HIPPA does not apply to no-fault: New trial ordered.

Despite the historical title, Eagle Surgical v GEICO did not hold that HIPAA never applies to no-fault matters. It ordered a new trial because the insurer had been prevented from offering medical evidence without an opportunity to establish an applicable basis for using the records without an authorization. The decision left the insurer’s covered-entity status undecided.

Historical note — Last reviewed: September 2026. Eagle Surgical, November 14, 2013, is a narrow trial-evidence ruling of the Appellate Term, First Department; current HHS guidance on payment and health care operations describes permissions with conditions, not unrestricted access to patient information.

What happened in the Bronx trial court

Eagle Surgical sought assigned no-fault benefits. The parties stipulated to the provider’s prima facie case. The Civil Court then acted on its own initiative to preclude the insurer’s medical evidence because it apparently lacked a HIPAA-compliant authorization, and directed a verdict for the provider.

GEICO appealed. On the abbreviated record, the Appellate Term found no justification for the exclusion and ordered a new trial. The published order did not award GEICO judgment on medical necessity.

The court assumed, without deciding, that GEICO was a covered entity for purposes of discussing the issue. It said the insurer should have had an opportunity to establish that the payment or health-care-operations provisions permitted use of the records without a HIPAA authorization. An opportunity to make that showing is not a finding that every condition had already been satisfied.

What the old headline overstates

The acronym is HIPAA, the Health Insurance Portability and Accountability Act. The historical title uses “HIPPA” and describes a broader rule than the opinion actually announced. The body should be read for the narrower holding.

The court did not determine that all no-fault insurers are covered entities, that none are covered entities, or that a provider’s privacy duties disappear when an automobile claim is submitted. It also did not order unrestricted release of the assignor’s medical history.

Likewise, the opinion does not report how GEICO obtained each record or resolve every possible state-law, evidentiary or confidentiality objection. Those questions cannot be answered by filling in the gaps in an abbreviated appellate record.

Jason’s November 2013 reaction

The original post included this prediction about trial management:

I think this will put an end to certain judges delaying no-fault trials in a certain venue (for HIPPA reasons) with a certain judge at a certain courthouse located between westchester county, new york county and queens county. That still does not mean that another reason for delaying these trials will not come to fruition.

That was Jason’s contemporary commentary, not a finding of misconduct or a rule that privacy objections always lack merit. Eagle Surgical required an opportunity to address the asserted basis for using the evidence. It did not forbid a court from considering a properly presented privacy issue.

The insurer and the medical provider are different actors

HHS explains that automobile liability and automobile medical-payment policies are not health plans under HIPAA to the extent they provide the excluded benefits identified in the governing definition.

That does not answer the separate question of whether a hospital, physician or other records holder is a covered entity. HHS’s covered-entity guidance includes qualifying health care providers that transmit information electronically in connection with standard transactions.

The distinction prevents a common mistake: an exclusion affecting an insurance product does not, by itself, authorize a covered provider to release any requested information for any purpose. Identify who holds the information, who requests it and what use or disclosure is proposed.

Eagle Surgical did not decide all of those facts. Its assumption about GEICO allowed the appellate court to explain why the insurer should be heard even on the premise that HIPAA applied.

Payment and operations are permissions with limits

HHS’s explanation of 45 CFR 164.506 describes permitted uses and disclosures for treatment, payment and health care operations. Payment activities can include billing, collection and medical-necessity review. The guidance also distinguishes an entity’s own activities from disclosures for another entity’s activities.

These permissions are not interchangeable. The identity of the recipient and the purpose of the disclosure matter. HHS describes minimum-necessary limits for payment and operations and special rules for psychotherapy notes, among other protections.

Thus, describing every insurer’s medical management as automatically falling within every operations exception would go beyond the guidance and Eagle Surgical. A records request should identify the applicable basis and satisfy its conditions, rather than rely on the word “insurance.”

This is a legal distinction about handling records, not permission to upload patient information to a public website or ordinary contact message. The actual records should be shared only through an appropriate process after the necessary review.

Consent is not the same as a HIPAA authorization

The HHS payment-and-operations guidance also distinguishes voluntary consent from an authorization required for a use or disclosure not otherwise permitted. A general consent document is not a substitute for the required authorization merely because both contain a signature.

That distinction matters when reviewing what the court called an apparent absence of authorization. Identify the proposed use first. Then ask whether an applicable permission covers it, whether a qualifying authorization is needed, or whether another legal process supplies the basis. The existence or absence of one document cannot answer every possible version of the question.

Eagle Surgical did not publish the records request, the patient’s paperwork or a full account of the proposed disclosure. Its result cannot establish the adequacy of a different form in a current file. A targeted review should match the actual document and disclosure purpose to the applicable requirement, while keeping patient information out of public filings or informal communications unless appropriately authorized or otherwise permitted.

The cited administrative opinion concerned workers’ compensation

Eagle Surgical cited New York Insurance Department OGC Opinion 03-07-10, July 8, 2003. That opinion addressed a hospital’s transmission of protected information for workers’ compensation payment.

Its discussion includes the workers’ compensation disclosure provision and possible business-associate responsibilities for entities assisting the hospital. It was not a no-fault appellate decision or a general declaration that health records lose protection whenever benefits are sought.

The court’s citation remains part of Eagle Surgical’s reasoning. Reading the administrative opinion in its own setting prevents it from being expanded into an exception that the agency did not actually discuss.

Litigation presents an additional distinction

HHS’s litigation guidance distinguishes a covered entity that is a party to a proceeding from a records holder that is not. For a nonparty’s response to legal process, it identifies the applicable requirements of 45 CFR 164.512(e). A litigation label is not an all-purpose release.

A particular case may also present questions about authorization scope, the records requested and the proposed use in court. Eagle Surgical should not be treated as a substitute for that analysis. Its immediate lesson is procedural: the insurer should have been allowed to establish its asserted basis before losing the opportunity to present the medical defense.

Permission to use records does not prove the defense

Even if records may lawfully be used and admitted, the medical evidence still has to support the issue for which it is offered. The Metropolitan Diagnostic v Erie note illustrates the next step: a competent defense expert testified but was not believed, and the provider’s judgment stood.

The Ortho-Med roundup addresses another separate question—whether reviewed records had to be attached to particular summary-judgment motions. An attachment ruling does not establish a privacy permission, and a privacy permission does not establish medical necessity.

For a focused review, keep the authorization or other asserted disclosure basis, the requested records, the medical report and the court’s actual ruling together. That makes it possible to identify whether the dispute concerns access, admissibility or the medical opinion itself. Eagle Surgical reopened the opportunity to present evidence; it did not decide all three questions for every later no-fault case.

Connect to the Encyclopedia

The medical-necessity case directory connects this note with the archive’s report, rebuttal and trial decisions:

• Metropolitan Diagnostic: admitted testimony that did not persuade
• Ortho-Med: reviewed records and motion attachments
• Elmont Open MRI: the provider’s motion and the insurer’s reports
• Westcan: a medical response that raised an issue of fact
• Five Boro Medical: proof and a claim-specific denial-timing problem

For review of a particular medical-records or trial-evidence issue, contact the Law Office of Jason Tenenbaum, P.C. Our no-fault defense practice handles provider-insurer disputes. Please use the initial message to describe the issue without sending patient records.