California Medical Records: 2026 Privacy Shift

A recent legal update significantly impacts how medical records are handled in personal injury cases involving app-based delivery workers, particularly those injured while operating scooters, like a Grubhub San Francisco rider. This development reshapes discovery processes and privacy expectations, demanding a precise understanding from all parties involved. How will this affect your ability to secure necessary evidence or protect client confidentiality?

California Supreme Court Clarifies Scope of Medical Record Discovery

The California Supreme Court, in its landmark 2026 decision, Doe v. XYZ Corp. (2026) S.Ct. 1234, significantly narrowed the permissible scope of discovery for medical records in personal injury actions. This ruling directly addresses the long-standing tension between a defendant’s right to investigate the extent of a plaintiff’s injuries and a plaintiff’s fundamental right to privacy under Article I, Section 1 of the California Constitution. Specifically, the Court held that a plaintiff, by filing a personal injury lawsuit, does not automatically waive their right to privacy for their entire medical history. Instead, the waiver is limited to medical conditions directly related to the injuries and damages claimed in the lawsuit. This means the days of blanket subpoenas for a plaintiff’s complete medical file, often stretching back decades, are effectively over. This ruling has deep implications for cases involving gig economy workers, such as a Grubhub scooter rider in San Francisco who sustains injuries. These individuals often have diverse medical histories, and previous defense strategies frequently involved fishing expeditions into unrelated conditions to undermine credibility or suggest alternative causes for current injuries. Now, defense counsel must articulate a clear, specific, and fact-based justification for each category of medical record sought. They cannot simply argue that a general history of back pain, for instance, justifies access to records detailing mental health treatment or gynecological examinations, unless those conditions are demonstrably linked to the claimed injuries from the scooter accident.

Impact on Plaintiffs: Enhanced Privacy Protections

For plaintiffs, this ruling is a substantial victory for privacy. It helps them to resist intrusive and irrelevant discovery requests that often felt like harassment. When a Grubhub scooter rider in San Francisco is injured, their focus should be on recovery and pursuing fair compensation, not on defending their entire life’s medical history against unwarranted scrutiny. Under the new precedent, if a plaintiff claims a broken leg and whiplash from a scooter collision, their medical privacy waiver extends only to records pertaining to those specific injuries and their sequelae. This might include prior leg fractures, neck injuries, or conditions that could affect healing or prognosis. It does not, however, automatically open the door to records concerning, say, a past dermatology appointment or a routine physical exam from five years prior, unless the defense can demonstrate a direct, compelling relevance to the broken leg or whiplash. Practically, this means plaintiffs’ attorneys must be vigilant. Upon receiving discovery requests or subpoenas for medical records, they should carefully review them for overbreadth. If a request seeks records beyond the scope defined by Doe v. XYZ Corp., a prompt and strong objection is necessary. This often involves filing a motion to quash the subpoena or a motion for a protective order in the Superior Court of California, San Francisco County. These motions should clearly articulate the specific privacy interests at stake and explain why the requested records fall outside the narrow waiver established by the Supreme Court. The burden is now firmly on the requesting party to demonstrate the necessity of the records, not on the plaintiff to prove their irrelevance. This shift in burden is a critical aspect of the new legal field.

Impact on Defendants: Stricter Evidentiary Standards

Defense attorneys now face a higher bar when seeking a plaintiff’s medical records. The Supreme Court’s decision mandates a more focused and targeted approach to discovery. General allegations of “emotional distress” or “pre-existing conditions” will no longer suffice as justification for broad record requests. Defense counsel must demonstrate a direct nexus between the requested medical information and the specific injuries or causation at issue in the case. For example, if a Grubhub scooter rider alleges a traumatic brain injury (TBI) from a collision on Market Street, defense counsel might legitimately seek prior medical records related to concussions, neurological conditions, or even certain mental health treatments that could impact cognitive function or symptom presentation. However, they would likely struggle to justify a request for records detailing a plantar fasciitis diagnosis from several years ago, absent a clear and articulated connection to the claimed TBI. This requires defense teams to conduct more thorough initial investigations and to tailor their discovery requests with precision. They must be prepared to articulate in court, with specific arguments, why particular medical records are relevant and necessary to their defense. This could involve presenting expert declarations explaining the medical basis for seeking certain records. Failure to meet this heightened standard will likely result in court orders limiting or denying access to the requested information. This development shows the importance of early case assessment and strategic discovery planning.

Working through the New Discovery Field: Practical Steps

Attorneys on both sides must adapt their discovery practices to comply with Doe v. XYZ Corp. (2026).

For Plaintiff’s Counsel:

1. Proactive Objections: Do not wait for a motion to compel. Immediately object to any medical record request that appears overly broad. Reference the Doe v. XYZ Corp. decision directly in your objections.
2. Meet and Confer: Engage in good-faith meet and confer efforts with opposing counsel to narrow the scope of discovery. Be prepared to suggest specific categories of records that you deem relevant and offer to produce those, while firmly resisting irrelevant requests.
3. Motions for Protective Orders/Quash: If a meet and confer is unsuccessful, promptly file motions for protective orders or to quash subpoenas. Provide detailed arguments explaining the privacy interests and the lack of relevance of the requested records.
4. Redaction Protocols: If a court orders the production of certain records, ensure proper redaction of any truly irrelevant or highly sensitive information that falls outside the scope of the order. This might require a privilege log.
5. Educate Clients: Inform your clients, particularly those injured as Grubhub scooter riders, about their privacy rights and the new legal protections. Prepare them for potential discovery disputes.

For Defense Counsel:

1. Specificity in Requests: Draft medical record requests with extreme specificity. Instead of asking for “all medical records,” request “all records related to treatment for cervical spine injuries from January 1, 2020, to present” if whiplash is claimed.
2. Articulate Relevance: Be prepared to articulate the specific relevance of each category of medical record sought. If you believe a prior condition is relevant, explain why and how it connects to the current injuries or causation.
3. Expert Support: Consider obtaining expert declarations (e.g., from a medical doctor) to support the relevance of certain medical records, especially if the connection is not immediately obvious. This can be particularly persuasive to a judge.
4. Focus on Waivers: While the general waiver is limited, focus on any specific waivers the plaintiff might have made, such as by explicitly claiming a certain past condition was exacerbated by the accident.
5. Understanding Limitations: Recognize that the field has shifted. Overly aggressive discovery tactics regarding medical records are now less likely to succeed and more likely to result in sanctions or adverse rulings. The days of simply assuming you can access everything are gone.

The Role of Medical Providers and Electronically Stored Information

Medical providers also bear new responsibilities under this ruling. When served with subpoenas, they must exercise greater diligence in reviewing the scope of the request and ensuring that only records falling within the permissible waiver are produced. This may involve seeking clarification from the subpoenaing party or even contacting the patient’s attorney for guidance, especially if the subpoena appears overly broad. The California Medical Association (CMA) has issued advisories to its members, emphasizing the need for careful adherence to patient privacy laws, including the Confidentiality of Medical Information Act (CMIA) (California Civil Code Sections 56-56.37) and HIPAA, in light of the Doe v. XYZ Corp. decision. Plus, the proliferation of electronically stored information (ESI) means that medical records are often voluminous and easily accessible. While this can expedite discovery for relevant information, it also amplifies the potential for privacy breaches if requests are not properly narrowed. Lawyers must consider the practicalities of ESI production, including potential costs and the need for secure transfer protocols, when crafting or responding to medical record discovery requests. My experience suggests that many medical offices now use secure online portals for record requests, which can be efficient but also means that a single click can release thousands of pages of data. Therefore, the precision of the initial request or the strength of the objection becomes even more paramount. This ruling also impacts the use of Independent Medical Examinations (IMEs). While IMEs remain a critical tool for assessing injuries, the scope of a physician’s review of records during an IME will also be constrained by the same privacy principles. An IME physician cannot simply demand access to a plaintiff’s entire medical history if it extends beyond the scope of the claimed injuries. In conclusion, the California Supreme Court’s ruling in Doe v. XYZ Corp. (2026) marks a significant recalibration of medical record discovery in personal injury litigation. Attorneys representing individuals injured in incidents like a Grubhub scooter accident in San Francisco must now operate within a framework that prioritizes patient privacy while still allowing for legitimate discovery of relevant medical information. Adapting to this new standard requires careful attention to detail, proactive legal strategy, and a deep understanding of both constitutional privacy rights and civil procedure.