HIPPA does not apply to no-fault: New trial ordered.

The intersection of federal healthcare privacy regulations and state no-fault insurance laws creates ongoing confusion in medical billing litigation. The Health Insurance Portability and Accountability Act (HIPAA) establishes comprehensive privacy protections for protected health information, including strict limitations on disclosure of medical records without patient authorization. However, HIPAA’s application to no-fault insurance transactions is more nuanced than commonly assumed, as the statute contains specific exceptions for payment and healthcare operations that often permit information sharing in insurance contexts.

HIPAA’s payment exception, codified at 45 CFR 164.506, permits covered entities to use and disclose protected health information for payment purposes without specific authorization. The regulations define “payment” broadly to include activities undertaken by health plans to obtain reimbursement, determine coverage and benefits, review medical necessity, and engage in utilization review. These payment activities encompass precisely the functions insurance carriers perform when investigating and adjudicating no-fault claims.

Similarly, HIPAA’s healthcare operations exception permits use and disclosure for quality assessment, case management, and business planning purposes. Insurance carriers’ medical management activities, including peer review of submitted claims, fall within this exception. Together, these exceptions mean that insurance carriers can often access and use medical records in no-fault litigation without obtaining HIPAA-compliant authorizations, contrary to assertions sometimes made by healthcare providers seeking to exclude evidence.

Case Background

Eagle Surgical Supply, Inc. v GEICO Ins. Co., 2013 NY Slip Op 51862(U)(App. Term 2d Dept. 2013) arose from a typical no-fault collection action where Eagle Surgical sought payment from GEICO for medical supplies provided to an insured. As trial approached, the parties disputed whether GEICO could introduce medical records from the assignor’s treatment in support of its medical necessity defense.

The trial court, acting sua sponte (on its own initiative), determined that GEICO could not use the medical records because the carrier failed to obtain a HIPAA-compliant authorization from the assignor. The court precluded GEICO from offering medical evidence supporting its lack-of-medical-necessity defense, effectively stripping the carrier of its primary defense to the claims.

The trial proceeded without GEICO presenting medical evidence, presumably resulting in a verdict for Eagle Surgical. GEICO appealed, arguing that the trial court erred in applying HIPAA to exclude relevant evidence without giving the carrier an opportunity to establish that it qualified for HIPAA’s payment and healthcare operations exceptions.

The Appellate Term reviewed the case on an abbreviated record, which limited the court’s ability to fully assess the factual circumstances surrounding GEICO’s access to and use of medical records.

Jason Tenenbaum’s Analysis

“The abbreviated record now before us provides no justification for the trial court’s sua sponte determination precluding the defendant insurer from offering medical evidence in support of its defense of lack of medical necessity, based on its apparent failure to obtain a HIPAA-compliant authorization from plaintiff’s assignor. Even assuming, without deciding, that defendant is a “covered entity” subject to HIPAA (see 45 CFR § 160.103), an issue not addressed below, defendant should have been given the opportunity to establish that it was entitled to adduce the assignor’s medical records without the need of a HIPAA authorization pursuant to the “payment” and “health care operations” exceptions set forth in the governing federal regulations (see 45 CFR 164.506; 45 CFR 164.501; see also Ops General Counsel NY Ins. Dept. No. 03-07-10 ).”

I think this will put an end to certain judges delaying no-fault trials in a certain venue (for HIPPA reasons) with a certain judge at a certain courthouse located between westchester county, new york county and queens county. That still does not mean that another reason for delaying these trials will not come to fruition.

Legal Significance

The Appellate Term’s decision establishes important principles regarding HIPAA’s applicability in no-fault insurance litigation. First, courts cannot sua sponte exclude evidence based on HIPAA concerns without giving the proponent an opportunity to establish that exceptions apply. Even if HIPAA would otherwise restrict use of medical records, the payment and healthcare operations exceptions may authorize the carrier’s access to and use of the information.

Second, the decision implicitly questions whether insurance carriers even constitute “covered entities” under HIPAA. The statute’s definition of covered entities includes health plans, healthcare providers, and healthcare clearinghouses. While no-fault insurers provide first-party medical benefits, whether this makes them “health plans” under HIPAA’s technical definitions remains debatable. The Appellate Term declined to resolve this threshold question, but its skepticism suggests carriers may have a complete defense to HIPAA applicability claims.

Third, the decision confirms that HIPAA cannot operate as an absolute bar to introducing relevant medical evidence in litigation. Even assuming HIPAA applies, its exceptions for payment and healthcare operations permit substantial information sharing in insurance contexts. Courts must allow parties to establish that these exceptions authorize the challenged uses of medical information.

Finally, the decision demonstrates the serious consequences of improperly excluding evidence. The trial court’s sua sponte HIPAA ruling stripped GEICO of its medical necessity defense, effectively deciding the case before trial. The Appellate Term recognized this fundamental unfairness by ordering a new trial, giving GEICO a second opportunity to present its defense with appropriate medical evidence.

Practical Implications

For insurance carriers defending no-fault claims, Eagle Surgical provides a critical roadmap for addressing HIPAA objections. When healthcare providers or trial courts raise HIPAA concerns about medical records, carriers should immediately respond by: (1) questioning whether the carrier is a covered entity subject to HIPAA; (2) establishing that the payment exception authorizes access to records for claims adjudication purposes; (3) demonstrating that healthcare operations exceptions permit use of records for medical management; and (4) citing the New York Insurance Department’s General Counsel opinions addressing HIPAA in the no-fault context.

Carriers should also object to sua sponte HIPAA rulings excluding evidence. As Eagle Surgical illustrates, courts cannot deprive parties of their defenses based on HIPAA without providing notice and an opportunity to be heard on the applicability of exceptions. If a court indicates it is considering HIPAA-based exclusion, carriers should request a hearing to present evidence and legal arguments on the exceptions.

For healthcare providers, the decision suggests that HIPAA objections to medical records in no-fault trials will rarely succeed. Providers cannot use HIPAA as a shield to prevent carriers from accessing and presenting medical evidence relevant to medical necessity defenses. While providers may legitimately raise HIPAA concerns, they should anticipate that carriers can establish exception applicability.

The decision also has broader implications for trial management in no-fault cases. As counsel observes, certain judges reportedly used HIPAA concerns as grounds for delaying no-fault trials. Eagle Surgical demonstrates that such delays lack legal justification when carriers can establish exception applicability. Courts should proceed to trial on medical necessity disputes without extended delays for HIPAA compliance measures that the governing regulations do not actually require.

Practitioners should also recognize the decision’s reference to New York Insurance Department General Counsel opinions addressing HIPAA in no-fault contexts. These administrative interpretations provide valuable guidance on HIPAA’s application to no-fault claims and support carriers’ positions that the payment and healthcare operations exceptions authorize most routine uses of medical information in claims handling.

Related Articles

• New York No-Fault Insurance Law
• Combating Litigation Delay Tactics in New York No-Fault Insurance Cases
• Understanding collateral estoppel in New York no-fault insurance cases
• Expert witness and motion practice considerations
• How signature authenticity and form defects can be addressed in reply papers