743 S.E.2d 375 (Ga. 2013)
We granted certiorari in this case to consider whether the trial court erred when it granted a motion filed by a plaintiff in a medical malpractice action to compel the production of transcripts of ex parte physician interviews conducted by defense counsel pursuant to a qualified protective order. We find that production of such material is not required by the federal Health Insurance Portability and Accountability Act (“HIPAA”) or the language of the protective order entered in this case, but for the reasons set forth below, we vacate the judgment of the trial court and remand for further proceedings consistent with this opinion.
Following the death of his wife, Marilyn Kay Adams Jordan, appellee James Jordan initiated this medical malpractice action against appellants Wellstar Health System, Inc. and Dr. James Sutherland (collectively “Wellstar”).1 As part of its discovery plan, Wellstar sought to conduct informal ex parte interviews of certain non-party health care providers who previously had treated Jordan’s spouse. Wellstar thus moved the trial court, consistent with our holding in Baker v. Wellstar Health System, 288 Ga. 336 (703 SE2d 601) (2010), and the requirements of HIPAA, for a protective order. After a hearing, the trial court issued a qualified protective order authorizing Wellstar to conduct ex parte interviews of named health care providers for the limited purpose of questioning them about the “development of, diagnosis of, and treatment of the cancerous condition which caused or contributed to the death of Marilyn Kay Adams Jordan” or her smoking, as a condition from which she may have suffered, which “caused or contributed to cause a diminishment of her life expectancy or the enjoyment of her life.”2
Although the trial court determined that the circumstances did not require Wellstar’s counsel to provide Jordan with prior notice of or an opportunity to appear at the interviews, it did require that “the interviews be transcribed by a court reporter should Jordan make a written request for transcription.” Jordan asked that the interviews be transcribed and subsequently sought their production. Wellstar objected to production of the transcripts, claiming they were not subject to discovery because they constituted protected work product. See OCGA § 9-11-26 (b) (3). Jordan filed a motion to compel, which the trial court granted without conducting an in-camera review in an order summarily rejecting Wellstar’s work product claim. The Court of Appeals denied Well-star’s application for interlocutory appeal, and we granted a writ of certiorari to determine the propriety of the trial court’s production order.
Without stating the basis for its ruling, the trial court in this case directed Wellstar to produce transcripts of the ex parte interviews of identified health care providers. This Court already has determined that parties to litigation or other judicial proceedings may conduct ex parte interviews of health care providers consistent with the requirements of HIPAA as long as they first obtain a valid authorization or court order or otherwise comply with 45 CFR § 164.512 (e). Baker, supra, 288 Ga. at 337. See former OCGA § 24-9-40 (a) (waiving patient’s right to medical privacy to the extent patient places his care and treatment or nature and extent of his injuries at issue in any civil or criminal proceeding). Wellstar satisfied the requirements of 45 CFR § 164.512 (e) when it secured a qualified protective order that, inter alia, prohibited the parties from using protected health information for any unauthorized purpose and required the return or destruction of protected health information at the end of the litigation. Baker, supra, 288 Ga. at 337. For this reason, Jordan does not contend that Wellstar was without authority to conduct the ex parte interviews. He argues instead that HIPAA requires Wellstar to produce the transcripts because they contain protected health information. We cannot agree with Jordan’s interpretation of HIPAA.
HIPAA was enacted by Congress in part to “improve the efficiency and effectiveness of the health care system by facilitating the electronic exchange of information with respect to financial and administrative transactions carried out by health plans, health care clearinghouses, and health care providers.” 67 Fed. Reg. 14776 (March 27, 2002). Because Congress recognized that the information to be exchanged would necessarily include private health information, it simultaneously authorized the United States Department of Health and Human Services (“HHS”) to issue safeguards to protect the confidentiality of health information. Id.; 42 USC §§ 1320d-l (d), 1320d-2. Pursuant to this authority, HHS promulgated privacy rules which prohibit covered entities from disclosing protected health information except under certain specified circumstances.3
45 CFR §§ 160 et seq. and 164 et seq. A “covered entity” includes physicians and other health care providers who transmit health information in electronic form, health plans, and health care clearinghouses. 45 CFR §§ 160.102, 160.103 and 164.104.
Consistent with its purpose to protect the privacy of health information, HIPAA mandates disclosures only in very limited circumstances. Although HIPAA grants an individual the right to access his or her health information that is in the possession of a covered entity, there are limits to the scope of this right of access. See 45 CFR § 164.524 (a). The regulations specifically exempt from the individual’s right of access “[i]nformation compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding,” id. at (a) (1) (ii), and the regulations’ preamble expressly provides that “the covered entity may deny access to any information that relates specifically to legal preparations.” 65 Fed. Reg. 82462, 82554 (Dec. 28, 2000). The preamble further notes that the privacy regulations are not “intended] to require covered entities to provide access to documents protected by attorney work-product privilege nor [are they] intend[ed] to alter rules of discovery.” Id. Therefore, it is clear HIPAA does not entitle an individual to access protected work product in the possession of a covered entity simply by virtue of the fact that it contains protected health information. One seeking production of such information must do so in accordance with applicable rules of discovery.4
Given the language and focus of HIPAA’s privacy rules, we cannot agree with Jordan that HIPAA requires a party, without regard to privileges and protections afforded under state law, to produce materials containing health information obtained within the course of proper discovery. HIPAA therefore does not require the production of the transcripts at issue.
Jordan also contends production of the transcripts is required pursuant to the trial court’s qualified protective order. As stated, the trial court properly included in its protective order conditions limiting the scope of the ex parte interviews, forbidding defense counsel from disclosing protected health information for any unauthorized purpose, and requiring the return or destruction of any protected health information at the end of the litigation. See Baker, supra, 288 Ga. at 337; 45 CFR § 164.512 (e) (1) (v). The trial court’s order further states:
This Court has considered whether or not there are any circumstances which warrant requiring defense counsel to provide the plaintiff with prior notice of, and the opportunity to appear at, scheduled interviews. There appear to be no circumstances warranting such measures at this point. However, and alternatively, the Court does require the transcription of the interview by a court reporter should plaintiff make a written request for transcription.
Jordan argues this language reflects the trial court’s intent to require Wellstar to make the transcripts available to him.
Jordan’s argument fails for several reasons. First, we find nothing in the plain and unambiguous language of the protective order requiring Wellstar to produce the transcripts to its adversary in these proceedings. The protective order is silent as to both the purpose for the transcription requirement and whether anyone other than defense counsel would be entitled to the transcripts of the private interviews. Inasmuch as the protective order did not include in the first instance any language directing Wellstar to produce the transcripts, it cannot serve as the basis for the trial court’s order compelling their production. This is not to say that the trial court was without authority to impose a production requirement upon Wellstar. Under our decision in Baker, if good cause is shown, a trial court is authorized to impose additional procedural safeguards for the protection of the parties, including a requirement that defense counsel provide notice of the interview to the plaintiff and an opportunity to attend the interview or that the interview be transcribed at the plaintiff’s request. Id. at 339-340. The potential safeguards identified in Baker were not intended as an exclusive list, and a trial court could, under appropriate circumstances and within its discretion, direct both transcription of the ex parte interview and production of the transcript. To properly do so, however, a court must determine that circumstances require the imposition of additional safeguards and clearly notify the parties of the procedures to be followed.
Nor can we agree with Jordan that the only reason the trial court had to require transcription was to make the transcripts automatically available to him. In the sentence preceding the trial court’s directive that interviews be transcribed at Jordan’s request, the protective order references the absence at that point of any circumstances requiring notice to or the presence of Jordan at the interviews. Given the juxtaposition of these sentences and our discussion in Baker about safeguards to be considered by trial courts when drafting protective orders, we find it just as plausible that the transcription requirement was intended to provide a method for determining through in-camera review whether the court’s protective order had been violated.
Under Georgia law, documents and tangible things prepared in anticipation of litigation constitute highly protected work product discoverable only if the party moving to compel discovery demonstrates a substantial need for the materials and that he or she is unable without undue hardship to obtain the substantial equivalent of the materials by other means. OCGA § 9-11-26 (b) (3).5 The trial court in this case summarily determined the witness interview transcripts were not statutorily protected work product and ordered their production. We have no difficulty concluding this ruling was erroneous.
It is beyond dispute that proper preparation for trial demands that an attorney
assemble information, sift what he considers to be the relevant from the irrelevant facts, prepare his legal theories and plan his strategy without undue and needless interference. . . . This work is reflected, of course, in interviews, statements, memoranda, correspondence, briefs, mental impressions, personal beliefs, and countless other tangible and intangible ways.
Hickman v. Taylor, 329 U. S. 495, 510-511 (67 SCt 385, 91 LE 451) (1947). See McKinnon v. Smock, 264 Ga. 375, 377 (445 SE2d 526) (1994). “The protection shields an attorney’s preparation from disclosure because there is a ‘higher value’ to be served in protecting the thought processes of counsel.” Id. at 378. Under this well-established authority, the transcripts of non-party interviews conducted by Well-star in the preparation of its defense clearly constitute attorney work product.6
The fact that the transcripts constitute work product does not, by itself, compel reversal of the trial court’s order. A party may waive work product protection, see McKesson HBOC v. Adler, 254 Ga. App. 500, 502 (1) (562 SE2d 809) (2002), and even absent waiver, work product may still be discovered under OCGA § 9-11-26 (b) (3) if the party seeking production makes an affirmative showing that he has a substantial need for the evidence and that it would cause an undue hardship to develop this evidence by other means. OCGA § 9-11-26 (b) (3). The record before us indicates the trial court made no inquiry into the content of the transcripts and made no findings or conclusions with regard to Jordan’s need or hardship. See id.; McMillan v. GMC, 122 Ga. App. 855 (179 SE2d 99) (1970) (burden is on moving party to show necessity and justification). Because no findings have been made with regard to waiver or the second criteria for production of the transcripts and the trial court sits as the trier of fact in discovery disputes, the case must be remanded to the trial court. See McKesson, supra, 254 Ga. App. at 502 (1). If the trial court determines Jordan has met his burden, it then must conduct an in-camera examination to determine whether any portion of the transcripts may be produced without disclosing the mental impressions, conclusions, opinions, or legal theories of defense counsel concerning the litigation.7 See McKinnon, supra, 264 Ga. at 377-378.
Accordingly, the judgment of the trial court is vacated, and the case is remanded for further proceedings consistent with this opinion.
Judgment vacated and case remanded with direction.
All the Justices concur.
Green & Sapp, Henry D. Green, Jr., Mary P. Adams, Daniel J. Moriarty, for appellants.
Thomas W. Malone, Meri K. Benoit, for appellees.
Allen, McCain & OMahony, Hunter S. Allen, Jr., Simuel F. Dosier, Jr., Gary P. Bunch, amici curiae.