JOHNSON & JOHNSON HEALTH CARE SYSTEMS INC. v. SAVE ON SP, LLC

UNITED STATES DISTRICT COURT

DISTRICT OF NEW JERSEY

JOHNSON & JOHNSON HEALTH CARE

SYSTEMS INC., Civil Action No. 22-02632 (CCC) (CLW)

Plaintiff,

OPINION AND ORDER

v.

SAVE ON SP, LLC et al,

Defendants.

CATHY L. WALDOR, U.S.M.J.

This matter comes before the Court upon Express Scripts, Inc., and Accredo Health Group,

Inc.’s Appeal of the Special Master’s Order to Compel Discovery pursuant to Federal Rule of Civil

Procedure 53(f)(2) and Local Rule 72.1(c)(1) entered on April 7, 2025, by Special Master Freda

Wolfson, U.S.D.J. (ret.). (ECF No. 582). In accordance with Federal Rule of Civil Procedure 78

and Local Civil Rule 78.1, the Court addresses Express Scripts, Inc., and Accredo Health Group,

Inc.’s appeal without oral argument. Upon careful consideration of the record for this matter, and

for the reasons discussed herein, Express Scripts, Inc., and Accredo Health Group, Inc.’s appeal is

DENIED, and the Special Master’s Order is AFFIRMED.

I. RELEVANT BACKGROUND AND PROCEDURAL HISTORY

Plaintiff Johnson & Johnson Health Care Systems, Inc. (“Plaintiff”) initiated this action

against Defendants Save On SP, LLC, Express Scripts, Inc. (“ESI”), and Accredo Health Group,

Inc. (“Accredo”), for their alleged involvement in a scheme to procure financial benefit by

thwarting Plaintiff’s payment assistance program intended to provide financial assistance for

patients using certain costly prescription medications. (See generally, Second Amended

Complaint, ECF No. 618). Prior to the addition of Defendants Accredo and ESI to the present

dispute on October 2, 2024, (see First Amended Complaint, ECF No. 395), this Court entered a

Discovery Confidentiality Order on November 22, 2022, (ECF No. 62), which counsel to ESI and

Accredo later endorsed in connection with Plaintiff’s service of third-party subpoenas on

November 10, 2023. (See Motion to Compel, Ex. 3, ECF No. 507-1).

The Confidentiality Order provides that this action is likely to involve the disclosure of

significant confidential health information for patient-subscribers. (See Discovery Confidentiality

Order, ECF No. 62). The term “Confidential Health Information” (“CHI”) incorporates all

“protected health information” (“PHI”) as defined by the Standards for Privacy of Individually

Identifiable Health Information, 45 CFR parts 160 and 164, promulgated pursuant to the Health

Insurance Portability and Accountability Act of 1996 (“HIPAA”). (Id. at ¶ 3(a)). For the purposes

of this litigation and subject to the conditions within the Confidentiality Order, the parties are to

produce all unredacted CHI, including PHI, in response to a discovery request. (Id. at ¶ 3(c)).

Upon the conclusion of this litigation, the parties are mandated to destroy or return material

produced or notes derived from the receipt of confidential materials subsumed within the scope of

the Confidentiality Order. (Id. at ¶ 19). The Confidentiality Order’s intended purpose is to

constitute a “Qualified Protective Order” as understood by HIPAA and its accompanying

regulations. (Id. at ¶ 3(d)).1

On December 12, 2024, having recognized that this action would entail significant

discovery and case management, the undersigned issued an Order appointing the Honorable Freda

1 The Court will refer to the Confidentiality Order as a “Qualified Protective Order” interchangeably, though

both are the same.

L. Wolfson, U.S.D.J. (ret.) (“Special Master”) as a Special Master to oversee the progression of

discovery and to resolve discovery disputes. (Order Appointing Special Master, ECF No. 184).

Between October 2024 and January 2025, after Plaintiff included Accredo and ESI as Defendants,

the parties began exchanging documents and initiated meet and confer efforts to resolve certain

PHI redactions made by ESI and Accredo. (Motion to Compel, Exs. 1–10, ECF No. 507-1).

Those efforts reached an impasse, and Plaintiff filed a Motion to Compel the Production

of Documents Without Redaction pursuant to the Confidentiality Order on February 3, 2025.

(Motion to Compel, ECF No. 507). ESI and Accredo opposed the Motion, contending that it must

comply with both HIPAA and the Confidentiality Order because the Confidentiality Order “does

not explicitly require that [ESI] and Accredo produce PHI without regard to HIPAA’s ‘minimum

necessary rule’” absent a court order or a sufficient explanation from Plaintiff as to why the

information it seeks meets the “minimum necessary rule.” (Opposition to Motion to Compel at 2–

3, ECF No. 525). In reply, Plaintiff asserted that the language of the Confidentiality Order

envelops PHI in its definition of CHI, and that PHI should have been produced unredacted because

the Confidentiality Order constitutes an exception to HIPAA’s “minimum necessary rule” as a

disclosure required by law. (Reply to Opposition to Motion to Compel at 3–4, ECF No. 531).

At oral argument before the Special Master, ESI and Accredo argued that HIPAA

regulations distinguish disclosures made by law pursuant to 45 C.F.R. § 164.512(a) and disclosures

permitted within judicial and administrative procedures under to 45 C.F.R. § 164.512(e). (Plf.

Appeal Opposition Brief, Ex. 3 at 60–64, ECF No. 643-2). ESI and Accredo took the position that

the regulations do not include civil discovery responses in the definition of “required by law” under

45 C.F.R. § 164.103, and therefore the “minimum necessary rule” applies to disclosures made

within judicial and administrative procedures. (Id. at 62–64). And because the Confidentiality

Order notes that it is a Qualified Protective Order as contemplated by § 164.512(e), ESI and

Accredo asserted that the parties did not agree for the producible content governed by the

Confidentiality Order to qualify as a disclosure “required by law” under § 164.512(a). (Id. at 63–

65). Thus, in order to comply with HIPAA, ESI and Accredo proposed that Plaintiff must identify

the specific information it seeks for them to produce documents consistent with HIPAA’s

“minimum necessary rule.” (Id.). In response, Plaintiff argued that the HIPAA-compliant

Confidentiality Order requires production of unredacted PHI and that ESI and Accredo are simply

violating its terms. (Id. at 67–70).

The Special Master rejected ESI and Accredo’s arguments, stating that the Confidentiality

Order was not favorable to their position and ordered the PHI to be produced unredacted. (Id. at

71). On April 7, 2025, the Special Master entered an order with an accompanying opinion to that

effect. (Special Master Opinion, ECF No. 582). In her written opinion, the Special Master

construed the HIPAA regulations and applicable caselaw to determine that the “minimum

necessary requirement” does not apply in judicial proceedings where a qualified protective order

is in place and that the information sought by Plaintiff fell within the scope of the Confidentiality

Order, thereby subjecting the requested CHI to the safeguards established by HIPAA. (Id. at 23–

25).

Pursuant to Federal Rule of Civil Procedure 53(f), ESI and Accredo filed an objection to

the Special Master’s Order. (Appeal of Special Master Order, ECF No. 600). Plaintiff filed an

opposition, (ECF No. 643), and ESI and Accredo filed a reply, (ECF No. 651).

II. LEGAL STANDARD

a. Standard of Review

The Order Appointing the Special Master incorporates Federal Rule of Civil Procedure

53(f), which governs this Court’s review of the Special Master’s order compelling discovery. (See

Order Appointing Special Master ¶10, ECF No. 184). According to Rule 53(f), the Court reviews

factual findings and legal conclusions de novo and reviews procedural matters for an abuse of

discretion. Fed. R. Civ. P. 53(f)(3)–(5). “The phrase ‘de novo determination’ . . . means an

independent determination of a controversy that accords no deference to any prior resolution of

the same controversy.” United States v. Raddatz, 447 U.S. 667, 690 (1980) (Stewart, J.,

dissenting).

However, for procedural matters, the Special Master’s decision may only be set aside for

an abuse of discretion. Fed. R. Civ. P. 53(f)(5). Similar to that of a Magistrate Judge,

the Special Master’s management of the discovery process “is entitled to great deference.”

See Schiano v. MBNA, No. 05-cv-01771, 2009 WL 1416040, at *3 (D.N.J. May 19,

2009); Honeywell v. Minolta Camera Co., No. 87-cv-04847, 1990 WL 66182, at *1 (D.N.J. May

15, 1990). In applying the same standard of review for decisions of a Magistrate Judge to the

Special Master, the Court may reverse the Special Master’s non-dispositive decision only if it was

clearly erroneous or contrary to law. See L. Civ. R. 72.1(c)(A); McDonough v. Horizon Blue Cross

Blue Shield of N.J., Inc., No. 09-0571, 2013 WL 322595, at *2 (D.N.J. Jan. 22, 2013).

A “finding is clearly erroneous when, although there may be some evidence to support it,

the reviewing court, after considering the entirety of the evidence, is left with the definite and firm

conviction that a mistake has been committed.” Coyle v. Hornell Brewing Co., No. 08-cv-2797,

2009 WL 1652399, at *3 (D.N.J. June 9, 2009) (quoting Kounelis v. Sherrer, 529 F. Supp. 2d 503,

518 (D.N.J. 2008)). “A [ruling] is contrary to law if the magistrate judge has misinterpreted or

misapplied applicable law.” Gunter v. Ridgewood Energy Corp., 32 F. Supp. 2d 162, 164 (D.N.J.

1998). “The party filing the notice of appeal bears the burden of demonstrating that the magistrate

judge’s decision was clearly erroneous or contrary to law.” Marks v. Struble, 347 F. Supp. 2d 136,

149 (D.N.J. 2004) (quoting Cardona v. Gen. Motors Corp., 942 F. Supp. 968, 971 (D.N.J. 1996)).

b. Principles of Statutory and Regulatory Interpretation

Because this appeal concerns whether the “minimum necessary rule” applies in judicial

proceedings where a qualified protective order is in place, the Court must interpret and apply

HIPAA’s statutory and regulatory text, which is a question of law this Court must review de novo.

Idahoan Fresh v. Advantage Produce, Inc., 157 F.3d 197, 202 (3d Cir. 1998) (citing Shell Oil Co.

v. Babbitt, 125 F.3d 172, 175 (3d Cir. 1997)). “It is the cardinal canon of [regulatory] interpretation

that a court must begin with the [regulatory] language.” In re Philadelphia Newspapers, LLC, 599

F.3d 298, 305 (3d Cir. 2010). When interpreting a regulation, the Court must avoid an

interpretation which renders superfluous any element of the text. Id. (collecting cases). The Court

must also read the entire statutory and regulatory text in a way that renders the provisions

compatible. United States v. Bass, 404 U.S. 336, 344 (1971). As such, the Court must “read the

[regulation] in its ordinary and natural sense.” Harvard Secured Liquidation Tr. v. I.R.S., 568 F.3d

444, 451 (3d Cir. 2009).

The Court may only defer to an agency’s interpretation of its own regulation when a

genuine ambiguity exists after it exhausted “all the ‘traditional tools’ of construction.” Kisor v.

Wilkie, 588 U.S. 558, 559 (2019) (citing Chevron U.S.A. Inc. v. Natural Res. Defense Council, Inc.,

467 U.S. 837, 843 n.9 (1984), overruled on other grounds by Loper Bright Enters. v. Raimondo,

603 U.S. 369 (2024)). “A provision is ambiguous only where the disputed language is ‘reasonably

susceptible of different interpretations.’” In re Philadelphia, 599 F.3d at 304 (quoting Dobrek v.

Phelan, 419 F.3d 259, 264 (3d Cir. 2005)). “When the words of a statute are unambiguous, then

this first canon is also the last: judicial inquiry is complete.” Conn. Nat’l Bank v. Germain, 503

U.S. 249, 253–54 (1992) (internal citations and quotations omitted); see also Hartford

Underwriters Ins. v. Union Planters Bank, N.A., 530 U.S. 1, 6 (2000) (“[W]hen a [regulation’s]

language is plain, the sole function of the courts, at least where the disposition by the text is

not absurd, is to enforce it according to its terms.” (first alteration in original)).

c. Relevant HIPAA Provisions

HIPAA is a complex stature intended to address the exchange for health-related

information. Nat. Abortion Fed. v. Ashcroft, No. 03-cv-8695, 2004 WL 555701 at *2 (S.D.N.Y.

Mar. 19, 2024). Congress delegated to the Secretary of Health and Human Services authority to

promulgate regulations, among other things, to protect the privacy of PHI. See 45 C.F.R. §

164.500–.534; South Carolina Med. Ass’n v. Thompson, 327 F.3d 346, 349 (4th Cir. 2003).

Relevant to the present dispute, the HIPAA rules generally prevent a covered entity—such

as the Defendants here—from using or disclosing protected health information except as permitted

or required, inter alia, to comply with § 164.512. 45 C.F.R. § 164.502(a). But when using or

disclosing protected health information, a covered entity must make reasonable efforts to protect

such information by disclosing the minimum information necessary to satisfy the requested

disclosure. Id. at (b)(1). This is the “minimum necessary requirement” central to the present

dispute. One of the exceptions to the “minimum necessary requirement” is uses or disclosures

required by law provided by § 164.512(a). Id. at (b)(2)(v).

Under § 164.512(a),

(1) A covered entity may use or disclose protected health

information to the extent that such use or disclosure is required by

law and the use or disclosure complies with and is limited to the

relevant requirements of such law.

(2) A covered entity must meet the requirements described in

paragraph . . . (e) . . . of this section for uses or disclosures required

by law.

45 C.F.R. § 164.512(a) (emphases added). The term “required by law” means a mandate

compelling “an entity to make a use or disclosure of protected health information that is

enforceable in a court of law” and “includes, but is not limited to, court orders.” 45 C.F.R. §

164.103 (emphases added).

Paragraph (e) of § 164.512 governs disclosures for judicial and administrative proceedings.

It permits disclosure in either one of two circumstances. The first permits disclosure “[i]n response

to an order of a court . . . provided that the covered entity discloses only the protected health

information expressly authorized by such order.” 45 C.F.R. § 164.512 (e)(1)(i). The second

permits disclosure “in response to a [ ] discovery request [ ] that is not accompanied by an order

of a court” provided that “the covered entity receives satisfactory assurance, as described in

paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts

have been made by such party to secure a qualified protective order that meets the requirements

of paragraph (e)(1)(v).” 45 C.F.R. § 164.512 (e)(1)(ii) (emphases added).

Paragraph (e)(1)(iv) provides that a covered entity receives a satisfactory assurance from

the party seeking PHI when the covered entity receives a writing that the parties to the dispute

agreed to a qualified protective order and have presented it to the court or the party seeking PHI

made an application to the court for a qualified protective order. Id. at (e)(1)(iv). A qualified

protective order means “an order of a court” or “a stipulation by the parties to the litigation” that:

(A) Prohibits the parties from using or disclosing the protected

health information for any purpose other than the litigation or

proceeding for which such information was requested; and

(B) Requires the return to the covered entity or destruction of the

protected health information (including all copies made) at the end

of the litigation or proceeding.

Id. at (e)(1)(v). Put simply, paragraph (e) permits a covered entity to “disclose medical information

without violating HIPAA if served with (1) a court order authorizing the disclosure of such

information or, alternatively, (2) a formal discovery request accompanied by certain required

assurances and notices.” Howard v. Rustin, No. 06-cv-0200, 2007 WL 2811828 at *2 (W.D. Pa.

Sept. 24, 2007).

III. DISCUSSION

a. The Parties’ Arguments

ESI and Accredo’s objection to the Special Master’s decision rests on the premise that

HIPAA’s “minimum necessary requirement” applies in judicial proceedings because the term

“judicial proceedings” is not expressly listed as an exception to the requirement under § 164.502

(b)(2). (Appeal of Special Master Order at 10–11, ECF No. 600). ESI and Accredo advance that

“required by law” exception under § 164.515(a) has two independent sub-parts, and that the

existence of the Qualified Protective Order here is sufficient to satisfy § 164.515(a)(2) but not §

164.512(a)(1). (Id. at 12–14). Instead, they posit that absent an additional court order to mandate

or compel the disclosure PHI, disclosure in response to Plaintiff’s requests for production §

164.515(e) is not a disclosure “required by law” according to § 164.515(a), and consequently, the

“minimum necessary rule” applies to the disclosure. (Id. at 14–18). ESI and Accredo additionally

contend that the Special Master’s decision ordering compulsion of unredacted PHI in accordance

with the Qualified Protective Order does not satisfy the “required by law” subparts under

subsection (a) because her order did not exist before the Special Master held that the “minimum

necessary rule” was inapplicable. (Id. at 18). ESI and Accredo further challenge the Special

Master’s decision to compel unredacted PHI on the basis that Plaintiff did not articulate the specific

categories of PHI that are necessary for discovery, and therefore, requests the Court to particularize

which PHI must be disclosed if the Court orders disclosure. (Id. at 19–24).

In opposition, Plaintiff asserts that ESI and Accredo waived much of their statutory

interpretation arguments—specifically, the arguments concerning Auer deference to the

Department of Health and Human Services’ interpretation of the HIPAA rules and the canon

against surplusage. (Opposition to Appeal at 11–13, ECF No. 643). Plaintiff contends that a

covered entity may use or disclose PHI to the extent it complies with a court order so long as the

requirements of § 164.515(e) are met, which mandate that a covered entity disclosing PHI pursuant

to a discovery request ensures that the party seeking PHI receives a satisfactory assurance by

making reasonable efforts to secure a Qualified Protective Order. (Id. at 14–15). Plaintiff argues

that § 164.515(a)(1) has an independent meaning because disclosure of PHI would have to comply

with the terms set forth by the Qualified Protective Order, and therefore, the “minimum necessary

rule” does not apply when a Qualified Protective Order is in place. (Id. at 15–20 & 15, n.2).

Finally, Plaintiff asserts that the Special Master correctly found that all relevant, non-privileged

CHI was critical to developing its case and that it needs unredacted CHI because Defendants

employed varying methods to track patient-subscriber identification. (Id. at 21–22).

In reply, ESI and Accredo contend that Plaintiff’s reading of § 164.515(a) is incorrect and

that the “minimum necessary rule” does not apply only if (1) disclosure is required by law and (2)

a Qualified Protective Order exists. (Reply at 8–9, ECF No. 651). They assert, that under

Plaintiff’s reading, both subparts of paragraph (a) would have identical—not independent—

meaning. (Id. at 9–10). ESI and Accredo propose that the Qualified Protective Order does not

render the production “required by law” because it does not mandate production and ESI and

Accredo cannot limit their disclosure to what is explicitly required by the Qualified Protective

Order. (Id. at 11). Therefore, ESI and Accredo aver that if the Qualified Protective Order does not

compel production of PHI, then it must meet the “necessary rule” because HIPAA contemplates

that the Court will conduct a “specific analysis” before ordering production of “specific PHI,” and

that the Special Master failed to conduct that analysis here. (Id. at 12–14).

The Court is not persuaded by ESI and Accredo’s reading of the HIPAA regulations.

As an initial matter, ESI and Accredo’s reliance on the Department of Human Health and

Services’ interpretation of the HIPAA regulations mandates a finding that the regulations are truly

ambiguous after exhausting all traditional means of statutory interpretation. See Kisor, 588 U.S.

at 559. The Court will not make such a finding as it was not before the Special Master. “It is well-

settled that arguments not presented to a [Special Master] and raised for the first time on appeal

are deemed waived.” Easterday v. USPack Logistics, LLC, No. 15-cv-7559, 2020 WL 7137859 at

*4 (D.N.J. Dec. 4, 2020). An argument is “waived unless a party raises it in its opening brief, and

for those purposes, ‘a passing reference to an issue . . . will not suffice to bring that issue before

this court.’” Laborers’ Int’l Union of N.A. v. Foster Wheeler Energy Corp., 26 F.3d 375, 398 (3d

Cir. 1994) (quoting Simmons v. City of Philadelphia, 947 F.2d 1042, 1066 (3d Cir. 1991)).

The questions this Court must address therefore remain whether the Special Master

correctly construed HIPAA’s regulations to determine that the “minimum necessary rule” does not

apply, and if so, whether the Special Master properly compelled production of unredacted PHI

pursuant to the terms of the Qualified Protective Order. The Court answers both questions in the

affirmative.

b. The “Minimum Necessary Rule” Does Not Apply This Judicial Proceeding

Because Both Subsections of § 164.512(a) Have Been Established

As both parties acknowledge, for the “required by law” exception to the “minimum

necessary rule” to apply, both subsections of § 164.512(a) must be met. Meaning, the covered

entity must: (1) use or disclose PHI to the extent required by law and in accordance with such

law; and (2) comply with subsection (e). See 45 C.F.R. § 164.512(a).

To satisfy paragraph (a)(1), there must be a court order mandating a covered entity to make

use of or disclose PHI and that order must be enforceable in the court. See 45 C.F.R. §

164.103(a)(1). The Court finds the first prong unquestionably met here. The Qualified Protective

Order entered by this Court mandates PHI to be disclosed in discovery unredacted. (See Discovery

Confidentiality Order ¶ 3(c) (“[T]he parties shall produce Discovery Material containing

Confidential Health Information in response to discovery requests of another party in this litigation

without redaction,” (emphases added)), ECF No. 62). The Qualified Protective Order is

nonetheless an enforceable order of this Court to make use of CHI—including PHI—in discovery

subject to its terms. Any violation of the order may be punished by sanctions, including contempt

of the Court. (See id. ¶ 21). And ESI and Accredo twice assented to the terms of the Qualified

Protective Order—once as non-parties and then after they became named defendants. (See Motion

to Compel, Exs. 1, 2, & 3, ECF No. 507-1). Accordingly, once this Court entered the Qualified

Protective Order, it became a mandate in law requiring ESI and Accredo to disclose all PHI

throughout discovery subject to the terms of the Order. (See Discovery Confidentiality Order ¶

3(c), ECF No. 62).

As the Special Master astutely observed, it is no surprise that courts do not apply the

“minimum necessary” analysis when a HIPAA Qualified Protective Order is in place. (Special

Master Opinion at 14, ECF No. 582). This is because “it is evidently denudate that a purpose of

HIPAA was that health information, that may eventually be used in litigation or court proceedings,

should be made available during the discovery phase.” Bayne v. Provost, 359 F. Supp. 2d 234, 237

(N.D.N.Y. 2005). Therefore, when a valid protective order permits PHI disclosure tailored to the

conditions set forth within it, HIPAA serves as no additional barrier. See Ruggles v. WellPoint,

Inc., No. 08-cv-0201, 2010 WL 11570681, at *14 (N.D.N.Y. Dec. 28, 2010); Lowe v. Vadlamudi,

No. 08-cv-10269, 2010 WL 2474806, at *3 (E.D. Mich. June 4, 2010).2

Turning to the second requirement of paragraph (a), the covered entity must ensure

compliance with paragraph (e). See 45 C.F.R. § 164.103(a)(2). Compliance with paragraph (e)

sufficient to satisfy prong two of § 164.512(a) requires that the covered entity respond either to a

court order authorizing disclosure, or a formal discovery request accompanied by assurances from

the party seeking PHI. Howard, 2007 WL 2811828 at *2. A “satisfactory assurance” is provided

by documents that demonstrate that the parties agreed to a Qualified Protective Order and

presented it to the court or that party seeking the protected information has requested a Qualified

Protective Order from the court. 45 C.F.R. § 164.512(e)(1)(iv). Contrary to ESI and Accredo’s

reading of the “required by law” sub-parts, it is not the Court’s entry of the Qualified Protective

Order which establishes compliance with paragraph (e) sufficient to establish prong two of §

164.512(a), but that efforts were made to secure one in connection with Plaintiff’s formal discovery

2 The Court finds no merit in ESI and Accredo’s proposition that the Special Master’s order compelling

discovery of unredacted PHI also does not satisfy § 164.512(a) because the order did not exist before she held that the

“minimum necessary rule” did not apply. Indeed, various other courts have recognized that, although not required by

the HIPAA rules, an order compelling discovery used in conjunction with a protective order bolsters HIPAA’s strong

policy to protect patient medical information. See Howard, 2007 WL 2811828 at *3 n.5; Ruggles, 2010 WL 11570681,

at *14; E.E.O.C. v. Boston Market Corp., No. 03-cv-4227, 2004 WL 3327264, at *4 n.5 (E.D.N.Y. Dec.16, 2004);

Law v. Zuckerman, 307 F. Supp. 2d 705, 711 (D. Md. 2004). ESI and Accredo assert no legal authority to the contrary.

For all intents and purposes, the Special Master’s order authorizing and compelling discovery of all PHI subject to the

terms of the Qualified Protective Order independently satisfies the “required by law” exception to the “minimum

necessary rule.”

requests. And because the Court entered one here, it therefore follows that both paragraphs (e)

and (a)(2) have been met.

Because the Court finds that both sub-parts of paragraph (a) are established, ESI and

Accredo’s PHI disclosures in response to Plaintiff’s document requests are not subject to HIPAA’s

“minimum necessary requirement.” See Handy v. Del. River Surgical Suites, LLC, No. 19-cv-

1028, 2024 WL 1539599 at *4, *6 (E.D. Pa. Feb. 29, 2024) (ordering compulsion of unredacted

PHI and patient lists after finding that the “minimum necessary rule” did not apply because a

Qualified Protective Order existed); MSP Recovery Claims, Series, LLC v. Sanofi-Aventis U.S.

LLC, No. 18-cv-2111, 2023 WL 4562998 at *5 (D.N.J. July 14, 2023) (finding the “minimum

necessary requirement” inapplicable to disclosures required by law because a Qualified Protective

Order was in place to secure confidential information); Jackson v. Wexford Health Sources, Inc.,

No. 20-cv-0900, 2022 WL 3644158 at *5 n.4 (S.D. Ill. Aug. 24, 2022) (rejecting defendant’s

proposed insertion of a “minimum necessary” PHI disclosure provision into the parties’ proposed

amended Qualified Protective Order because the requirements of § 164.512(a) were satisfied).

This Court therefore holds that the “minimum necessary rule” does not apply because the existence

of the Qualified Protective Order mandating compulsion of all unredacted PHI in connection with

the Plaintiff’s discovery requests satisfies § 164.512(a). The Special Master’s decision is affirmed.

c. Plaintiff Asserts Good Reason to Seek All Unredacted PHI

This Court rejects ESI and Accredo’s challenge to the Special Master’s order compelling

disclosure of all unredacted PHI. ESI and Accredo again do not assert any law to support the

argument that the Special Master abused her discretion by ordering all unredacted PHI to be

propounded in discovery in accordance with the Qualified Protective Order. Additionally, the

Court discerns no clear errors of law. Consequently, the Court defers to and adopts the Special

Master’s reasoning that Plaintiff adequately exhibited a need for all PHI. See L. Civ. R. 72.1(c)(A);

McDonough, 2013 WL 322595, at *2. Accordingly, the Special Master’s order compelling

disclosure of unredacted PHI pursuant to the terms of the Qualified Protective Order is affirmed.

For the avoidance of doubt, the Court finds that good cause exists to produce all unredacted

PHI because it is within the scope of discoverable information provided by the Qualified Protective

Order and Plaintiff asserted sufficient reason for acquiring such unredacted information as a result

of the inconsistent manner in which ESI and Accredo tracked patient-subscribers. (Opposition to

Appeal at 21–22, ECF No. 643). Additionally, the Qualified Protective Order obviates the need

for ESI and Accredo’s confidentiality concerns because PHI may only be used in connection with

this litigation and PHI obtained during the proceedings must be returned or destroyed at the

conclusion of the litigation. (See Discovery Confidentiality Order ¶ 19, ECF No. 62). Indeed, the

Qualified Protective Order is more protective than what HIPAA requires because it affords the

producing parties the ability to place an “Attorneys’ Eyes Only” designation on any document

with sensitive information. (Id. at ¶ 2). ESI and Accredo must produce all CHI and PHI unredacted

as defined by Paragraph 3 of the Confidentiality Order.

IV. CONCLUSION

Based on the foregoing, Express Scripts, Inc., and Accredo Health Group, Inc.’s appeal is

DENIED, and the Special Master’s Order is AFFIRMED. The “minimum necessary rule” does

not apply here, and Plaintiff adequately articulated a need for disclosure of all PHI within the scope

of the Qualified Protective Order.

It therefore is on this 10th day of June, 2025,

ORDERED that the Special Master’s Order (ECF No. 582) is AFFIRMED; and it is further

ORDERED that ESI and Accredo produce all unredacted CHI and PHI requested by

Plaintiff in discovery in accordance with Paragraph 3 of the Qualified Protective Order.

s/ Cathy L. Waldor

Hon. Cathy L. Waldor

United States Magistrate Judge

Cc: Hon. Claire C. Cecchi, U.S.D.J.

Hon. Freda L. Wolfson, U.S.D.J. (ret.), Special Master