Trubridge, Inc. v. Crook County Medical Services District

IN THE UNITED STATES DISTRICT COURT
FOR THE SOUTHERN DISTRICT OF ALABAMA
SOUTHERN DIVISION
TRUBRIDGE, INC., 	)
Plaintiff/Counter Defendant, 	)
)
v. 	) 	CIVIL ACTION NO. 1:24-00190-KD-N
)
CROOK COUNTY MEDICAL 	)
SERVICES DISTRICT, 	)
Defendant/Counter Claimant. )
ORDER
This civil action is before the Court on the “Motion for Protective Order” filed
February 25, 2025, by the Plaintiff/Counterdefendant, TruBridge, Inc. (Doc# 40).
Defendant/Counterclaimant Crook County Medical Services District (“the District”)
filed a response (Doc# 42) to said motion, Trubridge filed a reply (Doc# 45) to the
response, and the District has filed a motion for leave to file a surreply to the reply
(Doc# 46), with proposed surreply brief attached (Doc# 46-1).1
TruBridge requests that the Court enter its proposed protective order (Doc#
40-1) 	to 	govern 	the 	production 	and 	handling 	of 	confidential 	materials 	and
electronically stored information produced as part of discovery in this action. The
District’s response makes clear that it does not object to any of the provisions in the
proposed order, but wishes to include an additional provision, which TruBridge
opposes, stating as follows:
1 The 	assigned 	District 	Judge 	has 	referred 	said 	motions 	to 	the 	undersigned
Magistrate Judge for appropriate action under 28 U.S.C. § 636(a)-(b), Federal Rule
of Civil Procedure 72, and S.D. Ala. GenLR 72(a). See S.D. Ala. GenLR 72(b);
(2/25/2025 & 3/5/2025 electronic reference notations).
Case 1:24-cv-00190-KD-N Doc# 60 Filed 04/02/25 Page 1 of 8 PageID#
<pageID>

Special Provision for “Protected Health Information”: During the course
of this litigation, it may be necessary for the parties to disclose certain
patient protected health information (“PHI”) as that term is defined
under 	the 	Health 	Insurance 	Portability 	and 	Accountability 	Act
(“HIPAA”) and the Federal Regulations enacted pursuant to HIPAA.
All PHI, inclusive of medical records and related information, including
but 	not 	limited 	to 	patient 	account 	numbers, 	visit 	numbers, 	and
Medicare 	or 	Medicaid 	Numbers, 	shall 	be 	automatically 	deemed
“CONFIDENTIAL” regardless of whether they are so marked. The
parties hereby agree that all PHI disclosed by either party shall be used
for the sole purpose of preparing for or conducting this litigation,
including, but not limited to investigation, consultation, discovery,
depositions, trial preparation, trial, appeal, resolution, mediation, or
uses incidental to the proceeding in the case and shall not be disclosed
or revealed to anyone not authorized by this Order. Further, it is
expressly agreed that following the resolution of the litigation, all PHI
shall be returned or destroyed as provided for herein.
(Doc# 42, PageID.356).
The District argues that this provision should be included because “thousands
of…pages [of] emails” that it intends to produce as part of discovery “include an
account number in the subject line and other protected health information (‘PHI’) as
that term is defined under the Health Insurance Portability and Accountability Act
(‘HIPAA’) which prohibits disclosure without patient consent.” (Id.). “The inclusion
of this provision in the protective order[,]” the District claims, “would obviate the
necessity of [the District]’s reviewing and re-Bates stamping the thousands of pages
it is ready to produce as confidential or redacting the PHI in those pages.” (Id.). In
support, the District cites—with pin cite, but without providing a relevant quotation
or any explanation of that case’s significance—to Murphy v. Dulay, 768 F.3d 1360,
1368-70 (11th Cir. 2014). (Id.).
Case 1:24-cv-00190-KD-N Doc# 60 Filed 04/02/25 Page 2 of 8 PageID#
<pageID>

“The HIPAA regulations generally prohibit covered entities from using or
disclosing ‘protected health information.’ ” Murphy, 768 F.3d at 1368–69 (citing 45
C.F.R. §§ 164.508(a)(1), 164.502(a), 164.512). “The regulations, however, permit
covered entities to disclose protected health information when certain requirements
are met,” including, relevant here, “through the judicial process.” Id. at 1369 (citing
45 C.F.R. § 164.512(e)). See also 45 C.F.R. § 164.512(e)(1) (providing that “[a] covered
entity may disclose protected health information in the course of any judicial or
administrative proceeding”).
But certain procedures must be followed. Information may be released
only in response to: (1) an “order of a court or administrative tribunal,”
or (2) a “subpoena, discovery request, or other lawful process, that is not
accompanied by an order of a court or administrative tribunal,” when
certain conditions are met. [45 C.F.R.] § 164.512(e)(1)(i)-(ii).
For the latter, information may be disclosed only if the covered entity
receives satisfactory assurance from the party seeking the information
that reasonable efforts have been made to either (1) ensure that the
individual whose information is to be shared has been given notice of
the 	request, 	or 	(2) 	secure 	a 	qualified 	protective 	order. 	Id. 	§
164.512(e)(1)(ii).
Id.
“[A] 	qualified 	protective 	order 	means, 	with 	respect 	to 	protected 	health
information requested under paragraph (e)(1)(ii)…, an order of a court or of an
administrative 	tribunal 	or 	a 	stipulation 	by 	the 	parties 	to 	the 	litigation 	or
administrative proceeding that: (A) Prohibits the parties from using or disclosing the
protected health information for any purpose other than the litigation or proceeding
for which such information was requested; and (B) Requires the return to the covered
Case 1:24-cv-00190-KD-N Doc# 60 Filed 04/02/25 Page 3 of 8 PageID#
<pageID>

entity or destruction of the protected health information (including all copies made)
at the end of the litigation or proceeding.” 45 C.F.R. § 164.512(e)(1)(v).
TruBridge does not contest the District’s assertion that some of the discovery
material it intends to produce will contain “protected health information” subject to
HIPAA. However, it objects to that portion of the District’s proposed provision “that
‘automatically deem[s]’ information confidential[,]” arguing that the District “should
not be relieved of its obligation to review and properly designate information it
believes should be protected because it is inconvenient.” (Doc# 45, PageID.361).
TruBridge asserts that two provisions of its proposed protective order make the
District’s 	proposed 	provision 	“unnecessary” 	(id., 	PageID.362)—specifically,
paragraph 2 which states in relevant part that “[a]ll Protected Material in this case
shall 	be 	kept 	confidential 	by 	the 	Parties 	and 	used 	solely 	for 	the 	purpose 	of
investigating the claims and defenses asserted in this matter and for the purpose of
prosecuting the Parties’ claims and defenses in this matter and for no other
purpose[;]” and paragraph 18, which states in relevant part that “all documents
designated as ‘Confidential’ or ‘Confidential -- Attorneys’ Eyes Only’, including all
copies which may have been disclosed to expert witnesses, shall be returned to the
party producing it or destroyed, with a written certificate of such destruction being
provided by counsel for the receiving party,” within 30 days of the conclusion of this
case, either in this Court or on appeal if one is filed. (Doc# 40-1, PageID.340, 347).
While TruBridge claims those provisions “satisf[y] the requirements of the
HIPAA regulation” (Doc# 45, PageID.362), that is not quite right. By their terms
Case 1:24-cv-00190-KD-N Doc# 60 Filed 04/02/25 Page 4 of 8 PageID#
<pageID>

those 	provisions 	only 	apply 	to 	documents 	either 	containing 	“trade 	secrets,
proprietary 	information, 	and/or…otherwise 	privileged” 	information, 	or 	deemed
“Confidential” under the procedures in the protective order. (Doc# 40-1, PageID.339).
HIPAA, on the other hand, requires such treatment for all “protected health
information” produced, regardless of whether a party has specifically designated it
“confidential.” Nevertheless, TruBridge is correct that HIPAA does not justify the
District’s 	proposed 	automatic-confidentiality 	provision. 	As 	noted 	previously, 	a
qualified HIPAA protective order need only “(A) [p]rohibit[] the parties from using or
disclosing the protected health information for any purpose other than the litigation
or proceeding for which such information was requested; and (B) [r]equire[] the
return to the covered entity or destruction of the protected health information
(including all copies made) at the end of the litigation or proceeding.” 45 C.F.R. §
164.512(e)(1)(v). 	No 	other 	protections 	for 	“protected 	health 	information”—for
instance, restrictions on how the information is to be treated or handled when used
or disclosed in the relevant “litigation or proceeding”—are required by § 164.512(e)(1),
and the District has cited no other authority as requiring 	further protections.
HIPAA protects “protected health information,” as that term is defined by the
Act and its regulations. TruBridge’s proposed protective order, on the other hand, is
written 	to 	protect 	“trade 	secrets, 	proprietary 	information, 	and/or…otherwise
privileged” information, as well as any other information a party deems confidential.
TruBridge’s protective order, rightly, puts the burden of proof for confidentiality on
the party asserting it. (Doc# 40-1, PageID.347). Cf. United States v. Schaltenbrand,
Case 1:24-cv-00190-KD-N Doc# 60 Filed 04/02/25 Page 5 of 8 PageID#
<pageID>

930 F.2d 1554, 1562 (11th Cir. 1991) (“The party invoking the attorney-client
privilege has the burden of proving that an attorney-client relationship existed and
that the particular communications were confidential.”). The undersigned agrees
with TruBridge that the District’s proposed “automatic confidentiality” provision for
HIPAA “protected health information” would cause unnecessary overlap between the
distinct issues, leaving TruBridge to guess as to whether the District labeled a
document “confidential” simply because it is HIPAA-protected information or for
some other reason allowed by its proposed protective order. The District’s provision
would also unduly burden TruBridge by forcing it to treat as “confidential,” with all
the attendant responsibilities that entails under the protective order, potentially
large amounts of discovery material that HIPAA does not require be so treated, and
which the District would not otherwise so designate.2 Accordingly, the undersigned
declines to add the District’s proposed “automatic confidentiality” provision to
TruBridge’s proposed protective order.
However, because TruBridge has not contested the District’s claim that its
discovery responses will include HIPAA protected health information, and because
the other provisions of the District’s proposed provision meet the requirement for a
qualified HIPAA order, see 45 C.F.R. § 164.512(e)(1)(v), the undersigned will add
2 The 	District 	complains 	that 	omitting 	its 	proposed 	provision 	will 	necessitate
“reviewing and re-Bates stamping the thousands of pages it is ready to produce as
confidential or redacting the PHI in those pages.” (Doc# 42, PageID.356). However,
the District has cited no provision of HIPAA that requires PHI to be redacted when
used in the case for which it has been authorized. Moreover, the District should not
be allowed to escape its burden to designate discovery as “confidential” based on a
non-existent requirement in HIPAA.
Case 1:24-cv-00190-KD-N Doc# 60 Filed 04/02/25 Page 6 of 8 PageID#
<pageID>

those provisions to TruBridge’s proposed order in a separate section at the end.3
Additionally, having independently considered TruBridge’s proposed order, the
undersigned finds it appropriate to sua sponte modify certain sections, as follows:
• 	Sections 6, 12, 13 will be modified to remove their applicability to court
hearings and transcripts thereof. Any issues of confidentiality arising at court
hearings must be raised by motion of a party and will be handled by the Court
at its discretion on a case-by-case basis.
• 	Section 6 will also be modified to make clear that any private court reporter or
videographer is not bound by the protective order unless he or she voluntarily
agrees to be.
• 	Section 	17 	will 	be 	modified 	to 	clarify 	the 	Court’s 	requirements 	and
expectations with regard to filing material under seal.
Accordingly, TruBridge’s “Motion for Protective Order” filed February 25,
2025 	(Doc# 	40), 	is 	GRANTED 	in 	part 	and 	DENIED 	in 	part, 	in 	that 	the
undersigned 	will 	separately 	enter 	the 	substantive 	provisions 	of 	TruBridge’s
proposed 	protective 	order 	(Doc# 	40-1) 	as 	an 	order 	of 	the 	Court, 	with 	the
above-described modifications.
Any party who believes it is entitled to an award of reasonable expenses under
Federal Rule of Civil Procedure 37(a)(5) in connection with the disposition of the
present motion for protective order must file a motion for such expenses, properly
3 The District’s motion for leave to file a sur-reply (Doc# 46) is GRANTED. The
undersigned has considered the proposed sur-reply attached to that motion, but it
does not alter the conclusions reached herein.
Case 1:24-cv-00190-KD-N Doc# 60 Filed 04/02/25 Page 7 of 8 PageID#
<pageID>

supported to show both amount and reasonableness, no later than APRIL 16, 2025.4
Failure to do so will be deemed a forfeiture of the right to seek such expenses in
connection with the subject motion for protective order.
DONE and ORDERED this the 2nd day of April 2025.
/s/ Katherine P. Nelson
KATHERINE P. NELSON
UNITED STATES MAGISTRATE JUDGE
4 See Fed. R. Civ. P. 26(c)(3) (“Rule 37(a)(5) applies to the award of expenses” in
connection with a motion for protective order under Federal Rule of Civil Procedure
26(c).).
Case 1:24-cv-00190-KD-N Doc# 60 Filed 04/02/25 Page 8 of 8 PageID#
<pageID>