* * * FOR PUBLICATION IN WEST'S HAWAI`I REPORTS AND PACIFIC REPORTER * * *


IN THE SUPREME COURT OF THE STATE OF HAWAI`I



----O0O---



PHILLIP A. BRENDE; DOLORES L. BRENDE, Petitioners,


vs.


THE HONORABLE GLENN S. HARA, JUDGE OF THE CIRCUIT COURT OF THE
THIRD CIRCUIT, STATE OF HAWAI`I, Respondent.


KUULEI K. KUALII; JOHN DOES 1-10; JANE DOES 1-10; DOE
PARTNERSHIPS 1-10; DOE CORPORATIONS 1-10; ROE "NON-PROFIT"
CORPORATIONS 1-10; and ROE GOVERNMENTAL ENTITIES 1-10,
Respondents, Real Parties in Interest.



NO. 27964




ORIGINAL PROCEEDING
(CIV. NO. 05-1-0108)




JANUARY 25, 2007




MOON, C.J., LEVINSON, NAKAYAMA, ACOBA, AND DUFFY, JJ.

Amended Per Curiam. In this original proceeding, petitioners Phillip Brende and Dolores Brende (petitioners), as plaintiffs in Civil No. 05-1-0108 (the underlying litigation), petition this court for a writ of mandamus directing Glenn S. Hara, judge of the third circuit court (the respondent judge), to revise a medical information protective order to prohibit any person or entity from disclosing, for purposes outside the underlying litigation and without petitioners' consent, petitioners' health information produced in discovery. Petitioners contend that the privacy provision of the Hawai`i Constitution, article I, section 6 protects the disclosure, outside the underlying litigation, of petitioners' health information produced in discovery. Respondent Kuulei Kualii (respondent) counters that privacy protections have been waived.

Based on the following, we hold that petitioners are entitled to mandamus relief because there is no present legitimate need for disclosure of petitioners' health information unrelated to the underlying litigation, and disclosure outside the litigation of petitioners' health information produced in discovery will violate petitioners' informational privacy right under article I, section 6.

I.    Background

The underlying litigation arises out of a motor vehicle tort case filed by petitioners against respondent. The case is pending in the third circuit court. Before and after the filing of the complaint, petitioners attempted to secure from respondent a stipulated order that protected the disclosure and use of petitioners' health information produced in discovery. Petitioners sought an order protecting their privacy rights, asserted under federal and state law, regarding their health information produced in discovery. Their proposed stipulated order contained provisions patterned after the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulation, 45 C.F.R. § 164.512 (2005), (1) that: (1) prohibited respondent from using or disclosing -- outside the underlying litigation and without petitioners' consent -- petitioners' health information obtained in discovery from a health plan, health care clearinghouse, or health care provider that electronically transmits health information [hereinafter, health care entities]; and (2) required petitioners' health information obtained in discovery be returned to health care entities or be destroyed at the end of the litigation. The proposed stipulated order also contained a provision grounded in Hawai`i law -- article I, section 6 of the Hawai`i Constitution, (2) Hawai`i Rules of Evidence (HRE) Rule 504, (3) and Hawai`i Rules of Civil Procedure (HRCP) Rule 26(c) (4) -- that prohibited respondent and all other persons and entities from using or disclosing, outside the underlying litigation and without petitioners' consent, petitioners' health information obtained in discovery from any source.

Petitioners contended that the provision grounded in Hawai`i law was necessary because, absent such provision, respondent and/or her insurer, State Farm Mutual Automobile Insurance Company (respondent's insurer) and its employees and agents could use petitioners' health information produced in discovery for purposes beyond the evaluation of petitioners' tort claim asserted in the underlying litigation. Respondent, through counsel retained by respondent's insurer, contended that a stipulated protective order was not necessary. Nonetheless, respondent agreed to stipulate to the proposed provisions patterned after the HIPAA, but refused to stipulate to the proposed provision grounded in Hawai`i law.

Thereafter, petitioners made no further attempts to secure a stipulated protective order from respondent. Instead, they moved the circuit court for the issuance of a protective order, pursuant to HRCP Rule 26(c) and the HIPAA, in the form rejected by respondent (motion for protective order). Petitioners asserted that, absent entry of their proposed protective order providing extended protection under Hawai`i law, respondent, respondent's counsel, and respondent's insurer and its employees and agents could use petitioners' health information produced in discovery for purposes beyond the evaluation of petitioners' tort claim asserted in the underlying litigation.

Respondent opposed the motion for protective order. She countered that a protective order was not necessary, but argued, alternatively, that such order, if issued, should be limited to the protections of the HIPAA and that petitioners had failed to show good cause, as required under HRCP Rule 26(c), for a protective order that exceeded the protections of the HIPAA.

Petitioners' motion for protective order was heard by the respondent judge, who determined that petitioners had failed to show "good cause or any other basis for [a protective order] in excess of what is required by [the HIPAA]" and granted the motion as to a protective order that "track[ed, in] scope and terms, the language of [the HIPAA]." The ruling was reduced to a "HIPAA Qualified Protective Order" that was entered on February 7, 2006. The order specifically:

Petitioners moved for reconsideration of the February 7, 2006 qualified protective order on the ground that it was "deficient and ineffectual [and] tantamount to not having a protective order at all" because "it is [respondent's insurer] and not [respondent] which is interested in improperly using [petitioners'] private health information [produced in discovery] beyond [the underlying litigation]." Petitioners argued that "[respondent's insurer] clearly seeks unrestricted access to [petitioners'] medical and health information [produced in discovery]" inasmuch as "[respondent's] counsel [retained by respondent's insurer] has given no assurances to [petitioners'] counsel that [petitioners'] medical information produced [in discovery] in [the underlying litigation] will not be used by anyone for any purpose outside [of the underlying litigation] proceeding" and that respondent's insurer, in another case, engaged in "outrageous health information privacy abuse."

Regarding respondent insurer's "abuse" of health information privacy rights in another case, petitioners cited to a Colorado case, A.T. v. State Farm Mut. Auto Ins. Co., 989 P.2d 219 (Colo. App. 1999), wherein respondent's insurer discredited a witness by using health information about the witness that respondent's insurer had obtained in prior litigation with the witness. Petitioners described respondent insurer's conduct in the Colorado case as "appalling and reprehensible" and "a shocking example of [respondent] insurer's abusive, unethical use of patient medical information obtained in a prior proceeding which could have been prevented by a comprehensive qualified protective order." Petitioners argued that the February 7, 2006 qualified protective order must be reconsidered because respondent's counsel and respondent's insurer and its employees and agents "simply cannot be trusted to voluntarily not use [petitioners'] protected health information [produced in discovery] for purposes beyond [the underlying litigation][.]" The respondent judge denied the motion for reconsideration.

Petitioners thereupon filed the instant petition for a writ of mandamus. They seek an order directing the respondent judge to revise the February 7, 2006 qualified protected order by deleting the provision that states the order "shall not limit the use of any health information that has come, or which might come, into the possession of any party or any party's attorney from a source other than a [health care entity]" and replacing it with a provision that states "none of [petitioners'] protected health information and/or medical information obtained from any source in [the underlying litigation] shall be disclosed or used for any purpose by anyone or by any entity outside of [the underlying litigation] without [petitioners'] explicit written consent thereto."

II.     Standard for Disposition

A writ of mandamus is an extraordinary remedy that will not issue unless the petitioner demonstrates a clear and indisputable right to relief and a lack of alternative means to redress adequately the alleged wrong or obtain the requested action. Kema v. Gaddis, 91 Hawai`i 200, 204, 982 P.2d 334, 338 (1999) (citation omitted). Such writs are not intended to supersede the legal discretionary authority of the trial courts, nor are they intended to serve as legal remedies in lieu of normal appellate procedures. Id. Where a court has discretion to act, mandamus will not lie to interfere with or control the exercise of that discretion, even when the judge has acted erroneously, unless the judge has exceeded his or her jurisdiction, has committed a flagrant and manifest abuse of discretion, or has refused to act on a subject properly before the court under circumstances in which it has a legal duty to act. Id. at 204-05, 982 P.2d at 338-39.

III.     Discussion

A.     Mandamus Relief Is Available When A Court Issues A Discovery Order That Allows Access To Confidential
         Information.

"Mandamus is the appropriate remedy where [a] court issues an order releasing confidential files . . . and the order is not immediately appealable." Kema, 91 Hawai`i at 205, 982 P.2d at 339.

Discovery orders are not immediately appealable, but "[a] petition for writ of mandamus is available for extraordinary situations." Abrams v. Cades Schutte Fleming & Wright, 88 Hawai`i 319, 323, 966 P.2d 631, 635 (1999).

Petitioners are entitled to mandamus relief because the February 7, 2006 qualified protective order is a discovery order issued in the underlying litigation that is not immediately appealable, and the order allows access to confidential information by not prohibiting any person or entity from using or disclosing -- outside the underlying litigation and without petitioners' consent -- petitioners' health information obtained in discovery from any source.

B.     A Hawai`i Medical Information Protective Order Must, At Minimum, Provide HIPAA Protections.

HIPAA establishes national privacy standards and fair information practices regarding health information. As to judicial proceedings, HIPAA applies only to the parties involved in the proceeding and to health information obtained in discovery directly from health care entities. HIPAA also requires such health information be returned to health care entities or be destroyed at the end of the proceeding. 45 C.F.R. § 164.512, see supra note 1. The regulation is a "federal floor of privacy protections that does not disturb more protective rules or practices. . . . The protections are a mandatory floor, which other governments and any [Department of Health and Human Services regulated] entities may exceed." 65 Fed. Reg. 82,462 (Dec. 28, 2000). Thus, in Hawai`i, a medical information protective order issued in a judicial proceeding must, at a minimum, provide the protections of the HIPAA. Issuance of a medical information protective order in excess of the protections of HIPAA may be issued "for good cause shown" "to protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense[.]" HRCP Rule 26(c), see supra note 4.

The February 7, 2006 qualified protective order provides petitioners with the protections of HIPAA by prohibiting the parties to the underlying litigation from using or disclosing, outside of the litigation, petitioners' health information obtained in discovery directly from health care entities and requiring such health information to be returned to health care entities or be destroyed at the end of the litigation.

Petitioners contend that the respondent judge manifestly abused his discretion in issuing a protective order that was based solely on the protections of the HIPAA and that did not extend beyond the parties to the underlying litigation and beyond health information obtained in discovery directly from health care entities. Petitioners argue that the scope of the February 7, 2006 qualified protective order is "unreasonably narrow" and will result in irreparable harm once health information is produced in discovery because respondent's insurer has demonstrated, as in the Colorado case, that it "can[not] be trusted, without an effective, comprehensive protective order[,] to abide by a party's medical information privacy and not use confidential information outside of a subject proceeding." Petitioners assert that a "comprehensive" protective order is required by the privacy provision of article I, section 6 of the Hawai`i Constitution and HRE Rule 504 and that the respondent judge's refusal to issue such an order was a manifest abuse of discretion.

Respondent maintains that there was no "good cause" shown as required under HRCP Rule 26(c) for issuance of a protective order in excess of the protections of the HIPAA because the Colorado case "is nothing more than generalized, unsubstantiated speculation" that petitioners' health information produced in discovery will be misused by respondent's insurer and is not good cause for issuance of a protective order extending to respondent's insurer and other non-parties to the underlying litigation. Respondent further answers that petitioners waived any privacy interests in their health information by filing the underlying litigation, and petitioners' health information produced during litigation discovery is needed by respondent to assess the duplicity of future personal injury claims by petitioners. The information is also needed by liability insurers, defense counsel, and personal injury plaintiffs to evaluate tort claims.

C.     Article I, Section 6 Of The Hawai`i Constitution Protects The Disclosure Outside Of Litigation Of Health                          Information Produced In Discovery.

As previously noted article I, section 6 provides in part that "[t]he right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest."

[T]he [article I, section 6] right of privacy encompasses the common law right of privacy or tort privacy. This is a recognition that the dissemination of private and personal matters, be it true, embarrassing or not, can cause mental pain and distress far greater than bodily injury. For example, the right can be used to protect an individual from invasion of [the individual's] private affairs, public disclosure of embarrassing facts, and publicity placing the individual in a false light. In short, this right of privacy includes the right of an individual to tell the world to "mind your own business."

Stand. Comm. Rep. No. 69, in Proceedings of the Constitutional Convention of Hawaii of 1978 (Proceedings), Vol. I, at 674. "[A]rticle I, Section 6 'relates to privacy in the informational and personal autonomy sense.'" State of Hawai`i Organization of Police Officers (SHOPO) v. Society of Professional Jounalists-University of Hawai`i Chapter, 83 Hawai`i 378, 397, 927 P.2d 386, 405 (1996) (quoting Stand. Comm. Rep. No. 69 in Proceedings, at 674). "[T]he privacy right protected by the 'informational privacy' prong of article I, section 6 is the right to keep confidential information which is 'highly personal and intimate.'" Id. (quoting Comm. Whole Rep. No. 15 in Proceedings, at 1024 and citing Painting Industry of Hawaii Market Recovery Fund v. Alm, 69 Haw. 449, 746 P.2d 79 (1987)). "Highly personal and intimate" information that is protected by the informational prong of article I, section 6 includes "medical, financial, educational, or employment records." Painting Industry, 69 Haw. at 454, 746 P.2d at 82; State v. Mallan, 86 Hawai`i 440, 443 n.4, 950 P.2d 178, 181 n.4 (1998).

Petitioners' health information is "highly personal and intimate" information that is protected by the informational prong of article I, section 6. The constitutional provision protects the disclosure outside of the underlying litigation of petitioners' health information produced in discovery. (5)

Respondent contends that article I, section 6's protection of petitioners' health information has been waived by petitioners' filing of the underlying litigation that placed their medical conditions at issue. However, the waiver is plainly limited to the underlying litigation proceeding and does not extend outside of that proceeding. See HRE Rule 504 (quoted supra at note 3).

D.     "Good Cause" For Purposes Of HRCP Rule 26(c) Requires A Balancing Of The Harm Resulting From Disclosure,         Outside Of Litigation, Of Health Information Produced In Discovery Against The Need For The Discovered                     Information Outside Of Litigation.

HRCP Rule 26(c), (see supra note 4) authorizes the circuit court, "for good cause shown," to "make any order which justice requires to protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense[.]" "Good cause" is not defined by HRCP Rule 26(c) and has not been construed by the Hawai`i appellate courts. However, HRCP Rule 26(c) is patterned after Federal Rules of Civil Procedure (FRCP) Rule 26(c). "[I]n instances where Hawai`i case law and statutes are silent, this court can look to parallel federal law for guidance." Trivectra v. Ushijima, 112 Hawai`i 90, 102, 144 P.3d 1, 13 (2006) (citations omitted).

In determining whether good cause exists for issuance of a protective order under FRCP Rule 26(c), "the federal courts have superimposed a somewhat demanding balancing of interests approach to the Rule." 6 Moore's Federal Practice, § 26.101[1][c] (Matthew Bender 3d ed.). Under such standard, the court must balance the requesting party's need for information against the injury that might result if uncontrolled disclosure is compelled. See Pansy v. Borough of Stroudsburg, 23 F.3d 772 (3d Cir. 1994); Keyes v. Lenoir Rhyne College, 552 F.2d 579 (4th Cir. 1977); Deitchman v. E.R. Squibb & Sons, Inc., 740 F.2d 556 (7th Cir. 1984); General Dynamics Corp. v. Selb Mfg. Co., 481 F.2d 1204 (8th Cir. 1973); Phillips ex rel. Estates of Boyd v. General Motors Corp., 307 F.3d 1206 (9th Cir. 2002); Centurion Industries, Inc. v. Warren Steurer and Associates, 665 F.2d 323 (10th Cir. 1981); McCarthy v. Barnett Bank of Polk County, 876 F.2d 89 (11th Cir. 1989).

In the instant case, determining whether good cause exists for issuance of the revised protective order sought by petitioners requires a balancing of respondent's need, outside of the underlying litigation, for petitioners' health information produced in discovery against the injury that might result from the disclosure of that health information outside of the litigation. Respondent's need for petitioners' health information produced in discovery to assess the duplicity of a future personal injury claim will not arise unless petitioners make such a claim, and, until such a claim is made, respondent has no legitimate need, outside of the underlying litigation, for petitioners' health information produced in discovery. The asserted need by liability insurers, defense counsel, and personal injury plaintiffs for petitioners' health information produced in discovery is not a legitimate need for the health information outside of the underlying litigation. The disclosure outside of the underlying litigation, without petitioners' consent, of petitioners' health information produced in discovery will violate petitioners' constitutional right to informational privacy, and, once the information is disclosed, the potential harm cannot be undone.

There being no present legitimate need outside of the underlying litigation for petitioners' health information produced in discovery and, because any disclosure of such information outside the litigation would be a violation of petitioners' constitutional right to informational privacy, we believe petitioners have a clear and indisputable right to the revised protective order they seek, and good cause exists for the issuance of such order. We, therefore, hold that the respondent judge's refusal to issue such order constituted a flagrant and manifest abuse of discretion. See Kema, 91 Hawai`i at 204-05, 982 P.2d at 338-39.

IV.     Conclusion
Based on the foregoing, the petition for writ of mandamus is granted. The respondent judge is directed to revise the February 7, 2006 qualified protective order by: (1) deleting the provision stating that the order "shall not limit the use of any health information that has come, or which might come, into the possession of any party or any party's attorney from a source other than a [health care entity]"; and (2) adding a provision stating that "none of the plaintiffs' protected health information and/or medical information obtained in discovery from any source in Civil No. 05-1-0108 shall be disclosed or used for any purpose by anyone or by any entity outside of Civil No. 05-1-0108 without the plaintiffs' explicit written consent thereto." (6)

The qualified protective order, as revised, applies to petitioners' health and medical information obtained pursuant to HRCP Rule 26(a). (7) The qualified protective order, as revised, does not apply to petitioners' health and medical information that is publicly available in the underlying litigation and does not restrict the disclosure or use of such publicly available information by anyone or by any entity outside the underlying litigation.



Arthur Y. Park, Vernon Yu,
Laurent J. Remillard, Jr.,
John C. McLaren (of Park
Park Yu & Remillard), and
Lionel D. Meyer for petitioners

Randall Y.S. Chung
and Melanie S. Matsui
(of Matsui Chung) for
respondent Kuulei K. Kualii

Russell A. Suzuki,
Deputy Attorney General,
for respondent judge




1.    Section 164.512 of 45 C.F.R. provides in relevant part:

(e) Standard: Disclosures for judicial and administrative proceedings.

(1) Permitted disclosures. A [health plan, health care clearinghouse or health care provider who electronically transmits health information] may disclose protected health information in the course of any judicial or administrative proceeding:

. . .

(ii) in response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if:

. . .

(iv) . . .

(A) The parties to the dispute giving rise to the request for information have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute;

. . .

(v) For purposes of paragraph (e)(1) of this section, a qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii) of this section, an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that:

(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and

(B) Requires the return to the [health plan, health care clearinghouse or health care provider who electronically transmits health information] or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.

2.    Article I, section 6 provides that "[t]he right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest. The legislature shall take affirmative steps to implement this right.

3.    HRE Rule 504, entitled "Physician-Patient Privilege" provides in relevant part:

. . .

(b) General Rule of Privilege. A patient has a privilege to refuse to disclose and to prevent any other person from disclosing confidential communications made for the purpose of diagnosis or treatment of the patient's physical, mental, or emotional condition, including alcohol or drug addiction, among oneself, the patient's physicians, and persons who are participating in the diagnosis or treatment under the direction of the physician, including members of the patient's family.

. . .

(d) Exceptions.

. . .

(3) Condition as Element of Claim or Defense. There is no privilege under this rule as to a communication relevant to the physical, mental, or emotional condition of the patient in any proceeding in which the patient relies upon the condition as an element of the patient's claim or defense or, after the patient's death, in any proceeding in which any party relies upon the condition as an element of the party's claim or defense.

4.    HRCP Rule 26(c) provides in relevant part:

Protective Orders. Upon motion by a party or by the person from whom discovery is sought, accompanied by a certification that the movant has in good faith conferred or attempted to confer with other affected parties in an effort to resolve the dispute without court action, and for good cause shown, the court in which the action is pending . . . may make any order which justice requires to protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense[.]

5.     The privacy of health information was previously codified in Hawai`i Revised Statutes chapter 323C (Supp. 1999) (Privacy of Health Care Information), which prohibited anyone from disclosing, outside of a civil action, health information discovered in the action. The law was enacted in 1999, but was repealed in 2001 upon the legislature's finding of "little support for a Hawaii Medical Privacy Law in light of the adoption of [HIPAA]," "no evidence of widespread abuse [of medical records privacy] in Hawaii," and a need for "a clear understanding of what, if any, problems Hawaii faces in protecting medical privacy." 2001 Haw. Sess. L. Act 244.

6.    Pursuant to provision 3.A.(3) of the February 7, 2006 qualified protective order, the revision to the order "is [not] intended to affect, nor shall it affect the health information collection, maintenance, and record keeping obligations, requirements, or practices of any covered entity that is imposed by state and/or federal law, and which may conflict with the terms of this Order, and/or the maintenance and record keeping obligations, requirements, or practices of any insurance carrier or law firm involved in this proceeding, which may conflict with the terms of this Order."

The qualified protective order, as revised, would be subject to modification by the circuit court upon respondent's showing of a need, outside of the underlying litigation, for petitioners' health information produced in discovery that outweighs the harm resulting from disclosure of such information outside of the litigation.

7.    HRCP Rule 26(a) provides:

(a) Discovery Methods. Parties may obtain discovery by one or more of the following methods: depositions upon oral examination or written questions; written interrogatories; production of documents or things or permission to enter upon land or other property, for inspection and other purposes; physical and mental examinations; and requests for admission.