Planned Parenthood of the St. Louis Region & Southwest Missouri, Respondent/Cross-Appellant, vs. Andrew Bailey, Attorney General, State of Missouri, Appellant/Cross-Respondent.

PLANNED PARENTHOOD OF THE ) No. ED112842 ST. LOUIS REGION & SOUTHWEST ) MISSOURI, ) Appeal from the Circuit Court ) of the City of St. Louis Respondent/Cross-Appellant, ) Cause No. 2322-CC00637 ) vs. ) ) ANDREW BAILEY, ATTORNEY ) Honorable Michael F. Stelzer GENERAL STATE OF MISSOURI ) ) Appellant/Cross-Respondent. ) FILED: May 6, 2025 Opinion Planned Parenthood of the St. Louis Region and Southwest Missouri, also known as Planned Parenthood Great Rivers (PPGR), and the Attorney General for the State of Missouri (AG) appeal from the trial court's judgment on their cross-motions for judgment on the pleadings partially enforcing the AG's Civil Investigative Demand (CID) sent to PPGR. Granting and denying both motions in part, the trial court held the CID was authorized under the Missouri Merchandising Practices Act (MMPA), § 407.010 1 et seq. However, the trial court only partially enforced the CID by ordering PPGR to produce only those documents not protected by federal

1 All statutory references are to RSMo. (2016), unless otherwise indicated.

2

regulations enacted pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 2 finding only patients may waive HIPAA confidentiality. PPGR and the AG each raise five points on appeal. PPGR first argues the trial court erred in finding the CID was authorized under the MMPA because the CID's plain language shows the AG is investigating health care services, which are not covered by the MMPA nor regulated by the AG. PPGR next brings several constitutional claims, alleging the CID is an unreasonable search exceeding the scope of § 407.040; it maliciously invades privacy by inquiring into gender-affirming health services for minors; and it violates the separation of powers by overextending the AG's executive power beyond MMPA enforcement. Additionally, PPGR asserts the trial court erred in failing to modify the CID consistent with PPGR's pleaded objections. The AG's five points each contend the trial court erred in ordering PPGR not to produce purportedly HIPAA-protected documents because either the HIPAA issues are unripe or because HIPAA expressly permits disclosure of all documents requested by the CID. We affirm the portion of the trial court's judgment granting in part the AG's motion for judgment on the pleadings because the CID is valid and enforceable as it is within the scope of the MMPA. We reverse the portion of the trial court's judgment declaring patient waiver to be the sole exception to HIPAA confidentiality, as that is an erroneous statement of law. Because we find that the CID seeks neither privileged information nor protected health information, as the AG requests a privilege log and appropriate redactions, we remand the cause to the trial court to enter an order directing PPGR to respond to the CID in a manner compliant with relevant Missouri and federal law. Accordingly, we affirm the trial court's judgment in part and reverse

2 45 C.F.R. § 164.500 et seq. (2024).

3

in part, remanding the cause for the trial court to continue proceedings consistent with this opinion. Background On March 10, 2023, the AG sent CID No. 23-24 to PPGR. The CID arises out of the AG's investigation of alleged violations of Missouri's consumer protection law in the course of providing gender transition services to minors. The CID states the following: The AG is investigating whether Washington University Pediatric Transgender Center at St. Louis Children's Hospital (the Center), or others in the state providing similar services, engaged in any practices declared to be unlawful under the MMPA. The AG is inquiring into, among other things, the Center's activities and representations in connection with products and services offered in Missouri. The AG has reason to believe that the Center or others in the state may have used deception, fraud, false promises, misrepresentation, unfair practices, and/or the concealment, suppression, or omission of material facts within the scope of the MMPA. The AG's investigation is based in part, but not limited to, allegations made in an attached Affidavit, which the AG previously made public, containing sworn statements of a Center employee. The AG believes that PPGR has information, documentary material, and/or physical evidence relevant to the investigation. The CID directs PPGR to respond to the CID promptly and confidentially. The CID instructs that for responsive materials PPGR believed to be privileged, PPGR must produce a privilege log that identifies each document or communication, the basis for withholding it, and sufficient information to permit the AG to assess whether the claimed privilege applies. Following a set of instructions and definitions, the CID lists fifty-four requests for information and documents.

4

After receiving the CID, PPGR filed a petition to set aside the CID pursuant to § 407.070. The petition alleges that the parties attempted to resolve their disputes about the CID prior to filing but were unable to reach an agreement. Among the grounds for setting aside the CID, the petition alleges the CID is deficient under the statutory requirements of § 407.040 because it alleges no wrongdoing by PPGR under the MMPA or alleges no nexus between PPGR and the Center, as the Affidavit refers only to alleged activities of the Center and makes no reference to PPGR. The petition also alleges the CID exceeds the scope of the AG's authority under § 407.040 by impermissibly seeking production of patient records that are protected from disclosure by HIPAA or by Missouri law, including physician-patient privilege § 491.060(5) , peer review privilege § 537.035, communications of a licensed clinical social worker § 337.636, and mandatory reporting of child abuse § 210.115, RSMo (Cum. Supp. 2021). The petition further alleges the CID violates the Fourth Amendment of the United States (U.S.) Constitution on Fourteenth Amendment due process grounds as an unreasonable search into the "zone of privacy" and violates the Missouri Constitution's separation of powers as an overreach by the executive branch attempting to criminalize legal conduct. Attached to the petition are objections to the CID's instructions, definitions, and fifty-four requests and their subparts. The petition asks the trial court to issue an order setting aside the CID or, in the alternative, modifying the CID in light of PPGR's objections. The AG answered PPGR's petition and filed a counterclaim to enforce the CID under § 407.090. After PPGR answered the AG's counterclaim, the parties filed cross-motions for judgment on the pleadings. In its motion, PPGR reiterated the petition's reasonings for setting aside or modifying the CID, including that the CID was deficient under the MMPA, that enforcing the CID would force PPGR to violate HIPAA, and that the CID was unconstitutional.

5

Similarly, the AG in its motion reaffirmed that the CID was authorized by and compliant with the MMPA. Following briefing by the parties, the trial court issued judgment granting in part and denying in part the cross-motions for judgment on the pleadings. The trial court stated that the parties agreed to the underlying facts. The trial court found the MMPA gives the AG broad investigative powers when Missouri consumers may need protection from dishonesty in medical services and billing practices. However, the trial court went on to find that the only way for the AG to gain access to HIPAA-protected medical records is for individual patients to waive their HIPAA privacy rights. The trial court thus concluded the AG was entitled to receive all requested documents not protected by HIPAA and ordered PPGR to produce such documents. The trial court's judgment was silent as to PPGR's statutory privilege and constitutional claims. The AG moved to amend the trial court's judgment, and the post-judgment motion was deemed denied after ninety days. These cross-appeals follow. Standard of Review We review a trial court's judgment on the pleadings de novo. Coburn v. Kramer & Frank, P.C., 627 S.W.3d 18, 26 (Mo. App. E.D. 2021) ( internal citation omitted). Our role is to determine whether the moving party is entitled to judgment as a matter of law on the face of the pleadings. City of St. Louis v. State, 682 S.W.3d 387, 396 (Mo. banc 2024) (quoting Emerson Elec. Co. v. Marsh & McLennan Cos., 362 S.W.3d 7, 12 (Mo. banc 2012)). We treat the non- moving party's well-pleaded facts as admitted. Id. (quoting Gross v. Parson, 624 S.W.3d 877, 883 (Mo. banc 2021)). "However, [t]his Court will not blindly accept the legal conclusions drawn by the pleaders from the facts." Id. (quoting Gross, 624 S.W.3d at 883). Here, each party is both a movant and non-movant on cross-motions for judgment on the pleadings.

6

We will affirm a grant of judgment on the pleadings "only if the facts pleaded by the petitioner, together with the benefit of all reasonable inferences drawn therefrom, show that [the] petitioner could not prevail under any legal theory[.]" Id. (quoting Emerson Elec. Co., 362 S.W.3d at 12). We " will affirm the judgment if it is supported by any theory, 'regardless of whether the reasons advanced by the [trial] court are wrong or not sufficient.'" Gross, 624 S.W.3d at 883 (internal quotation omitted); Coburn, 627 S.W.3d at 26 (internal quotation omitted) (noting we "are not limited to the grounds relied on by the trial court"). "This is because we are 'primarily concerned with the correctness of the result, and not the route taken by the trial court to reach it.'" Coburn, 627 S.W.3d at 26 (internal quotation omitted). Statutory interpretation in a motion for judgment on the pleadings is a matter of law that we review de novo. Gross, 624 S.W.3d at 884 (internal citation omitted). Likewise, we review constitutional interpretation de novo. Missouri Highways & Transp. Comm'n v. Zellers, 705 S.W.3d 577, 580 (Mo. App. W.D. 2024) ( quoting Faatz v. Ashcroft, 685 S.W.3d 388, 400 (Mo. banc 2024)). Discussion 3

I. PPGR's Cross-Appeal Point One—The CID is authorized under the MMPA We construe PPGR's Point One as arguing the trial court erred in granting in part the AG's motion for judgment on the pleadings as to the enforceability of the CID under the MMPA

3 In their briefs, PPGR and the AG each moved to strike all or parts of each other's briefs for failing to substantially comply with the rules of appellate procedure. See Mo. R. Civ. P. 84.04 (2024). We deny both motions. PPGR alleges the AG's brief contained an improper introduction and argued facts outside the record. Rule 84.04 does not prohibit introductions, and while Rule 84.04(c) requires all facts to be cited to the record on appeal, we do not find it necessary to strike the AG's entire brief due to limited reference to a National Health Service report from the United Kingdom and the affiant's testimony in a different case, both of which were offered in the context of the AG explaining the basis for its investigation. Moreover, we need not consider any matters outside the pleadings to resolve the issues on appeal. See City of St. Louis, 682 S.W.3d at 396 (quoting Gross, 624 S.W.3d at 883). Turning to the AG's motion, the AG contends we should strike PPGR's brief for violating Rule 84.04(a)(1) with an insufficient table of contents as well as Points One and Two for being impermissibly multifarious and violating Rules 84.04(d) and 84.04(e). As with PPGR's argument on the AG's statement of facts, we decline to

7

on the following grounds: the CID was not issued pursuant to an investigation of unfair practices in connection with the sale or advertisement of "merchandise" under the MMPA; the MMPA does not authorize the AG to issue a CID to investigate health care services, to investigate PPGR for medical malpractice, or to investigate PPGR for conduct that is regulated by the State Board of Registration for the Healing Arts (the Board); and the CID fails to make clear that the AG is investigating PPGR, as opposed to the Center, for alleged MMPA violations. Exercising our discretion to review these interrelated claims together, we find the trial court properly found the CID to be enforceable because the CID is authorized under the MMPA.

dismiss an entire brief solely due to minor briefing deficiencies, such as with PPGR's table of contents. Regarding PPGR's Points One and Two, we agree the points are deficient under Rule 84.04(d)(1) for failing to identify why, in the context of the case, the trial court erred and for being multifarious in raising multiple subparts with distinct legal reasons for reversal that should have been raised as separate points. See Bi-Nat'l Gateway Terminal, LLC v. City of St. Louis, 697 S.W.3d 593, 598 (Mo. App. E.D. 2024) (citing Dieckmann v. JH Constr. 2, LLC, 619 S.W.3d 513, 522 (Mo. App. E.D. 2021) ("An appellant must address separate legal theories in different points relied on to comply with Rule 84.04(d).")). "However, we have discretion to exercise review of multifarious points on appeal when the argument is readily ascertainable and does not require us to become an advocate for one party." Dieckmann, 619 S.W.3d at 522 (internal citation omitted). We choose to exercise that discretion here, particularly because PPGR's Points One and Two fulfill the overarching purpose of Rule 84.04(d), which is to give notice to the respondent of the precise matters that must be contended with and to inform us of the issues presented for review. See Burgan v. Newman, 618 S.W.3d 712, 715 (Mo. App. E.D. 2021) (internal citation omitted). Indeed, Respondents take no issue with the phrasing of four of PPGR's points on appeal that invert the standard of review by claiming the trial court erred in denying PPGR's motion for judgment on the pleadings in part rather than claiming the trial court erred in granting the AG's motion in part. See Sanders v. Gould, 685 S.W.3d 589, 595 (Mo. App. E.D. 2024) (citing Atlas Sec. Servs., Inc. v. Git-N-Go, Inc., 728 S.W.2d 727, 729 (Mo. App. S.D. 1987)) (noting no appeal lies from the denial of a judgment on the pleadings). Clearly, however, we have jurisdiction in the case on an appeal from a judgment on the pleadings, and there is no confusion as to the nature of the dispute. "[T]his Court has discretion to review noncompliant points gratuitously, overlooking the technical deficiencies in the points relied on, when the deficiencies do not impede review on the merits." Bi-Nat'l Gateway Terminal, 697 S.W.3d at 599 (quoting Lexow v. Boeing Co., 643 S.W.3d 501, 508 (Mo. banc 2022)). Given PPGR's argument sections for Points One and Two and the record for the judgment on the pleadings in the trial court, PPGR's claims were preserved and not a source of unfair surprise, nor do they lack clarity so as to impede meaningful review or risk improperly making us advocates by forcing us to speculate on facts and arguments that have not been made. See id. at 597 (internal quotation omitted). We therefore review PPGR's Points One and Two on their merits. We do so "cautiously because each time we review a noncompliant brief ex gratia, we send an implicit message that substandard briefing is acceptable[;] [i]t is not." Penzel Constr. Co. Inc. v. Jackson R-2 Sch. Dist., 655 S.W.3d 434, 439 (Mo. App. E.D. 2022) (internal citation omitted). We also bear this admonition in mind when reviewing PPGR's other claims in Points Three, Four, and Five, which the AG also accurately point out lack significant development of support from legal authorities. See Acol v. Travers Autoplex & RV, Inc., 637 S.W.3d 415, 420 (Mo. App. E.D. 2021) (internal citation omitted) (noting "[a] party on appeal must develop the issue raised in its point relied on" and "support a point with relevant legal authority or argument beyond conclusory statements"). Notwithstanding, we do not find the procedural issues in either party's briefs fatally impair our review, and both motions to strike on Rule 84.04 grounds are denied. See id.

8

The CID notifies PPGR that the AG is investigating the Center and others in the state, including PPGR, for unfair practices under the MMPA. The unfair practices are in connection with the sale or advertisement of merchandise because medical products and services are covered by the MMPA and are not exclusively relevant to medical malpractice claims. Relatedly, the AG's broad investigative powers under the MMPA are not preempted by the Board. We begin by addressing the broad scope of the MMPA. The AG is charged with investigating and prosecuting violations of Missouri's consumer protection laws, including the MMPA. State ex rel Koster v. Charter Commc'ns, Inc., 461 S.W.3d 851, 857 (Mo. App. W.D. 2015). Acting as a civil enforcement agency with respect to the MMPA, the AG is empowered to issue CIDs, which are a type of administrative subpoena that "provide a form of pretrial discovery for the benefit of the attorney general." Id. (quoting State ex rel. Ashcroft v. Goldberg, 608 S.W.2d 385, 388 (Mo. banc 1980)); see also State ex rel. Danforth v. Indep. Dodge, Inc., 494 S.W.2d 362, 366–67 (Mo. App. K.C.D. 1973) ("[T]he Civil Investigative Demand procedure is entirely unilateral, and is intended solely for the benefit of the attorney general, not for the benefit of the defendant."). As a matter of historical context, Missouri, like many other states, adopted CID procedures similar to the U.S. AG's CID pretrial discovery powers under the Federal Antitrust Civil Process Act, 15 U.S.C.A. § 1312. Indep. Dodge, 494 S.W.2d at 366. Because Missouri's CID procedures are patterned after the parallel provisions of the federal procedures, federal caselaw can be persuasive in interpreting CIDs in Missouri. Id.; see also Charter Commc'ns,

9

Inc., 461 S.W.3d at 856 (quoting Goldberg, 608 S.W.2d at 388) (favorably citing federal decisions because the Missouri CID statute had received "virtually no judicial attention"). 4

The MMPA CID statute provides: When it appears to the attorney general that a person has engaged in or is engaging in any method, act, use, practice or solicitation declared to be unlawful by this chapter or when he believes it to be in the public interest that an investigation should be made to ascertain whether a person in fact has engaged in or is engaging in any such method, act, use, practice or solicitation, he may execute in writing and cause to be served upon any person who is believed to have information, documentary material, or physical evidence relevant to the alleged or suspected violation, a civil investigative demand requiring such person to appear and testify, or to produce relevant documentary material or physical evidence or examination, at such reasonable time and place as may be stated in the civil investigative demand, concerning the advertisement, sale or offering for sale of any goods or services or the conduct of any trade or commerce or the conduct of any solicitation that is the subject matter of the investigation.

§ 407.040.1. Regarding investigations covered by the MMPA CID statute, the AG is authorized to investigate possible violations of the MMPA to promote the "laudable purpose" of protecting Missouri consumers. Heinz v. Driven Auto Sales, LLC, 603 S.W.3d 890, 895 (Mo. App. E.D. 2020) ( citing Berry v. Volkswagen Grp. of Am., Inc., 397 S.W.3d 425, 433 (Mo. banc 2013)). The MMPA prohibits in relevant part "[t]he act, use or employment by any person of any deception, fraud, false pretense, false promise, misrepresentation, unfair practice or the concealment, suppression, or omission of any material fact in connection with the sale or advertisement of any merchandise in trade or commerce[.]" § 407.020.1. 5 In deciding what conduct constitutes an unfair practice, "[p]ursuant to § 407.145, the legislature granted to the

4 Missouri courts have discussed CIDs a total of five times in nearly sixty years. See Charter Commc'ns, 461 S.W.3d at 856; Ports Petroleum Co., Inc. of Ohio v. Nixon, 37 S.W.3d 237, 239 (Mo. banc 2001); Goldberg 608 S.W.2d at 388; Lewandowski v. Danforth, 547 S.W.2d 470, 473 (Mo. banc 1977); Indep. Dodge, 494 S.W.2d at 366. 5 We note § 407.020 was amended in 2021 with no changes to any provisions relevant to this appeal. See § 407.020, RSMo (Cum. Supp. 2021).

10

attorney general the authority to issue rules setting out the scope and meaning of the MMPA." Heinz, 603 S.W.3d at 894 n.2 (citing Huch v. Charter Commc'ns, Inc., 290 S.W.3d 721, 724–25 (Mo. banc 2009)); see also 15 C.S.R. § 60-8.020. 6 Missouri's Code of State Regulations defines an "unfair practice" under the MMPA as conduct presenting a risk of, or causing, substantial injury to customers and (1) "offend[ing] any public policy as it has been established by the Constitution, statutes or common law of this state, or by the Federal Trade Commission, or its interpretive decisions; or" (2) being "unethical, oppressive or unscrupulous[.]" 15 C.S.R. § 60- 8.020(1). "In interpreting this section [§ 407.020], our courts have held that the 'plain and ordinary meaning of the words themselves . . . are unrestricted, all-encompassing and exceedingly broad.'" Peel v. Credit Acceptance Corp., 408 S.W.3d 191, 208 (Mo. App. W.D. 2013) (quoting Ports Petroleum Co., Inc. of Ohio v. Nixon, 37 S.W.3d 237, 240 (Mo. banc 2001)). "For better or worse, the literal words [of § 407.020] cover every practice imaginable and every unfairness to whatever degree." Id. (quoting Ports Petroleum, 37 S.W.3d at 240). MMPA § 407.020.1 and 15 C.S.R. 60-8.020 together "paint in broad strokes to prevent evasion thereof due to overly meticulous definitions." Schuchmann v. Air Servs. Heating & Air Conditioning, Inc., 199 S.W.3d 228, 233 (Mo. App. S.D. 2006) (citing Clement v. St. Charles Nissan, Inc., 103 S.W.3d 898, 900 (Mo. App. E.D. 2003)). Therefore, PPGR's contention that the MMPA does not reach all fraud or unfair practices is not well taken. See id. The AG issued the CID as part of its investigation into unfair practices in the provision of gender transition medical services to minors. PPGR contends the CID should not be enforced

6 "The [AG] administers and enforces the provisions of the [MMPA], Chapter 407, RSMo. The attorney general may make rules necessary to the administration and enforcement of the provisions of Chapter 407, RSMo and, in order to provide notice to the public, may specify the meaning of terms whether or not used in the Act. This rule specifies the settled meanings of certain terms used in the enforcement of the Act and provides notice to the public of their application." 15 C.S.R. § 60-8.020.

11

because it fails to indicate that the AG is investigating the sale or advertisement of "merchandise" under the MMPA. PPGR disputes the applicability of the MMPA to its practices on the grounds that medical services exclusively implicate standard-of-care questions properly investigated as medical malpractice, and thus are not connected to any sale or advertisement of merchandise in trade or commerce. PPGR's argument fails because Missouri courts have held that the broad language of the MMPA covers medical goods and services. Freeman Health Sys. v. Wass, 124 S.W.3d 504, 507 (Mo. App. S.D. 2004). Specifically, "[m]edical goods and services meet the statutory definition of merchandise as defined by [§] 407.010(4)." Id. 7

Medical goods and services are put into trade or commerce when they are advertised, sold, offered for sale or distribution, or any combination thereof "directly or indirectly affecting the people of this state." § 407.010(7). Accordingly, by providing and billing for medical services, PPGR's business practices fall squarely within the MMPA a nd are subject to the AG's oversight. See § 407.010(4), (7); Freeman Health Sys., 124 S.W.3d at 507. The majority of the CID requests seek information about PPGR's operating policies. However, we understand PPGR's concern that some CID requests appear to seek information about PPGR's practice of medicine, whereas others are more clearly directed to PPGR's marketing and billing practices. In line with prior Missouri courts, we must reject PPGR's argument that any overlap with medical malpractice necessarily places a business's practices outside the scope of the MMPA so as to invalidate a CID issued under § 407.040. See, e.g., Breeden v. Hueser, 273 S.W.3d 1, 5, 7–8 (Mo. App. W.D. 2008) ( finding the statute of limitations for medical malpractice claims did not apply to MMPA and fraud claims against a physician for unauthorized and duplicative billing practices).

7 The MMPA defines merchandise as "any objects, wares, goods, commodities, intangibles, real estate or services." § 407.010(4).

12

Whether a claim falls under the MMPA or medical negligence depends on which is more central to the complaint. Id. at 7–8 (internal citation omitted). In Breeden, the plaintiff alleged a physician engaged in deceptive business practices and fraud by intentionally charging chemotherapy patients for full treatment vials despite using partially-filled vials to treat multiple patients, when common medical practice and government regulations required using new vials for each treatment. Id. at 5. Unmistakably, there is overlap between business practices and the practice of medicine in the prescribing, administering, and billing of cancer-fighting drugs. But Breeden held that "actions brought against doctors and health care providers are not automatically subject to [§] 516.105," RSMo (Cum. Supp. 2018), governing claims for medical malpractice. Id. at 7 ( internal citations omitted). Alleged intentional acts "cannot be categorized as negligence, error, or mistake." Id. at 8. To the contrary, allegations of unfair practices in connection with the provision of medical services fall under the broad ambit of the MMPA. See § 407.020.1. The MMPA thus authorizes the AG to issue a CID to investigate possible unfair practices by PPGR in the provision of medical services. See §§ 407.040.1, .020.1. Additionally, no amendments to the MMPA have in any way impaired the AG's ability to enforce its provisions, particularly with respect to its ability to issue CIDs during pre-claim investigations. PPGR urges us to extend to the AG the codified prohibition against filing private causes of action to recover damages for personal injury or death under the MMPA that can be brought as medical malpractice claims under Chapter 538. See § 407.025.3, RSMo (Cum. Supp. 2020). We decline to do so. We likewise decline to find that the narrow provisions of the Missouri Save Adolescents from Experimentation (SAFE) Act, 8 enacted subsequent to the CID,

8 § 191.1720, RSMo (Cum. Supp. 2023). The SAFE Act creates a cause of action against health care providers separate from Chapter 538 arising from the performance of gender transition surgery or the prescription or administration of cross-sex hormones or puberty-blocking drugs to minors. § 191.1720.5, RSMo (Cum. Supp. 2023). The SAFE Act contains a sunset provision under which its provisions shall expire on August 28, 2027.

13

subsumes any potential MMPA violations relating to the provision of transgender health care services to minors. Irrespective of these non-MMPA statutes, 9 as stated above, the AG is authorized to issue a CID to investigate possible MMPA claims, which is what the CID at issue professes to do through investigating not medical malpractice violations but rather dishonesty or unfair practices in connection with hormonal or surgical interventions for minors as affecting Missouri consumers. We must underscore that there is no MMPA claim against PPGR before us—we are reviewing only the validity of an administrative subpoena issued by the AG in a pre- claim investigation under the auspices o f the MMPA. The government may use its administrative subpoena power to " investigate merely on suspicion that the law is being violated, or even just because it wants assurance that it is not.'" United States v. Whispering Oaks Res. Care Facility, LLC, 673 F.3d 813, 818 (8th Cir. 2012) (per curiam) (quoting United States v. Morton Salt Co., 338 U.S. 632, 643 (1950)); see also CFPB v. Heartland Campus Sols., ECSI, 747 F. App'x. 44, 47 (3d Cir. 2018) (quoting United States v. Powell, 379 U.S. 48, 57 (1964)). In this regard, we find wholly unavailing PPGR's reliance on the trial court's judgment with respect to the purported importance of the Affidavit as evidentiary support for the AG's allegation of intentional dishonesty in PPGR's medical and billing practices. See Whispering Oaks, 673 F.3d at 818 (noting that whether something is relevant to an administrative subpoena is not a question of evidentiary relevance). To the extent that the trial court's judgment can be understood as improperly requiring the AG adduce evidence in support of a claim it has not yet, and may not ever, bring, we will affirm the judgment if it reaches the correct result despite any

9 We also note that the AG has specific statutory authority to investigate Medicaid billing fraud using the powers it is granted under the MMPA. § 191.910.1. However, given our holding that the CID is valid for investigating possible MMPA violations, we need not reach the AG's suggestion that this CID is also validly issued to investigate Medicaid fraud under § 191.910 and limit our analysis accordingly.

14

flawed reasoning in reaching that result. See Gross, 624 S.W.3d at 883 (internal citation omitted). Finally, we find as a matter of law that the AG's regulatory authority under the MMPA is not preempted or divested by the Board. The Board regulates the practice of medicine in the state and may investigate and discipline holders of medical licenses for misconduct, including "[w]ilfully and continually performing inappropriate or unnecessary treatment" and "conduct that is unethical or unprofessional involving a minor." See §§ 334.020, .100.2(4)(c), (s), RSMo (Cum. Supp. 2023). The fact that medical providers, like other professionals, are regulated by licensure oversight bodies does not exempt them from complying with consumer protection laws in their business practices, which the AG is responsible for overseeing. See Charter Commc'ns, 461 S.W.3d at 857. Although PPGR suggests no statute gives the AG the power to investigate the provision of health care services in the state, that is precisely what the MMPA does with its broad language prohibiting all persons, including health care providers, from harming Missouri consumers through unfair and deceptive practices. See Ports Petroleum, 37 S.W.3d at 240. A. The CID is sufficiently directed to PPGR under § 407.040 PPGR also disputes whether the CID makes clear that the AG is investigating anything with respect to PPGR, inasmuch as the CID and its attached Affidavit allege only wrongdoing in the rendering of medical services with respect to the Center. We find no merit to this claim. Preliminarily, we must be clear about the nature of PPGR's argument. PPGR does not claim defective notice as a matter of constitutional due process. Rather, PPGR presumes that for the CID to be valid, it must specifically state PPGR is being investigated for possible MMPA violations. PPGR adduces no legal support for this presumption. Section 407.040.1 simply provides that the AG may serve a CID on "any person who is believed to have information, documentary material, or physical evidence relevant to the alleged or suspected violation[.]"

15

§ 407.040.1. Additionally, the CID statute expressly states what a CID must do and what it cannot do:

1. Each civil investigative demand shall:

(1) State the statute and section thereof, the alleged violation of which is under investigation, and the general subject matter of the investigation; (2) Describe the class or classes of information, documentary material, or physical evidence to be produced thereunder with reasonable specificity so as fairly to indicate the material demanded; (3) Prescribe a return date by which the information, documentary material, or physical evidence is to be produced; and (4) Identify the members of the attorney general's staff to whom the information, documentary material, or physical evidence requested is to be made available.

1. No civil investigative demand shall:

(1) Contain any requirement which would be unreasonable or improper if contained in a subpoena duces tecum issued by a court of this state; or (2) Require the disclosure of any documentary material which would be privileged or which, for any other reason, could not be required by a subpoena duces tecum issued by a court of this state.

§ 407.040.2–3 (emphasis added). In interpreting these provisions, we consider " [t] he primary goal of statutory interpretation is to give effect to legislative intent, which is most clearly evidenced by the plain text of the statute" taking words and phrases "in their plain or ordinary and usual sense." Gross, 624 S.W.3d at 884 (internal quotations omitted). Thus, the question is whether PPGR is "any person" who the AG believes has information relevant to its investigation. PPGR does not challenge the enforcement of the CID on the grounds that PPGR is not a "person," but instead presumes that the CID cannot be premised on the AG's investigation into the Center. We find no such presumption in the plain language of § 407.040.1. Similarly, regarding the statute's other provisions, "[a] CID issued by the Attorney General must comport with the requirements of [§] 407.040 which requires reasonable notice of the conduct under investigation and specific notice of the documents to be produced."

16

Lewandowski v. Danforth, 547 S.W.2d 470, 473 (Mo. banc 1977) (internal citations omitted) (emphases added). Reasonable notice and specific notice are different. The reasonable-notice requirement is expressed with broad language, requiring only that the AG set forth the "general subject matter" of its investigation as well as the applicable law. See § 407.040.2(1). The AG suggests the reason for this generality is to protect the secrecy of its pre-claim investigations so they are not compromised. Regardless of the potential policy reasons for this statutory language, we agree with the AG that PPGR's interpretation incorrectly imposes an additional element not contained in § 407.040.2(1), because under the statute's plain language, the phrase "the alleged violation of which is under investigation" is not a separate requirement but an appositive that provides clarifying information about what precedes it, namely, "the statute and section thereof." See Gross, 624 S.W.3d at 885 n.4 (internal quotation omitted) (noting statutory interpretation does not permit adding or subtracting words from a statute). Therefore, the CID satisfies § 407.040.2(1) by identifying the general subject matter of its investigation and the relevant MMPA section. Moreover, even had PPGR established that the CID must state the AG is investigating PPGR, the CID's inclusive language does in fact allege the AG is investigating PPGR. Specifically, the CID states that the AG believes it to be in the public interest to investigate whether the Center, its agents or employees, or others in the state providing similar services, have engaged in or are engaging in any practices declared to be unlawful by § 407.020 in the provision of gender transition services to minors. The CID further states the AG has reason to believe that the Center or others in the state may have used deception, fraud, false promises, misrepresentation, unfair practices, and/or the concealment, suppression, or omission of material facts within the scope of the MMPA. Directly incorporating § 407.040.1's statutory language,

17

the CID states the AG believes PPGR has information, documentary material, and/or physical evidence relevant to its investigation of the Center or others. We find PPGR is readily understandable to be included within "others in the state" being investigated, hence being the recipient of the CID. PPGR counters that the phrase "or others" is not sufficient to satisfy § 407.040 because it would allow the AG to premise its investigation on an unknown target. However, PPGR's own argument recognizes the Center as a known target. PPGR further suggests "or others" does not satisfy § 407.040 because the four precedential Missouri cases assessing the enforcement of a CID involved CIDs that specifically alleged wrongdoing by the CID recipient. See Ports Petroleum, 37 S.W.3d at 239; Goldberg, 608 S.W.2d at 387; Lewandowski, 547 S.W.2d at 471– 72; Charter Commc'ns, 461 S.W.3d at 854. However, none of those cases were presented with this precise issue, and certainly none support ignoring or adding to § 407.040.1's plain language. PPGR also takes issue with the CID's attached Affidavit, which only references the Center. Although the Affidavit does not mention PPGR, PPGR fails to show this was a requirement for the CID to be valid. Indeed, the CID states the AG's investigation is based in part on, but is not limited to, the allegations in the Affidavit. PPGR identifies no language in § 407.040 requiring the AG to provide an affidavit in defense of its investigation of possible MMPA violations. See Gross, 624 S.W.3d at 884 (internal quotations omitted) (providing our primary goal is to interpret the statute's plain language); cf. Heartland Campus, 747 F. App'x. at 47 (quoting Powell, 379 U.S. at 57) (noting a CID may be validly issued without any proof of a violation). Additionally, the AG pleaded it had reason to believe there was a nexus between the Center and PPGR, such as PPGR having board members affiliated with Washington University, and that it suspected PPGR may have engaged in similar practices to the Center alleged to be

18

unlawful under the MMPA, all of which the trial court was free to consider in cross-motions for judgment on the pleadings. See City of St. Louis, 682 S.W.3d at 396 (quoting Emerson Elec., 362 S.W.3d at 12). Given the breadth of the MMPA and the AG's investigative powers, we are persuaded the CID is valid and enforceable. See §§ 407.040, RSMo (2016), .020.1, RSMo (Cum. Supp. 2020). Point One is denied. II. PPGR's Cross-Appeal Points Two, Four, and Five—PPGR's constitutional arguments do not require setting aside the CID 10

In Points Two, Four, and Five, PPGR argues in the alternative that even if the CID is authorized under the MMPA, the CID nevertheless fails to comply with the constitutional protections found in the U.S. and Missouri Constitutions and should therefore be set aside. 11 We disagree.

10 PPGR and the AG disagree about whether jurisdiction properly lies with this Court. The AG contends the Missouri Supreme Court has exclusive jurisdiction over these claims because they challenge the constitutionality of a statute. See M O. CONST. art. V, § 3. The AG sought transfer, which was denied both by this Court and the Supreme Court. "The Supreme Court's 'exclusive appellate jurisdiction is invoked when a party asserts that a state statute directly violates the constitution either facially or as applied.'" State v. Forster, 616 S.W.3d 436, 442 (Mo. App. E.D. 2020) (quoting McNeal v. McNeal-Sydnor, 472 S.W.3d 194, 195 (Mo. banc 2015)). To invoke Supreme Court jurisdiction, "[t]he constitutional issue must be real and substantial, not merely colorable." Id. (quoting McNeal, 472 S.W.3d at 495). "[I]f the United States Supreme Court or Missouri Supreme Court has addressed a constitutional challenge, the claim is merely colorable and the intermediate appellate court has jurisdiction.'" Id. (internal quotation omitted). Because PPGR's constitutional claims are merely colorable, we have jurisdiction to review them. See id. Additionally, we note sua sponte that § 407.090—the statute under which the AG filed its CID enforcement counterclaim—is also not a proper basis for transfer. Section 407.090 states that the Supreme Court has jurisdiction over appeals from CID enforcement actions. § 407.090 ("Any final order so entered shall be subject to appeal to the state supreme court."). However, the Supreme Court has made clear this provision is not good law, in light of the historical change requiring jurisdiction to be conferred by article V, § 3 of the Missouri Constitution rather than created by statute. Goldberg, 608 S.W.2d at 387. Although the jurisdictional language in § 407.090 has never been removed by the legislature, the Supreme Court held that the outdated provision does not render the statute unconstitutional and implied it was severable. See id. Further, the Supreme Court had the opportunity to take transfer in this case based on § 407.090 as raised in the AG's motion to transfer but declined to so. 11 PPGR preserved its three constitutional claims by raising them at the earliest opportunity in its petition to set aside the CID, which alleged the CID is unenforceable because it runs afoul of the Missouri and U.S. Constitutions in that it violates the prohibition against unreasonable searches, violates due process by invading the privacy of medical records, and violates the separation of powers.

19

A. Point Two—The CID is not an unreasonable search Point Two contends the trial court erred in impliedly rejecting its argument that the CID was unconstitutional under article I, § 15 of the Missouri Constitution prohibiting unreasonable searches under the three-part test set out in Charter Communications. As a type of administrative subpoena, a CID must comply with due process principles outlined by the Fourth Amendment to the U.S. Constitution and, in our case, as applied to our state via article I, § 15 of the Missouri Constitution. Charter Commc'ns, 461 S.W.3d at 857 n.4 (internal citation omitted). Both the AG and PPGR recognize that the Missouri Supreme Court has held that CIDs properly issued under § 407.040 fully afford recipients the protection of procedural due process by offering a meaningful opportunity to be heard. See Lewandowski, 547 S.W.2d at 472 (internal citations omitted). As a type of administrative subpoena, a CID generally does not violate the Missouri Constitution's protection against unreasonable searches where the CID recipient has an opportunity to seek "pre-compliance judicial review." Charter Commc'ns, 461 S.W.3d at 858 (internal quotation omitted). The CID procedure set forth in § 407.070 affords just such opportunity, as demonstrated here where PPGR petitioned to set aside or modify the CID, and the AG counterclaimed to enforce it. Id. "In addition to the requirement that there be some mechanism for the recipient of an administrative investigative demand to be able to seek pre-compliance judicial review, the Fourth Amendment . . . [has a] reasonableness requirement[.]" Id. at 859 (citing United States v. Golden Valley Elec., 689 F.3d 1108, 1113 (9th Cir. 2012); Benson v. People, 703 P.2d 1274, 1278 (Colo. banc 1985)); see also Div. of Emp. Sec. v. Ferger, 781 S.W.2d 568, 570 (Mo. App. E.D. 1989) (noting subpoenas duces tecum 12 involve Fourth Amendment interests and are

12 CIDs may not "contain any requirement that would be unreasonable or improper in a subpoena duces tecum" nor require disclosure of the same. § 407.040.3(1)–(2).

20

subject to a test of reasonableness even though they do not require a strict showing of probable cause). Synthesizing federal and state caselaw, Charter Communications interpreted that reasonableness requirement as a three-part test: (1) the CID must comply with the statute authorizing it; (2) the information sought in the CID must be relevant to the administrative inquiry; and (3) the CID must not be too indefinite or too broad. 13 Id. Here, PPGR argues the CID fails each part of Charter Communication's three-part test in that the CID (1) exceeds the scope of § 407.040 by alleging only wrongdoing by an entity other than PPGR, (2) seeks irrelevant information, and (3) is harassing and unduly burdensome. Regarding PPGR's argument as to the first and second prongs of the test, our holding in Point One—that the CID is authorized and enforceable under § 407.040.1 and that the language of the CID makes clear that the AG is also investigating PPGR for possible violations of the MMPA— is dispositive, therefore we will not discuss those claims below. Regarding the third prong, we find the CID to be reasonable because PPGR has not shown the CID is too indefinite or too broad. See id.

1. PPGR fails to show the CID is too indefinite or too broad

PPGR posits the CID fails the third prong of the reasonableness test by being harassing and unduly burdensome. Given that the third prong of the reasonableness test is that the CID not be "too indefinite or too broad," we agree with the AG that PPGR's complaints that the CID is "harassing and unduly burdensome" are not obvious legal equivalents. See id. To the extent that PPGR does not develop any argument as to why the CID is "too indefinite or too broad" in this section, we deem the claim abandoned. See In re S.H.P., 638 S.W.3d 524, 533 (Mo. App. W.D.

13 Federal cases similarly assess the enforceability of an administrative subpoena issued by the AG for whether it is "(1) issued pursuant to lawful authority, (2) for a lawful purpose, (3) requesting information relevant to the lawful purpose, and (4) the information sought is not unreasonable." Whispering Oaks, 673 F.3d at 817 (internal citation omitted).

21

2021) (internal quotation omitted) ("Points that are not developed in the argument are deemed to be abandoned."). Similarly, PPGR does not develop any argument in this section to support its assertion that the CID is unduly burdensome—which would need to be a separate point on appeal as it would be brought under different legal authority—thus we also deem that part of its claim abandoned. See id. (internal quotations omitted) (noting the "argument should show how the principles of the law and the facts of the case interact" and "[i] f a party does not support contentions with relevant authority or argument beyond conclusory statements, the point is deemed abandoned"). In its reply brief, PPGR elaborates that the CID requests are overbroad and burdensome because many would require PPGR to review all its records and compile statistics and process data to present in the AG's desired format. While there is merit to this complaint, PPGR's failure to preserve the argument in a point on appeal with supporting authority does not offer us means to review it. Regarding the CID being harassing, PPGR states the AG's past actions demonstrate the AG has issued the CID to PPGR for an improper purpose in that the AG has shown a political and personal disagreement with PPGR and with gender-affirming health care for minors. Although PPGR maintains it presented support for this claim to the trial court, PPGR merely provides us with a string of record citations with no elaboration. While the record citations are certainly relevant to the preservation of PPGR's argument, they are not themselves an argument. We cannot sift through the record to develop PPGR's argument by speculating how in the context of this case the cited but unmentioned examples prove animus towards PPGR, much less supply legal arguments connecting that animus to a finding of reversible error. For example, PPGR does not offer any particular legal framework for determining whether a CID is merely

22

pretextual, such as analogizing to the standard used in malicious prosecution claims. While we have exercised our discretion to review PPGR's points relied on, we cannot "assum[e] the role of [its] advocate by sifting through the legal record, reconstructing the statement of facts, and crafting a legal argument on [its] behalf." Burgan v. Newman, 618 S.W.3d 712, 714–15 (Mo. App. E.D. 2021) (internal citations omitted). Because PPGR fails to develop this line of argumentation, we deem it abandoned. See In re S.H.P., 638 S.W.3d at 533. Point Two is denied. B. Point Four—The CID is not a malicious invasion of privacy In its fourth point, PPGR asserts that even if the CID is valid under the MMPA, the CID should not be enforced because its inquiry into gender-affirming health care for minors constitutes a malicious invasion of privacy that violates the U.S. Constitution. Because we are not persuaded that the AG's investigation pursuant to the MMPA is a malicious invasion of privacy, we deny the point. PPGR urges us to recognize a constitutional right to informational privacy, or a "zone of privacy," under which certain information is so "inherently private" that disclosure would be "a shocking degradation or an egregious humiliation . . . or a flagrant breach of a pledge of confidentiality which was instrumental in obtaining the personal information." Dillard v. O'Kelley, 961 F.3d 1048, 1054 (8th Cir. 2020) ( quoting Eagle v. Morgan, 88 F.3d 620, 625 (8th Cir. 1996)). Although not made explicit, we presume PPGR is asserting that gender-affirming health care, including hormonal treatments and surgical interventions, is so inherently private that it falls under this zone of privacy, such that even redacted medical records about the offerings and treatment provided by PPGR should not be disclosable to the AG through a CID issued to ensure compliance with state law.

23

Reviewing federal precedent, the Eighth Circuit declined to recognize a constitutional right to informational privacy as a certainty "beyond debate[.]" Id. (citing Nixon v. Adm'r of Gen. Services, 433 U.S. 425 (1977); Whalen v. Roe, 429 U.S. 589 (1977)) (additional citations omitted); see also Dobbs v. Jackson Women's Health Org., 597 U.S. 215, 273 (2022) (noting some precedent supporting a constitutional "right of personal privacy" conflated the right to shield information from disclosure with the right to make personal decisions without governmental interference). Further, courts in other jurisdictions have found no violation of personal privacy rights so long as the requested information is de-identified. See, e.g., Getting the Word Out, Inc. v. New York State Olympic Reg'l Dev. Auth., 214 A.D.3d 1158, 1162–63 (N.Y. App. Div. 2023) (noting disclosure under New York's Freedom of Information Law (FOIL), which has analogous requirements to HIPAA, is not an unwarranted invasion of personal privacy when identifying details are deleted). Nevertheless, PPGR argues that this constitutional right to informational privacy precludes the AG from obtaining PPGR's confidential patient records and information without a legitimate purpose. First, PPGR fails to develop this argument in sufficient detail to meet the standard for appellate briefing. See Rule 84.04(e); In re S.H.P., 638 S.W.3d at 533. Rather than identifying specific CID requests and explaining how they demonstrate the alleged constitutional violation, PPGR generalizes both the law and facts, impairing our ability to review its argument. PPGR informs this Court that it "presented information to the trial court that there is both a strong privacy interest in the medical records and information requested, and a malicious invasion of privacy." While this statement is relevant to the preservation of its argument, it is not itself an argument.

24

Even assuming arguendo there is a right to informational privacy at play here, we find the following phrase in PPGR's argument dispositive: without a legitimate purpose. The spirit of PPGR's argument as we understand it—that there should be a legitimate purpose to the AG's inquiry—is already a fixed principle in Missouri law. As discussed above, both the statutory requirements of § 407.040 and the three-prong reasonableness test in Charter Communications protect individuals' constitutional rights. See Charter Commc'ns, 461 S.W.3d at 859 (internal citations omitted). In particular, by requiring the CID to comply with the statute authorizing it and to seek only that information that is relevant to the investigation, and to not include demands that are too indefinite or too broad, the Charter Communications test ensures the AG issues a CID for a legitimate purpose—to protect Missouri consumers from possible unfair practices that violate the MMPA. See id. PPGR suggests we should weigh the AG's public interest in protecting Missouri consumers against PPGR and its patients' interests in avoiding intrusions on privacy, and that we should find the law favors non-disclosure. However, precedent regarding the paternalistic purpose of the MMPA demonstrates a compelling government interest. See Heinz, 603 S.W.3d at 895 (quoting Berry, 397 S.W.3d at 433) ("The MMPA is paternalistic legislation designed to protect those that could not otherwise protect themselves."); see also Nw. Mem'l Hosp. v. Ashcroft, 362 F.3d 923, 935 (7th Cir. 2004) (Manion, J., concurring in part and dissenting in part) (observing that nothing supports finding a privacy interest exists in redacted medical records, thus courts should not attempt to weigh the potential loss of privacy against the records' probative value to the government entity issuing the investigative CID). Because Missouri courts have held that a CID is constitutional if it satisfies the three-part reasonableness test, which includes being properly bounded by the statute under which the CID is issued, we are not

25

convinced the CID is unconstitutional on the grounds alleged here. See Charter Commc'ns, 461 S.W.3d at 859 (internal citations omitted). Point Four is denied. C. Point Five—The CID does not violate the constitutional separation of powers PPGR's Point Five contends the CID runs afoul of the Missouri Constitution by violating the separation of powers in that it overextends the AG's executive power beyond MMPA enforcement. "The separation of powers is a fundamental principle embedded in the Missouri Constitution." Rebman v. Parson, 576 S.W.3d 605, 608 (Mo. banc 2019). The powers of government shall be divided into three distinct departments—the legislative, executive and judicial—each of which shall be confided to a separate magistracy, and no person, or collection of persons, charged with the exercise of powers properly belonging to one of those departments, shall exercise any power properly belonging to either of the others, except in the instances in this constitution expressly directed or permitted.

M O. CONST. art. II, § 1. Generally, the legislative branch makes the law, the executive branch enforces the law, and the judicial branch says what the law is. Rebman, 576 S.W.3d at 609 (quoting Marbury v. Madison, 5 U.S. 137, 177 (1803)). "The purpose of the doctrine of separation of powers . . . is to prevent the abuses that can flow from the centralization of power." Id. (internal quotation omitted). PPGR asserts the legislature has spoken on the legality of the issues in the SAFE Act, thus the CID reflects an arbitrary overreach by the AG in an effort to criminalize legal behavior. However, both the SAFE Act and the MMPA are civil laws—not criminal laws. Moreover, PPGR does not identify any provision in the SAFE Act—PPGR does not even cite or quote from the SAFE Act in this argument section, which is deficient under Rule 84.04(e)—containing language that transforms unlawful conduct under the MMPA into lawful conduct. See §§ 191.1720, RSMo (Cum. Supp. 2023), 407.020, .040. The SAFE Act, sunsetting in 2027, and

26

with certain caveats for services to which the following does not apply, makes it civilly unlawful for a health care provider to "knowingly perform a gender transition surgery on any individual under eighteen years of age" or to "knowingly prescribe or administer cross-sex hormones or puberty-blocking drugs for the purpose of a gender transition for any individual under eighteen years of age." § 191.1720.3–4, .8, RSMo (Cum. Supp. 2023). Critically, as discussed above, the AG may validly use a CID to investigate whether the Center, PPGR, and others in the state have conducted the business of providing and billing for gender-affirming medical care to minors using deception, fraud, false promises, misrepresentation, or unfair practices prohibited by the MMPA. Nothing in the SAFE Act undermines the AG's authority to enforce the MMPA and issue CIDs, which are a valid exercise of the AG's powers consistent with the separation-of- powers provision. See M O. CONST. art. II, § 1. We deny Point Five. III. PPGR's Cross-Appeal Point Three—The trial court did not err by not ruling on PPGR's objections In its third point, PPGR argues the trial court erred in entering judgment on the pleadings because it failed to properly apply § 407.070 in that it did not rule on each objection attached to PPGR's petition to set aside the CID, which alternatively sought to modify the CID consistent with those objections. The AG opposes review of this point on its merits because the argument fails to include any citations to authority aside from § 407.070, making it deficient under Rule 84.04(e). "[A]n appellant is obligated to cite appropriate and available precedent if he expects to prevail, and, if no authority is available to cite, he should explain the reason for the absence of citations." Pearson v. Keystone Temp. Assignment Grp., Inc., 588 S.W.3d 546, 551–52 (Mo. App. E.D. 2019) (citing Thummel v. King, 570 S.W.2d 679, 687 (Mo. banc 1978)). In addition to the lack of citations to legal authority, PPGR's single-paragraph argument is not developed with any clear

27

explanation of "how the relevant principles of law and the facts of the case interact." Id. (internal citations omitted). On one hand, PPGR alleges the trial court erred in failing to rule on all its objections, as stated in the point relied on and, on the other hand, PPGR alleges the AG waived any response to PPGR's objections by not responding to them before or during briefing on cross-motions for judgment on the pleadings. To the extent that we exercise our discretion to review the point ex gratia, and to the extent we construe it as a challenge to the trial court's failure to make certain findings on PPGR's objections under § 407.070, we must find the point unpreserved. In non-jury cases, like this one, Rule 78.07(c) requires that "allegations of error relating to the form or language of the judgment, including the failure to make statutorily required findings, must be raised in a motion to amend the judgment in order to be preserved for appellate review." "The party appealing must object at the trial level to the failure to make a finding so the circuit court has an opportunity to correct the error." Prosecuting Att'y, 21st Judicial Circuit, ex rel. Williams v. State, 696 S.W.3d 853, 863–64 (Mo. banc 2024) (internal quotation omitted). Because PPGR did not make a Rule 78.07(c) motion bringing the judgment's failure to rule on the objections to the trial court's attention, it would not be appropriate to criticize the trial court for failing to do so. See id. In any event, we would find no error. "[T]he prescribed and preferable method for recipients of CIDs to lodge objections to CIDs is to follow the statutory scheme outlined by [§] 407.070." Charter Commc'ns, 461 S.W.3d at 859 n.5. "Once a CID is served, the recipient has until the return date specified in the CID, up to twenty days, to file a petition to modify or set aside the CID." Id. at 858 (citing § 407.070). "In such a petition, the recipient may state its objections to the CID, and why it believes that the CID is unreasonable." Id. Section 407.070

28

thus directs a petitioner challenging a CID to make objections but does not specifically direct the trial court to rule on them when entering judgment on the pleadings as sought by PPGR here. See id. PPGR presumes § 407.070 imposes such a requirement on the trial court but does not support that presumption with argument or authority, and we decline to do so sua sponte. In its reply brief, PPGR suggests § 407.070's language clearly authorizes a trial court to modify a CID but acknowledges there is no established precedent as to how a trial court should respond to specific objections. In its list of objections filed with its § 407.070 petition, PPGR objected to the CID overall, to the CID's instructions and definitions, and to every specific request therein on various general grounds, including assertions of statutory privileges and HIPAA confidentiality. Following the AG's answer and counterclaim to enforce the CID as written, the parties filed cross-motions for judgment on the pleadings. The parties told the trial court that no facts were in dispute and that judgment should be granted as a matter of law. In their respective briefings, the parties litigated, in broad strokes, the general issues concerning the AG's authority to issue the CID under the MMPA. Except for PPGR's argument that enforcing the CID would force PPGR to violate HIPAA, which the trial court granted and which will be discussed in the following section, neither party briefed PPGR's objections in detail. One obvious reason for this is that many of PPGR's objections were disfavored "blanket objections" and/or based on privileges that required a privilege log to fully ascertain the nature of the objection. See State ex rel. Ford Motor Co. v. Westbrooke, 151 S.W.3d 364, 367 (Mo. banc 2004) ( internal quotation omitted) (noting the party challenging privilege must have "sufficient information to assess whether the claimed privilege is applicable"). A party is entitled to a privilege log if requested, and relief is premised on producing such a log. State ex rel. Hayes v.

29

Dierker, 535 S.W.3d 372, 374 (Mo. App. E.D. 2017) (citing Westerbrooke, 151 S.W.3d at 367 n.5)). A privilege log helps the opposing party—and the trial court—determine whether the claimed privilege applies. Westerbrooke, 151 S.W.3d at 367–68 (internal citation omitted). "The privilege log may identify documents individually or by categories if that provides sufficient clarity for the court to rule on the asserted privilege claim." State ex rel. Kilroy Was Here, LLC v. Moriarty, 633 S.W.3d 406, 415 (Mo. App. E.D. 2021) (quoting Westbrooke, 151 S.W.3d at 367–68). In fact, the CID instructs PPGR to make a privilege log. 14 In this way, the CID explicitly respects the statutory limits on disclosure but, as Missouri rules permit, 15 seeks sufficient information to be assured the claimed privilege applies. See § 407.040.3(2) (providing a CID may not require disclosure of privileged documentary material). PPGR did not produce a privilege log, which would have aided the trial court in ruling on PPGR's request to consider its objections. See Kilroy, 633 S.W.3d at 415 (quoting Westbrooke, 151 S.W.3d at 367–68). Therefore, the trial court's alleged failure to rule on all the objections would be self-invited error. See Wilson v. P.B. Patel, M.D., P.C., 517 S.W.3d 520, 525 (Mo. banc 2017) (internal quotation omitted) ("It is axiomatic that a defendant may not take advantage of self-invited error or error of his own making."). Point Three is denied.

14 CID Instruction No. 9 states: "If You believe that You have responsive materials that are privileged, You must produce a privilege log that identifies each Document or communication, the basis for withholding it, and sufficient information to permit the Attorney General's Office to assess whether it is privileged." 15 Although PPGR does not cite any discovery rules in Point Three, elsewhere in its briefing PPGR correctly notes that a CID may not contain any requirement, nor request any documentary material, that would be unreasonable or improper if contained in a subpoena duces tecum. § 407.040.3(1)–(2). The permissible scope of a production request contained in a subpoena duces tecum is governed by the general discovery provisions of Rules 56.01 and 58.01. Therefore, we would find the general discovery rules to be incorporated by reference when litigating a claim filed by a CID recipient under § 407.070 or by the AG seeking enforcement under § 407.090. Notably, Rule 58.01, concerning the production of documents, requires an objecting party state the reason for the objection and, if privilege is asserted, state enough information to permit others to assess the applicability of the claimed privilege.

30

IV. AG's Points One through Five—The trial court erred as a matter of law in modifying the CID with respect to HIPAA

The AG challenges the portion of the trial court's judgment ordering PPGR not to produce HIPAA-protected documents responsive to the CID. The trial court found that the only HIPAA-compliant way for PPGR to disclose patient medical records is for each patient to directly waive their HIPAA rights. We hold the trial court erred as a matter of law in declaring that HIPAA recognizes patient waiver as the only authorized means of disclosure of medical records responsive to the AG's CID. Consequently, the trial erred in prohibiting disclosure of all purportedly HIPAA-protected documents. Preliminarily, the AG's Point One contends the trial court's ruling about HIPAA was premature because the parties had not fully litigated the HIPAA issue—which the AG blames on PPGR for failing to produce a privilege log and for failing to defend its HIPAA-claim as a so- called affirmative defense. As noted above in our discussion of PPGR's Point Three, we generally agree that the record does not sufficiently develop either the specifics of PPGR's claimed HIPAA confidentiality nor the details of the HIPAA regulations themselves. For example, PPGR does not directly address whether the requested documents even implicate protected health information (PHI) under HIPAA. In relevant part, the HIPAA Privacy Rule defines PHI as "individually identifiable health information" that is "created or received by a health care provider" that "[r]elates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual." 45 C.F.R. § 160.103. "Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information." 45 C.F.R. § 164.514

31

(emphasis added). Although HIPAA prohibits wrongful disclosure of PHI, de-identified health information is not protected under the act. See 45 C.F.R. §§ 160.103, 164.502, .508, .514; In re Zyprexa Prods. Liab. Litig., 254 F.R.D. 50, 54 (E.D.N.Y. 2008) ("[D]e-identified health information is not protected under HIPAA[.] "). Notwithstanding valid exceptions to patient waiver that permit disclosure of unredacted PHI under 45 C.F.R. § 164.512, de-identified health information is a recognized safe harbor for disclosure. See, e.g., Nw. Mem'l Hosp., 362 F.3d at 926 (declining to quash a Department of Justice (DOJ) subpoena seeking late-term abortion records on HIPAA grounds—but quashing on other grounds—in part because "medical records [that] are redacted in accordance with the redaction requirements (themselves quite stringent) of § 164.514(a) . . . would not contain 'individually identifiable health information'"); Sun-Times v. Cook Cnty. Health & Hosps. Sys., 215 N.E.3d 963, 970–72 (Ill. 2022) (finding HIPAA did not prevent a hospital system from using PHI to fulfill a Freedom of Information Act (FOIA) request where individually identifiable health information was properly de-identified); In re Nat'l Hockey League Players' Concussion Injury Litig., 120 F. Supp. 3d 942, 959 (D. Minn. 2015) (finding HIPAA did not prevent the production of hockey players' medical information where the information could be "adequately anonymized and protected"). Here, the pleadings show that the AG is seeking only redacted, de-identified medical records—when it is seeking such records at all, as many of the CID requests concern PPGR's policies that only indirectly involve medical records in creating responsive materials. See Sun- Times, 215 N.E.3d at 972 (citing 45 C.F.R. 164.502(d)(1) (noting HIPAA permits a covered entity to use PHI to "create information" that is not individually identifiable and thus disclosable)). Therefore, because properly redacted records do not require PPGR to violate

32

HIPAA, the trial court erred as a matter of law in finding HIPAA precluded disclosure absent patient waiver. See 45 C.F.R. §§ 160.103, 164.514. PPGR counters that it would be impossible to remove everything in a patient's medical record that would be considered privileged or would possibly identify the patient. As previously discussed, a blanket objection on privilege grounds is ineffective absent a privilege log. See Dierker, 535 S.W.3d at 373–74 (citing Westerbrooke, 151 S.W.3d at 367 n.5). HIPAA confidentiality is not technically a privilege. United States v. Bek, 493 F.3d 790, 802 (7th Cir. 2007) (quoting Nw. Mem'l Hosp., 362 F.3d at 926) ("We do not think HIPAA is rightly understood as an Act of Congress that creates a privilege."). HIPAA confidentiality is also not an affirmative defense. See Giudicy v. Mercy Hosps. E. Cmtys., 645 S.W.3d 492, 500 (Mo. banc 2022) (internal quotation omitted) (defining an affirmative defense as "a procedural tool 'that allows the defendant to defeat or avoid the plaintiff's cause of action and avers that even if the allegations of the petition are taken as true, the plaintiff cannot prevail because there are additional facts that permit the defendant to avoid the legal responsibility alleged'"). Crucially, a blanket HIPAA-based objection does not make the CID unenforceable, as the burden is on PPGR as the covered entity to comply with HIPAA when responding to subpoenas. See 45 C.F.R. §164.502(a), .508, .512; Nw. Mem'l Hosp., 362 F.3d at 925–26; Jackson v. Jamaica Hosp. Med. Ctr., 61 A.D.3d 1166, 1168–69 (N.Y. App. Div. 2009) ( finding the defendant-hospital bore the burden of proving that the requested material involved PHI and was protected under HIPAA or state privilege laws). To comply with HIPAA, as a general rule, a covered entity may not use or disclose PHI without an authorization that is valid "except as otherwise permitted or required[.]" 45 C.F.R. § 164.508(a)(1). Section 164.512 then sets forth permissible and required uses and disclosures for

33

which patient waiver is not needed, including those exceptions the AG maintains are applicable here, such as for health oversight activities, law enforcement, and judicial and administrative proceedings. See 45 C.F.R. § 164.512(d) –( f). Regarding disclosure in judicial and administrative proceedings, "[a]ll that 45 C.F.R. § 164.512(e) should be understood to do . . . is to create a procedure for obtaining authority to use medical records in litigation." Nw. Mem'l Hosp., 362 F.3d at 925–26 (distinguishing HIPAA from state privilege objections). "The purely procedural character of the HIPAA standard for disclosure of medical information in judicial or administrative proceedings is indicated by the procedure for disclosure in response to a subpoena or other process[.]" Id. That procedure may be patient waiver or, alternatively, an exception may apply. We need not examine the AG's suggested exceptions, which were not litigated in the trial court, because PPGR has not shown either that the AG is seeking PHI or that PPGR cannot fulfill the CID while complying with HIPAA and related state privilege laws, including preparing a privilege log and making appropriate redactions. Furthermore, § 407.060 imposes a confidentiality requirement on the AG for any information obtained pursuant to a CID, which safeguards the rights of individuals under investigation. See Lewandowski, 547 S.W.2d at 473 (finding the appellants' claim that they should not be compelled to disclose trade secrets in response to a CID was premature because § 407.060.2 prohibits the AG from revealing any material containing trade secrets without court approval); cf. Illinois v. Abbott & Assocs., Inc., 460 U.S. 557, 571 (1983) (noting the U.S. AG's broad antitrust investigative powers are subject to stringent confidentiality requirements on materials obtained through a CID). In summary, HIPAA does not require setting aside or modifying the CID, nor does HIPAA preclude PPGR from disclosing de-identified information. We therefore grant the AG's appeal and reverse the part of the trial court's judgment granting in part PPGR's motion for

34

judgment on the pleadings with respect to HIPAA. We direct the trial court on remand to order PPGR to fulfill the CID as written while complying with state and federal laws. Conclusion The judgment of the trial court is affirmed in part and reversed in part. We remand the cause to the trial court for further proceedings consistent with this opinion.

Rebeca Navarro-McKelvey, J.

Lisa P. Page, P.J. and Virginia W. Lay, J., concur.