## Facts

- A state health agency, through Dr. Charles Barron, petitioned for an assisted outpatient treatment (AOT) order against Miguel M. under New York Mental Hygiene Law § 9.60 (Kendra’s Law).
- The petition alleged Miguel had a mental illness, was unlikely to survive safely without supervision, had a history of noncompliance leading to hospitalization, would not participate voluntarily in needed treatment, and needed AOT to prevent relapse likely to cause serious harm.
- For the AOT hearing, the agency obtained records of Miguel’s prior psychiatric hospitalizations directly from two hospitals.
- The hospitals produced the records in response to the agency’s request without Miguel’s authorization, without notice to him, and without a court order or subpoena.
- Miguel objected to admission of the records on privacy grounds, but the trial court admitted them and entered a six-month AOT order.
- The Appellate Division affirmed; by the time the case reached the Court of Appeals, the AOT order had expired.

## Issues

1. Whether the Court of Appeals should decide the appeal despite mootness because the AOT order had expired.
2. Whether the HIPAA Privacy Rule permits a hospital to disclose a patient’s medical records to a state agency for use in an AOT proceeding when the patient neither authorized the disclosure nor received notice of the request, and no judicial process compelled disclosure.
3. Whether HIPAA’s “public health” or “treatment” exceptions authorized the disclosure for purposes of obtaining a court order compelling outpatient mental-health treatment.
4. Whether medical records obtained through a HIPAA-violating disclosure are admissible in an AOT proceeding.

## Decision

- The Court of Appeals reached the merits under the mootness exception for questions likely to recur yet evade review.
- The court reversed the Appellate Division and held the hospitals’ records were inadmissible in the AOT proceeding.
- The court held HIPAA prohibited disclosure of Miguel’s records to the state agency for use in the AOT case because Miguel neither authorized the disclosure nor received notice, and no court order or subpoena was obtained.
- The court rejected reliance on HIPAA’s public health exception because an individual treatment-compulsion proceeding is not a public-health activity of the kind addressed by that exception.
- The court rejected reliance on HIPAA’s treatment exception because the disclosure was to support the agency’s litigation effort to obtain a coercive order, not to coordinate treatment among health-care providers.

## Legal Principles

- HIPAA generally bars disclosure of protected health information absent patient authorization or a specifically permitted disclosure accompanied by required safeguards (including notice and an opportunity to object, or judicial process where applicable).
- HIPAA’s public health exception is limited to specified public-health purposes and does not extend to obtaining records for individualized civil litigation to compel treatment.
- HIPAA’s treatment exception concerns information-sharing for treatment activities among providers and does not authorize disclosures primarily made to support a government agency’s application for a court order mandating treatment.
- Where HIPAA prohibits disclosure, less protective state practices are preempted to the extent they allow disclosure without HIPAA-required authorization or process.
- In an AOT proceeding, medical records obtained through a disclosure that violates HIPAA are not admissible.

## Conclusion

The court held that HIPAA barred a hospital from providing a patient’s medical records to a state agency for use in an AOT proceeding without the patient’s authorization, notice, or judicial process, and it reversed the AOT order because the improperly obtained records were inadmissible.


In re Miguel M. v. Barron, 950 N.E.2d 107 (N.Y. 2011)