Posted by Post Authored By: Alexandra Morelli
The Illinois Supreme Court recently decided liability insurers are now prohibited from using or disclosing protected health information (PHI) for any purpose other than the litigation and are required to return or destroy the PHI at the end of the litigation. Haage v. Zavala, 2021 IL 125918.
The Haage decision stems from two automobile personal injury actions filed in Lake County with conflicting motions for qualified protective orders (QPOs). Plaintiffs’ filed motions for a QPO which alleged that the treating physicians, hospitals, and other care providers were subject to the Privacy Rule, that the covered entities possessed their PHI in the form of medical records, and that the parties/their agents/consultants/witnesses, would receive and review copies of the PHI. Accordingly, Plaintiffs’ proposed QPOs ordered: 1) that the PHI may not be disclosed for any reason without the party’s prior written consent or by way of court order specifying the parameters of the disclosure; and 2) that the PHI be destroyed or returned within 60 days after the conclusion of the litigation. These QPOs were granted by the trial court.
State Farm, the insurer for the Defendants in each case, intervened and filed objections to Plaintiffs’ proposed QPOs, and looked to the standard protective order used in the Law Division of Cook County for support. The Cook County standard protective order permits insurers to disclose, maintain, and use PHI for purposes beyond litigation and further exempts insurers having to return or destroy the PHI at the conclusion of the case. For these two reasons, the trial court found that the Cook County standard protective order violated HIPAA and the appellate court agreed. The appellate court further found that any person or entity receiving PHI in response to a QPO is bound by the terms of that order regardless of whether they are a “covered entity” or not.
The Illinois Supreme Court affirmed the appellate court decision, finding that the Privacy Rule applies to State Farm and any insurer – the reason being that an insurer, while not the disclosing party, is the party seeking Plaintiffs’ PHI and can only do so by complying with a QPO containing the “use and disclosure” prohibition and “return or destroy” requirement. As a result, the Illinois Supreme Court held that the Cook County standard protective order conflicted with HIPAA and was preempted by the Privacy Rule. The Court similarly rejected State Farm’s arguments that Illinois insurance law mandates the use, disclosure, and retention of PHI. Instead, the Court noted that in order to comply with state law, all State Farm would have to do is maintain a copy of the QPO in the file, which would explain why the documents (medical records and bills) were no longer in the file – because it is not permitted to keep the PHI following the close of litigation.
Based on this decision, a new standard protective order is likely coming Cook County’s way. In the meantime, liability insurers should work on developing a process to return or destroy all medical and billing record following the conclusion of a case.
About the Author:
Alexandra Morelli is an associate attorney with the law firm of Barker, Castro, Kuban & Steinback LLC. Alexandra concentrates her practice in the area of medical negligence serving in the defense of hospitals, physicians, and medical staff members. Her medical malpractice defense work involves pre-litigation investigation and counseling, as well as guidance and recommendations to her clients in various risk management strategies. She also handles a wide variety of civil defense litigation where she represents not-for-profit organizations and health care facilities in cases involving premises liability and personal injury. Prior to joining Barker, Castro, Kuban & Steinback LLC, Alexandra worked as a law clerk at one of Chicago’s prevalent plaintiff litigation firms, where she gained invaluable experience she uses to defend her current clients.