Opinion
No. 1-16-1300
05-10-2017
TRACY RUZZIER and GEORGE RUZZIER, Plaintiffs-Appellees, v. NORTHWESTERN LAKE FOREST HOSPITAL and NORTHWESTERN MEMORIAL HEALTHCARE, Defendants, (Northwestern Lake Forest Hospital, Defendant-Appellant).
NOTICE: This order was filed under Supreme Court Rule 23 and may not be cited as precedent by any party except in the limited circumstances allowed under Rule 23(e)(1).
Appeal from the Circuit Court of Cook County.
No. 15 L 4619
The Honorable Larry Axelrood, Judge Presiding.
JUSTICE PUCINSKI delivered the judgment of the court.
Presiding Justice Fitzgerald Smith and Justice Lavin concurred in the judgment.
ORDER
¶ 1 Held: The Illinois doctor-patient privilege and HIPAA did not preclude the disclosure of the names and addresses of the nonparty patient and the patient's visitor where the names and addresses were the only information sought.
¶ 2 The plaintiffs, Tracy and George Ruzzier, brought suit against the defendants, Northwestern Lake Forest Hospital ("Hospital") and Northwestern Memorial Healthcare
("Healthcare"), alleging personal injuries to Tracy and loss of consortium to George as a result of a fall sustained by Tracy while a patient at the Hospital. During discovery, the plaintiffs sought the name and address of the patient ("patient") who shared a room with Tracy on the date of her fall and a visitor of the patient's ("visitor") on the date of Tracy's fall, both of whom might have witnessed Tracy's fall. The Hospital refused to produce the requested information on the grounds that it was protected by the patient's privacy rights and the Health Insurance Portability and Accountability Act ("HIPAA") (Pub.L. No. 104-191, 110 Stat. 1936; 45 C.F.R. §§ 160 through 164 (2014)). The trial court denied the plaintiffs' request to compel the Hospital to provide the requested information. The trial court did, however, grant the plaintiffs' request to certify the question to us pursuant to Supreme Court Rule 308 (eff. Jan. 1, 2016). For the reasons that follow, we conclude that the requested information is not protected by either Illinois' doctor-patient privilege or HIPAA.
¶ 3 BACKGROUND
¶ 4 On May 5, 2015, the plaintiffs filed a complaint against the Hospital and Healthcare. In that complaint, the plaintiffs alleged that in May 2013, Tracy was a patient at the Hospital. On the day of her discharge, a hospital attendant employed by the defendants came to Tracy's hospital room with a wheelchair. The attendant stood at the door of Tracy's room and instructed Tracy to get out of bed and into the wheelchair. Tracy objected to walking to the wheelchair and asked the attendant to bring the wheelchair closer to the bed, but the attendant refused and again instructed Tracy to walk to the wheelchair. Tracy got out of bed and attempted to walk to the wheelchair but fell, injuring herself.
¶ 5 Tracy alleged that her injuries were the result of the defendants' negligence in that they (1) failed to provide her with safe egress out of the hospital by not bringing the wheelchair closer
to the bed and helping her into it; (2) ordered her to get out of bed and walk to the wheelchair despite her objections; (3) permitted her to get out of bed and walk to the wheelchair when they knew or should have known that she had taken pain medication that would impair her ability to walk; (4) failed to properly train Tracy's nurses to communicate with the attendant about Tracy's ability to get out of bed and walk to the wheelchair; and (5) failed to train the hospital attendant that the attendant was not to require patients to get out of bed and walk to the wheelchair when the patient had taken pain medication and was uncomfortable with walking to the wheelchair.
¶ 6 In addition to Tracy's personal injury claim, George brought a claim for loss of consortium based on Tracy's injuries.
¶ 7 The defendants responded by filing a "Motion to Dismiss and/or Transfer Venue Pursuant to Rule 187 and the Doctrine of Forum Non Conveniens" ("Motion to Transfer"), requesting that the case be transferred from Cook County to Lake County. In September 2015, prior to any ruling on the Motion to Transfer, the plaintiffs voluntarily dismissed Healthcare.
¶ 8 During discovery on the Motion to Transfer, the plaintiffs requested that the Hospital provide the last known name and address of the patient, along with the last known name and address of the visitor. The Hospital objected to these requests, stating that the information could not be obtained because to do so would violate the patient's privacy rights and HIPAA.
¶ 9 The plaintiffs brought a motion to compel the Hospital to answer the requests, but the trial court denied that motion. Thereafter, at a hearing on whether the trial court would enter a finding pursuant to Supreme Court Rule 304(a) (eff. Mar. 8, 2016) or Supreme Court Rule 308, the plaintiffs renewed their argument that the Hospital should be forced to provide the requested information. The trial court construed this argument as a motion to reconsider, which it then
denied. The trial court did, however, acquiesce in the plaintiffs' request that the issue be certified pursuant to Rule 308.
¶ 10 Thereafter, in accordance with Supreme Court Rule 308, the plaintiff requested that this court grant it leave to appeal the certified question, which we granted.
¶ 11 STANDARD OF REVIEW
¶ 12 Supreme Court Rule 308(a) provides for the review of a interlocutory order where the trial court finds that the order "involves a question of law as to which there is substantial ground for difference of opinion and that an immediate appeal from the order may materially advance the ultimate termination of the litigation." Our review of the certified question of law is de novo. Walker v. Ware, 2013 IL App (1st) 122364, ¶ 15.
¶ 13 The exact wording of the certified question, as stated on the record, was as follows: "Did [the trial court] err in denying [the plaintiffs'] request to enforce an answer to the interrogatory to disclose the identity of the patient and the patient's visitor in that particular room at that date, time, and location[?]" Although stated as a question of whether the trial court erred, our review is limited to the certified question of law, and we will not render any opinion on the propriety of the underlying ruling of the trial court. Id. Accordingly, the question of law to be answered here is whether the Illinois doctor-patient privilege and HIPAA preclude the disclosure of the patient's and the visitor's names and addresses.
¶ 14 ANALYSIS
¶ 15 On appeal, the plaintiffs argue that the Hospital was required to provide the last known name and address of the patient and visitor, because the disclosure of such information did not violate either the doctor-patient privilege found in section 8-802 of the Code of Civil Procedure (735 ILCS 5/8-802 (West 2014)) or the protections afforded by HIPAA. We agree.
¶ 16 Doctor-Patient Privilege
¶ 17 At common law, communications between a doctor and patient were not privileged. Parkson v. Central DuPage Hospital, 105 Ill. App. 3d 850, 852 (1982). In an effort to encourage frank disclosure between the patient and doctor and to protect patients' privacy (Petrillo v. Syntex Laboratories, Inc., 148 Ill. App. 3d 581, 602-03 (1986)), the Illinois General Assembly saw fit to enact a statutory doctor-patient privilege: "No physician or surgeon shall be permitted to disclose any information he or she may have acquired in attending any patient in a professional character, necessary to enable him or her professionally to serve the patient ***" (735 ILCS 5/8-802 (West 2014)). This privilege is not absolute, however, and the statute provides fourteen specific exceptions to the privilege, none of which are applicable in the present case. Id.
¶ 18 We conclude, as have many other courts before us, that this privilege does not protect the name and contact information of patients when that is the only information sought. See Giangiulio v. Ingalls Memorial Hospital, 365 Ill. App. 3d 823, 833 (2006); People, Department of Professional Regulation v. Manos, 326 Ill. App. 3d 698, 708 (2001); House v. SwedishAmerican Hospital, 206 Ill. App. 3d 437, 445 (1990); Davis v. Hinde, 141 Ill. App. 3d 664, 666 (1986); Geisberger v. Willuhn, 72 Ill. App. 3d 435, 438 (1979). This is because the privilege specifically protects only that information that is "necessary to enable [the doctor] professionally to serve the patient."
¶ 19 The last known name and address of the patient and the visitor was not information that would have had any bearing on the doctor's diagnosis or treatment of the patient. Nor would disclosing that information to the plaintiffs reveal anything about the patient's medical condition, diagnosis, or treatment. See Giangiulio, 365 Ill. App. 3d at 833 ("We find no nexus between the
information sought [the name, address, and telephone number of a non-party patient, Jane Doe] and the care or treatment that Jane Doe received or the medical or mental condition from which she suffered."); Manos, 326 Ill. App. 3d at 708 ("[W]e find that disclosing the addresses and telephone numbers of the patients *** will not provide any further insight into a particular patient's medical condition, diagnosis or treatment received."); House, 206 Ill. App. 3d at 445 ("Simply revealing the patient's identity, in and of itself, will not result in the disclosure of confidential communications. It is evident that disclosure of the patient's name does not violate the physician-patient privilege.").
¶ 20 The Hospital argues that the case law above is not as clearly in favor of disclosure as it seems, based on the Fifth District's decision in Coy v. Washington County Hospital District, 372 Ill. App. 3d 1077 (2007). According to the Hospital, the Fifth District found that a patient's name is, in fact, protected from disclosure. Although it is true that the Fifth District in Coy affirmed the trial court's decision to prevent the disclosure of certain patient identities, the procedural posture and analysis of Coy readily distinguishes it from the long-standing line of cases, cited above, that have held that the doctor-patient privilege in Illinois does not protect the name and contact information of a patient, when it is that information alone that is sought.
¶ 21 In Coy, the plaintiff doctor sued the defendant hospital over the hospital's suspension of the doctor's practicing privileges. Id. at 1078. The doctor and hospital ultimately entered into an agreed order. Id. Because the agreed order contained the names of seven patients who allegedly received substandard care at the hands of the doctor, the parties requested that it be filed under seal. Id. Journalists covering the story intervened in the case and filed a motion for access to the sealed order. Id. The trial court ultimately unsealed the agreed order, except for the names of
the seven patients, concluding that the names were protected by HIPAA and that there was otherwise good reason to seal the names of the patients. Id. at 1079.
¶ 22 On the journalists' appeal, the Fifth District first held that HIPAA did not apply because the trial court did not qualify as a covered entity under HIPAA and, thus, was not subject to its privacy rules. Id. at 1081. With respect to the trial court's exercise of its discretion in keeping the patients' names sealed, the Fifth District acknowledged Illinois' public policy in favor of patient privacy and the fact that by revealing that a person was treated by a certain type of physician, information about that person's medical condition might be revealed. Id. at 1083. On the other hand, there also existed a strong presumption in favor of public access to court records. Id. at 1079. The Fifth District concluded that the trial court properly balanced these competing interests by narrowly tailoring its restriction on access to the agreed order by redacting only the patients' names. Id. at 1083.
¶ 23 It is apparent that the Fifth District in Coy was not charged with answering the question of whether disclosure of the patients' names was prohibited by the statutory doctor-patient privilege. In fact, the Fifth District specifically noted that the privilege, along with other statutes addressing patient privacy rights, did not apply to the case. Id. at 1082. Rather, the Coy court addressed only the question of whether the trial court abused its discretion in keeping the patients' names sealed in light of the competing interests of patients' privacy and public access to court documents. Here, however, we are not reviewing the propriety of an order sealing court records. Instead, we are faced with the question of whether the patient's and her visitor's name and address is protected by the doctor-patient privilege, such that the Hospital cannot be compelled to disclose it in discovery. The holding and analysis in Coy has no bearing on this determination.
¶ 24 We find equally misplaced the Hospital's reliance on the Coy court's reasoning that the revelation of the names of a specific doctor's patients could reveal information about that patient's medical condition. Although we do not disagree that the revelation of the names of patients seeking treatment from a specialized doctor, such as an abortionist, psychiatrist, or oncologist, might also reveal information about the patient's medical condition, the plaintiffs in this case have not sought the names of patients connected to a specific physician. Rather, the plaintiffs have only requested the last known name of the patient sharing Tracy's room and that patient's visitor. There is nothing in the record before us that suggests that the patient has been connected to a specific doctor or department of the Hospital, and the Hospital does not explain how the disclosure of the patient's and visitor's names and addresses would otherwise reveal information about the patient's medical condition, diagnosis, or treatment.
¶ 25 Finally, the Hospital argues that the present case is distinguishable from past cases that have found the disclosure of patient names and contact information alone does not violate the doctor-patient privilege, because in those cases the patient whose information was sought played a role in the underlying incident (see Giangiulio, 365 Ill. App. 3d at 826 (patient was alleged to have attacked the plaintiff); House, 206 Ill. App. 3d at 439 (patient was alleged to have attacked the plaintiff); Geisberger, 72 Ill. App. 3d at 436 (patient's name was furnished to police as a possible suspect in an armed robbery)), while the patient and visitor in this case were, at most, mere fact witnesses. This is a distinction without a difference, however, as the patients' roles in the underlying incident played no role in the courts' privilege analyses in Giangiulio, House, and Geisberger. Nor should they, as the statutory privilege does not make the culpability of the patient a relevant consideration in determining whether his or her medical information is protected.
¶ 26 HIPAA
¶ 27 Having concluded that the names and addresses of the patient and the visitor are not protected from disclosure by Illinois' doctor-patient privilege, we turn now to the question of whether they are otherwise protected from disclosure by HIPAA. Again, we conclude they are not.
¶ 28 In general, HIPAA prevents the disclosure of "protected health information" except in certain, enumerated circumstances (45 C.F.R. § 164.502 (2013)), and the restrictions of HIPAA preempt any contrary state law, unless the state law is more stringent than the applicable HIPAA regulation (45 C.R.F. § 160.203(b) (2013)). In arguing that HIPAA does not preclude the disclosure of the patient's and visitor's name and address, the plaintiffs argue that because Illinois law is more stringent than HIPAA regarding the disclosure of nonparties' health information, HIPAA does not preempt Illinois law in this respect and, thus, is inapplicable. The Hospital makes no argument in response to the plaintiffs' preemption contention.
¶ 29 In support of their contention that HIPAA does not preempt Illinois law and, thus, has no application here, the plaintiffs cite to the decision in Giangiulio. In Giangiulio, this District was asked to determine whether the defendant hospital was required to disclose, among other things, the name, address, and telephone number of a nonparty patient who had attacked the plaintiff. Giangiulio, 365 Ill. App. 3d at 826, 839. The hospital argued that it could not disclose that information without violating the protections of HIPAA. Id. at 839. The appellate court disagreed, concluding that because Illinois law was more stringent than HIPAA when it came to the disclosure of information about nonparties, HIPAA did not preempt Illinois law in that respect. Id. at 840. Therefore, the appellate court held that HIPAA did not preclude disclosure of the patient's name, address, and telephone number. Id. at 841.
¶ 30 The present case is on all fours with Giangiulio. As in that case, the question is whether HIPAA prevents the disclosure of a non-party patient's (and visitor's) name and contact information. Because, as concluded in Giangiulio, HIPAA does not preempt Illinois law in this respect, HIPAA does not preclude the information's disclosure.
¶ 31 Even putting aside the preemption issue and assuming that the requested information is covered by HIPAA, as the Hospital claims, HIPAA nevertheless permits the disclosure of the information requested by the plaintiffs. The regulations promulgated under HIPAA specifically permit the disclosure of protected health information under the following relevant circumstances:
"Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding:
(i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected information expressly authorized by such order; or
(ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if:
(A) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or
(B) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that
meets the requirements of paragraph (e)(1)(v) of this section." 45 C.F.R. § 164.512(e)(1)(i)-(ii) (2013).
¶ 32 Clearly, there has been no court order directing the disclosure of the requested information, but the plaintiffs did make the request for the information pursuant to a discovery request. The record does not reflect whether the Hospital received satisfactory assurance from the plaintiffs that the patient has been given notice of the request or, in the alternative, that the plaintiffs have attempted to secure a protective order. Regardless, the question before us is whether HIPAA prevents the disclosure of the requested information, and we conclude that HIPAA does not preclude the disclosure of the patient's and visitor's name and address in this case, so long as the procedural requirements of 45 C.F.R. §164.512(e)(1) are satisfied.
¶ 33 The Hospital's contention that the above exceptions apply only to information regarding patients who are parties to the judicial or administrative proceeding is unavailing. First, the exception states that under the enumerated circumstances, "[a] covered entity may disclose protected health information in the course of any judicial or administrative proceeding." 45 C.F.R. § 164.512(e). Nowhere does the regulation limit its application to disclosure of protected health information in proceedings in which the patient is a party. Second, the Hospital cites no authority for its proposition that the exceptions at issue apply only when the patient is a party to the proceeding. Notably, other courts applying these exceptions have not felt constrained by the patient's lack of party status. See, e.g., United States v. Grace, 401 F. Supp. 2d 1093, 1098-99 (D. Montana Nov. 23, 2005) (permitting the disclosure of medical records of 1,200 non-party patients pursuant to 45 C.F.R. § 164.512(e)); Chapman v. Health and Hospitals Corps., 796 N.Y.S.2d 876, 939 (2005) (compelling the disclosure of non-party patient's medical records pursuant to 45 C.F.R. 164.512(e)).
¶ 34 CONCLUSION
¶ 35 In sum, we conclude that (1) the disclosure of the name and address of the patient and the visitor is not precluded by the Illinois doctor-patient privilege, because the information is not necessary for a doctor to render professional services and because the information does not reveal anything about the patient's medical condition, diagnosis, or treatment; and (2) the disclosure of the name and address of the patient and the visitor is not precluded by HIPAA, because HIPAA does not preempt Illinois law in this area and, even if it did, HIPAA permits the disclosure of such information in judicial proceedings, provided the correct procedure is followed pursuant to 45 C.F.R. §164.512(e).
¶ 36 Certified question answered.