Like Board of Registered Nursing v. Superior Court (2021) 59 Cal.App.5th 1011, this writ proceeding arises from Johnson & Johnson’s discovery in the county’s opioid UCL, FAL and public nuisance action. J&J subpoenaed several non-party counties to produce records of opioid prescriptions and drug treatment records with intact personal identification information to J&J’s third party vendor for it to de-identify and then produce to J&J. Held, discovery order is reversed. The counties have standing to raise their patients’ privacy rights. The patients have a significant, legally protected in their medical records and have a reasonable expectation that their privacy interest in those records will not be invaded. The discovery orders would require a significant intrusion on the patients’ privacy interest. Their records would be produced with personal identification information to a third party. There was a risk of an intended or inadvertent data breach. Moreover, the vendor’s de-identification might well not prevent re-identification through comparison of this data set with others. Finally, J&J did not present sufficient evidence that the ordered discovery was justified by its interests in defending the litigation. It failed to show how the subpoenaed information could be used to disprove elements of the counties’ claims.