The Washington University, Respondent, v. Attorney General of the State of Missouri, Appellant.

THE WASHINGTON UNIVERSITY,

Respondent,

v.

ATTORNEY GENERAL OF THE STATE OF MISSOURI,

Appellant.

) ) ) ) ) ) ) ) ) ) ) No. ED113034

Appeal from the Circuit Court of the City of St. Louis Cause No. 2322-CC09640

Honorable Joseph P. Whyte

Introduction This appeal involves a complex discovery dispute between the Attorney General of the State of Missouri ("Attorney General"), 1 and the Washington University Pediatric Transgender Center at St. Louis Children's Hospital ("the Center"). 2 The Attorney General launched an investigation under the authority of the Missouri Merchandising Practices Act ("MMPA"), section 407.010 et seq. 3 into the Center after a whistleblower issued a sworn affidavit detailing allegations

1 Andrew Bailey originally brought this appeal in his official capacity as Attorney General. Bailey ceased holding this office on September 8, 2025. Catherine L. Hanaway was appointed to fill this vacancy. Hanaway has recused herself in this appeal. See Rule 52.13(d) (directing when "a public officer is a party to an action in an official capacity and during its pendency ... ceases to hold office, the action does not abate and the successor is automatically substituted as a party." Further, "[w]hen a public officer sues or is sued in an official capacity, the officer may be described as a party by official title rather than by name...."); Conservation Comm'n v. Bailey, 669 S.W.3d 61, 66 n.7 (Mo. banc 2023) (finding Rule 52.13(d) provides for automatic substitution of parties under these circumstances). 2 This opinion addresses only the Attorney General's administrative subpoena power to compel production of unredacted medical records under the MMPA during a pre-claim investigation. This Court expresses no opinion about the underlying merits of the Attorney General's investigation against the Center's alleged practices because he has not filed any formal charge or claim against it alleging any wrongdoing. 3 All statutory references are to RSMo 2016 unless otherwise indicated.

2 involving pediatric transgender care the Center provided. The Attorney General issued three civil investigative demands ("CIDs") to the Center seeking 135 responses to requests for documents and information and to depose two Center healthcare providers. The Center moved to modify the CIDs to the extent they sought protected health information ("PHI") as defined under the Health Information Portability and Accountability Act of 1996 ("HIPAA") Privacy Rule, 45 C.F.R. Parts 160 and 164. The Attorney General concurrently moved to enforce the CIDs as issued. The circuit court entered judgment on the pleadings in the Center's favor and modified the CIDs to prevent disclosure of any medical records and PHI. The Attorney General appeals, raising seven points. In Point I, the Attorney General argues the circuit court erred in finding the PHI was irrelevant to the MMPA investigation because he asserts it falls squarely within the MMPA's scope. He contends the PHI contains evidence of billing fraud and unlawful coercion relevant to whether the Center engaged in deception, coercion, or fraud when urging parents and insurance providers to purchase irreversible gender transition services. In Point II, the Attorney General contends the circuit court erred in precluding the Center from producing PHI on privilege grounds because the Center waived this argument by not raising it below, and the circuit court could not raise this affirmative defense sua sponte for the Center. In Points III through VII, the Attorney General asks this Court to resolve whether HIPAA is an affirmative defense, who has the burden of proving HIPAA applies, and whether four HIPAA provisions compel disclosure of the Center's medical records and PHI without redaction. This Court holds the circuit court erred in sustaining the Center's motion to modify the CIDs to preclude disclosure of its patients' medical records and PHI because, in a pre-claim investigation, the Attorney General's broad investigative power permits him to request discovery into medical-related services which may involve coercive, fraudulent, and/or unlawful practices

3 under the MMPA. Point I is granted. The circuit court erred in ruling on privilege because the Center did not raise it below. Point II is granted. Because the CIDs clearly stated the Attorney General's intent to investigate the Center for alleged unlawful practices under the MMPA and not Chapter 191, HIPAA's "health oversight agency" provision permitting disclosure cannot be satisfied on remand as a matter of law under the facts presented. Point V is denied. Because the CIDs are not independently enforceable orders, HIPAA's "administrative tribunal" provision permitting disclosure cannot be satisfied on remand as a matter of law under the facts presented. Point VI is denied. Because the circuit court has not entered a court order determining which PHI will be expressly authorized for disclosure while considering viable HIPAA provisions, Point IV is denied in part and granted in part. Because the circuit court misapplied the first two prongs of HIPAA's "law enforcement purposes" provision but has not determined the merits of whether de- identified information could not reasonably be used, Point VII is granted in part. Finally, although the Center generally bears the burden of complying with HIPAA, the Attorney General bears the burden on remand of demonstrating de-identified information could not reasonably be used to authorize disclosure under HIPAA's "law enforcement purposes" provision. Point III is denied. The circuit court's judgment is reversed, and the case is remanded for further proceedings consistent with this opinion. Factual and Procedural History In 2017, Washington University opened the Center to provide medical care for transgender youth. In 2023, a Center whistleblower issued an 86-paragraph sworn affidavit alleging the Center engaged in misconduct, prompting the Attorney General to launch an investigation. The Attorney General issued three CIDs to the Center and its employees, explaining he believed the Center had

4 "engaged in or [is] engaging in any practices declared to be unlawful [under the MMPA]." 4 The CIDs state, "The Attorney General has reason to believe that [the Center] may have used deception, fraud, false promises, misrepresentation, unfair practices, and/or the concealment, suppression, or omission of material facts within the scope of the [MMPA]." The Attorney General stated the investigation was "based in part on, but is not limited to, allegations made in the sworn affidavit by [the whistleblower]." The first CID, issued in February 2023, provided instructions on how to respond, including Instruction No. 9, which stated if the Center believed it had responsive materials which were privileged, the Center had to produce a privilege log identifying the material, the basis for withholding it, and sufficient information to permit the Attorney General to assess whether it is privileged. The CID contained defined terms, including, "Client" to mean "all customers to whom [the Center] ha[s] provided or [is] providing [its] services, Clients' Parents, or Clients' legal guardians." The CID then listed 135 individual requests for information and documents. These requests sought information about the Center's policies, procedures, guidelines, publications, studies relied upon and participated in, annual reports, solicitation and promotional materials, organizational charts, personnel materials such as personnel files, resumes, and curricula vitae, and requests for information related to 50 specific whistleblower allegations. There were also numerous requests for individual patient medical records and PHI. For illustrative purposes, some requests included:

1. Identify all Clients to whom You have provided Your Services .... For each

Client, describe Your Services, the dates You provided Your services, the amounts

4 Section 407.040.1 empowers the Attorney General to issue and serve CIDs "upon any person who is believed to have information, documentary material, or physical evidence relevant to the alleged or suspected violation" or a person who has engaged in "any method, act, use, practice or solicitation declared to be unlawful by [the MMPA]" or it is in the "public interest that an investigation should be made to ascertain whether a person in fact has engaged in or is engaging in any such method, act, use, practice or solicitation ...."

5 Clients, their insurers, or other third-party payors paid for these Services, and any contracts related to these Services.

1. Produce access to all electronic health records of Clients.

1. List all mental-health diagnoses that were active in the record of each Client at

the time when You prescribed the Client puberty blockers, cross-sex hormones, or other hormonal or surgical intervention.

1. For all Clients to whom You prescribed puberty blockers, cross-sex hormones,

or other hormonal or surgical intervention, produce all documents related to parental consent for these Clients.

1. For all Clients to whom You prescribed puberty blockers, cross-sex hormones,

or other hormonal or surgical intervention, produce all documents related to your disclosure of risk to these Clients.

The second and third CIDs, issued in November 2023, compelled a Center nurse and physician to appear for depositions to testify about the information, documentary material, and/or physical evidence relevant to the investigation including individual patients and PHI. The Center and the Attorney General initially worked cooperatively to negotiate the Center's responses to the first CID. In its initial response, the Center catalogued its "general qualifications and objections" to the CID, including: The CID appears to seek information pertaining to both representations to the public regarding [the Center's] services and the propriety of actual medical care delivered to patients. While representations to the public regarding services may be within the scope of the MMPA, requests directed to issues such as whether the care delivered by [the Center] met professional medical standards, including with regard to a specific patient's care, are outside the proper scope of the MMPA.

The Center further claimed the CID was overly broad and unduly burdensome to the extent the Attorney General sought "all" documents, records, or information. The Center also asserted, "The patient records (and e-mails or other documents related to patients) contain highly sensitive, private health and personal information. Any PHI ... produced is protected by HIPAA." The Center nevertheless agreed to provide the Attorney General with remote, read-only access to its

6 electronic medical records system, EPIC, to further comply with the CID. The Center provided voluminous responses to this CID with many individual responses directing the Attorney General to find additional information in the electronic medical records. A week later, the Center provided its first supplemental response, which incorporated by reference its "general qualifications and objections" from its initial response. In response to request No. 31, the Center provided the Attorney General with a detailed spreadsheet containing the following data for all 1,165 patients: • [Center] Clinic Pt List: This tab provides the patient list (1,165) for all patients who had an encounter with [the Center] sufficient to create an EPIC medical record for the patient, including those who attended a visit with a provider. The list provides demographic information for these patients, including Patient ID, Medical Record Number, date of birth, age at first [Center] encounter, first [Center] encounter date, last [Center] encounter date (including future events if already scheduled), total [Center] encounters, and total completed [Center] appointments.

• [Center] Encounter Data: This tab includes data for all encounters recorded in EPIC for transgender care for the 1,165 patients. It includes the date of the encounter and a description of the encounter (including patient name, date, type of encounter, and visit type). Accordingly, it describes the service provided on each date, although the medical records will have more detail.

• All [Center] Meds by Patient: This tab includes the date of every [Center] prescription for a [Center] patient, including the patient's name and drug prescribed. This tab thus describes services if they included a prescription order by the provider.

• Charge Data for Encounter: This tab includes the [Center] charge for [Center] encounters described above. (Note that not all encounters result in a [Center] charge, so this tab includes fewer rows than the Encounter data.) The data includes the date of the charge, the patient's name, the provider, the payor, the procedure code, the procedure name, diagnosis codes, the amount charged, and the amount paid.

In addition, the tabs provide information that permit cross reference, including dates, patient identifiers, and encounter numbers. More detail about the specific services provided can be found in the medical records.

7 The Center also directed the Attorney General to find more specific information in the electronic medical records in response to several other supplemental requests. On April 7, 2023, the Center provided a second supplemental response via email through a password-protected link. The Attorney General did not "contemporaneously access[]" the link and notified the Center the link no longer worked on August 7, 2023. The Center sent a letter explaining it was obligated to ensure it provided tailored—and perhaps redacted—information to protect its patients' privacy rights. The Center requested a meeting to discuss tailoring the CID's requests to the MMPA's stated purposes while taking steps to ensure patient privacy was consistent with HIPAA's minimum standards. The Attorney General declined this request and demanded all documents be produced unredacted with their metadata. The Center indicated it would produce the materials after redacting PHI, which occurred in September 2023. Some materials the Center provided were heavily redacted. The parties continued to dispute whether: (1) the Attorney General's requests for PHI were within the MMPA's scope; (2) the Center was obligated to provide remote, read-only access to its electronic medical records; (3) HIPAA applied and to what extent; and (4) redacted documents fulfilled the CID. The Center produced a privilege log, but the parties could not resolve their disputes. Having reached an impasse, the Center moved to modify the CIDs. 5 The Center requested guidance about whether the requests, including "patient medical records and information concerning the medical standard of care; individualized medical assessments and treatment decisions; patient records related to deliberations between patients, their parents and doctors about the appropriate course of care; and mental health assessments" fell within the MMPA's scope and the Attorney General's authority to investigate. The Center further alleged because HIPAA

5 Section 407.070 permits a party subject to a CID to file "a petition ... to modify or set aside the [CID], stating good cause ..." in the circuit court.

8 governed this information's disclosure, it required guidance on its obligation under HIPAA when complying with the CIDs. The Center alleged the Attorney General bore the burden of demonstrating HIPAA permitted PHI disclosure. The Center further alleged it was disputed whether two HIPAA provisions—the "health oversight agency" and "law enforcement purposes"—permitted disclosure. Accordingly, the Center moved to modify the CIDs to exclude any requests outside the MMPA's scope or prohibited or narrowed by HIPAA. The Center did not assert any privilege applied to prevent disclosure. The Attorney General filed an answer and counterclaim requesting the CIDs be enforced as written. 6 The Attorney General contended the investigation concerned "whether [the Center] used unfair or deceptive practices 'in connection with the sale or advertisement' of these interventions." The Attorney General denied "the MMPA forbids investigating medical malpractice issues" and believed the medical malpractice exemption did not divest him of investigative authority. 7 Regarding the Center's HIPAA assertions, the Attorney General noted the MMPA included robust privacy protections prohibiting him from disclosing any documents except in limited circumstances, and he was committed to maintaining the confidentiality requirements imposed by law. 8 The Attorney General generally contended HIPAA regulations did not prohibit the Center from producing the PHI the CIDs requested. The Attorney General did not respond to or address the applicability of any specific HIPAA provision permitting disclosure.

6 Section 407.090 permits the Attorney General to file a petition to require CIDs be enforced "[w]henever any person fails to comply with any [CID] duly served ...." 7 The medical malpractice exemption was added to the MMPA in 2020. See section 407.025.3, RSMo Cum. Supp. 2020 ("No action may be brought under this section to recover damages for personal injury or death in which a claim can be made [for medical malpractice] under chapter 538."). The parties do not address this amendment on appeal. 8 Section 407.060.1 prohibits the production or disclosure of any "information, documentary material, or physical evidence requested pursuant to a [CID] issued under section 407.040" to any person other than an authorized Attorney General employee "unless otherwise ordered by a court for good cause shown[.]"

9 The parties both moved for judgment on the pleadings. After extensive briefing, a hearing, and submission of proposed judgments, the circuit court issued judgment on the pleadings in the Center's favor for three reasons. First, the circuit court found the CIDs' request for unredacted medical records were outside the MMPA's scope. Second, the circuit court found the PHI sought was privileged because section 407.040.3(2) specified the CID could not "[r]equire the disclosure of any documentary material which would be privileged or which, for any other reason, could not be required by a subpoena duces tecum issued by a court of this state." Third, the circuit court determined the non-consenting patients' medical records were not required for the Attorney General to carry out his duties under the MMPA, and the requests were not limited in accordance with HIPAA regulations. The Attorney General moved to amend the judgment seeking clarification or alteration regarding the circuit court's privilege finding, arguing the Center did not assert privilege and HIPAA did "not amount to a 'privilege' under the MMPA." The circuit court overruled the Attorney General's motion without further explanation. This appeal follows. Appellate Jurisdiction This Court initially must determine whether it has jurisdiction over this appeal. After the Attorney General filed his notice of appeal, this Court issued an order directing the parties to file memoranda and address in their jurisdictional statements section 407.090's applicability. Section 407.090 states any final order adjudicating the Attorney General's petition to enforce a CID "shall be subject to appeal to the state supreme court." Both parties assert this Court has jurisdiction despite this statutory language. This Court agrees. In State ex rel. Ashcroft v. Goldberg, 608 S.W.2d 385, 387 (Mo. banc 1980), the Supreme Court of Missouri recognized this statutory provision was "enacted in 1967 at a time when s[ection] 3 of Article V placed jurisdiction in this Court of 'all civil cases where the state ... is a

10 party' or 'any state officer as such is a party.'" Goldberg determined "the appellate procedure designated therein has by constitutional change become obsolete" and held the outdated provision did not render the statute unconstitutional. Id. Although section 407.090 has not been amended to remove this language, this Court is bound by Goldberg's determination this statutory language is obsolete. Accordingly, this Court holds it has general jurisdiction over this appeal because none of the Attorney General's claims invoke the Supreme Court of Missouri's exclusive appellate jurisdiction under Missouri Constitution article V, section 3. See also Planned Parenthood of the St. Louis Region & Sw. Mo. v. Bailey, 715 S.W.3d 167, 185 n.10 (Mo. App. E.D. 2025) ("Planned Parenthood St. Louis") (likewise holding this Court had jurisdiction over a related CID dispute). Standard of Review "Judgment on the pleadings is appropriate where the question before the court is strictly one of law." Eaton v. Mallinckrodt, Inc., 224 S.W.3d 596, 599 (Mo. banc 2007). "This Court reviews a circuit court's ruling on a motion for judgment on the pleadings de novo." City of St. Louis v. State, 682 S.W.3d 387, 396 (Mo. banc 2024). "In reviewing the grant of a motion for judgment on the pleadings, this Court must decide whether the moving party is entitled to judgment as a matter of law on the face of the pleadings." Id. (quoting Emerson Elec. Co. v. Marsh & McLennan Cos., 362 S.W.3d 7, 12 (Mo. banc 2012)). Here, the Center and the Attorney General are both a movant and a non-movant on cross-motions for judgment on the pleadings. When "both parties file dueling motions for judgment on the pleadings, 'each party thereby admit[s] the facts well pleaded in the pleadings of the other' for purposes of the motions." Planned Parenthood Great Plains v. State ex rel. Bailey, 713 S.W.3d 213, 226 (Mo. App. W.D. 2025) ("Planned Parenthood Great Plains") (quoting Kerkemeyer v. Midkiff, 299 S.W.2d 409, 410 (Mo. banc 1957)). "However, this Court will not blindly accept the legal conclusions drawn by the pleaders from the facts." State ex rel. Love v. Cunningham, 689 S.W.3d 489, 494 (Mo. banc 2024) (quoting

11 City of St. Louis, 682 S.W.3d at 396). "Statutory interpretation in a motion for judgment on the pleadings is a matter of law [this Court] review[s] de novo." Planned Parenthood St. Louis, 715 S.W.3d at 177. MMPA Scope, Applicability, and Privilege Point I: MMPA's Scope Party Positions

In Point I, the Attorney General argues the circuit court erred in finding the medical records and other documents containing PHI were irrelevant to his investigation because he asserts the documents fall squarely within the MMPA's scope. The Attorney General contends the documents potentially contain evidence of billing fraud, unlawful coercion, and other unlawful practices relevant to whether the Center engaged in deception, unlawful pressure, or fraud when urging parents and insurance providers to purchase irreversible gender transition services, which possibly violate the MMPA. 9

The Center argues its patients' PHI is irrelevant to any issue within the MMPA's scope. The Center claims because the Attorney General's allegations supporting the CIDs principally challenge the Center's practice of medicine—as opposed to the medical providers' entrepreneurial conduct—they cannot be characterized as "trade or commerce" under the MMPA. Thus, the Center believes it need not disclose any medical records or PHI.

9 To the extent the Attorney General raises in his argument section separate legal claims concerning which party has the burden of proving a valid purpose and document relevancy and how section 191.910 alternatively would compel disclosure, these claims are not preserved for appeal. Rule 84.04(e) (2023) mandates, "The argument shall be limited to those errors included in the 'Points Relied On.'" "Issues that are raised only in the argument portion of the brief and are not contained in the point relied on are not preserved for appellate review." Abram v. TitleMax of Mo. Inc., 684 S.W.3d 74, 89 (Mo. App. E.D. 2023) (quoting Hawley v. Tseona, 453 S.W.3d 837, 842 n.6 (Mo. App. W.D. 2014)). This Court "will not afford even ex gratia review of an error raised in the argument section of an appellant's brief but not captured in an associated point relied on." Id. (quoting Wallace v. Byrne, 672 S.W.3d 96, 106 (Mo. App. E.D. 2023)).

12 The MMPA & the Attorney General's CID Authority "The MMPA, as first adopted by the legislature in 1967, protects consumers by expanding the common law definition of fraud 'to preserve fundamental honesty, fair play and right dealings in public transactions.'" Conway v. CitiMortgage Inc., 438 S.W.3d 410, 414 (Mo. banc 2014) (quoting State ex rel. Danforth v. Indep. Dodge, Inc., 494 S.W.2d 362, 368 (Mo. App. 1973)). The MMPA's "fundamental purpose is the 'protection of consumers,' and, to promote that purpose, the act prohibits false, fraudulent or deceptive merchandising practices." Huch v. Charter Commc'ns, Inc., 290 S.W.3d 721, 724 (Mo. banc 2009) (internal citation omitted). Section 407.020.1 states: The act, use or employment by any person of any deception, fraud, false pretense, false promise, misrepresentation, unfair practice or the concealment, suppression, or omission of any material fact in connection with the sale or advertisement of any merchandise in trade or commerce ... in or from the state of Missouri, is declared to be an unlawful practice.

"Sec[tion] 407.020 does not define deceptive practices; it simply declares unfair or deceptive practices unlawful. This was done to give broad scope to the meaning of the statute and to prevent evasion because of overly meticulous definitions." Huch, 290 S.W.3d at 724 (quoting State ex rel. Webster Areaco Inv. Co., 756 S.W.2d 633, 635 (Mo. App. E.D. 1988)). When construing the MMPA's plain and ordinary meaning, the Supreme Court of Missouri instructs courts to "consider the object the legislature seeks to accomplish with an eye towards finding resolution to the problems addressed therein." Ports Petroleum Co. Inc. of Ohio v. Nixon, 37 S.W.3d 237, 240 (Mo. banc 2001) (quoting Gott v. Dir. of Revenue, 5 S.W.3d 155, 159 (Mo. banc 1999)). When construing the MMPA's plain statutory language, the words "are unrestricted, all-encompassing and exceedingly broad. For better or worse, the literal words cover every practice imaginable and every unfairness to whatever degree." Id.

13 The Attorney General "is charged with investigating and prosecuting violations of Missouri's consumer protection laws, including the MMPA." Planned Parenthood St. Louis, 715 S.W.3d at 179. Section 407.040.1 authorizes the Attorney General "to investigate possible violations of the MMPA to promote the 'laudable purpose' of protecting Missouri consumers." Id. at 180 (emphasis added) (quoting Heinz v. Driven Auto Sales, LLC, 603 S.W.3d 890, 895 (Mo. App. E.D. 2020)); see also section 407.040.1 (authorizing the Attorney General to issue a CID "when he [or she] believes it to be in the public interest that an investigation should be made to ascertain whether a person in fact has engaged in or is engaging in any [unlawful practice...]"). "Missouri's CID proceeding 'is patterned after the parallel provisions' of the federal proceedings set forth in the Federal Antitrust Civil Process Act, 15 U.S.C. § 1312 ...." State ex rel. Koster v. Charter Commc'ns Inc., 461 S.W.3d 851, 856 (Mo. App. W.D. 2015) (quoting Goldberg, 608 S.W.2d at 388). CIDs are administrative subpoenas. Planned Parenthood Great Plains, 713 S.W.3d at 229; Planned Parenthood St. Louis, 715 S.W.3d at 186. "The purpose of the [CID] procedure is to provide a form of pretrial discovery" for the Attorney General's benefit. Independence Dodge, 494 S.W.2d at 366. CIDs provide the Attorney General "with another tool in his [or her] litigative kit, similar to the various discovery methods traditionally available after suit is filed." Id. While the Attorney General's investigatory powers are broad, "the legislature has not bestowed unbridled authority upon the Attorney General to pursue this mission at the expense of any individual's entitlement to procedural due process." Lewandowski v. Danforth, 547 S.W.2d 470, 472 (Mo. banc 1977). Thus, "[a] CID issued by the Attorney General must comport with the requirements of s[ection] 407.040 which requires reasonable notice of the conduct under investigation and specific notice of the documents to be produced." Id. at 473.

14 Analysis The Center does not challenge the CIDs' procedural form nor contend its procedural due process rights were violated. Nor could it because it used the remedy available under section 407.070 to challenge the Attorney General's CIDs. See Planned Parenthood St. Louis, 715 S.W.3d at 186 (recognizing "[a]s a type of administrative subpoena, a CID generally does not violate ... protection[s] against unreasonable searches where the CID recipient has an opportunity to seek 'pre-compliance judicial review'" under section 407.070). Instead, the Center challenges the CIDs on substantive grounds, arguing the Attorney General's requests have exceeded the MMPA's scope by seeking unredacted medical records and PHI which are not contemplated as "trade or commerce" under the MMPA, but rather, seek to investigate medical malpractice. The MMPA's scope to investigate these precise medical services-related claims was addressed and resolved in Planned Parenthood Great Plains and Planned Parenthood St. Louis, in which Planned Parenthood challenged the Attorney General's issuance of CIDs to its clinics related to the Center's investigation. 10 In Planned Parenthood Great Plains, the Western District explained, "The MMPA defines 'merchandise' to include 'any objects, wares, goods, commodities, intangibles, real estate or services'" as defined by section 407.010(4). Planned Parenthood Great Plains, 713 S.W.3d at 227 (emphasis in original). The Western District then recognized, "Medical goods and services meet the statutory definition of merchandise as defined by section 407.010(4)." Id. (quoting Freeman Health Sys. v. Wass, 124 S.W.3d 504, 507 (Mo. App. S.D. 2004)). In Planned Parenthood St. Louis, this Court also relied on Freeman to find the MMPA's broad language "covers medical goods and services." Planned Parenthood

10 In those cases, the CIDs issued to Planned Parenthood stated the Attorney General had reason to believe the Center "or others in the state providing similar services" may have engaged in unlawful practices under the MMPA based in part on the whistleblower's allegations regarding transgender care. Planned Parenthood Great Plains, 713 S.W.3d at 218; Planned Parenthood St. Louis, 715 S.W.3d at 176.

15 St. Louis, 715 S.W.3d at 181. Planned Parenthood St. Louis further explained, "Medical goods and services are put into trade or commerce when they are advertised, sold, offered for sale or distribution, or any combination thereof 'directly or indirectly affecting the people of this state.'" Id. (quoting section 407.010(7)). Both districts rejected Planned Parenthood's arguments that the Attorney General's pre- claim investigation targeted medical malpractice claims. In Planned Parenthood St. Louis, this Court explained, "[W]e must reject [Planned Parenthood's] argument that any overlap with medical malpractice necessarily places a business's practices outside the scope of the MMPA so as to invalidate a CID issued under § 407.040." Id. (emphasis in original). Hence, "by providing and billing for medical services, [Planned Parenthood's] business practices f[e]ll squarely within the MMPA and [were] subject to the [Attorney General's] oversight." Id. Similarly, Planned Parenthood Great Plains found: [T]he Attorney General's investigation does not target claims of medical malpractice .... Rather, the stated purpose of the investigation is focused squarely on what the MMPA prohibits—the "deception, fraud, false promises, misrepresentation, unfair practices, and/or the concealment, suppression, or omission of material facts" regarding the transgender care provided by ... [the] Center and "others in the state providing similar services." The requests set out in the corresponding CID demonstrate this intent. Planned Parenthood Great Plains, 713 S.W.3d at 228. After finding the Attorney General could investigate these claims, the Western District explained that, under section 407.040.1, "the Attorney General is authorized by the MMPA to issue an enforceable CID to 'any person who is believed to have information, documentary material, or physical evidence relevant to the alleged or suspected violation.'" Id. at 230 (emphasis in original). "[T]he question of an administrative subpoena's relevance is not a question of evidentiary relevance." Id. (quoting United States v. Whispering Oaks Res. Care Facility, LLC,

16 673 F.3d 813, 818 (8th Cir. 2012)). "The standard for determining the relevance of a subpoena's requests is not particularly burdensome, and indeed, a subpoena 'should be enforced when the evidence sought by the subpoena is not plainly incompetent or irrelevant to any lawful purpose of the agency in the discharge of its duties.'" Id. When examining the CID's requests through this lens, the Western District stated, "That the requests, in isolation, may well appear on the surface to seek information related to the practice of medicine is not the end of our query but the starting point." Id. "To evaluate the relevance of the information sought, we first look at the nature of the Attorney General's investigation." Id. The Western District found the CID "specifically referenced the factual allegations giving rise to its investigation of [the Center] and 'others' providing similar services by referencing and incorporating the sworn affidavit of a whistleblower, which detailed a variety of practices, that, if confirmed, could suggest deception and fraud in violation of the MMPA." Id. Hence, the CID's requests, which "on their surface seek information about the provision of medical care" were "appropriate when the gravamen of those requests is to investigate conduct in violation of the MMPA related to the provision of healthcare services." Id. at 231. This analysis compels the same result here. While the CIDs issued to the Center are more numerous and more explicit in seeking individual medical records and information about matters touching more firmly on the practice of medicine, they fall within the pre-claim investigative scope of the MMPA. As in the Planned Parenthood cases, the CIDs here stated the Attorney General "believes it to be in the public interest that an investigation be made to ascertain whether the [Center] or its agents or employees have engaged in or are engaging in any practices declared to be unlawful by § 407.020, RSMo." The CID further advised "[t]he Attorney General has reason to believe that [the Center] may have used deception, fraud, false promises, misrepresentation,

17 unfair practices, and/or concealment, suppression, or omission of material facts within the scope of the [MMPA.]" The CID explained "[t]he Attorney General's investigation is based in part on, but is not limited to, allegations made in the" whistleblower's sworn affidavit. As in Planned Parenthood Great Plains, the whistleblower's affidavit "detailed a variety of practices, that, if confirmed, could suggest deception and fraud in violation of the MMPA." Planned Parenthood Great Plains, 713 S.W.3d at 230. Hence, the Attorney General "may validly use a CID to investigate whether the Center, [Planned Parenthood], and others in the state have conducted the business of providing and billing for gender-affirming medical care to minors using deception, fraud, false promises, misrepresentation, or unfair practices prohibited by the MMPA." Planned Parenthood St. Louis, 715 S.W.3d at 190. The Center finds itself in the same procedural posture as Planned Parenthood. This is a pre-claim investigation with no claim pending against the Center before this Court alleging wrongdoing. This Court was mindful of this procedural posture when acknowledging, "We must underscore that there is no MMPA claim against [Planned Parenthood] before us—we are reviewing only the validity of an administrative subpoena issued by the [Attorney General] in a pre-claim investigation under the auspices of the MMPA." Planned Parenthood St. Louis, 715 S.W.3d at 182 (emphasis in original). "The government may use its administrative subpoena power to 'investigate merely on suspicion that the law is being violated, or even just because it wants assurance that it is not." Id. (quoting Whispering Oaks, 673 F.3d at 818); see also Planned Parenthood Great Plains, 713 S.W.3d at 230 (same). This opinion should not be read to conclusively foreclose the Center from litigating at a later date—if and when the Attorney General chooses to bring a formal MMPA claim—that specific allegations do not state a claim for relief because they are medical malpractice claims

18 masquerading as consumer protection and billing fraud claims. At this juncture, however, this Court reiterates it is adjudicating only a discovery dispute about an administrative subpoena issued under the Attorney General's broad pre-claim investigatory powers to determine if the Center has possibly violated the MMPA. Accordingly, the parties' desire to litigate the nuanced merits of whether these general requests are investigating unlawful consumer practices or medical malpractice is premature. Planned Parenthood St. Louis, 715 S.W.3d at 182. This Court holds the Attorney General's pre-claim, investigatory CIDs sought information within the MMPA's "unrestricted, all-encompassing and exceedingly broad" scope. Ports Petroleum, 37 S.W.3d at 240 (quoting Gott, 5 S.W.3d at 159). The circuit court erred in entering judgment on the pleadings for the Center when it found the CID requests were not within the MMPA's scope. Point I is granted. Point II: Privilege Party Positions In Point II, the Attorney General argues the circuit court erred in finding the Center did not have to produce the medical records because they were privileged. The Attorney General contends because the Center did not assert any privilege below, the issue was waived, and the circuit court could not sua sponte raise privilege on the Center's behalf as an affirmative defense. 11

The Center argues the circuit court's analysis of whether the medical records were privileged was based on the MMPA's plain language, the statutory limits on CIDs under section 407.040.3(2), and its repeated assertions the Attorney General's demands for PHI invaded

11 As this Court found with Point I, the Attorney General asserts additional arguments concerning the merits of whether the medical records were privileged in Point II which were not captured in his point relied on. These arguments are not preserved for appeal and will not be addressed. Abram, 684 S.W.3d at 89. This Court confines its analysis to the procedural argument presented in the point relied on: whether privilege was properly presented to the circuit court for adjudication.

19 its patients' protected privacy interests. Alternatively, the Center asserts if the circuit court's waiver finding was improper, reversal is not warranted because the finding was not necessary for the circuit court's judgment. Analysis Section 407.090 states when the Attorney General petitions the circuit court to enforce a CID, the circuit court "shall have jurisdiction to hear and determine the matter so presented, and to enter such order or orders as may be required to carry into effect the provisions of section 407.040." Section 407.040.3(2) states, "No [CID] ... shall [r]equire the disclosure of any documentary material which would be privileged or which, for any other reason, could not be required by a subpoena duces tecum issued by a court of this state." Planned Parenthood Great Plains found this section's prohibition on producing privileged materials was "consistent with the protections afforded the physician-patient relationship under Missouri law" because this privilege "applies to medical records and all aspects of discovery." Planned Parenthood Great Plains, 713 S.W.3d 221 n.5 (quoting State ex rel. Dean v. Cunningham, 182 S.W.3d 561, 567 (Mo. banc 2006)). Section 407.090 specifically contemplates the circuit court will construe and apply section 407.040, which includes determining whether the CID impermissibly requests privileged information when rendering an order adjudicating an enforcement action. See id. Hence, the issue of privilege was before the circuit court as a matter of law through the Attorney General's counterclaim seeking to enforce the CIDs. 12

12 At oral argument, the Attorney General argued the circuit court could not address privilege as a matter of law even if it were explicitly raised because privilege does not override an MMPA consumer investigation into medical services fraud. This interpretation would render meaningless section 407.040.3(2)'s prohibition on disclosure of privileged material in response to a CID. See Missouri Bond Co., LLC v. Devore, 641 S.W.3d 397, 403 (Mo. App. E.D. 2022) (holding appellate courts "must avoid statutory interpretations that are unjust, absurd, unreasonable, or render statutory language meaningless.").

20 This does not end this Court's inquiry, however, because the parties filed competing motions for judgment on the pleadings in which the Center sought to modify the CIDs. At no point below did the Center assert the CIDs should be modified because they requested privileged materials under section 407.040.3(2). In fact, the word "privilege" does not appear in any of the Center's pleadings. Although the parties' correspondence indicated the Center produced a privilege log at the Attorney General's request, it is unclear whether the circuit court was provided the privilege log to review. See Planned Parenthood of St. Louis, 715 S.W.3d at 192 (finding Planned Parenthood failed to "produce a privilege log, which would have aided the [circuit] court in ruling on [Planned Parenthood's] request to consider its objections."). Nor was the privilege log made a part of this Court's record. Counsel for both parties attempted to clarify the privilege log contents during oral argument but this Court cannot consider those clarifications. "An appellate court cannot accept counsels' statements or averments as substitute for record proof even if there is no reason to doubt counsels' accuracy." Abram, 684 S.W.3d at 91 (quoting Bertocci v. Thoroughbred Ford, Inc., 530 S.W.3d 543, 551 (Mo. App. W.D. 2017)). Hence, the Center waived the issue of privilege before the circuit court because it did not raise privilege in its pleadings nor produce a privilege log for the circuit court to examine. See Planned Parenthood Great Plains, 713 S.W.3d at 221 (declining to review Planned Parenthood's potential privilege claim absent any demand for privileged information because "there can be no review of a matter which has not been presented to or expressly decided by the [circuit] court.") (quoting Barkley v. McKeever Enters., Inc., 456 S.W.3d 829, 839 (Mo. banc 2015)). The circuit court erred in entering judgment on the pleadings for the Center to the extent it considered privilege, which the Center did not raise. Point II is granted.

21 Because the circuit court erred in modifying the CIDs to prevent disclosure of the medical records and PHI based on the requests being outside the MMPA's scope and privileged, this Court must reverse the circuit court's judgment. HIPAA Disclosure Provisions The Attorney General's remaining five points ask this Court to resolve whether HIPAA is an affirmative defense, who has the burden of proving HIPAA provisions permit or prevent disclosure, and whether four HIPAA provisions permit or compel the Center to disclose its medical records and PHI to the Attorney General. In finding the medical records were outside the MMPA's scope and privileged, the circuit court did not address three of the four HIPAA provisions the parties raised regarding disclosure, and incorrectly analyzed a fourth provision. Because these issues will arise again on remand, this Court must address them. "By its text, HIPAA promotes a renewed awareness of, or emphasis upon, the principle of patient privacy." State ex rel. Proctor v. Messina, 320 S.W.3d 145, 150 (Mo. banc 2010). "Missouri courts are bound to follow HIPAA's statutory and regulatory mandate ...." Id. at 153. The HIPAA Privacy Rule defines PHI as: "individually identifiable health information" that is "created or received by a health care provider" that "[r]elates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual." Planned Parenthood St. Louis, 715 S.W.3d at 192 (citing 45 C.F.R. § 160.103). "Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiably health information." 45 C.F.R. § 164.514(a). To comply with HIPAA generally, "a covered entity may not use or disclose [PHI] without an authorization that is valid" "except as otherwise permitted or required[.]" 45 C.F.R.

22 § 164.508(a)(1). When disclosing PHI, the covered entity generally "must make reasonable efforts to limit [PHI] to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request." 45 C.F.R. § 164.502(b). This minimum standard does not apply, however, to "[u]ses or disclosures that are required by law, as described by 45 C.F.R. § 164.512(a)." 45 C.F.R. § 160.502(b)(2)(v). Hence, "[a] covered entity may use or disclose [PHI] to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law." 45 C.F.R. § 164.512(a)(1). Section 164.512 further states "[a] covered entity must meet the requirements described in paragraph (c), (e), or (f) of this section for uses or disclosures required by law." 45 C.F.R. § 164.512(a)(2). This section then sets forth permissible and required uses and disclosures including four provisions the parties dispute apply here and which will be addressed in Points IV through VII. The Attorney General's HIPAA-related points will be analyzed out of order for clarity. Point V: Disclosure under HIPAA's "Health Oversight Agency" Provision Party Positions In Point V, the Attorney General argues the circuit court erred in finding the Center did not have to produce HIPAA-protected documents because HIPAA expressly permits disclosure under the "health oversight agency" provision. The Attorney General maintains his office is a health oversight agency, and the CIDs were issued for health oversight activities authorized by law. The Center argues the Attorney General's reliance on the health oversight agency provision ignores the fact the Attorney General initiated this investigation under the MMPA, not Chapter 191. By doing so, the Center contends the Attorney General's MMPA investigation is limited to conduct concerning the advertisement or sale of goods or services in trade or commerce, not conduct related to enforcing the healthcare fraud and abuse act.

23 Analysis "A covered entity may disclose [PHI] [without individual authorization] to a health oversight agency for oversight activities authorized by law, including ... civil [or] administrative ... investigations ... or other activities necessary for appropriate oversight of ... [t]he health care system[.]" 45 C.F.R. § 164.512(d)(1)(i). This Court has recognized the Attorney General "has specific statutory authority to investigate Medicaid billing fraud using the powers [he] is granted under the MMPA" as stated in Chapter 191. Planned Parenthood St. Louis, 715 S.W.3d at 182 n.9. However, the CIDs' plain language reflects the Attorney General did not choose to proceed or investigate the Center under this authority. Section 407.040.2 governs what information shall be included in a lawfully issued CID to provide notice to the investigation's target. The Attorney General is required to "[s]tate the statute and section thereof, the alleged violation of which is under investigation, and the general subject matter of the investigation." Section 407.040.2(1). Here, the CIDs stated the Attorney General believed an investigation was appropriate to determine whether the Center, "its agents or employees have engaged in or are engaged in any practice declared to be unlawful by [section] 407.020 ..." and "within the scope of the [MMPA]." The CIDs do not cite Chapter 191 nor state they were issued under any purported "health oversight agency" investigative powers as section 407.040.2(1) requires. The Attorney General's argument the CIDs were relevant to his authority as a health oversight agency is belied by the CIDs' plain language: the CIDs sought information relevant to an investigation into whether the Center engaged in unlawful practices under the MMPA. There may be overlap between the subject matter and the investigative mechanisms if launching an investigation under Chapter 191. However, the Attorney General was required to "state the statute and section" the Center allegedly violated. See section 407.040.2(7). The CIDs state the Center allegedly violated the MMPA, not under Chapter 191.

24 Because the CIDs clearly stated the Attorney General's intent to investigate the Center for alleged unlawful practices under the MMPA and not Chapter 191, this provision cannot be satisfied on remand as a matter of law under the facts presented. Point V is denied. Point VI: Disclosure under HIPAA's "Administrative Tribunal Order" Provision Party Positions In Point VI, the Attorney General argues the circuit court erred in finding the Center did not have to produce HIPAA-protected documents responsive to the CIDs because HIPAA expressly permits disclosure in response to an "administrative tribunal," and the CIDs were "orders" issued by the Attorney General. The Attorney General contends its office is an "administrative tribunal" exercising "quasi-judicial authority" when issuing CIDs because CIDs are "the civil equivalent to a criminal grand jury." The Center argues a CID is not a "quasi-judicial order," and the Attorney General is not an "administrative tribunal" within the meaning of this HIPAA provision. The Center further argues the grand jury analogy fails because HIPAA addresses grand jury disclosures under the law enforcement purposes provision. Analysis "A covered entity may disclose [PHI] [without individual authorization] in the course of any judicial or administrative proceeding [i]n response to an order of ... [an] administrative tribunal ...." 45 C.F.R. § 164.512(e)(1)(i). "[A]lthough the [Attorney General's] office is not an administrative agency, when issuing CIDs under section 407.040, the [Attorney General] is performing an administrative function. It is the functional equivalent of a civil enforcement agency enforcing the civil consumer protection laws of Missouri." Charter Communications, 461 S.W.3d at 857. Even if this Court broadly read Charter Communications' holding to extrapolate the

25 Attorney General acts as "an administrative tribunal exercising quasi-judicial authority" when issuing CIDs, his argument fails because a CID is not an "order" contemplated under this provision. The Attorney General is correct that section 407.040.1 "require[s]" a CID recipient "to appear and testify, or to produce relevant documentary material or physical evidence or examination ...." However, "the Attorney General, pursuant to section 407.090, must seek a court order to require a recalcitrant recipient of the CID to respond." Planned Parenthood Great Plains, 713 S.W.3d at 220 (citing Charter Communications, 461 S.W.3d at 857). Section 407.080 also mandates a CID recipient "shall comply with the terms thereof" but this compliance is excused "unless otherwise provided by an order of a court." (Emphasis added). Accordingly, "CIDs are not independently enforceable" orders. Id. This provision cannot be satisfied on remand as a matter of law under the facts presented. Point VI is denied. Point IV: Disclosure under HIPAA's "Court Order" Provision Party Positions In Point IV, the Attorney General argues the circuit court erred in finding the Center did not have to produce HIPAA-protected documents because HIPAA expressly permits disclosure in response to a "court order." The Attorney General contends the circuit court should have simply upheld the CIDs and ordered disclosure because any court order finding a CID lawful under section 407.040 "automatically resolves HIPAA" without further analysis. 13

13 The Attorney General tangentially argues this circuit court error, if affirmed, "would decimate the State's ability to investigate healthcare fraud." Not only is this argument not encompassed in his point relied on, but it also raises additional arguments regarding his purported power as a "health oversight agency" which were not the auspices under which the CIDs were issued as addressed in Point V.

26 The Center argues this HIPAA provision does not authorize disclosure of all patients' PHI because the Attorney General's argument rests on a misunderstanding of the circuit court's judgment. The Center asserts the circuit court did not uphold the CIDs, but instead, found the PHI requests did not relate to any issue within the MMPA's scope and were not subject to disclosure. Analysis HIPAA permits a covered entity to disclose PHI without individual authorization "in the course of any judicial or administrative proceeding [i]n response to an order of a court ... provided that the covered entity discloses only the [PHI] expressly authorized by such order[.]" 45 C.F.R. § 164.512(e)(1)(i). Neither party disputes this HIPAA provision would require disclosure if a court so orders, but the circuit court did not so order here. 14 This provision contemplates the circuit court determining which PHI will be expressly authorized for disclosure when crafting its order. Because the circuit court has not entered an order to disclose PHI, it has not made this determination or considered if and how HIPAA may apply. This must occur on remand. Point IV is denied in part and granted in part.

14 At oral argument, the Attorney General argued the Planned Parenthood cases determined these CIDs were valid and, therefore, this Court need not reach whether HIPAA applied here. While the Attorney General is correct the CIDs issued here mirror the CIDs issued in the Planned Parenthood cases in many respects, he disregards the crucial difference between the CIDs issued there and issued to the Center: the Planned Parenthood CIDs did not seek wholesale, unredacted access to every single patient medical record held by those clinics. Hence, the validity of the Center's CIDs has not been fully resolved until today.

27 Point VII: Disclosure under HIPAA's "Law Enforcement Purposes" Provision Party Positions In Point VII, the Attorney General argues the circuit court erred in finding the Center did not have to produce HIPAA-protected documents because HIPAA expressly permits disclosure under the "law enforcement purposes" provision. The Attorney General argues the Center did not disprove: (1) the Attorney General issued a CID requiring it to respond; (2) the CID seeks information relevant and material to a legitimate law enforcement inquiry; (3) the CID was specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information was sought; and (4) de-identified information could not reasonably be used. The Center argues the circuit court appropriately found this HIPAA provision did not apply because: (1) patient PHI is irrelevant and immaterial to a legitimate MMPA investigation; (2) a request for all medical records for all Center patients is not specific or limited in scope; and (3) the Attorney General has not shown why de-identified information could not reasonably be used. Analysis HIPAA permits a covered entity to disclose PHI without individual authorization "for law enforcement purposes" in response to "an administrative request for which response is required by law, including an administrative subpoena ..., a civil or an authorized investigative demand ... provided that: (1) [t]he information sought is relevant and material to a legitimate law enforcement inquiry; (2) [t]he request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and (3) [d]e-identified information could not reasonably be used." 45 C.F.R. § 164.512(f)(1)(ii)(C)(1)–(3). First, this Court has already determined the CIDs seek information which is relevant and material to a legitimate law enforcement inquiry. The Attorney General has broad pre-claim

28 investigatory power under the MMPA to ascertain whether the Center has possibly engaged in unlawful practices. Second, the Center argues the requests are not specific and limited in scope because the Attorney General is seeking access to all 1,165 patient records during the Center's operation. The Center does not read this prong in its entirety. This prong requires the request to be "specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought." 45 C.F.R. § 164.512(f)(1)(ii)(C)(2) (emphasis added). This inquiry is limited by the wide-ranging purpose for which the information is sought under the MMPA. See United States v. Wilson, 98 F.4th 1204, 1220 (10th Cir. 2024) (finding the DEA's modified administrative "subpoena was sufficiently specific and limited in scope to comply" with this prong "given the DEA's overall purpose in evaluating [the target's] controlled-substance prescription practices, and [the] specific goals of [its investigation in] examining" patients' medical, billing, and communication records). Third, the parties disagree whether de-identified information could not reasonably be used to comply with the CIDs. "Although HIPAA prohibits wrongful disclosure of PHI, de-identified health information is not protected under the act." Planned Parenthood St. Louis, 715 S.W.3d at 193 (citing 45 C.F.R. §§ 160.103, 164.502, .508 and .514). Accordingly, "de-identified health information is a recognized safe harbor for disclosure." Id. PHI may be de-identified when specific "identifiers of the individual or of relatives ... or household members of the individual are removed[.]" 45 C.F.R. § 164.514(b)(2)(i). This section lists identifiers which, if removed, "de- identifies" medical records. See 45 C.F.R. § 164.514(b)(2)(i)(A)–(R) (listing 18 identifiers). The parties hotly disputed whether disclosing de-identified information would satisfy the CIDs. Initially, the Center agreed much of the information responsive to the CIDs could be found

29 in the medical records, which it offered to the Attorney General with remote, read-only access on multiple occasions. The Center abruptly changed its position, which prompted the Attorney General to insist on receiving unredacted medical records with their metadata included. When the parties reached an impasse and filed suit, they maintained their diametrically opposed positions: The Center asserted the Attorney General was entitled to no medical records, redacted or otherwise, while the Attorney General contended he was entitled to all medical records with no redaction. The circuit court ultimately found the Attorney General was entitled to no records because the requests went beyond the MMPA's scope. In his briefing, the Attorney General argues "de-identified records are suboptimal given the scope of the investigation and allegations by the whistleblower" regarding specific patients. Without de-identified information, the Attorney General argues his ability to cross-reference the Center's previous disclosures with the whistleblower's allegations will impede his ability to determine their veracity. Yet, in the last pages of his appellant's brief, the Attorney General concedes he would accept de-identified records, despite his position before the circuit court. During oral argument, this Court sought to clarify the Attorney General's position. Initially, the Attorney General reaffirmed he was entitled to unredacted medical records. When questioned further regarding the importance of receiving information encompassed by HIPAA's safe harbor provision, the Attorney General agreed he "certainly could use" anonymized information and it would help him identify potential claims, but he maintained unredacted medical records were preferable. "Parties are bound by the position they took in the trial court and will not be heard on a different theory on appeal." City of St. Louis v. Bertels, 699 S.W.3d 221, 227 n.3 (Mo. App. E.D. 2024) (quoting Weber v. Fed. Home Loan Mortg. Corp., 675 S.W.3d 728, 733 (Mo. App. E.D.

30 2023)). "Further, this Court 'will generally not convict a lower court of error on an issue that was not put before it to decide.'" Id. (quoting Clarksboro, LLC v. City of Overland, 678 S.W.3d 139, 145 (Mo. App. E.D. 2023)). Here, the circuit court incorrectly analyzed the law enforcement purposes provision because it erroneously determined no records could be disclosed, as it found the requests were outside the MMPA's scope. In practical terms, this means the circuit court has not determined the merits whether de-identified information could not reasonably be used and must answer this question on remand. To answer this question requires this Court to resolve Point III, which seeks clarity on the burden of proof and affirmative defenses when asserting HIPAA to modify or limit disclosure when responding to a CID. Point III: HIPAA as an Affirmative Defense and Burden of Proof Party Positions The Attorney General argues the circuit court erred in placing the burden regarding HIPAA's scope and applicability on the State because it should have been placed on the Center. The Attorney General contends because the Center raised HIPAA as an affirmative defense to preclude disclosure, the Center had the burden of establishing its affirmative defense applies. The Center argues the circuit court did not place an improper burden on the Attorney General because the Attorney General cited no authority demonstrating HIPAA was an affirmative defense and the circuit court's analysis was appropriate under HIPAA regulations. Analysis HIPAA confidentiality is not an affirmative defense. Planned Parenthood St. Louis, 715 S.W.3d at 193. This Court has also recognized "a blanket HIPAA-based objection does not make the CID unenforceable, as the burden is on [the covered entity] to comply with HIPAA when responding to subpoenas." Id. (citing 45 C.F.R. §§ 164.502(a), .508 and .512). In certain

31 instances, however, the covered entity must consider additional provisions when confronted with a request for PHI to determine whether disclosure is permitted. For example, "If a disclosure is conditioned by this subpart on particular documentation, statements, or representations from the person requesting the [PHI], a covered entity may rely, if such reliance is reasonable under the circumstances, on documentation, statements, or representations that, on their face, meet the applicable requirements." 45 C.F.R. § 164.514(h)(2)(i) (emphasis added). Specifically, when complying with the law enforcement purposes provision at issue here, this subsection states, "The conditions in § 164.512(f)(1)(ii)(C) may be satisfied by the administrative subpoena or similar process or by a separate written statement that, on its face, demonstrates that the applicable requirements have been met." 45 C.F.R. § 164.514(h)(2)(i)(A). The Center interprets this language to place the burden on the Attorney General to demonstrate he meets the three prongs of the law enforcement purposes provision for an administrative subpoena before the Center must disclose any PHI. The Attorney General interprets this language to mean the Center "can take the State's word at face value" and may rely on this safe harbor to disclose the PHI after receiving the CIDs. This Court finds the Attorney General's interpretation unpersuasive because the CIDs, on their faces, do not state § 164.512(f)(1)(ii)(C)'s provisions have been satisfied so the Center can "take the State's word" and disclose the PHI in unredacted form. Compare Wilson, 98 F.4th at 1218–20 (finding a government agent's declaration—attached to an administrative subpoena seeking medical records—providing attestations demonstrating satisfaction of the law enforcement purposes' three prongs compelled a psychologist to disclose certain patient records). Because the Attorney General is not required to disclose the full scope of his investigation, a covered entity attempting to comply with a CID cannot know whether de-identified information

32 could not reasonably be used in a vacuum so as to comply with its obligation to "make reasonable efforts to limit [PHI] to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request." 45 C.F.R. § 164.502(b). Hence, this Court finds when seeking HIPAA- protected PHI under the law enforcement purposes provision, the entity seeking the PHI must carry the burden of proving it has satisfied the three prongs of § 164.512(f)(1)(ii)(C) as contemplated by 45 C.F.R. § 164.514(h)(2)(i)(A). Because the circuit court has not determined whether the Attorney General has satisfied the third prong of the law enforcement purposes provision, it must do so on remand. Point III is denied. Because the circuit court misapplied the first two prongs of HIPAA's "law enforcement purposes" provision but has not determined the merits of whether de-identified information could not reasonably be used, which the Attorney General bears the burden of proving, Point VII is granted in part. Remand As this Court stated in its introduction, this case, at its essence, is a complex discovery dispute. "The circuit court retains broad discretion in conducting discovery." Main v. Main, 685 S.W.3d 620, 631 (Mo. App. E.D. 2024) (quoting State ex rel. Ford Motor Co. v. Messina, 71 S.W.3d 602, 607 (Mo. banc 2002)). "The permissible scope of a production request contained in a subpoena duces tecum is governed by the general discovery provisions of Rule 56.01 and 58.01." Planned Parenthood St. Louis, 715 S.W.3d at 192 n.15. Hence, "the general discovery rules [are] incorporated by reference when litigating a claim filed by a CID recipient under § 407.070 or by the [Attorney General] seeking enforcement under § 407.090." Id. This Court is very mindful of the breadth and depth of the Attorney General's requests to examine 1,165 minor patients' most personal medical information. Thus, the circuit court is

33 empowered to modify the CIDs as it deems appropriate under state and federal law. In its sound discretion, the circuit court may employ any of its discovery management tools, such as in-camera review or the appointment of a special master, to resolve any further dispute regarding de- identification or redaction given the sensitive nature and volume of PHI requested. See State ex rel. Chance v. Sweeney, 70 S.W.3d 664, 668 (Mo. App. S.D. 2002) (recognizing in camera review or the appointment of a special master is "appropriate in order to protect one who may be subjected to harm or humiliation upon unwarranted invasion by another who is seeking information."). The circuit court, in its sound discretion, can enter appropriate protective orders or other orders reiterating the importance of compliance with section 407.060.1's confidentiality requirements. See State ex rel. Health Midwest Dev. Group, Inc. v. Daugherty, 965 S.W.2d 841, 844 (Mo. banc 1998) (holding protective orders are appropriate to protect patients "against humiliation, embarrassment or disgrace"). In sum, on remand, the circuit court has the discretion to fashion discovery orders it deems appropriate to balance the Attorney General's need to investigate possible MMPA violations and the 1,165 minor patients' medical privacy rights. Conclusion The circuit court's judgment is reversed, and the cause is remanded for further proceedings consistent with this opinion.

_______________________________ Philip M. Hess, Judge

Michael S. Wright, P.J. and Virginia W. Lay, J. concur.