Petitioner moved to exclude the testimony of respondent's expert Dr. Reese Jones on several grounds. In a November 14, 2008 order, this court addressed one issue and sought additional information on the remaining issues: (1) whether Dr. Jones brought to his deposition all documents he reviewed before preparing his report, (2) whether respondent's provision of petitioner's medical records to Dr. Jones violated petitioner's privacy rights, and (3) whether Dr. Jones is qualified to testify in the areas of neurology and neuropsychology. Since then, respondent has filed a declaration by Dr. Jones that describes his qualifications to testify as an expert and states his belief that he brought to his deposition all documents he reviewed to form his opinions in this case. See Nov. 14, 2008 Decl. of Reese T. Jones, M.D. ("Nov. 2008 Jones Decl."), filed herein on Nov. 18, 2008. Based on Dr. Jones' declaration, the court finds Dr. Jones provided petitioner's counsel with all documents he reviewed prior to completing his report and will deny the motion to limit or exclude Dr. Jones' testimony on that basis. With respect to the remaining issues, and after considering the additional briefs filed by the parties, the court finds and orders as follows.
I. Provision of Medical Records to Dr. Jones
Petitioner argues his constitutional privacy rights and rights under both federal and state law were violated when respondent provided his mental health expert with copies of petitioner's prison medical records. Primarily, petitioner relies upon the Health Insurance Portability and Accountability Act ("HIPAA").*fn1 See 42 U.S.C. § 1320d, et seq.; 45 C.F.R. § 164.500, et seq.
In a November 19, 2008 filing, petitioner described the parties' positions with respect to these medical records, contained in respondent's proposed exhibit P. These records can be divided into three categories. First, the parties agree that pages 7 to 15 of exhibit P are records that were disclosed in the state habeas proceedings. Petitioner does not object to Dr. Jones' use of those records. Second, pages 19 and 22 to 29 of exhibit P were provided to one of petitioner's mental health experts, Dr. Victoroff. While petitioner concedes that respondent's counsel could have sought these records through discovery and should be permitted to cross-examine Dr. Victoroff regarding these records, he continues to object to their use by Dr. Jones. He seeks to bar use by Dr. Jones as a sanction for respondent's alleged violation of petitioner's constitutional and statutory privacy rights. The third set of documents, pages 1 to 6, 16 to 18 and 20 to 21 of exhibit P, are fairly recent medical records. Petitioner contends respondent should be sanctioned for obtaining these records and his expert should be barred from using them.
In a November 21, 2008 response, respondent contends the sanctions petitioner seeks are too severe for any possible violation of his privacy rights. He also states he will withdraw all documents in the third category and submit Dr. Jones' opinions without consideration of them. The issue, then, is limited to Dr. Jones' use of the documents in the second category, pages 19 and 22 to 29 of exhibit P.
With respect to petitioner's constitutional privacy claim, there is no question that petitioner's medical condition around the time of trial is relevant to claims raised in his petition. By making these claims, petitioner waived his privacy rights in his medical records. See Barnes v. Glennon, No. 9:05-CV-0153 (LEK/RFT), 2006 WL 2811821, at *4 (N.D.N.Y. Sept. 28, 2006) ("Although the release of the medical records was not pursuant to a discovery order or by consent, the release, nevertheless, did not violate Plaintiff's constitutional right to privacy since medical conditions were at the heart of the argument presented by Plaintiff in his habeas corpus petition. . . ."); Woods v. Goord, No. 01-CV-3255 (SAS), 2002 WL 731691, at *11 (S.D.N.Y. Apr. 23, 2002) ("It is settled law that release of an inmate's medical records in defense of litigation does not violate any right of the inmate when he has filed suit against prison officials.") (citing Gill v. Gilder, No. 95 Civ. 7933, 1997 WL 419983, at *2 (S.D.N.Y. July 28, 1997)); Ferrell v. Glen-Gery Brick, 678 F. Supp. 111, 112-13 (E.D. Pa. 1987) ("when a party places his or her physical or mental condition in issue, the privacy right is waived"). Petitioner has waived his right to privacy in pages 19 and 22 to 29 of exhibit P.
Petitioner has a better argument that respondent violated his rights under HIPAA. Congress enacted HIPAA, in part, to address concerns about the confidentiality of health information . . . HIPAA . . . defines terms and imposes requirements on the Department of Health and Human Services (HHS), health plans, and healthcare providers involved in the exchange of health information. HIPAA provides for both civil and criminal penalties to be imposed upon individuals who improperly handle or disclose individually identifiable health information.
Logan v. Department of Veterans' Affairs, 357 F. Supp. 2d 149, 155 (D. D.C. 2004). The HIPAA regulations are extensive and have been interpreted infrequently in situations comparable to the present one where the party whose records are at issue has waived his right to privacy in those records and where the party allegedly violating HIPAA has possession of the records. Neither party has pointed to clear authority that HIPAA did or did not require respondent to obtain petitioner's authorization or a court order to procure those records and forward them to Dr. Jones.
There is no question that respondent had a right to provide his expert with medical records reviewed by petitioner's expert that are relevant to petitioner's claims. See Fed. R. Civ. P. 26(a)(2)(B); cf. Fed. R. Evid. 705. Assuming for the sake of this order that respondent was required to obtain petitioner's consent before providing the records to Dr. Jones, it is not clear he was required to do so through the discovery process. Petitioner's argument for sanctions rests on this premise, and is problematic for several reasons.
First, given that respondent was in possession of the records, it seems possible he simply could have requested petitioner's permission to provide the records to Dr. Jones.*fn2 As noted above, petitioner has waived his right to privacy in these documents; because he had provided them to his own expert, the only basis upon which petitioner could have refused to consent would have been a dispute over the scope of any protective order limiting the use of the documents in or to this proceeding.
Second, HIPAA does not provide a private remedy for its violation. See Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1081-82 (9th Cir. 2007). Enforcement of HIPAA rests solely with the Secretary of Health and Human Services. Logan, 357 F. Supp. 2d at 155. Further, HIPAA does not provide for exclusion of evidence as a remedy for its violation. Cf. United States v. Streich, 560 F.3d 926 (9th Cir. 2009) ("HIPAA does not provide any private right of action, much less a suppression remedy."); State v. Yenzer, 195 P.3d 271 (Kan. App. 2008); State v. Straehler, 745 N.W. 2d 431 (Wis. 2007). At least one court, however, has found some sort of sanction appropriate for a violation of HIPAA in the course of litigation where the plaintiff had waived his privacy rights. Even though HIPAA "does not address how to treat a HIPAA violation that occurs during discovery or trial," that court fashioned a remedy that "addresses the HIPAA violation and ensures that defense counsel has not exceeded the scope of Plaintiff's waiver of his physician-patient privilege, resulting from bringing this suit." Crenshaw v. MONY Life Insurance Co., 318 F. Supp. 2d 1015, 1030 (S.D. Cal. 2004). The court in Crenshaw denied the plaintiff's request to exclude the testimony of the defendant's expert. Instead, the court required the defendant to pay for the plaintiff's deposition of the expert, which would also permit the plaintiff to ensure "that defense counsel has not exceeded the scope of Plaintiff's waiver of his physician-patient privilege, resulting from bringing this suit." Id.*fn3
Even were the court to assume petitioner in the present case had some right to some sort of redress under HIPAA, it would not be possible to fashion a remedy because petitioner has suffered no prejudice as a result of any HIPAA violation: petitioner has had knowledge of Dr. Jones' use of the documents for some time and had this knowledge when he deposed Dr. Jones. In addition, respondent already will be paying for Dr. Jones' time for testifying. As noted by the court in Law, HIPAA provides for only a "mild" penalty, a $100.00 fine, for its violation. 307 F. Supp. 2d at 712 (citing 42 U.S.C. § 1320d-5(a)(1)). Given the circumstances of the present case, this court finds no sanctions appropriate regarding the second category of documents, pages 19 and 22 to 29 of exhibit P. In addition, because ...