—

In an action to recover damages for personal injuries, the defendant appeals, as limited by its brief, from so much of an order of the Supreme Court, Westchester County (Donovan, J.), entered August 1, 2003, as, after an in camera review of the names and addresses of patients at the defendant hospital who were potential witnesses, pursuant to an order of the same court dated June 23, 2003, directed it to disclose that information to the plaintiff.

Ordered that on the Court's own motion, the notice of appeal is treated as an application for leave to appeal, and leave to appeal is granted (see CPLR 5701 [c]); and it is further,

Ordered that the order is reversed insofar as appealed from, on the law, with costs.

Since the Supreme Court's order did not determine a motion made on notice, it is not appealable as a matter of right (see CPLR 5701 [c]; Sauray v City of New York, 261 AD2d 601 [1999]). However, under the circumstances of this case, we find it appropriate to treat the notice of appeal as an application for leave to appeal, and grant leave to appeal.

On May 20, 1998, the plaintiff sustained an injury at the Cardiac Rehabilitation Center (hereinafter the Center) of the defendant Sound Shore Medical Center of Westchester (hereinafter the hospital), when an elevated treadmill was allegedly lowered onto her foot. After the commencement of the instant action, the plaintiff sought discovery of, inter alia, the names and addresses of the patients who were present in the Center at the time of the occurrence. Pursuant to two disclosure orders, dated March 28, 2003 and April 28, 2003, respectively, the Supreme Court directed the hospital to reveal the names and addresses. Pursuant to another order of the same court dated June 23, 2003, the hospital submitted a redacted copy of the Center's May 20, 1998, patient sign-in log book to the Supreme Court for an in camera review. After conducting the review, the Supreme Court directed the hospital to release the patients' names to the plaintiff. We reverse.

The physician-patient privilege (see CPLR 4504 [a]) shields a "patient's medical information (diagnosis, prognosis and propensities) from disclosure" (Matter of Ashford v Brunswick Psychiatric Ctr., 90 AD2d 848 [1982]). As a general rule, "[d]isclosure of the identity of a nonparty patient who may have been a witness to an alleged act of negligence or malpractice does not violate the privilege of confidentiality of treatment accorded those individuals under CPLR 4504 (subd [a])" (Hirsch v Catholic Med. Ctr. of Brooklyn & Queens, 91 AD2d 1033, 1034 [1983]).

In the case at bar, the plaintiff's request to discover the names of the other patients in the Center who may have witnessed the accident was not a request to discover their medical information per se. However, since disclosure of the patients' names will, in effect, reveal that they were undergoing treatment for cardiac-related conditions, such discovery is prohibited under CPLR 4504 (a) (see generally Matter of Grand Jury Investigation in N.Y. County, 98 NY2d 525 [2002]; Matter of Grand Jury Investigation of Onondaga County, 59 NY2d 130 [1983]).

The modern-day legislative trend is to protect a medical patient's privacy (see e.g. Health Insurance Portability and Accountability Act of 1996, 42 USC § 1320d et seq., as added by Pub L 104-191, Title II, § 262 [a], 110 US Stat 2021 [hereinafter HIPAA]). Under HIPAA, "protected health information" is broadly defined as any individually-identifiable health information which was created by, among others, a health care provider, and which relates to, inter alia, the past, present, or future physical or mental health or condition of an individual (42 USC 1320d [6]; 45 CFR 160.103). HIPAA and its supporting regulations, inter alia, established standards and procedures for the collection and disclosure of protected health information to prevent its wrongful disclosure.

The defendant has not raised the issue of whether HIPAA prohibits the information sought by plaintiff and thus we do not reach this issue. However, the passage of HIPAA lends support to the conclusion that disclosure of the identity of the other patients at the Center would breach the physician-patient privilege and thus should not be permitted. Santucci, J.P., S. Miller, Townes and Rivera, JJ., concur.