IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON
DIVISION ONE
STATE OF WASHINGTON,
No. 84140-8-I
Appellant,
ORDER GRANTING
v. MOTION TO PUBLISH
JOHNSON & JOHNSON; JANSSEN
PHARMACEUTICALS, INC.; ORTHOMCNEIL-JANSSEN
PHARMACEUTICALS, INC., n/k/a
JANSSEN PHARMACEUTICALS, INC.;
JANSSEN PHARMACEUTICA, INC. n/k/a
JANSSEN PHARMACEUTICALS, INC.;
and XYZ Corporations 1 through 20,
Respondents.
The appellant, State of Washington, having filed a motion to publish opinion, and
the panel having considered the motion, and finding that the opinion dated July 31, 2023
will be of precedential value; now, therefore it is hereby
ORDERED that the unpublished opinion filed July 31, 2023 shall be published.
FOR THE COURT:
IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON
STATE OF WASHINGTON,
No. 84140-8-I
Appellant,
DIVISION ONE
v.
UNPUBLISHED OPINION
JOHNSON & JOHNSON; JANSSEN
PHARMACEUTICALS, INC.; ORTHOMCNEIL-JANSSEN
PHARMACEUTICALS, INC., n/k/a
JANSSEN PHARMACEUTICALS, INC.;
JANSSEN PHARMACEUTICA, INC.
n/k/a JANSSEN PHARMACEUTICALS,
INC.; and XYZ Corporations 1 through
20,
Respondents.
COBURN, J. — The State sued Johnson & Johnson and Janssen
Pharmaceuticals (collectively Janssen), claiming that they violated the Consumer
Protection Act and created a public nuisance by contributing to the opioid crisis in
Washington. During discovery, the State produced data from a Medicaid claims
database consistent with the Health Insurance Portability and Accountability Act
(HIPAA) disclosure practices, which meant only the years of claims were included,
instead of full dates. Janssen moved to compel the production of the specific days and
months related to service and prescription dates. A Special Master agreed with the
State that releasing full dates created a risk of re-identifying Medicaid patients that was
Citations and pincites are based on the Westlaw online version of the cited material. No. 84140-8-I/2
not small enough to be acceptable under HIPAA. The trial court disagreed, overruled
the Special Master, added its own parameters related to the release of data, and
granted the motion to compel. A commissioner of this court granted the State’s request
for discretionary review. We reverse.
BACKGROUND
The State Attorney General filed this lawsuit against Janssen 1 and affiliated
defendants alleging that they violated the state’s Consumer Protection Act and created
a public nuisance regarding its manufacture and marketing of pharmaceutical opioids.
Discovery was presided over by a court-appointed Special Master. A Special Master is
permitted under CR 53.3 to provide independent assistance to the court in resolving
complex discovery issues. 4 ELIZABETH A. TURNER, W ASHINGTON PRACTICE: RULES
PRACTICE CR 53.3 author’s cmt. 1 (7th ed. 2021).
During discovery, the State produced 11 years of data from a database of all
Medicaid claims in the state maintained by the Washington Healthcare Authority (HCA).
The database contains health information for millions of Washington residents. The
data provided to Janssen included the year in which Medicaid services were provided,
but not the month or the day of the service, in accordance with HCA’s typical disclosure
practices.
In passing HIPAA in 1996, Congress recognized the need for strict privacy
protections for health information, authorizing the United States Department of Health
and Human Services (DHHS) to promulgate regulations to put protections in place,
1
The State alleges that Johnson and Johnson is the only company that owns more than 10 percent of Janssen Pharmaceuticals’ stock and corresponds with the Federal Drug Administration regarding Janssen’s products.
2
No. 84140-8-I/3
codified at 45 C.F.R. §§ 160 and 164. See Health Insurance Portability and
Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936. The regulations apply
to “covered entities,” including health plans and health care providers transmitting any
health information electronically. 45 C.F.R. § 164.104(a)(1), (3). The rule defines
protected health information to mean “individually identifiable health information”—that
is, health information “[t]hat identifies the individual” or “[w]ith respect to which there is a
reasonable basis to believe the information can be used to identify the individual.” 45
C.F.R. § 160.103. Covered entities are generally prohibited from using or disclosing
protected health information, with a limited number of exceptions outlined in 45 C.F.R. §
164.502.
DHHS provides standards and requirements related to “[d]e-identification of
protected health information.” “Health information that does not identify an individual
and with respect to which there is no reasonable basis to believe that the information
can be used to identify an individual is not individually identifiable health information.”
45 C.F.R. § 164.514(a). Under “Implementation specifications: Requirements for deidentification of protected health information,” a covered entity “may determine that
health information is not individually identifiable health information only” through two
methods: “Safe Harbor” or “Expert Determination.” 45 C.F.R. § 164.514(b).
The Safe Harbor method requires removing 18 identifiers listed in 45 C.F.R. §
164.514(b)(2)(i). 45 C.F.R. § 164.514(b)(2). That list includes “[a]ll elements of dates
(except year) for dates directly related to an individual, including birth date, admission
date, discharge date, date of death.” 45 C.F.R. § 164.514(b)(2)(i)(C).
3
No. 84140-8-I/4
Under the Expert Determination method, a covered entity may determine that
health information is not individually identifiable health information only if
(1) A person with appropriate knowledge of and experience with generally
accepted statistical and scientific principles and methods for rendering
information not individually identifiable:
(i) Applying such principles and methods, determines that the risk is very
small that the information could be used, alone or in combination with
other reasonably available information, by an anticipated recipient to
identify an individual who is a subject of the information; and
(ii) Documents the methods and results of the analysis that justify such
determination.
45 C.F.R. § 164.514(b)(1).
The DHHS’s Office of Civil Rights (OCR) issues guidance on complying with deidentification procedures, including the expert determination method. This guidance
notes that there is no certain degree or certification program for use in designating an
expert, but that expertise may be gained through relevant education and experience
generally in mathematics, statistics, or scientific domains. It also notes that
There is no explicit numerical level of identification risk that is deemed to
universally meet the “very small” level indicated by the [Expert
Determination] method. The ability of a recipient of information to identify
an individual (i.e., subject of the information) is dependent on many
factors, which an expert will need to take into account while assessing the
risk from a data set . . . As a result, an expert will define an acceptable
“very small” risk based on the ability of an anticipated recipient to identify
an individual.
The guidance also states “OCR does not require a particular process for an expert to
use to reach a determination that the risk of identification is very small. However, the
Rule does require that the methods and results of the analysis that justify the
determination be documented.” The guidance also observed general principles
(replicability, data source availability, distinguishability, assess risk) used by experts in
4
No. 84140-8-I/5
the determination of the identifiability of health information and cited published research
by Dr. Latanya Sweeney, PhD, among others. Though not a definitive list, the principles
serve as a starting point and “experts are advised to consider how data sources that are
available to a recipient of health information . . . could be utilized for identification of an
individual.” The guidance explained that experts, when evaluating identification risk,
often consider the degree to which a data set can be linked to a data source that
reveals the identity of the corresponding individuals. To do so, experts consider 1) that
the de-identified data are unique or distinguishing, 2) the existence of a naming data
source, including publicly available databases, and 3) the existence of a mechanism to
relate the de-identified and identified data sources.
After receiving the Medicaid data that included 1,835,136,898 distinct records,
Janssen moved the court to compel the State to supplement the Medicaid claims data
with the month and day of the services and prescriptions. Janssen argued that it
needed the data to determine the “extent to which prescriptions for Janssen opioid
medications preceded diagnoses for opioid use disorder” as part of its defense.
The State objected. It submitted a declaration from the Privacy Officer of the
Washington Healthcare Authority (HCA) explaining that HCA is a covered entity subject
to the requirements of HIPAA and 42 C.F.R. part 2, which regulates the disclosure of
information related to federally subsidized substance use disorder treatment. The State
argued that there are two ways that Janssen can legally obtain information protected
under part 2: with individual patient consent, or under a court order finding good cause
for disclosure after every impacted patient receives notice and an opportunity to be
heard. See 42 U.S.C. § 290dd-2(b)(1),(b)(2)(C); 42 C.F.R. § 2.64(b), (d). The State
5
No. 84140-8-I/6
argued that, despite having raised these issues with Janssen, Janssen had not offered
a plan for identifying the millions of impacted patients and obtaining their consent, nor
had it offered any proposal to give notice to these impacted patients. The State argued
that granting a motion to compel HCA to disclose full dates associated with individual
patients would cause HCA to violate federal law under HIPAA and 42 C.F.R. part 2.
The Special Master held a hearing on the motion in October 2021 and
provisionally granted Janssen’s motion, subject to Janssen providing “expert
certification to the special master that the disclosure of this information does not have
the potential for re-identification or for reverse engineering to disclose the identity of the
individuals for whom the data is disclosed, and is HIPAA-compliant.”
Janssen submitted a declaration from Dr. M. Laurentius Marais, PhD, which
stated that there was virtually no risk of re-identification of individuals should the data be
supplemented. The State submitted an expert report by Dr. Latanya Sweeney, PhD,
who refuted Dr. Marais’ declaration as containing incorrect statements. Dr. Sweeney
demonstrated how full dates in the Medicaid Dataset “would allow it to be joined with
other publicly available and privately held information, thus allowing sensitive
information on individuals in the Medicaid Dataset to be re-associated with named
individuals.”
Janssen Expert Dr. Marais
Dr. Marais works for a “consulting firm that specializes in applied mathematical
and statistical analysis” and holds “a PhD degree and master’s degrees in business
administration, mathematics, and statistics from Stanford University.” He has several
decades of experience in applying and reviewing mathematical and statistical theory
6
No. 84140-8-I/7
and methods. He has taught and conducted scholarly research at the University of
Chicago and Stanford University. Dr. Marais lists his areas of expertise as “the uses of
biostatistical and epidemiological methods to draw conclusions from data concerning
the rates of and risk factors for health effects, including the analysis of data on the
efficacy of and adverse events associated with pharmaceutical drugs.” Janssen
retained Dr. Marais to conduct similar work he had previously performed for Janssen in
California – to statistically analyze the de-identified medical claims data by locating the
date of an opioid use disorder diagnosis for each patient and analyzing data prior to that
diagnosis to determine whether the corresponding pharmacy claims data reflected any
opioid prescription for the same patient. In response to the Special Master’s order,
Janssen submitted a declaration from Dr. Marais specifically addressing concerns about
re-identification.
Dr. Marais declared he was “competent to testify about the matters set forth
herein because I have either personally observed such matters or have formed opinions
within my areas of professional expertise concerning such matters.” Dr. Marais
explained in his declaration:
8. Assuming Plaintiff did not hold the same level of concern about
its previous production of de-identified Medicaid data, Plaintiff’s current
elevated concern must arise from some hypothetically increased
vulnerability to re-identification based on month and day information in
addition to the calendar-year information produced previously. Based on
my education, pertinent experience, and pertinent background knowledge,
it is my opinion that the re-identification risk associated with the production
Janssen seeks, whether arising from the completed dates alone or in
combination with other demographic information produced to date, or with
other publicly accessible information, is de minimis, if indeed any nonzero
risk exists at all.
9. I base this opinion on the simple fact that any risk of reidentification from the additional month and day information Janssen is
7
No. 84140-8-I/8
seeking would have to arise from the purely hypothetical notion of using
complete service and dispensing dates to link records from the deidentified Medicaid data disclosed by Plaintiff to dated records from
another, complementary data source that could reveal the identities of
individual patients (a so-called “naming data source”). But Janssen does
not have access to identified versions of any such complementary data
resources. Indeed, patient names and other identifying information have
routinely been removed from analogous data sets in other opioid litigation,
and I understand that, to the extent Janssen seeks any potentially
identifying, supplementary information in this litigation, it has indicated it
too would be produced in a de-identified form. Accordingly, there is simply
no way that Janssen could use the complete date information that it seeks
to re-identify the Medicaid claims data in this litigation.
Dr. Marais went on to explain that there is no realistic prospect that Janssen
could re-identify patients using two data sets produced in the litigation provided by the
Washington Labor & Industries Workers Compensation (L&I) and Washington Public
Employees Benefits Board Program (PEBB). Dr. Marais reasoned that “neither the L&I
nor the PEBB data (nor any other data set produced in this litigation) include individually
identifying information.” Dr. Marais concluded that “the demographic descriptors
included in these data sets (year of birth, gender, race, marital status, and three-digit
ZIP code) are insufficient to establish that records drawn from different data sets but
having identical demographic descriptors actually represent the same individual patient,
even when these combinations of descriptors are unique in the data sets where they
appear.” He further opined that “even if [demographic indicators] did happen to
represent the same patient, this fact per se would still not identify that patient (because
the patient data sets produced in this proceeding simply do not contain a key to
individually identifying information, either individually or collectively, with or without the
complete service dates that Janssen seeks).” Dr. Marais said that this reasoning
“supports my opinion that the incremental re-identification risk associated with the
8
No. 84140-8-I/9
production Janssen seeks is essentially nil.”
Dr. Marais asserted that he needed the complete date of every medical service
and prescription fill event in order for him to conduct his analysis, but suggested that the
State could “re-produce” the Medicaid data without demographic variables such as birth
year, gender, marital status and race.
Dr. Marais further concluded that “there is no basis for supposing” that full
Medicaid service dates would contain information that overlapped with service or
pharmacy claim records in the workers’ compensation or public employee benefits
program datasets available to Janssen. Dr. Marais did not document any method of
applying statistical and scientific principles and methods to support his opinion that the
risk of re-identification is essentially nil.
State’s Expert Dr. Sweeney
The State’s expert, Dr. Sweeney is the director and founder of the Data Privacy
Lab and Public Interest Technology Lab at Harvard University, where she is also a
professor. Prior to her current position she was a Chief Technology Officer at the
United States Federal Trade Commission, was a commissioner on the U.S. Evidence
Based Policy Making Commission, and a professor of Computer Science, Technology,
and Policy at Carnegie Mellon University. Dr. Sweeney earned a PhD in computer
science from the Massachusetts Institute of Technology. Alongside this experience, Dr.
Sweeney also lists extensive experience specific to data privacy in medical records,
including the identification of re-identification risks and privacy vulnerabilities in publicly
available medical data. Her work includes re-identification of Washington State health
data in 2015 using blotter stories from archived newspapers and publicly available
9
No. 84140-8-I/10
health data. 2 Through this method, Dr. Sweeney was able to learn sensitive information
about patients, such as drug and alcohol abuse and sexually transmitted diseases,
none of which had anything to do with the news stories. Dr. Sweeney’s work is cited in
the preamble to HIPAA and in other federal regulations.
The State retained Dr. Sweeney to review Janssen’s request for the creation of a
version of the de-identified Medicaid Dataset that has full dates for services and
prescription refills, and to assess privacy risks related to the disclosure of the Medicaid
Dataset. This work is consistent with many other projects she has worked on to
demonstrate privacy vulnerabilities. Dr. Sweeney cited her own work as well as
published papers reporting re-identification experiments. She also reviewed Dr. Marais’
declaration and noted that it did not provide any evidence or detailed analysis, and did
not address a large body of evidence contrary to his opinion.
Dr. Sweeney conducted an analysis using the same information that had been
provided to Janssen, the Medicaid Dataset as well as the Death Dataset, which is from
the official death registry for the State of Washington. Dr. Sweeney explained that while
not all decedents who appear in the Death Dataset are in the Medicaid Dataset, almost
all decedents in the Medicaid Dataset should be in the Death Dataset. 3 Dr. Sweeney
described the Death Dataset as “semi-publicly available,” noting that the term is used
when there is an associated cost for acquisition that limits its availability or requires a
lengthy or involved review or application process that limits access. She first measured
the identifiability of the Death Dataset, because doing so “describes the overall ground
2 Latanya Sweeney, Only You, Your Doctor, and Many Others May Know, TECH. SCI.
(Sept. 28, 2015), https://techscience.org/a/2015092903 [https://perma.cc/K3Q5-L3P2].
3
The Death Dataset is from the years 2007 through 2017.
10
No. 84140-8-I/11
truth of the identifiability of death data in subsets that could link to it, such as the
Medicaid Dataset.” Dr. Sweeney started with the Death Dataset “because matches of
records in the Medicaid Dataset to records in the Death Dataset puts names and
addresses, as well as Social Security numbers, to the health data.” Dr. Sweeney further
explained:
If each decedent record in the Medicaid Dataset matches lots of other
records in the Death Dataset ambiguously, then the identifiability of the
decedent records in the Medicaid Dataset is low. On the other hand, if
decedent records in the Medicaid Dataset match one or few of the namebearing records in the Death Dataset, then the identifiability of the
Medicaid Dataset is high. The following experiment reports how low or
high the identifiability can be based on the identifiability of the Death
Dataset.
Through progressive experiments Dr. Sweeney was able to demonstrate how
191 hospice patients in the Medicaid Dataset uniquely matched 191 named records in
the Death Dataset. Dr. Sweeney focused on hospice patients in the Medicaid claims
reasoning that patients who receive services at hospice facilities will soon decease and
can expect their claims for hospice to appear in the Medicaid Dataset and death to
appear in the Death Dataset. Dr. Sweeney compared the 23,013 records for distinct
patients who received hospice care that contained year of birth, gender, and the first
three digits of their zip code (3-digit zip code). Then by using the last year of hospice
service as a proxy for year of death, Dr. Sweeney, found 191 unique matches in the
Death Dataset. This constituted a .83 percent match of the 23,013 hospice records.
Observing that HIPAA allows health data to be shared that has more than a zero risk,
Dr. Sweeney stated “in the case of HIPAA, the risk was quantified experimentally to be
acceptable at 0.04% and 0.02% for [unique one to one matches] based on dates in
years and only the first three digits of the ZIP code.” When Dr. Sweeney added
11
No. 84140-8-I/12
race/ethnicity data to the analysis, the unique matches increased to 1,275. Dr.
Sweeney opined that if Janssen were to obtain the full dates for service claims in the
Medicaid Dataset and if the full date of the last day of service for hospice patients
matched the date of death, then identifiability would increase further. When using
month, day, and year of death, year of birth, gender, 3-digit zip code and race/ethnicity,
Dr. Sweeney was able to identify 90 percent of the 574,058 records in the death
Dataset as unique. Dr. Sweeney opined that “Defendant’s request for complete dates in
the Medicaid Dataset would allow inferences that can put names to a substantial
number of records in the Medicaid Dataset.”
Dr. Sweeney explained that the “risk is not limited to the Death Dataset alone.
There are a multitude of possibilities, especially considering publicly and privately held
data.” Dr. Sweeney concluded that
Defendant’s request does not seem to understand the privacy risks
involved in releasing personal health information under today’s standards.
The fact is that grave risks exist in the data as proposed for release, even
without lowering the standard to include complete and full dates of medical
services and prescription refills. Lowering the standard would not even
adhere to federal and best practices standards for the sharing of personal
health.
Dr. Sweeney explained that it is not impossible to anonymize the data and that the
proper way requires the use of “scientifically proven methods, not ad hoc guess work
(see Declaration of Defendant’s expert). [Janssen]’s request comes nowhere close to
meeting those established standards or otherwise assuring individuals whose sensitive
health information is in the Medicaid Dataset cannot be re-identified.” 4
4
Dr. Sweeney’s report discussed two of methods of anonymizing data: k-anonymity and differential privacy.
12
No. 84140-8-I/13
Alongside the submission of Dr. Sweeney’s report, the State submitted a
declaration from Christopher Purdy of Celerity Consulting Group explaining that an
alternative to providing Janssen with the full dates of service, it could provide a
“sequenced” dataset. Purdy explained that the sequenced dataset “would indicate the
sequence of [Medicaid claims] events within a given year without revealing any day and
month information for those events.” He explained that the group had previously
provided sequenced datasets of L&I data for use in discovery production in the State’s
litigation with other opioid manufacturers.
The Special Master held another hearing in January 2022, allowing the parties to
argue their positions regarding the expert opinions. The Special Master ordered the
State to provide sequencing of the Medicaid Dataset, but denied Janssen’s request to
supplement the Medicaid Dataset with month and date of servicing and prescription
filling. The Special Master reasoned that it was persuaded from Dr. Sweeney’s opinion
that re-identification is a substantial risk if this additional information is produced by the
State.
The Special Master held an additional hearing in February 2022 after Janssen
moved for reconsideration of his prior ruling denying the motion to compel the
production of full Medicaid service dates. The Special Master ruled that both Dr. Marais
and Dr. Sweeney were qualified experts under 45 C.F.R. § 164.514(b)(2). The Special
Master then concluded that it found “Dr. Marais’ conclusions stating such a risk is de
minimis if indeed any nonzero risk at all is ipse dixit” and that Janssen did not meet its
burden of showing the “risk is very small” under §164.514(b).
13
No. 84140-8-I/14
Janssen then filed an objection to the Special Master’s ruling and order denying
its motion to compel the supplemental Medicaid claims data. Janssen asserted in the
motion that Dr. Sweeney had incorrectly calculated the risk of re-identification stating,
Dr. Sweeney’s analyses of DOH mortality data were limited to identifying
potential matches (not reasonably accurate matches) in a limited subset of
hospice patients’ Medicaid data. And she found that just 191 hospice
patients in the Medicaid data had a birth year, gender, and a three-digit zip
code that corresponded to the same demographic information for a
decedent in the DOH death data. Even assuming those were true
matches (an assumption unsupported by the record), Dr. Sweeney
showed nothing more than a re-identification risk of 0.0004% (191 of over
4.5 million Medicaid patients).
The trial court, without oral argument, 5 sustained Janssen’s objection and
reversed the Special Master’s ruling. The trial court believed the State and Special
Master had applied an incorrect standard and each had suggested that “any risk of reidentification is unacceptable.” The trial court noted that neither the State nor Special
Master had addressed “how the Court could minimize, if not entirely eliminate, the risk
of re-identification, and the burden to the State.” The trial court specifically found that
the expert opinion of Dr. Marais provided by Janssen “is compliant with the certification
requirement in 45 C.F.R. § 164.514” and that “the most probative portion of [Dr. Marais’]
analysis largely boiled down to one similar to the State’s expert’s, but with a different
denominator.” The court then concluded there was no justification of using the total
number of hospice patients as opposed to the total number of Medicaid patients,
followed the change in the formula proposed in Janssen’s brief and found that “the
resulting risk of re-identification is 0.004%, which this Court finds is acceptably a ‘very
small’ risk of identification pursuant to 45 C.F.R. § 164.514.” The record is devoid of
5
The parties did not request oral argument.
14
No. 84140-8-I/15
any expert supporting the assertion that it was proper to substitute the entire Medicaid
patient population in a formula designed to match Medicaid patients in hospice whose
last date of service matched the date of death in the Death Database.
The trial court granted Janssen’s motion and followed its recommendations to
further mitigate risk of re-identification. The court ruled:
• The State is ordered to produce the Medicaid claims data with full
dates of service and dispensing, but without birth year, gender,
marital status, and race/ethnicity variables.
• The Defendants are prohibited from making any effort whatsoever
to take this data or any other data and link it up to any named data,
permitting re-identification.
• The distribution of this data would be strictly restricted to
Defendants’ counsel and Defendants’ expert and the fewest
number of people from his office needed to assist him with the data
analysis. The newly produced data will be maintained otherwise
subject to the Protective Order entered in this matter.
• The Defendants are required to contemporaneously destroy, and
certify the destruction of, the prior Medicaid dataset produced by
the State and provided to the Defendants’ expert, prior to the
provision of this data.
• The Defendants are prohibited from providing the DOH mortality
data set or any other “naming data source” to the expert who will
conduct this analysis.
• Defendants will pay for additional redaction and costs incurred as a
result of providing this data.
The trial court denied the State’s motion for reconsideration. The State filed a notice of
discretionary review to this court. Interlocutory review under RAP 2.3(b)(2) requires a
showing of “probable error” in a trial court decision that “substantially alters the status
quo or substantially limits the freedom of a party to act.” Review may be granted where
the superior court has departed from the usual course of judicial proceedings. RAP
2.3(b)(3). A commissioner of this court granted discretionary review.
15
No. 84140-8-I/16
DISCUSSION
Standard of Review
It is within the trial court’s discretion to deny a motion to compel discovery and
we will not disrupt the ruling absent an abuse of discretion. Clarke v. State Att’y Gen.'s
Off., 133 Wn. App. 767, 777, 138 P.3d 144 (2006) (citing Shields v. Morgan Fin., Inc.,
130 Wn. App. 750, 759, 125 P.3d 164 (2005)). “A trial court abuses its discretion if its
decision is manifestly unreasonable or based on untenable grounds or untenable
reasons.” Marriage of Littlefield, 133 Wn.2d 39, 46-47, 940 P.2d 1362 (1997).
Timeliness
As a threshold matter, Janssen contends that the State failed to timely file a
notice for discretionary review, time barring review. Janssen claims that the State was
required under RAP 5.2(b)(1) to file a notice for discretionary review within 30 days after
the entry of the order granting Janssen’s motion to compel, on which the State seeks
review here. Respondent argues that review is time-barred because the State only filed
its notice for discretionary review 30 days after the trial court’s entry of the order
denying the State’s motion for reconsideration of the order to which the State assigns
error. Janssen asserts the State is limited to review of the denial of its motion for
reconsideration, not the underlying order.
A timely motion for reconsideration will extend the 30-day deadline to appeal the
original order. Singleton v. Naegeli Reporting Corp., 142 Wn. App. 598, 603, 175 P.3d
594 (2008). Under CR 59, an aggrieved party may move for reconsideration of a
decision or order “not later than 10 days” after the entry of the order or decision. CR
59(b). Here, the trial court entered its order on April 13, 2022 sustaining Janssen’s
16
No. 84140-8-I/17
objection to the special master’s ruling and order denying its request for the State to
produce the Medicaid claims database with supplemental data fields. The State moved
for reconsideration on April 29, 2022, outside the 10-day limit permitted under CR 59(b).
In its response to the State’s motion for discretionary review, Janssen argued
that the State’s notice for discretionary review was barred under RAP 5.2(b) as untimely
because it was filed more than 30 days after entry of the trial court’s decision. The
commissioner of this court did not address the issue of timeliness in its Ruling Granting
Discretionary Review. Janssen did not move to modify the order.
Consideration of a motion for discretionary review is governed by the regular
motion procedure, RAP 6.2(c), requiring an aggrieved party to object to a ruling only by
way of a motion to modify. RAP 17.7(a). See City of Spokane v. Marquette, 103 Wn.
App. 792, 797, 14 P.3d 832 (2000), rev’d on other grounds, 146 Wn.2d 124, 43 P.3d
502 (2002). Because Janssen did not move to modify the commissioner’s ruling, it has
waived any argument that the granting of discretionary review was improper because
the request was untimely.
Expert Determination
The State contends that the trial court erred in ordering it to produce the
supplemental Medicaid claims data to include the day and month in the date of service
field, rather than just the year. The State argues that Janssen’s expert failed to comply
with the requirements of the Expert Determination method of producing HIPAA
protected information. We agree.
The parties agree that 45 C.F.R. § 164.514(b)(1) provides the requirements for
the Expert Determination method. Releasing the full dates in the Medicaid Dataset is
17
No. 84140-8-I/18
contrary to 45 C.F.R. § 164.514(b)(2)(i)(C) under the Safe Harbor method. Thus, for the
court to be satisfied that the release of full dates would not create a “reasonable basis to
believe that the information can be used to identify an individual,” 45 C.F.R. §
164.514(a), a qualified expert, applying principles and methods for rendering
information not individually identifiable, had to document the methods and results of its
analysis that determined the “the risk is very small that the information could be used,
alone or in combination with other reasonably available information, by an anticipated
recipient to identify an individual who is a subject of the information.” 45 C.F.R. §
164.514(b)(1)(i) and (ii).
It appears the trial court misread the record. First, it incorrectly found that the
State and the Special Master applied an incorrect risk level of “any risk” instead of the
correct standard of a “very small risk” under 45 C.F.R. § 164.514(b)(1)(i). The State
submitted Dr. Sweeney’s declaration where she acknowledged that HIPAA does not
require the risk to be zero before health data may be shared. The Special Master
expressly found that Janssen did not meet its burden of showing the “risk is very small”
under §164.514(b).
Second, the trial court incorrectly attributed to Dr. Marais an analysis and formula
that he did not make or suggest. Nowhere does Dr. Marais propose replacing the
denominator of Medicaid hospice patients in Dr. Sweeney’s analysis with the entire
number of Medicaid patients in the Dataset. That suggestion instead came from the
Janssen attorneys in their brief.
Janssen argues that “Dr. Marais considered all of the ‘data sets produced in this
proceeding’ and publicly available dataset.” First, Dr. Marais made no such claim. His
18
No. 84140-8-I/19
declaration reveals that he did not review or consider the consequences of the Death
Dataset before opining that the risk was “nil.” He based his opinion on the “simple fact”
that Janssen does not have “another, complementary data source that could reveal the
identifies of individual patients” that could be compared to the Medicaid claims database
to provide identifying information. It is undisputed that the Death Dataset included
identifiable information, including names. Dr. Marais did not document having applied
principles and methods for rendering information not individually identifiable. Dr.
Marais’ declaration simply states “Based on my education, pertinent experience, and
pertinent background knowledge, it is my opinion that the re-identification risk
associated with the production Janssen seeks, whether arising from the completed
dates alone or in combination with other demographic information produced to date, or
with other publicly accessible information, is de minimis.”
The trial court adopted the suggestion by Janssen’s attorneys that Dr. Sweeney’s
analysis should be changed to replace the denominator in her risk assessment formula
from the total number of hospice patients in the Medicaid Dataset to the entire 4.5
million people in the Dataset in order to get to a lower risk percentage. This is without
any support from any expert that doing so is a proper measurement of calculating the
risk of re-identifying the subset of hospice patients in the Medicaid Dataset.
In contrast, Dr. Sweeney provided detailed explanations of the generally
accepted method she applied in making her determinations regarding the risk of reidentification. Dr. Sweeney also demonstrated how the ability to identify unique
individuals increased as more datapoints were included in the analysis. She also
applied the methods in five separate applications and considered how the additional
19
No. 84140-8-I/20
information requested could be compared with datasets previously provided to Janssen
in discovery and how such information is publicly available.
It appears the trial court also reasoned that changing Dr. Sweeney’s analysis
was appropriate because there was no justification to looking at only hospice patients.
The trial court appeared to misunderstand why Dr. Sweeney focused on hospice
patients. The concern under HIPAA is whether there is a “reasonable basis to believe
that the information can be used to identify an individual.” 45 C.F.R. § 164.514(a)
(emphasis added). The question is whether “the risk is very small that the information
could be used . . . to identify an individual who is a subject of the information.” 45
C.F.R. § 164.514(b)(1)(i) (emphasis added). That is a different question than whether
the percentage of identifiable people out of the total number of people whose records
are released is very small. OCR’s guidance notes that “experts are advised to consider
how data sources that are available to a recipient of health information . . . could be
utilized for identification of an individual.” (Emphasis added.) Dr. Sweeney
demonstrated through her analysis that, even before using full dates, the data sources
could be used to identify 191 unique individuals. Janssen cites to no authority that
suggests an analysis under the Expert Determination method must calculate the risk of
identifying the entire population within the data set.
Regardless, the trial court could not substitute its opinion or the opinion of the
Janssen attorneys for that of a qualified expert under 45 C.F.R. § 165.514(b)(1)(i) and
(ii). Because the record establishes that Dr. Marais’ expert opinion did not satisfy 45
C.F.R. § 165.514(b)(1)(i) and (ii), we hold that the trial court’s reliance on Dr. Marais’
opinion was untenable and that the court abused its discretion in determining that the
20
No. 84140-8-I/21
Expert Determination method was satisfied under HIPAA as a basis to grant Janssen’s
motion to compel HCA, a covered entity, to disclose full dates in the Medicaid claims
database.
Release Under Court Order
While HIPAA controls what a “covered entity” may release, it does allow
disclosure of protected health information in the course of a judicial proceeding if certain
requirements are met. 45 C.F.R. § 164.512(e)(1). Disclosures are permitted in
“response to an order of a court or administrative tribunal, provided that the covered
entity discloses only the protected health information expressly authorized by such
order” and that a “qualified protective order means” one that
(A) Prohibits the parties from using or disclosing the protected health
information for any purpose other than the litigation or proceeding for
which such information was requested; and
(B) Requires the return to the covered entity or destruction of the
protected health information (including all copies made) at the end of the
litigation or proceeding.
45 C.F.R. § 164.512(e)(1)(v). However, the parties do not dispute that because the
Medicaid Dataset includes substance use disorder patient records, 42 C.F.R. part 2 also
applies to the requested records.
Records identifying any patient receiving treatment or rehabilitation for a
substance use disorder under a federally conducted or funded program, such as
Medicaid, are required to be “confidential”. 42 U.S.C. § 290dd-2(a); See Daybreak
Youth Servs. v. Clark County Sheriff's Off., 19 Wn. App. 2d 879, 892, 498 P.3d 571
(2021). Disclosure is only permitted through means expressly authorized under 42
U.S.C. § 290dd-2. The statute generally requires patient consent to disclose the
21
No. 84140-8-I/22
records, but makes express exceptions for disclosure in limited circumstances. 42
U.S.C. § 290dd-2(b)(2)(A)-(D). One such exception is permitted “if authorized by an
appropriate order of a court of competent jurisdiction granted after application showing
good cause therefor.” 42 U.S.C. § 290dd-2(b)(2)(C); Daybreak Youth Servs., 19 Wn.
App. 2d at 889. A court granting such an order must “weigh the public interest and the
need for disclosure against the injury to the patient, to the physician-patient relationship,
and to the treatment services” in assessing good cause. 42 U.S.C. § 290dd-2(b)(2)(C).
Federal regulations further explain the process for disclosure of identifying information.
The restrictions under 42 U.S.C. § 290dd-2 apply to any records which “would
identify a patient as having or having had a substance use disorder either directly, by
reference to publicly available information, or through verification of such identification
by another person.” 42 C.F.R. § 2.12(a)(i).
Janssen does not attempt to argue that the trial court weighed the public interest
and need for disclosure or assessed good cause. Instead, Janssen contends the
information requested is de-identified so neither HIPAA nor part 2 prohibits disclosure. 6
The trial court imposed “conditions in compliance with 42 C.F.R. § 2.11” as part of its
order to compel. In addition to HIPAA concerns, a commissioner of this court granted
discretionary review to consider whether the trial court committed error by ordering
release of protected health information which could be further used to identify
6
Janssen also contends that the parties had entered into a qualifying protective order that satisfies HIPAA for patients who did not have a substance use disorder. We granted Janssen’s request to supplement the record with a copy of this protective order, but this order was entered prior to Janssen’s motion to compel disclosure of the full service and prescription dates and the trial court did not rule on whether the HIPAA-compliant Protective Order previously entered by the court overrides the application of the Safe Harbor provision. That issue is not before us.
22
No. 84140-8-I/23
substance-use disorder patients in violation of 42 U.S.C. § 290dd-2(b)(1) and (b)(2)(C),
and implementing regulations at 42 C.F.R. §§ 2.1-2.67.
As the trial court recognized, 42 C.F.R. § 2.11 defines patient identifying
information to include “information by which the identity of a patient, as defined in this
section, can be determined with reasonable accuracy either directly or by reference to
other information.”
“42 C.F.R. § 2.61 defines the legal effect of a court order entered under the
regulations. The order’s ‘only purpose is to authorize a disclosure or use of patient
information which would otherwise be prohibited.’” Daybreak Youth Servs., 19 Wn.
App. 2d at 889 (quoting 42 C.F.R. § 2.61(a)).
If the court decides to issue an order authorizing disclosure, the court must
determine that good cause for the disclosure exists. 42 C.F.R. § 2.64(d). To find good
cause, the court must determine that
(1) Other ways of obtaining the information are not available or would not
be effective; and
(2) The public interest and need for the disclosure outweigh the potential
injury to the patient, the physician-patient relationship and the
treatment services.
42 C.F.R. § 2.64(d). Prior to an order authorizing disclosure, both the patient and the
record holder must be provided with
(1) Adequate notice in a manner which does not disclose patient identifying
information to other persons; and
(2) An opportunity to file a written response to the application, or to appear in
person, for the limited purpose of providing evidence on the statutory and
regulatory criteria for the issuance of the court order as described in §
2.64(d).
42 C.F.R. § 2.64(b).
23
No. 84140-8-I/24
In addition to the required findings and notice, the order itself must:
(1) Limit disclosure to those parts of the patient’s record which are essential to
fulfill the objective of the order;
(2) Limit disclosure to those persons whose need for information is the basis for
the order; and
(3) Include such other measures as are necessary to limit disclosure for the
protection of the patient, the physician-patient relationship and the treatment
services; for example, sealing from public scrutiny the record of any
proceeding for which disclosure of a patient’s record has been ordered.
42 C.F.R. § 2.64(e). 7
Because the trial court ruled that Janssen’s expert satisfied the Expert
Determination method, 8 the court presumably believed the requested information under
the motion to compel was not individually identifiable health information as defined in 42
C.F.R. § 2.11. Because we conclude this record does not support the trial court’s
determination that the Expert Determination was satisfied, in order for the trial court to
order release of any identifiable health information otherwise protected under 42 C.F.R.
part 2, the trial court was required to find good cause under 42 C.F.R. § 2.64(d) and
require notice be provided under 42 C.F.R. § 2.64(b) before ordering disclosure and
imposing limitations and conditions under 42 C.F.R. § 2.64(e). It is undisputed that the
7
The court order alone does not compel disclosure, but must be accompanied by “a subpoena or a similar legal mandate” in order to compel the disclosure. 42 C.F.R. § 2.61(a).
8
Though the trial court adopted Dr. Marias’ suggestion to grant Janssen’s request for full dates in the Medicaid Dataset while limiting other data points, the record is absent of any Expert Determination analysis as to whether release of such a combination of data satisfies HIPAA.
24
No. 84140-8-I/25
court did not grant the motion to compel under 42 C.F.R. § 2.64.
Accordingly, we reverse.
WE CONCUR:
25