UNITED STATES OF AMERICA v. The Kroger Company

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF OHIO
WESTERN DIVISION
UNITED STATES OF AMERICA, 	Case No. 1:25-mc-17
Plaintiff, 	Cole, J.
Litkovitz, M.J.
vs.
THE KROGER COMPANY, 	ORDER
Defendant.
This matter is before the Court on plaintiff’s motion for summary enforcement of Civil
Investigative Demand 22-522 (Doc. 2). Defendants oppose the motion (Doc. 5), and plaintiff
filed a reply memorandum (Doc. 6). This matter was temporarily stayed pursuant to S.D. Ohio
Amended General Order 25-04, but it is now ripe for review.
I. 	Background
Plaintiff United States of America initiated a Federal False Claims Act1 investigation into
“allegations that The Kroger Company knowingly submitted, or caused to be submitted, false
claims to Medicare and other government programs for controlled substance, including opioids,
that were not reasonable or necessary or which were otherwise not eligible for coverage.” (Doc.
2-3 at PAGEID 88). As part of that investigation, the Department of Justice (DOJ) served
defendant The Kroger Company (Kroger) with Civil Investigative Demand (CID) 22-522,
seeking documents and other information related to, among other things, Kroger’s dispensing of
controlled substances by 40 specified Kroger pharmacies, communications with 42 specified
prescribers, and Kroger policies and communications related to when and how Kroger
pharmacists should refuse to fill prescriptions for opioids or other controlled substances. (Doc.
2-3 at PAGEID 88-104).
131 U.S.C. §§ 3729-3733.
Case: 1:25-mc-00017-DRC-KLL Doc #: 11 Filed: 11/25/25 Page: 1 of 7 PAGEID #: <pageID>

2
Kroger partially complied with CID 22-522 by producing a significant number of
documents and other information. However, Kroger produced two privilege logs—one for
documents that were withheld as privileged and a second for documents produced with specific
patient information redacted. (Horwitz Dec., Doc. 2-2 at ¶ 4). The DOJ requested that Kroger
produce the nonprivileged documents without redactions, but Kroger refused to produce the
documents without redacting “protected health information (PHI) (patient names, birthdates,
etc.).” (Doc. 2-4 at PAGEID 120).
The Government now moves for summary enforcement of CID 22-522, requiring Kroger
to produce unredacted disclosures. (Doc. 2). 	Kroger responds that, “[g]iven the massive
amount of personal data at issue and potential ambiguities in the law, Kroger seeks the assurance
of a Court as to whether such a disclosure would comply with [the Health Insurance Portability
and Accountability Act].” (Doc. 5 at PAGEID 135).
II. 	Applicable Legal Standard
The Federal False Claims Act (FCA) “is designed to ‘discourage fraud against the
government.’” United States ex rel. Felten v. William Beaumont Hosp., 993 F.3d 428, 435 (6th
Cir. 2021) (quoting Robertson v. Bell Helicopter Textron, Inc., 32 F.3d 948, 951 (5th Cir. 1994)).
Pursuant to 31 U.S.C. § 3730, the Government must investigate allegedly false claims, and may
initiate a civil action for damages and civil penalties. The FCA authorizes the Government to
issue a Civil Investigative Demand (CID) to “any person” the United States “has reason to
believe . . . may be in possession, custody, or control of any documentary material or information
relevant to a false claims law investigation” requiring that person to produce specified
Case: 1:25-mc-00017-DRC-KLL Doc #: 11 Filed: 11/25/25 Page: 2 of 7 PAGEID #: <pageID>

3
documents, answer written interrogatories, and/or provide oral testimony. 31 U.S.C. §
3733(a)(1).
The Health Insurance Portability and Accountability Act (HIPAA) generally protects
certain health information from unauthorized disclosure, but regulations promulgated under
HIPAA authorize uses and disclosures of protected health information (PHI) under specific
circumstances. 45 C.F.R. § 164.512. As relevant here, section 164.512(d) permits disclosure of
“protected health information to a health oversight agency for oversight activities,” including
civil, administrative and criminal investigations “or other activities necessary for appropriate
oversight of . . . [t]he health care system [or] Government benefit programs for which health
information is relevant to beneficiary eligibility.” 45 C.F.R. §164.512(d)(1)(i), (ii).
Courts have routinely held that the Department of Justice is a “health oversight agency”
within the meaning of 45 C.F.R. § 164.512(d)(1). Matter of Admin. Subpoenas Duces Tecum
Served Upon Mo. Baptist Med. Ctr. and Mo. Baptist Hosp.-Sullivan, No. 4:21-mc-01049, 2022
WL 1802809, at *8 (E.D. Mo. June 2, 2022) (DOJ “has long been recognized in its capacity as a
health oversight agency in connection with its investigation of allegations of healthcare fraud.”);
Cleveland Clinic Fndn. v. United States, No. 1:11-mc-4, 2011 WL 862027, at *2 (N.D. Ohio
Mar. 9, 2011) (“[T]he Court finds that the patient medical records sought in the CIDs can be
furnished to the United States Department of Justice in its capacity as a ‘health oversight agency’
in furtherance of its ‘health oversight activities’ pursuant to 45 C.F.R. § 164.512(d).”); United
States ex rel. Stewart v. La. Clinic, No. Civ. A. 99-1767 (E.D. La. Dec. 12, 2002), 2002 WL
31819130, at *9 (“The final rule implementing the Standards [of 45 C.F.R. § 164.512(d)(1)]
specifically names the Department of Justice as a health oversight agency with respect to its
Case: 1:25-mc-00017-DRC-KLL Doc #: 11 Filed: 11/25/25 Page: 3 of 7 PAGEID #: <pageID>

4
conduct of oversight activities relating to the health care system and its civil rights enforcement
activities.”) (citing 65 Fed. Reg. 82492 (Dec. 28, 2000)). When demanded during a FCA
investigation into health care fraud by a CID issued pursuant to 31 U.S.C. § 3733, neither
HIPAA nor the Ohio physician-patient privilege statute prevents disclosure of protected health
information to the DOJ. Cleveland Clinic Fndn., 2011 WL 862027, at *2-3.
III. 	Analysis
The validity of CID 22-522 is not at issue. Kroger acknowledges that it must comply
with the DOJ’s demand and has “produced hundreds of thousands of pages of documents” and
other information in response to CID 22-522. (Doc. 5 at PAGEID 134). The sole issue here is
whether Kroger must produce unredacted nonprivileged documents, even if they contain PHI,
pursuant to the “health oversight” exception to HIPAA contained at 45 C.F.R. § 164.512(d)(1).
In accordance with Cleveland Clinic Fndn., the Court concludes that the health oversight
exception applies, and Kroger must produce unredacted nonprivileged documents responsive to
CID 22-522. See 45 C.F.R. § 164.512(d)(1).
Kroger contends, relying primarily on United States v. Wilson, 98 F.4th 1204 (10th Cir.
2024), that the DOJ must comply with the more extensive “law enforcement purposes” exception
contained at 45 C.F.R. § 164.512(f)(1)(ii)(C) before requiring Kroger to produce documents
containing PHI in response to CID 22-522. (Doc. 5 at PAGEID 136-138). Section
164.512(f)(1)(ii)(C) provides:
(f) Standard: 	Disclosures for law enforcement purposes. 	A covered entity may
disclose protected health information for a law enforcement purpose to a law
enforcement official if the conditions in paragraphs (f)(1) through (f)(6) of this
section are met, as applicable.
(1) Permitted disclosures: Pursuant to process and as otherwise required by law.
A covered entity may disclose protected health information:
Case: 1:25-mc-00017-DRC-KLL Doc #: 11 Filed: 11/25/25 Page: 4 of 7 PAGEID #: <pageID>

5
* * *
(ii) In compliance with and as limited by the relevant requirements of:
* * *
(C) An administrative request for which response is required by law, including an
administrative subpoena or summons, a civil or an authorized investigative
demand, or similar process authorized under law, provided that:
(1) The information sought is relevant and material to a legitimate law enforcement
inquiry;
(2) The request is specific and limited in scope to the extent reasonably practicable
in light of the purpose for which the information is sought; and
(3) De-identified information could not reasonably be used.
In United States v. Wilson, a California psychologist—identified as the “second-most
prolific prescriber of benzodiazepines in New Mexico”—drew the attention of the Drug
Enforcement Administration (DEA) after at least seventeen of his patients died shortly after
filling prescriptions he had provided. 98 F.4th at 1211. The DEA issued an administrative
subpoena to the psychologist during their investigation into potential criminal charges for
violations of the Controlled Substances Act, seeking essentially all of his medical, prescription,
and billing records. Id. The psychologist challenged the subpoena on several grounds,
including: (1) overbreadth in violation of the Fourth Amendment: (2) Fifth Amendment
protection from self-incrimination; and (3) the subpoena’s overbreadth required him to violate
HIPAA because it required disclosure of patient medical records for patients for whom no
prescriptions had been provided. Id. at 1213. The District Court in that case cured the HIPAA
and Fourth Amendment-related overbreadth by limiting “the subpoena to requesting the number
of patients from the five-year period, and the identities of only those patients to whom controlled
substances were prescribed.” Id. at 1214. The Court rejected his Fifth Amendment challenge.
Id. The Tenth Circuit upheld the District Court’s enforcement of the subpoena, finding, in part,
that “the modified subpoena satisfies HIPAA’s law-enforcement exception.” Id. at 1221.
Case: 1:25-mc-00017-DRC-KLL Doc #: 11 Filed: 11/25/25 Page: 5 of 7 PAGEID #: <pageID>

6
Contrary to Kroger’s assertion, the Wilson case has no relevance here. In Wilson (and the
other cases on which Kroger relies), the Government was acting purely as a law enforcement
agency, and the courts analyzed the HIPAA issue only under the law enforcement exception
contained at 45 C.F.R. §164.512(f). See Wilson, 98 F.4th at 1211 (DEA investigating criminal
violation of Controlled Substances Act); United States v. Columbia St. Mary’s Inc., No. 15-mc-
010, 2015 U.S. Dist. LEXIS 154099, at *1 (E.D. Wis. Nov. 3, 2015) (DEA investigating criminal
violation of Controlled Substances Act); Estate of Chaiken v. United States, No. 16-mc-80155,
2016 WL 8255575, at *1 (N.D. Cal. Dec. 27, 2016) (IRS investigating tax implications of
millions of dollars of “promissory note forgiveness” made to trust in children’s names while
potentially terminally ill). In the only case Kroger cites involving a FCA investigation, the Court
rejected defendant’s HIPAA challenge to the administrative subpoenas, concluding:
Defendants also assert that the Government failed to satisfy the regulatory
requirements for disclosure because the FBI did not request “de-identified”
information. . . . 45 C.F.R § 164.512(f)(1)(C)(3). But as the Government points
out, that argument is misplaced because agents were attempting to corroborate data
received from other sources and required identifying information in order to do so.
Additionally, the FBI was authorized to request information in connection with its
health oversight activities pursuant to § 164.512(d), which does not reference “de-
identified” information.
United States v. Hertel & Brown Physical and Aquatic Therapy, No. 1:21-cr-39, 2025 WL
83789, at *7 (W.D. Pa. Jan. 13, 2025) (emphasis added).
In the case at bar, HIPAA’s health oversight agency exception applies to CID 22-522.
See 45 C.F.R. § 164.512(d). Accordingly, the DOJ need not also satisfy the more extensive
requirements of the law enforcement exception contained at 45 C.F.R. § 164.512(f) to enforce
CID 22-522.
IT IS THEREFORE ORDERED THAT:
Case: 1:25-mc-00017-DRC-KLL Doc #: 11 Filed: 11/25/25 Page: 6 of 7 PAGEID #: <pageID>

7
1. 	The United States’ petition for summary enforcement of CID 22-522 (Doc. 2) is
GRANTED; and
2. 	Kroger must produce all nonprivileged documents previously withheld, de-identified,
or redacted because they contained responsive patient information, including PHI,
within forty-five days of the date of this Order.
Date: 	__________________ 	_______________________
Karen L. Litkovitz
United States Magistrate Judge
11/25/2025
Case: 1:25-mc-00017-DRC-KLL Doc #: 11 Filed: 11/25/25 Page: 7 of 7 PAGEID #: <pageID>