicians to comply with a court order or other legal request for protected information. But as a precaution, he suggests doctors try to notify patients or get their authorization. If physicians aren't sure what is being requested of them, they should seek legal help, the LSMS' Phillips recommended. She said the medical society found out about the case when internists, family physicians and psychiatrists across the state started receiving subpoenas for patient records.