State of New York Court of Appeals

- 1 -

State of New York

Court of Appeals

OPINION

This opinion is uncorrected and subject to revision

before publication in the New York Reports.

No. 106

In the Matter of The Plastic Surgery

Group, P.C.,

Appellant,

Comptroller of the State of New York,

Respondent.

Matthew F. Didora, for appellant.

Jeffrey W. Lang, for respondent.

Medical Society of the State of New York et al., amici curiae.

FAHEY, J.:

The Comptroller of the State of New York has a constitutional and statutory duty to

audit payments of state money, including payments to private companies that provide

health care to beneficiaries of a state insurance program. Here, the Comptroller carried out

- 2 - No. 106

- 2 -

that obligation by means of investigatory subpoenas duces tecum directed to a medical

provider, seeking patients’ records. We hold that CPLR 3122 (a) (2) does not require that

the Comptroller’s subpoenas be accompanied by written patient authorizations, as the

requirements set out in that paragraph apply only to subpoenas duces tecum served after

commencement of an action.

Petitioner the Plastic Surgery Group, P.C. (the Group) is, as its name suggests, a

professional corporation engaged in the practice of plastic surgery. It is a nonparticipating

or “out-of-network” provider with respect to the Empire Plan, the principal insurance

coverage option of the New York State Health Insurance Program (NYSHIP). A

nonparticipating provider does not negotiate a contracted rate for its services. As a result,

its patients who are Empire Plan members ordinarily pay higher out-of-pocket costs than

they would to a participating provider.

An out-of-network provider has “a legal duty to collect patients’ co-payments”

(Matter of Martin H. Handler, M.D., P.C. v DiNapoli, 23 NY3d 239, 243 [2014]).

Violation of that duty is considered inflation of invoices and “can result in civil and

criminal penalties for insurance fraud” (id., citing Insurance Law § 403 [c]; Penal Law §

176.05 [2]). As we have explained, “[a] provider’s failure to collect a co-payment from an

Empire Plan member inflates a claim’s cost and adversely impacts the State’s fisc. For

example, a provider that charges $100 for a service, and who collects $80 in state money,

must collect $20 from the Empire Plan member. In the event that the provider does not

- 3 - No. 106

- 3 -

collect the co-payment, it has provided a medical service for $80, not $100, and the State

should have paid only $64 of that cost” (id.).

In 2015, as part of broader audits of NYSHIP, the Comptroller selected for audit

certain claims paid to the Group by the Empire Plan’s administrator, United Healthcare

Insurance of New York, for services rendered to Empire Plan members since 2011. The

Comptroller sought to determine whether the Group had routinely waived those patients’

out-of-pocket costs, thus inflating its invoices in the manner explained above. The Office

of the Comptroller gave notice that its auditors would be visiting the Group’s office to

inspect records.

The Group was uncooperative and the Comptroller served it with a subpoena duces

tecum, pursuant to CPLR 2302 (a),

requesting the names and addresses of its Empire Plan

member patients; their account records and ledgers; dates, procedure codes, and

descriptions of services; copies of patient checks; and correspondence between the Group

and those patients. The subpoena was not accompanied by written authorizations from the

patients or any notice that such authorizations were required. The Group refused to

comply. It relied on CPLR 3122 (a) (2), which requires certain subpoenas duces tecum

seeking patient medical records to include a notice that the records shall not be provided

absent written patient authorizations or direction by a court and permits a medical provider

not to respond or object to such a subpoena that is unaccompanied by written patient

authorizations. The Comptroller then offered a compromise in which patient names would

The parties have not raised, and we are not offering any opinion on, any issue related to

CPLR 3102 (c).

- 4 - No. 106

- 4 -

be redacted and replaced with unique identifiers enabling matching of records. The Group

declined. Instead, it commenced this special proceeding to quash the subpoena.

The Group contended that (1) under CPLR 3122 (a) (2), it is “not obligated to

respond to the Subpoena”; (2) “the Subpoena improperly requests patient information

protected by HIPAA”; and (3) “the Subpoena is overbroad and unduly burdensome.” The

Comptroller opposed the petition and cross-moved to compel compliance with the

subpoena, contending, among other things, that CPLR 3122 (a) (2) applies only to

discovery subpoenas issued by a party in litigation, and does not govern investigatory

subpoenas issued prior to the commencement of litigation.

Supreme Court granted the petition, quashed the subpoena, and denied the

Comptroller’s cross motion to compel, on the ground that the subpoena did not comply

with CPLR 3122 (a) (2). The Appellate Division reversed, denied the Group’s application

to quash the subpoena, and granted the Comptroller’s cross motion to compel compliance

(155 AD3d 1417 [2017]). That court rejected each of the Group’s contentions.

granted the Group leave to appeal (32 NY3d 904 [2018]).

II.

The audit powers of the Comptroller are grounded in Article V, section 1 of the

State Constitution, which this Court has called “the ‘wellspring of [the Comptroller’s]

authority’ ” (Handler, 23 NY3d at 245, quoting Matter of McCall v Barrios-Paoli, 93 NY2d

On appeal, the Group does not challenge the Appellate Division’s determinations that

the Comptroller’s subpoena was not improper under HIPAA and was not overbroad or

unduly burdensome. We therefore do not opine on those matters.

- 5 - No. 106

- 5 -

99, 105 [1999]). As we described in Matter of Martin H. Handler, M.D., P.C. v DiNapoli,

New York has had state audit authority since colonial days, and the State Constitution has

authorized and prescribed the Comptroller’s powers and duties to audit since the early

twentieth century (see Handler, 23 NY3d at 246). The Constitution straightforwardly states

that “[t]he payment of any money of the state, or of any money under its control, or the

refund of any money paid to the state, except upon audit by the comptroller, shall be void

. . .” (NY Const, art V, § 1).

There is no dispute that the case before us involves such “payment of . . . money of

the state” and that the Comptroller has the “authority to review the billing records of private

companies that provide health care to beneficiaries of a state insurance program” (Handler,

23 NY3d at 242).

The State is the ultimate source of payments of Empire Plan claims and

“[p]reventing overpayment is a core aspect of the Comptroller’s constitutional mantle” (id.

at 250). Indeed, in Civil Service Law § 167 (7), the legislature expressly authorized the

Comptroller to audit payments to the State’s health insurance vendors, stating that

“amounts required to be paid to any contracting corporation under any contract [with the

NYSHIP] shall be payable from such health insurance fund as audited by and upon the

warrant of the comptroller.”

“The New York State Health Insurance Program (NYSHIP) provides health insurance

coverage to government employees, retirees, and their dependents. The NYSHIP’s

primary coverage option is the Empire Plan. Under a contract with the State, . . .

United Healthcare Insurance of New York (United) processes and pays claims made by

Empire Plan beneficiaries. After United has processed a claim, the State covers its full cost

and pays United an administrative fee. In other words, the State funds the Empire Plan as

a self-insurer.” (Handler, 23 NY3d at 242-243.)

- 6 - No. 106

- 6 -

The State Finance Law “grant[s] the Comptroller broad subpoena powers in

furtherance of the Comptroller’s investigatory functions” (Handler, 23 NY3d at 247).

Specifically, the Comptroller “may issue a subpoena or subpoenas requiring a person or

persons to attend . . . and be examined in reference to any matter within the scope of the

inquiry or investigation being conducted by the [C]omptroller, and, in a proper case, to

bring . . . a book or paper” (State Finance Law § 9). State Finance Law § 9 further provides

that such subpoenas are “regulated by the civil practice law and rules.”

The issue in the appeal before us concerns one question regarding the mechanics of

auditing payments of Empire Plan claims. Under the CPLR, may the Comptroller

subpoena patient billing records without written patient authorizations? Handler gives no

answer because the providers in that case voluntarily turned over patient records, and the

patient authorization question was not litigated. Nevertheless, Handler stands for the

proposition that the State Constitution and our statutes give the Comptroller broad authority

to review the billing records of companies that provide health care to NYSHIP

beneficiaries, to ensure that the State has not overpaid on health insurance claims.

III.

The Group relies on CPLR 3122 (a) (2)’s patient authorization requirement. That

provision must be understood in its broader context in article 31 of the Civil Practice Law

and Rules, which is titled “Disclosure.” Rule 3122 is preceded by rule 3120 and section

3121, and we turn first to those provisions.

As the CPLR (1962) states, it is the successor to the Civil Practice Act (1920) and the

non-statutory Rules of Civil Practice (1921), “and shall be deemed substituted therefor

- 7 - No. 106

- 7 -

CPLR 3120 provides, among other things, that a party to an action, seeking

discovery, may serve a notice on another party, or a subpoena duces tecum on a non-party,

demanding documents:

“After commencement of an action, any party may serve on any other party

a notice or on any other person a subpoena duces tecum:

(i) to produce and permit the party seeking discovery, or someone acting on

his or her behalf, to inspect, copy, test or photograph any designated

documents or any things which are in the possession, custody or control of

the party or person served; or

(ii) to permit entry upon designated land or other property in the possession,

custody or control of the party or person served for the purpose of inspecting,

measuring, surveying, sampling, testing, photographing or recording by

motion pictures or otherwise the property or any specifically designated

object or operation thereon.” (CPLR 3120 [1] [emphasis added].)

The immediately following statute, CPLR 3121, provides that a party to an action

in which the mental or physical condition or blood relationship of a party is in controversy

may serve a notice on that party, demanding submission to a physical, mental, or blood

examination by a designated physician:

“After commencement of an action in which the mental or physical condition

or the blood relationship of a party, or of an agent, employee or person in the

custody or under the legal control of a party, is in controversy, any party may

serve notice on another party to submit to a physical, mental or blood

examination by a designated physician, or to produce for such examination

his agent, employee or the person in his custody or under his legal control.”

(CPLR 3121 [a] [emphasis added].)

throughout the statutes and rules of the state” (CPLR 101). The distinction between “rules”

and “sections” still maintained throughout the CPLR is a vestige of its origins, retaining

little practical significance today. “Reference to a provision in the civil practice law and

rules may, except when such provision is being enacted or amended, be made without

indicating whether it is a rule or section” (CPLR 101). “Each of the [CPLR] Articles

contains a series of provisions preceded by ‘§’ or ‘Rule’ . . . For the practitioner, however,

there is no practical working difference between a section or a rule” (Morris D. Forkosch,

Abraham Wilson, Carmody-Forkosch New York Practice § 33 at 24).

- 8 - No. 106

- 8 -

Both CPLR 3120 and CPLR 3121 expressly govern practice after an action has been

commenced.

The Group relies on a paragraph contained in the subsequent provision, specifically

CPLR 3122 (a) (2). The Group maintains that paragraph (a) (2) requires patient

authorizations for all subpoenas duces tecum served on medical providers requesting the

production of a patient’s medical records (other than trial subpoenas issued by a court),

regardless of whether the subpoena is served during pretrial discovery or as part of an

investigation occurring outside of litigation. We conclude that the Group’s arguments are

unpersuasive.

Foremost, the language of the statute refutes the Group’s theory.

“1. Within twenty days of service of a notice or subpoena duces tecum under

rule 3120 or section 3121, the party or person to whom the notice or subpoena

duces tecum is directed, if that party or person objects to the disclosure,

inspection or examination, shall serve a response which shall state with

reasonable particularity the reasons for each objection. If objection is made

to part of an item or category, the part shall be specified. . . .

“2. A medical provider served with a subpoena duces tecum, other than a

trial subpoena issued by a court, requesting the production of a patient’s

medical records pursuant to this rule need not respond or object to the

subpoena if the subpoena is not accompanied by a written authorization by

the patient. Any subpoena served upon a medical provider requesting the

medical records of a patient shall state in conspicuous bold-faced type that

the records shall not be provided unless the subpoena is accompanied by a

written authorization by the patient, or the court has issued the subpoena or

otherwise directed the production of the documents.” (CPLR 3122 [a]

[emphasis added].)

CPLR 3122 (a) (2) imposes a requirement of patient authorizations on certain

subpoenas duces tecum served on a medical provider. The statute expressly provides that

the requirement applies to subpoenas duces tecum served “pursuant to this rule” (CPLR

- 9 - No. 106

- 9 -

3122 [a] [2]). The only CPLR rule that is referred to in the immediately preceding text and

that governs service of a subpoena duces tecum to obtain medical records is “rule 3120,”

which is incorporated in CPLR 3122 (a) (1), the paragraph concerned with objections to

pretrial discovery.

We conclude that the requirement set out in CPLR 3122 (a) (2) applies

only to subpoenas served pursuant to CPLR 3120, after the commencement of an action.

The Group suggests that the phrase “pursuant to this rule” in CPLR 3122 (a) (2) is

self-referential. We disagree. CPLR 3122 (a) (2) is not itself a “rule,” let alone a rule

“pursuant to” which a subpoena is served. The words “this rule,” in “a subpoena duces

tecum . . . requesting the production of a patient’s medical records pursuant to this rule”

(CPLR 3122 [a] [2]), could not refer to CPLR 3122 (a) (2) itself, because that provision

does not set out a rule “pursuant to” which a subpoena is served and the production of a

patient’s medical records is requested. Rather, it delineates a circumstance in which a

medical provider need not respond or object to a subpoena. We are required to “consider

a statute as a whole, reading and construing all [its] parts . . . together to determine

legislative intent” (Friedman v Connecticut Gen. Life Ins. Co., 9 NY3d 105, 115 [2007],

citing McKinney’s Cons Laws of NY, Book 1, Statutes § 97). The plain text of CPLR

CPLR 3122 (a) (1) also refers to “section 3121” but that reference introduces no

ambiguity concerning the phrase “pursuant to this rule” in CPLR 3122 (a) (2). First, CPLR

3121 is a “section,” not a “rule.” Second, CPLR 3121 governs the service of a notice, not

a subpoena.

In many statutory contexts, the natural reading of “this rule” would be a reference to the

rule in which those words occur. Here, the same result follows if “this rule” is interpreted

to refer to CPLR 3122 as a whole. CPLR 3122 expressly limits its application to subpoenas

duces tecum served under CPLR 3120 and notices served under CPLR 3120 or CPLR 3121

(see CPLR 3122 [a] [1]), and CPLR 3122 (a) (2) further limits the application to the former.

- 10 - No. 106

- 10 -

3122 (a) (2) and its location in CPLR article 31 (“Disclosure”) strongly support our

interpretation.

The statutory history of CPLR 3122 confirms our conclusion. Prior to 2011, CPLR

3122 (a) consisted of a single paragraph:

“Within twenty days of service of a notice or subpoena duces tecum under

rule 3120 or section 3121, the party or person to whom the notice or subpoena

duces tecum is directed, if that party or person objects to the disclosure,

inspection or examination, shall serve a response which shall state with

reasonable particularity the reasons for each objection. If objection is made

to part of an item or category, the part shall be specified. A medical provider

served with a subpoena duces tecum requesting the production of a patient’s

medical records pursuant to this rule need not respond or object to the

subpoena if the subpoena is not accompanied by a written authorization by

the patient. Any subpoena served upon a medical provider requesting the

medical records of a patient shall state in conspicuous bold-faced type that

the records shall not be provided unless the subpoena is accompanied by a

written authorization by the patient. . . .” (Former CPLR 3122 [a] [emphases

added].)

In 2011, the legislature amended CPLR 3122 to clarify that the patient authorization

requirement did not apply to “a trial subpoena issued by a court” (CPLR 3122 [a] [2]). The

amendment was designed to overturn a judicial decision, Campos v Payne (2 Misc 3d 921

[Civ Court Richmond County 2003]), which had applied the patient authorization

requirement to quash a subpoena issued by a trial court (see Assembly Sponsor’s Mem in

Support, Bill Jacket, L 2011, ch 307 at 6; OCA Mem in Support, Bill Jacket, L 2011, ch

307 at 13). In effectuating that change, the legislature moved the patient authorization

requirement into a separate, numbered paragraph and added a clear exception for trial court

subpoenas.

- 11 - No. 106

- 11 -

In its earlier format, CPLR 3122 (a) stated in plain terms that the patient

authorization requirement applied only to a subpoena duces tecum served pursuant to “rule

3120.” The Group contends that the division of CPLR 3122 (a) into numbered paragraphs

created, in CPLR 3122 (a) (2), a freestanding statute applicable to all subpoenas duces

tecum served on medical providers, regardless of whether they were served during an

action. We disagree. If it were the intent of the legislature to set forth a rule, governing

the operation of all subpoenas duces tecum served on medical providers, it would not have

placed such a statute in the article of the CPLR that governs “Disclosure” and immediately

after a paragraph concerning the service of notices and subpoenas during discovery, with

only a new paragraph number to indicate so different a topic and so expansive a change in

the meaning of the statute. Rather the meaning of “pursuant to this rule” remains what it

was prior to the 2011 amendment.

Were there any doubt about the meaning of CPLR 3122 (a) (2), the legislative

history would put it to rest. The requirement of patient authorizations was added in 2002

to ensure “that a physician who is served with a subpoena duces tecum requesting a

patient’s medical records during the course of discovery . . . need not respond or object if

the subpoena is not accompanied by a written authorization by the patient” (2002 Report

of the Advisory Committee on Civil Practice to the Chief Administrative Judge of the

Courts of the State of New York, 2002 McKinney’s Session Laws of NY at 2164 [emphasis

added]).

When CPLR 3122 (a) was divided into two paragraphs in 2011, the Assembly

Sponsor and the Office of Court Administration both expressed the hope that the revision

- 12 - No. 106

- 12 -

“would make clear . . . that CPLR 3122, requiring a patient’s authorization, applies only to

subpoenas issued during discovery” (Assembly Sponsor’s Mem in Support, Bill Jacket, L

2011, ch 307 at 6 [emphasis added]; see also OCA Mem in Support, Bill Jacket, L 2011,

ch 307 at 12 [identical language]). Similarly, a contemporaneous letter from the State

Education Department stated that the 2011 amendment “relate[d] to the issuance of a ‘trial

subpoena duces tecum’ for purposes of discovery in a litigation proceeding pending before

a court” (No Objection Letter from the Counsel and Deputy Commissioner for Legal

Affairs, State Education Department to the Counsel to the Governor, Bill Jacket, L 2011,

ch 307 at 10 [emphasis added]). Indeed, this history suggests that the 2011 amendment

was in part designed to forestall an interpretation such as that advanced by the Group in

this proceeding.

IV.

The Group cites State Finance Law § 9, which, as noted, grants the Comptroller

broad subpoena powers “in reference to any matter within the scope of the inquiry or

investigation being conducted by the comptroller,” and expressly states that “[a] subpoena

issued under this section shall be regulated by the civil practice law and rules.”

The Group would have this Court infer that the legislature intended the

Comptroller’s subpoenas to be governed by all CPLR provisions regulating subpoenas of

any kind, regardless of whether those provisions are inapplicable on their face. Certainly,

there are statutes that subject agencies’ subpoena powers to the regulation of the CPLR

using narrower language (see e.g. Social Services Law § 111-p [1997] [“Such subpoena

shall be subject to the provisions of article twenty-three of the civil practice law and rules”];

- 13 - No. 106

- 13 -

Executive Law § 58 [3] [2017] [“A subpoena issued under this section shall be governed

by article twenty-three of the civil practice law and rules . . .”]). Nevertheless, we reject

the Group’s contention that the broader language here was intended to subject the

Comptroller’s subpoenas to the entirety of the CPLR, including provisions that do not

govern investigatory subpoenas at all. It was not necessary for the legislature to state

expressly that “regulated by the civil practice law and rules” means regulation by

applicable provisions in the CPLR, such as those governing subpoenas in general (see

generally CPLR art 23).

The Group’s theory would have the absurd result that the Comptroller’s subpoenas

would be governed by provisions that are expressly applicable only to a “subpoena . . .

served in a pending civil judicial proceeding,” such as the requirement in CPLR 2303 (a)

that such a subpoena “be served . . . on each party who has appeared in the civil judicial

proceeding” or the principle that “[t]he reasonable production expenses of a non-party

witness shall be defrayed by the party seeking discovery” (CPLR 3122 [d] [emphases

added]).

The Group suggests that an affirmance will have detrimental ramifications for the

physician-patient privilege (see CPLR 4504 [a]; Chanko v American Broadcasting Cos.

Inc., 27 NY3d 46, 52 [2016]). Because CPLR 3122 (a) (2) does not apply by its own terms,

it cannot be imposed here to further the policy interests motivating the physician-patient

privilege set forth in CPLR 4504, and the Group does not argue that the privilege is a

separate basis for quashing the subpoena. In any case, the Group’s argument does not

- 14 - No. 106

- 14 -

compel a different outcome. The Comptroller is prohibited from disclosing to the public

any patient records it received for purposes of conducting its audits, without the patient’s

consent. No state agency – defined, with certain exceptions, as “any state board, bureau,

committee, commission, council, department, public authority, public benefit corporation,

division, office or any other governmental entity performing a governmental or proprietary

function for the state of New York” (Public Officers Law § 92 [1]) – “may disclose any

record or personal information unless such disclosure is . . . pursuant to a written request

by or the voluntary written consent of the data subject” (Public Officers Law § 96 [1] [a]).

This statutory confidentiality requirement operates to minimize any infringement on

patient privacy interests flowing from the Comptroller’s exercise of its investigatory

authority.

Accordingly, the order of the Appellate Division should be affirmed, with costs.

* * * * * * * * * * * * * * * * *

Order affirmed, with costs. Opinion by Judge Fahey. Chief Judge DiFiore and Judges

Rivera, Stein, Garcia, Wilson and Feinman concur.

Decided December 17, 2019