Employee Entitled To Disclosure of Medical Records For Whistleblower Case

McMahon v. New York Organ Donor Network, Inc., ____Misc. 3d____(N.Y. Co., April 6, 2017), is both an interesting and unusual case.

The plaintiff, a transplant coordinator, asserted that he was fired for being a whistleblower in violation of New York Labor Law Section 740 (applicable to private sector employers). He alleged that he disclosed the fact that organs were procured without legally required medical testing and in some cases, were taken from the patient while they were still showing signs of life.

This case is about disclosure of medical records which the plaintiff needed in order to prove his case.

The court ordered the disclosure and rejected the argument that these medical records were protected under HIPPA, reasoning:

HIPAA provides that "[e]xcept as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section" (45 CFR § 164.508[a][1]). Health plans, health care clearinghouses and certain health care providers are identified as 'covered entities' under HIPAA (45 CFR § 160.103). "A covered entity may use or disclose protected health information to organ procurement organizations" (45 CFR §164.512[h]). A covered entity may also disclose health information protected under HIPAA in a judicial proceeding (45 CFR §164.512[e])HIPAA provides that "[e]xcept as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section" (45 CFR § 164.508[a][1]). Health plans, health care clearinghouses and certain health care providers are identified as 'covered entities' under HIPAA (45 CFR § 160.103). "A covered entity may use or disclose protected health information to organ procurement organizations" (45 CFR §164.512[h]). A covered entity may also disclose health information protected under HIPAA in a judicial proceeding (45 CFR §164.512[e]).

The instant motion appears to raise an issue of first impression — whether an OPO that is not covered by HIPAA must produce medical records it obtained from a covered entity because this information is required in order to run its organization. The reason that defendant receives medical records is that it needs the information to process organ donations. Defendant must know certain information about a donor's medical history in order to ensure that a donation is successful.

However, defendant is not a covered entity and, therefore, must turn over the requested information. Defendant failed to identify a federal regulation or case law that would prevent this Court from requiring disclosure. Defendant cites Liew v New York Univ. Med. Ctr. (55 AD3d 566, 865 NYS2d 278 [2d Dept 2008]) in support of its argument that it need not produce the requested medical records. That case, however, is inapposite because in Liew, the defendant, a hospital, sought to compel third-party defendant St. Luke's Hospital to produce medical records of a nonparty organ donor. The Supreme Court's opinion in Liew, which the Second Department affirmed without modification, noted that the "HIPAA Privacy Rule protects the confidentiality of these records" (Liew v New York Univ. Med. Ctr., 2007 WL 6122885 [Sup Ct, Queens County, May 29, 2007]). This suggests that, although not mentioned in the Appellate Division's decision, St. Luke's Hospital was a covered entity HIPAA. Because defendant is not a covered entity, this case is not binding based on the facts of this case.