Marlene Henderson v. County of Santa Cruz

Background

James Henderson was formerly incarcerated in the Santa Cruz County Jail Mental Health Unit. After his release, he murdered his parents, Joseph and Edyth Henderson, and was later convicted of two counts of first-degree murder with special circumstances. Marlene Henderson, James Henderson’s sister and the daughter of Joseph and Edyth Henderson, brought this action against Santa Cruz County agencies alleging that they acted wrongfully in releasing him.

The case was initially stayed while the criminal case proceeded. After the stay was lifted, the parties entered discovery. The dispute concerned requests for James Henderson’s medical and mental-health records.

Parties’ Positions

The defendants argued that they could not produce James Henderson’s medical and mental-health records without his authorization or a court order. The plaintiffs argued that James Henderson lacked capacity to authorize release because of severe mental disabilities alleged to have contributed to the murders. They further argued that the defendants could produce the records because the parties had entered into a qualified protective order.

Court’s Analysis

The court explained that the Health Insurance Portability and Accountability Act (HIPAA) permits disclosure of protected health information in judicial proceedings when the requesting party makes reasonable efforts to obtain a qualified protective order. Under the applicable regulation, such an order must prohibit use or disclosure of the information for purposes outside the litigation and must require the information to be returned or destroyed at the end of the case.

The parties’ protective order satisfied both requirements. Section 7.1 limited the use of protected material to litigation purposes, and section 13 required receiving parties to return or destroy the material at the end of the case. Section 14 also required documents produced by the County containing James Henderson’s medical, mental-health, or other sensitive information to be marked confidential and handled under the protective order.

The court therefore concluded that HIPAA did not prevent production because the protective order adequately protected James Henderson’s privacy rights. The court also stated that the defendants’ reliance on a five-factor privacy test from a prior case was misplaced because that case involved a different constitutional question concerning abortion-clinic regulations, while this dispute concerned production of a third party’s medical and mental-health records.

Disposition

Judge William H. Orrick ordered the defendants to produce the requested medical and mental-health records to the plaintiff within 20 days, in accordance with the HIPAA-compliant protective order. The plaintiffs also sought production of other document categories that the defendants had already agreed to provide; the defendants indicated that they would produce those documents on or before May 1, 2020.