Opinion
Nos. 2-19-0499 2-19-0500 cons.
03-13-2020
Rosemarie HAAGE, Plaintiff-Appellee, v. Alfonso Montiel ZAVALA, Patricia Santiago, Jose Pacheco-Villanuevo, Okan Esmez, and Rosalina Esmez, Defendants (State Farm Mutual Automobile Insurance Company, Intervenor-Appellant). Agnieszka Surlock and Edward Surlock, Plaintiffs-Appellees, v. Dragoslav Starcevic, Defendant (State Farm Mutual Automobile Insurance Company, Intervenor-Appellant).
Glen E. Amundsen and Michael Resis, of SmithAmundsen LLC, of Chicago, for appellant. Robert D. Fink and Kenneth A. Koppelman, of Collison Law Offices, of Chicago, for appellees.
Glen E. Amundsen and Michael Resis, of SmithAmundsen LLC, of Chicago, for appellant.
Robert D. Fink and Kenneth A. Koppelman, of Collison Law Offices, of Chicago, for appellees.
JUSTICE HUDSON delivered the judgment of the court, with opinion. ¶ 1 I. INTRODUCTION
¶ 2 This consolidated appeal concerns the scope of protective orders involving the
disclosure of protected health information (PHI) to a property and casualty insurer. In each of the two underlying cases, plaintiffs sued to recover damages occasioned by the alleged negligence of defendants in driving their automobiles. Plaintiffs subsequently moved for the entry of qualified protective orders pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended in scattered sections of Titles 18, 26, 29, and 42 of the United States Code)) (HIPAA qualified protective orders). Among other things, the protective orders proposed by plaintiffs would have (1) prohibited the parties and any other persons or entities from using or disclosing PHI for any purpose other than the litigation for which it was requested and (2) required the return or destruction of the PHI within 60 days after the conclusion of the litigation. See 45 C.F.R. § 164.512(e)(1)(v)(A), (B) (2018) (setting forth requirements for a qualified protective order under HIPAA). State Farm Mutual Automobile Insurance Company (State Farm), the liability insurer for at least one of the named defendants in each case, petitioned to intervene. After the circuit court of Lake County granted the petition in each case, State Farm filed objections to the HIPAA qualified protective orders. State Farm argued, inter alia , that the HIPAA qualified protective orders (1) sought to bind State Farm to the requirements of HIPAA, although State Farm is expressly exempt from the statute's application and (2) directly conflicted with State Farm's obligations and rights under the Illinois Insurance Code ( 215 ILCS 5/1 et seq. (West 2018)) and the administrative regulations governing its business operations. State Farm requested that the trial court deny the HIPAA qualified protective orders and enter, pursuant to Illinois Supreme Court Rule 201(c)(1) (eff. May 29, 2014), protective orders similar to one used in the law division of the circuit court of Cook County (Cook County protective orders). The Cook County protective orders would permit insurance companies to "disclose, maintain, use, and dispose of PHI or what would otherwise be considered PHI to comply and conform with current and future applicable federal and state statutes, rules, and regulations" for certain designated purposes and exempt insurers from any "return or destroy" provisions.
¶ 3 Following a combined hearing and additional briefing, the trial court in each case granted plaintiffs' motions for the HIPAA qualified protective orders and denied State Farm's request for the Cook County protective orders. The trial courts determined, among other things, that (1) to the extent that State Farm's obligations and rights under Illinois law conflict with HIPAA requirements, the federal statute and its regulations preempt state law and (2) any individual or entity receiving PHI in response to a HIPAA qualified protective order is bound to follow the terms of the order. State Farm filed an interlocutory appeal in each case, pursuant to Illinois Supreme Court Rule 307(a)(1) (eff. Nov. 1, 2017). On appeal, State Farm contends that the trial courts erred in granting plaintiffs' motions for the HIPAA qualified protective orders. We affirm.
¶ 4 II. BACKGROUND
¶ 5 To provide context to the parties' arguments, we briefly review the relevant provisions of HIPAA before discussing the facts underlying this appeal.
¶ 6 A. HIPAA
¶ 7 In 1996, Congress passed, and President Clinton signed into law, HIPAA (Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended in scattered sections of Titles 18, 26, 29, and 42 of the United
States Code)). Among HIPAA's purposes were to establish national privacy standards and fair information practices regarding individually identifiable health information. Brende v. Hara , 113 Hawai'i 424, 153 P.3d 1109, 1114 (2007) ; see also Wade v. Vabnick-Wener , 922 F. Supp. 2d 679, 687 (W.D. Tenn. 2010) ("HIPAA embodies Congress' recognition of ‘the importance of protecting the privacy of health information in the midst of the rapid evolution of health information systems.’ " (quoting South Carolina Medical Ass'n v. Thompson , 327 F.3d 346, 348 (4th Cir. 2003) ); Law v. Zuckerman , 307 F. Supp. 2d 705, 710 (D. Md. 2004) ("Congress enacted HIPAA, in part, to protect the security and privacy of individually identifiable health information."); U.S. Dep't of Health & Human Servs., Office for Civil Rights, Summary of the HIPAA Privacy Rule 1 (May 2003), https://www.hhs.gov/sites/default/files/privacysummary.pdf [https://perma.cc/F66C-T4TR] ("A major goal of [HIPAA] is to assure that individuals' health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well being."). To this end, HIPAA authorized the Secretary of the Department of Health and Human Services (HHS) to issue regulations governing individually identifiable health information if Congress did not enact privacy legislation within three years of the passage of the statute. HIPAA, Pub. L. No. 104-191, § 264(c)(1), 110 Stat. 1936, 2033-34 (1996); U.S. Dep't of Health & Human Servs., Office for Civil Rights, Summary of the HIPAA Privacy Rule 1-2 (May 2003), https://www.hhs.gov/sites/ default/files/privacysummary.pdf [https://perma.cc/F66C-T4TR]; Arons v. Jutkowitz , 9 N.Y.3d 393, 850 N.Y.S.2d 345, 880 N.E.2d 831, 840 (2007). Congress did not meet its self-imposed deadline, so HHS proposed and subsequently adopted the "Privacy Rule," a series of regulations governing permitted uses and disclosures of PHI. Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462 (Dec. 28, 2000) ; U.S. Dep't of Health & Human Servs., Office for Civil Rights, Summary of the HIPAA Privacy Rule 2 (May 2003), https://www.hhs.gov/sites/default/files/ privacysummary.pdf [https://perma.cc/F66C-T4TR]; Arons , 850 N.Y.S.2d 345, 880 N.E.2d at 840. The Privacy Rule is codified at parts 160 and 164 of Title 45 of the Code of Federal Regulations (45 C.F.R. pt. 160, 164 (2018)). U.S. Dep't of Health & Human Servs., Office for Civil Rights, Summary of the HIPAA Privacy Rule 2 (May 2003), https://www.hhs.gov/sites/default/files/privacysummary.pdf [https://perma.cc/F66C-T4TR]; Arons , 850 N.Y.S.2d 345, 880 N.E.2d at 840.
¶ 8 The Privacy Rule prohibits the use or disclosure of an individual's PHI by a "covered entity" or "business associate" unless the individual has consented in writing or unless the use or disclosure is otherwise specifically permitted or required by the Privacy Rule. 45 C.F.R. §§ 164.502, 164.506, 164.508, 164.510, 164.512 (2018). With exceptions not relevant here, the Privacy Rule defines the term "protected health information" as "individually identifiable health information" transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. 45 C.F.R. § 160.103 (2018). In turn, "individually identifiable health information" means information, including demographic data, that (1) relates to "the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual" and (2) "identifies the individual" or where "there is a reasonable basis to
believe the information can be used to identify the individual." 45 C.F.R. § 160.103 (2018). A "covered entity" means "[a] health plan," "[a] health care clearinghouse," or "[a] health care provider who transmits any health information in electronic form" as those terms are defined in the regulation. 45 C.F.R. § 160.103 (2018). A "business associate" is a person, other than a member of a covered entity's workforce, who performs certain functions or activities on behalf of or provides certain services to a covered entity that involve the use or disclosure of PHI. 45 C.F.R. § 160.103 (2018).
¶ 9 Relevant to this dispute, the Privacy Rule permits a "covered entity" to use or disclose PHI, in the course of any judicial or administrative proceeding, without the written authorization of the individual to whom it belongs. 45 C.F.R. § 164.512(e) (2018). However, the Privacy Rule places certain requirements on both the party providing the information and the party seeking it. U.S. Dep't of Health & Human Servs., Office for Civil Rights, Summary of the HIPAA Privacy Rule 6 (May 2003), https://www.hhs.gov/sites/default/files/privacysummary.pdf [https://perma.cc/F66C-T4TR]. Hence, a covered entity may disclose PHI expressly authorized by a court order. 45 C.F.R. § 164.512(e)(1)(i) (2018). A covered entity may also disclose PHI "[i]n response to a subpoena, discovery request, or other lawful process, not accompanied by an order of a court," if the covered entity "receives satisfactory assurance * * * from the party seeking the information" that the party has made reasonable efforts (1) to ensure that the individual who is the subject of the PHI has been given notice of the request or (2) to secure a qualified protective order. 45 C.F.R. § 164.512(e)(1)(ii) (2018). In addition, a covered entity may disclose PHI in response to "lawful process," without receiving satisfactory assurance from the requesting party, if the covered entity itself makes reasonable efforts to notify the individual or seek a qualified protective order. 45 C.F.R. § 164.512(e)(1)(vi) (2018). With respect to PHI, a "qualified protective order" under the Privacy Rule means an order of the court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that (1) "[p]rohibits the parties from using or disclosing the [PHI] for any purpose other than the litigation or proceeding for which such information was requested" and (2) "[r]equires the return to the covered entity or destruction of the [PHI] (including all copies made) at the end of the litigation or proceeding." 45 C.F.R. § 164.512(e)(1)(v)(A), (B) (2018).
¶ 10 HIPAA and its regulations establish a "uniform federal ‘floor’ of privacy protections for individual medical information." Scott D. Stein, What Litigators Need to Know About HIPAA , 36 J. Health L. 433, 434 (2003) ; see also Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,471 ("The protections [(provided by HIPAA and its regulations)] are a mandatory floor, which other governments and any covered entity may exceed."); 45 C.F.R. § 164.502(a) (2018). As a result, HIPAA preempts "contrary" state laws unless the state law is "more stringent" than the standards set forth in the Privacy Rule. 42 U.S.C. § 1320d-7 (2018) ; 45 C.F.R. §§ 160.202, 160.203(b), 164.502(a) (2018) ; Giangiulio v. Ingalls Memorial Hospital , 365 Ill. App. 3d 823, 840, 302 Ill.Dec. 812, 850 N.E.2d 249 (2006) ; Stein, supra , at 434. A state law is "contrary" to HIPAA if a "covered entity or business associate would find it impossible to comply with both the State and Federal requirements" or if the "provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of [HIPAA]."
45 C.F.R. § 160.202 (2018). A state law is "more stringent" than HIPAA if the state law provides greater privacy protection or privacy rights. 45 C.F.R. § 160.202 (2018) ; Giangiulio , 365 Ill. App. 3d at 840, 302 Ill.Dec. 812, 850 N.E.2d 249 ; Caldwell v. Chauvin , 464 S.W.3d 139, 153 (Ky. 2015) ("[I]f a ‘contrary’ [state] law requires a more stringent standard of privacy, HIPAA's preemption provisions are inapplicable and state law controls." (Emphasis in original.)). In addition, HIPAA will not preempt a contrary state law if the Secretary of HHS determines, in response to a request by the State, that, among other things, the state law is necessary for one of the specified purposes set forth in section 160.203(a)(1) of the Privacy Rule. 45 C.F.R. §§ 160.203(a)(1), 160.204 (2018).
¶ 11 B. Underlying Facts
¶ 12 1. Haage Complaint
¶ 13 On November 15, 2017, plaintiff, Rosemarie Haage, filed a five-count complaint against defendants Alfonso Montiel Zavala, Patricia Santiago, Jose Pacheco-Villanuevo, Okan Esmez, and Rosalina Esmez. The action arose out of a multi-vehicle collision near the intersection of Lakeview Parkway and Route 60 in Vernon Hills. Count I of the complaint alleged negligence on the part of Zavala, count II alleged negligent entrustment on the part of Santiago, count III alleged negligence on the part of Pacheco-Villanuevo, count IV alleged negligence on the part of Okan Esmez, and count V alleged negligent entrustment on the part of Rosalina Esmez. All counts sought to recover damages for, inter alia , Haage's bodily injuries.
¶ 14 2. Surlock Complaint
¶ 15 On January 11, 2018, plaintiffs, Agnieszka and Edward Surlock, filed a two-count complaint against defendant Dragoslav Starcevic. The action arose out of an automobile accident between Agnieszka and Starcevic on January 24, 2016, at the intersection of Grand Avenue and Route 45 in Lindenhurst. Count I of the complaint alleged negligence and sought to recover damages for, inter alia , Agnieszka's bodily injuries. Count II of the complaint alleged loss of consortium on behalf of Edward, Angieszka's husband.
¶ 16 3. Motions for Entry of Protective Orders
¶ 17 On August 23, 2018, the Surlocks and Haage each filed a "Motion for Entry of Protective Order and Authorization to Disclose Protected Health Information" in their respective lawsuits. The motions alleged that Agnieszka's and Haage's treating physicians, hospitals, and other healthcare providers, all of whom are "covered entities" as defined by the Privacy Rule, possess their PHI. The motions further alleged that both the prosecution and the defense in each case "will require that the parties, their attorneys, their attorneys' agents, consultants and various witnesses and other personnel receive and review copies of the protected health information" but that HIPAA "potentially prohibits covered entities from disclosing protected health information in judicial proceedings other than by authorization or Qualified Protective Order." See 45 C.F.R. § 164.512(e) (2018). Accordingly, the Surlocks and Haage requested HIPAA qualified protective orders permitting the use and disclosure of PHI pertaining to Agnieszka and Haage. Relevant to these appeals, the HIPAA qualified protective orders proposed by the Surlocks and Haage would (1) require any person or entity in possession of PHI received pursuant to the protective order, including an insurance company, to return or destroy any and all PHI pertaining to the plaintiffs within 60 days after the conclusion of the litigation ( 45 C.F.R. § 164.512(e)(1)(v)(B) (2018) ) and (2) prohibit the parties, their attorneys, and their insurers from using or disclosing
PHI for any purpose other than the litigation at issue ( 45 C.F.R. § 164.512(e)(1)(v)(A) (2018) ). A hearing on plaintiffs' motions was scheduled for October 6, 2018.
¶ 18 4. Petitions to Intervene
¶ 19 On September 17, 2018, State Farm filed a petition to intervene in the Surlock case as a matter of right pursuant to section 2-408(a)(2) of the Code of Civil Procedure (Code) ( 735 ILCS 5/2-408(a)(2) (West 2018)). On September 28, 2018, State Farm filed a nearly identical petition to intervene in the Haage litigation. State Farm sought to intervene on the basis that, as the liability insurer for Starcevic and at least one of the named defendants in the Haage case, the proposed HIPAA qualified protective orders would impose upon it "significant restrictions and obligations." State Farm asserted that it met the threshold requirements to intervene as of right pursuant to section 2-408(a)(2) of the Code, because (1) its petitions were timely, having been filed before the entry of the HIPAA qualified protective orders, (2) representation of its interest by existing parties would be inadequate, as the attorneys representing its policyholders are not conversant with either the legal issues raised by the proposed HIPAA qualified protective orders or the laws and regulations applicable to State Farm's business operations, and (3) the negative effect on State Farm if the HIPAA qualified protective orders were entered is of no concern or consequence to State Farm's policyholders. Over plaintiffs' objections, the trial court granted State Farm's petitions to intervene and allowed State Farm leave to file objections to the HIPAA qualified protective orders.
¶ 20 5. State Farm's Objections
¶ 21 In support of its objections, State Farm initially argued that the HIPAA qualified protective orders proposed by plaintiffs seek to bind it to HIPAA's requirements, even though it is exempt from the statute's application. In this regard, State Farm asserted that, as a property and casualty insurer, it is not a "covered entity" under HIPAA. State Farm also argued that restrictions in the proposed HIPAA qualified protective orders would directly conflict with its obligations and rights under Illinois law in two principal ways. First, State Farm asserted that requiring it to return or destroy all copies of PHI following the conclusion of the litigation would interfere with its obligations under provisions of both the Illinois Insurance Code and the Illinois Administrative Code, which require it to maintain a complete record of all books, records, and accounts, including claim files and claim data, and to make that information available for examination upon request to the Illinois Department of Insurance. See 215 ILCS 5/133(2) (West 2018); 50 Ill. Adm. Code 919.30 (1989). According to State Farm, this would encompass medical records and PHI produced to it. State Farm maintained that its failure to comply with its obligations under Illinois law could subject the company to possible disciplinary action by the state. Second, State Farm asserted that restricting the use of the PHI to the litigation at issue would interfere with its rights under Illinois law to use plaintiffs' information to perform "certain insurance functions," including (1) claims administration; (2) the detection, investigation, or reporting of actual or potential fraud, misrepresentation, or criminal activity; (3) underwriting; (4) ratemaking and guaranty fund functions; (5) reinsurance and excess loss insurance; and (6) actuarial, scientific, medical, or public policy research.
¶ 22 State Farm also questioned the use of a qualified protective order in light of the fact that the Privacy Rule provides
that PHI may be produced in litigation by several other procedures that would not impede the access, use, and retention of medical records by a property and casualty insurer. See 45 C.F.R. §§ 164.502(b)(2), 164.508, 164.512(e)(1)(i), (ii) (2018). As an alternative to plaintiffs' proposed HIPAA qualified protective orders, State Farm urged the courts to adopt and enter, pursuant to Illinois Supreme Court Rule 201(c)(1) (eff. May 29, 2014), the Cook County protective order, which is the standard "HIPAA Protective Order" used by the law division of the circuit court of Cook County pursuant to General Administrative Order 17-4 (Cook County Cir. Ct. Law Div. Gen. Adm. Order 17-4 (Dec. 15, 2017)). Paragraph two of the Cook County protective order permits insurance companies to "disclose, maintain, use, and dispose of PHI or what would otherwise be considered PHI to comply and conform with current and future applicable federal and state statutes, rules, and regulations" for the 11 designated purposes enumerated therein. Cook County Cir. Ct. Law Div. Gen. Adm. Order 17-4 (Dec. 15, 2017). The Cook County protective order also exempts insurance companies from any "return or destroy" provision, but only for the purposes listed in paragraph two. Cook County Cir. Ct. Law Div. Gen. Adm. Order 17-4 (Dec. 15, 2017). State Farm maintained that the Cook County protective order "omits unnecessary restrictions and explicitly accommodates casualty insurers' obligations under applicable state and federal law."
After State Farm petitioned to intervene, General Administrative Order 17-4 was vacated by the law division of the circuit court of Cook County, pursuant to General Administrative Order 18-1 (Cook County Cir. Ct. Law Div. Gen. Adm. Order 18-1 (Oct. 29, 2018)). General Administrative Order 18-1 adopted a "HIPAA Qualified Protective Order" to replace the standard "HIPAA Protective Order" that had been previously used under General Administrative Order 17-4. Other than some minor modifications, the "HIPAA Qualified Protective Order" approved by General Administrative Order 18-1 is nearly identical to the standard "HIPAA Protective Order" adopted pursuant to General Administrative Order 17-4. General Administrative Order 18-1 is the subject of Proposal 18-01, which would amend Illinois Supreme Court Rule 218 (eff. July 1, 2014). A public meeting regarding Proposal 18-01 was held before the Illinois Supreme Court Rules Committee on June 19, 2019. At oral argument, the parties represented that, to the best of their knowledge, no additional action has been taken with respect to Proposal 18-01.
¶ 23 6. Plaintiffs' Replies to State Farm's Objections
¶ 24 In their replies to State Farm's objections, plaintiffs argued that, absent a waiver from the federal government, HIPAA prohibits the use or disclosure of PHI for any purpose other than the litigation or proceeding for which such information was requested and requires the return or destruction of PHI at the end of the litigation or proceeding. See 45 C.F.R. § 164.512(e)(1)(v)(A), (B) (2018). Thus, plaintiffs reasoned, to the extent that any state law or regulation permits State Farm to use, store, maintain, or distribute PHI outside the scope of litigation and for their own business operations, it is preempted by HIPAA. See 42 U.S.C. § 1320d-7 (2018) ; 45 C.F.R. § 160.203 (2018) (providing that a standard, requirement, or implementation specification adopted under HIPAA regulations that is contrary to a provision of state law preempts the state law provision).
¶ 25 Plaintiffs further asserted that no fact or law supports State Farm's claim that their proposed HIPAA qualified protective orders impose upon insurers undue restrictions or obligations. According to plaintiffs, there is no language in either the Illinois Insurance Code or the Illinois Administrative Code requiring non-health
insurers to retain PHI and there has never been a disciplinary action taken against State Farm for failing to maintain PHI despite the entry each year of thousands of HIPAA qualified protective orders. Thus, plaintiffs concluded, their proposed HIPAA qualified protective orders do not place any obligations or restrictions on State Farm that would affect the reporting obligations of non-health insurers. Plaintiffs also disputed State Farm's claim that it requires PHI in order to perform "certain insurance functions," arguing that State Farm failed to cite any policies or regulations that would require the use of PHI for such purposes. Plaintiffs further posited that, even if State Farm is correct and Illinois law does require it to maintain PHI for purposes other than the litigation, any statute or regulation would be preempted by HIPAA.
¶ 26 Plaintiffs also asserted that, whether State Farm is exempt from HIPAA because it is not a "covered entity" is "a moot point," because a determination of that issue does not control a court's ability to enter a HIPAA qualified protective order restricting what a "non-covered entity" can do with PHI received from a covered entity. In this regard, State Farm obtains the ability to review plaintiffs' PHI only because of a valid protective order. Thus, if State Farm wishes to access the PHI at issue, it must abide by the terms of any HIPAA qualified protective order entered by the court. Plaintiffs concluded that, if State Farm's arguments are accepted, then a court could never enter a meaningful protective order that would require the destruction of PHI at the conclusion of litigation, as clearly required by HIPAA.
¶ 27 7. Trial Court Proceedings and Orders
¶ 28 On February 13, 2019, the trial courts held a combined hearing on plaintiffs' motions for HIPAA protective orders. On May 15, 2019, following additional briefing by the parties, the trial courts issued a memorandum opinion and order granting plaintiffs' motions. In so ruling, the trial courts determined that, to the extent that State Farm's obligations and rights under Illinois law conflict with HIPAA's requirements, the federal statute preempts state law. The courts noted that it would be impossible to comply with both Illinois law and HIPAA requirements for a qualified protective order. Specifically, in direct conflict with HIPAA, adoption of the Cook County protective order would allow insurance companies to disclose, maintain, use, and dispose of PHI outside of the litigation and would not require insurers to return the PHI at the end of the litigation. See 45 C.F.R. § 164.512(e)(1)(v)(A), (B) (2018). The courts also concluded that State Farm's interpretation of Illinois law defeats the full purposes and objectives of HIPAA. In this regard, the courts determined that, by eliminating the two requirements for a HIPAA qualified protective order, the Cook County order would not provide the confidentiality and protection of PHI envisioned when the Privacy Rule was enacted and would lower the protective floor that Congress provided in enacting HIPAA.
¶ 29 Next, the courts addressed State Farm's claim that plaintiffs' proposed HIPAA qualified protective orders seek to bind it to HIPAA's requirements, although it is expressly exempt from the statute's application. While the courts agreed that, as a property and casualty liability insurer, State Farm is not a covered entity under HIPAA, they also determined that State Farm is not exempt from obeying a protective order entered with respect to PHI that has been produced by a covered entity. The courts concluded that all parties receiving PHI must follow the qualified protective order, regardless of whether
they are covered entities under HIPAA in the first instance. The courts reasoned that a qualified protective order would "lose[ ] its effectiveness" in protecting an individual's PHI if a non-covered entity may ignore the restrictions required by HIPAA. The courts further concluded that Congress could not have intended that, at the close of litigation, noncovered entities may use PHI for their own private business purposes simply by virtue of their status as a non-covered entity.
¶ 30 Finally, the courts considered whether to avoid conflict with State Farm's alleged obligations and rights under Illinois law by treating plaintiffs' motions as proposals for a court order pursuant to 45 C.F.R. § 164.512(e)(1)(i) (2018) instead of as "qualified protective order[s]" accompanying "a subpoena, discovery request, or other lawful process" pursuant to 45 C.F.R. § 164.512(e)(1)(ii) (2018). The courts acknowledged that the Privacy Rule provides several different methods by which a covered entity may disclose PHI, but they noted that plaintiffs elected to seek HIPAA qualified protective orders, under 45 C.F.R. § 164.512(e)(1)(ii) (2018). As such, the courts concluded, it was "irrelevant" whether a different method could be used that would avoid conflict with State Farm's alleged obligations and rights under Illinois law.
¶ 31 Accordingly, the courts denied State Farm's request for the Cook County protective orders and granted plaintiffs' motions for the HIPAA qualified protective orders. On May 15, 2019, the court in the Surlock case entered a HIPAA qualified protective order. On May 16, 2019, the court in the Haage case entered a HIPAA qualified protective order. Relevant here, the HIPAA qualified protective orders entered by the courts provided:
"8. Within 60 days after the conclusion of the litigation, including appeals, the parties, their attorneys, insurance companies and any person or entity in possession of PHI received pursuant to this Order, shall return Plaintiff's PHI to the covered entity or destroy any and all copies of PHI pertaining to Plaintiff , including any electronically stored copy or image, except that counsel are not required to secure the return or destruction of PHI submitted to the Court.
* * *
12. All requests by or on behalf of any Defendant for protected health information, including but not limited to subpoenas, shall be accompanied by a complete copy of this Order. The parties—including their insurers and counsel—are prohibited from using or disclosing protected health information for any purpose other than this litigation . ‘Disclose’ shall have the same * * * scope and definition as set forth in 45 C.F.R. § 160.103 : ‘the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.’ " (Emphases added.)
¶ 32 8. Postentry Proceedings
¶ 33 On June 6, 2019, State Farm filed a motion to stay portions of the HIPAA qualified protective orders, pursuant to Illinois Supreme Court Rule 305(b) (eff. July 1, 2017), pending interlocutory appeal by State Farm. On June 12, 2019, State Farm filed a notice of interlocutory appeal in each case pursuant to Illinois Supreme Court Rule 307(a)(1) (eff. Nov. 1, 2017) (allowing an appeal to be taken to the appellate court from an interlocutory order granting, modifying, refusing, dissolving, or refusing to dissolve or modify an injunction). On June 26, 2019, this court granted State Farm's motion to consolidate the appeals. On June 28, 2019, plaintiffs filed with this court a motion to dismiss the
appeals as improper under Rule 307(a)(1). This court denied plaintiffs' motion to dismiss on July 10, 2019. See In re Appointment of Special Prosecutor , 2017 IL App (1st) 161376, ¶ 31, 418 Ill.Dec. 723, 91 N.E.3d 424 ("A protective order ‘circumscribing the publication of information is reviewable as an interlocutory injunctive order, pursuant to Rule 307(a)(1).’ " (quoting Skolnick v. Altheimer & Gray , 191 Ill. 2d 214, 221, 246 Ill.Dec. 324, 730 N.E.2d 4 (2000) )); see also In re Daveisha C. , 2014 IL App (1st) 133870, ¶ 25, 384 Ill.Dec. 875, 17 N.E.3d 857 (holding that Rule 307(a)(1) allows review of an order granting or denying injunctive relief, including a protective order entered during the discovery phase of the proceedings); Bush v. Catholic Diocese of Peoria , 351 Ill. App. 3d 588, 590, 286 Ill.Dec. 485, 814 N.E.2d 135 (2004) (deciding interlocutory appeal pursuant to Rule 307(a)(1) from entry of protective order).
¶ 34 III. ANALYSIS
¶ 35 On appeal, State Farm argues that it is not a "covered entity" subject to HIPAA and that, therefore, the trial court erred in finding that HIPAA and the Privacy Rule preempted its obligations under state law. State Farm further contends that the HIPAA qualified protective orders entered by the trial courts conflict in two principal ways with the use, retention, and disclosure of PHI authorized by the Illinois Insurance Code and the Illinois Administrative Code. First, the protective orders limit the use of PHI to the litigation in which it was produced. Second, they require the return or destruction of records containing PHI within 60 days of the conclusion of the litigation. In the interests of consistency and uniformity, State Farm requests that this court vacate the HIPAA qualified protective orders and enter in their stead the Cook County protective orders.
¶ 36 In response, plaintiffs contend that the trial court did not err in entering the HIPAA qualified protective orders. Plaintiffs do not dispute that State Farm is not a "covered entity" under HIPAA, but they argue that this fact does not discharge State Farm from obeying a protective order entered by the court with respect to PHI that has been produced by a "covered entity." Plaintiffs further argue that neither the Illinois Insurance Code nor the administrative regulations governing insurers' business operations require State Farm to retain PHI.
¶ 37 A. Covered Entity
¶ 38 State Farm initially argues that, as a property and casualty insurer, it is not a "covered entity" under HIPAA and, therefore, is not subject to HIPAA's Privacy Rule. Whether State Farm falls within the definition of a "covered entity" for purposes of HIPAA requires us to construe the Privacy Rule. "Because administrative regulations have the force and effect of law, the familiar rules that govern construction of statutes also apply to the construction of administrative regulations." Kean v. Wal-Mart Stores, Inc. , 235 Ill. 2d 351, 368, 336 Ill.Dec. 1, 919 N.E.2d 926 (2009). The cardinal rule of statutory construction is to ascertain and give effect to the intent of the drafter. State Bank of Cherry v. CGB Enterprises, Inc. , 2013 IL 113836, ¶ 56, 368 Ill.Dec. 503, 984 N.E.2d 449. The most reliable indicator of the drafter's intent is the language of the regulation itself, which must be given its plain and ordinary meaning. State Bank of Cherry , 2013 IL 113836, ¶ 56, 368 Ill.Dec. 503, 984 N.E.2d 449. If the language of the enactment is clear, we must apply it as written, without resort to extrinsic aids. State Bank of Cherry , 2013 IL 113836, ¶ 56, 368 Ill.Dec. 503, 984 N.E.2d 449. Moreover, we will not depart from the plain meaning of an administrative regulation
by reading into it exceptions, limitations, or conditions that conflict with the expressed intent. State Bank of Cherry , 2013 IL 113836, ¶ 56, 368 Ill.Dec. 503, 984 N.E.2d 449. Statutory construction presents a question of law, subject to de novo review. Van Dyke v. White , 2019 IL 121452, ¶ 45, 433 Ill.Dec. 153, 131 N.E.3d 511.
¶ 39 The Privacy Rule defines a "covered entity" as a "health plan," "health care clearinghouse," or "health care provider who transmits any health information in electronic form." 45 C.F.R. § 160.103 (2018). In turn, each of these three entities has its own statutory definition. The term "health plan" is defined as "an individual or group plan that provides, or pays the cost of, medical care" but excludes "[a]ny policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits that are listed in * * * 42 U.S.C. § 300gg-91(c)(1)." 45 C.F.R. § 160.103 (2018). "Excepted benefits" include benefits under "[l]iability insurance, including general liability insurance and automobile liability insurance." 42 U.S.C. § 300gg-91(c)(1)(C) (2018). Here, State Farm presents itself as a property and casualty insurer that insures its policyholders against the risk of third-party liability for bodily injury and property damage that results from an accident. Plaintiffs do not dispute this portrayal of State Farm. Indeed, State Farm's description comports with the generally recognized definitions of automobile, liability, property, and casualty insurance—an agreement to indemnify against property damage or loss. See Black's Law Dictionary (11th ed. 2019) (defining "automobile insurance" as "[a]n agreement to indemnify against one or more kinds of loss associated with the use of an automobile, including damage to a vehicle and liability for personal injury"); Black's Law Dictionary (11th ed. 2019) (defining "casualty insurance" as "[a]n agreement to indemnify against loss resulting from a broad group of causes such as legal liability, theft, accident, property damage, and workers' compensation"); Black's Law Dictionary (11th ed. 2019) (defining "liability insurance" as "[a]n agreement to cover a loss resulting from the insured's liability to a third party, such as a loss incurred by a driver who injures a pedestrian, and [usually] to defend the insured or to pay for a defense regardless of whether the insured is ultimately found liable"); Black's Law Dictionary (11th ed. 2019) (defining "property insurance" as "[a]n agreement to indemnify against property damage or destruction"). In light of the foregoing, we agree that State Farm, as a property and casualty insurer, does not constitute a "health plan" as defined by the Privacy Rule.
¶ 40 Likewise, State Farm does not constitute a "health care clearinghouse" or a "health care provider" as those terms are defined by the Privacy Rule. A "health care clearinghouse" is defined as a public or private entity that either "[p]rocesses or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction" or "[r]eceives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity." 45 C.F.R. § 160.103 (2018). There is no evidence that State Farm performs either of the functions that would qualify it as a "health care clearinghouse." A "health care provider" means "a provider of services (as defined in section 1861(u) of the [Social Security] Act, 42 U.S.C. 1395x(u) ), a provider of medical or health services (as defined in section 1861(s) of the [Social Security] Act, 42 U.S.C. 1395x(s) ), and any other person
or organization who furnishes, bills, or is paid for health care in the normal course of business." 45 C.F.R. § 160.103 (2018). With exceptions not relevant here, a "provider of services" is "a hospital, critical access hospital, skilled nursing facility, comprehensive outpatient rehabilitation facility, home health agency, [or] hospice program." 42 U.S.C. § 1395x(u) (2018). A "provider of medical or health services" includes, inter alia , physician services, services and supplies furnished incident to a physician's services, hospital services, and diagnostic tests. 42 U.S.C. § 1395x(s) (2018). There is no evidence that State Farm is a provider of services, a provider of medical or health services, or one who furnishes, bills, or is paid for health care in the normal course of business. Because State Farm does not fall within the definition of a "health plan," "health care clearinghouse," or "health care provider," we conclude that it is not a covered entity for purposes of HIPAA. See Small v. Ramsey , 280 F.R.D. 264, 276 (N.D. W. Va. 2012) ("This Court finds no language extending the provision of the HIPPA [sic ] statutes [citation] and regulations [citation] to liability insurers * * *.").
¶ 41 B. Application of HIPAA
¶ 42 The trial courts agreed that State Farm, as a property and casualty insurer, is not a covered entity under HIPAA. They then determined that State Farm's status as a "non-covered entity" did not exempt it from obeying a protective order entered with respect to PHI produced by a covered entity. The trial courts held that all parties receiving PHI are bound to follow a HIPAA qualified protective order regardless of whether the party is a covered entity under HIPAA in the first instance, reasoning that a qualified protective order would "lose[ ] its effectiveness in protecting a patient's PHI if a non-covered entity may ignore the restrictions required by HIPAA." The question thus becomes whether a "non-covered entity" that receives PHI from a covered entity in response to a HIPAA qualified protective order is bound to comply with any of the order's restrictions regarding the use and disclosure of PHI. State Farm insists that, because it is not a covered entity, it is not subject to any use or disclosure restrictions. Plaintiffs counter that, although State Farm is not a covered entity for purposes of HIPAA, this fact does not discharge it from obeying a HIPAA qualified protective order entered with respect to PHI that has been produced by a covered entity. Whether State Farm's status as a "non-covered entity" exempts it from obeying the terms of a HIPAA qualified protective order requires us to construe the Privacy Rule. As such, it presents an issue of statutory construction, which is subject to de novo review. Van Dyke , 2019 IL 121452, ¶ 45, 433 Ill.Dec. 153, 131 N.E.3d 511 ; State Bank of Cherry , 2013 IL 113836, ¶ 22, 368 Ill.Dec. 503, 984 N.E.2d 449.
¶ 43 Section 164.512(e) of the Privacy Rule ( 45 C.F.R. § 164.512(e) (2018) ) governs the circumstances under which a covered entity may disclose PHI to another party, in the course of a judicial proceeding. Section 164.512(e)(1)(i) permits a covered entity to disclose specified PHI in the course of a judicial proceeding, "[i]n response to an order of a court." 45 C.F.R. § 164.512(e)(1)(i) (2018). Section 164.512(e)(1)(ii) permits a covered entity to disclose PHI in the course of a judicial proceeding, "[i]n response to a subpoena, discovery request, or other lawful process" that is not accompanied by an order of a court, if:
"(A) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such
party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or
(B) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v) of this section." 45 C.F.R. § 164.512(e)(1)(ii)(A), (B) (2018).
For the purposes of paragraph (e)(1)(ii)(B), a covered entity receives satisfactory assurances from a party seeking PHI if the covered entity receives from such party a written statement and accompanying documentation demonstrating that "[t]he parties to the dispute giving rise to the request for information have agreed to a qualified protective order and have presented it to the court * * * with jurisdiction over the dispute" or "[t]he party seeking the [PHI] has requested a qualified protective order from such court." 45 C.F.R. § 164.512(e)(1)(iv) (2018). Further, paragraph (e)(1)(v) states:
"For purposes of paragraph (e)(1) of this section, a qualified protective order means, with respect to [PHI] requested under paragraph (e)(1)(ii) of this section, an order of a court * * * that:
(A) Prohibits the parties from using or disclosing the [PHI] for any purpose other than the litigation or proceeding for which such information was requested; and
(B) Requires the return to the covered entity or destruction of the [PHI] (including all copies made) at the end of the litigation or proceeding." 45 C.F.R. § 164.512(e)(1)(v) (2018).
Thus, in the absence of an order of the court, HIPAA authorizes a covered entity to disclose PHI in a judicial proceeding, pursuant to a subpoena, discovery request, or other lawful process, provided that adequate notice was given to the individual whose information is to be produced or a qualified protective order containing the specified restrictions has been entered in the litigation.
¶ 44 It is important to note that State Farm is not the disclosing party in this case. Rather, it is the party wishing to obtain PHI. In this regard, after plaintiffs moved for the HIPAA qualified protective orders with respect to the disclosure of their PHI, State Farm intervened and filed objections, requesting entry of an alternative HIPAA protective order, the Cook County protective order. As the plain language of the Privacy Rule indicates, a covered entity may disclose PHI to State Farm only if the protective order meets the requirements of section 164.512(e)(1)(v) of the Privacy Rule ( 45 C.F.R. § 164.512(e)(1)(v) (2018) ). Yet, the Cook County protective order would exempt State Farm from any obligation to limit the use or disclosure of PHI to the litigation or to return or destroy the PHI at the end of the litigation. State Farm cites no provision in HIPAA, the Privacy Rule, any other regulations, or case law that would allow such exemptions. Again, State Farm obtains the ability to review plaintiffs' PHI only in response to a protective order issued in accordance with the requirements of section 164.512(e)(1)(v) ( 45 C.F.R. § 164.512(e)(1)(v) (2018) ). Hence, if State Farm wishes to access the PHI at issue, it must abide by the terms of the HIPAA qualified protective orders entered by the court. Accordingly, we agree with the trial courts and conclude that State Farm, as an entity wishing to receive PHI from a covered entity in response to a HIPAA qualified protective order, is bound to comply
with the use and disclosure restrictions set forth in the orders.
¶ 45 Citing various extrinsic sources, including the Federal Register, State Farm contends that the trial courts' reasoning "ignores that possession of PHI does not convert a non-covered entity into a covered entity under HIPAA and its regulations." To be sure, the passages State Farm cites support the notion that Congress did not intend property and casualty insurers to constitute "covered entities" for purposes of HIPAA. See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,567 ("Congress did not include life insurers and casualty insurance carriers as ‘health plans’ for purposes of this rule and therefore they are not covered entities."); Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,568 ("[P]roperty and casualty insurers * * * are not covered entities, as they do not meet the statutory definition of ‘health plan.’ "); Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,578 (" ‘[E]xcepted benefits’ as defined under 42 U.S.C. 300gg-91(c)(1), which includes liability programs such as property and casualty benefit providers, are not health plans for purposes of this rule."). Indeed, as explained earlier, we have no quarrel with State Farm's proposition. The passages it cites, however, say nothing about whether a non-covered entity is exempt from obeying a HIPAA qualified protective order entered with respect to PHI that has been produced by a covered entity.
¶ 46 State Farm further asserts that HHS has recognized that the Privacy Rule does not protect all PHI "wherever it is found." In support of this position, State Farm directs us to the following passages from a report authored by HHS:
"The HIPAA Rules apply only to organizations known as covered entities and their business associates. HIPAA does not apply to individuals or to other types of organizations that do not qualify as covered entities or business associates, even those that may handle or store an individual's health information.
* * *
The HIPAA Privacy Rule does not protect all health information wherever it is found. Because the rules apply only to covered entities and their business associates, the protections do not extend to data about the health of individuals held by [non-covered entities]." U.S. Dep't of Health & Human Servs., Examining Oversight of the Privacy & Security of Health Data Collected by Entities Not Regulated by HIPAA 13, 15 (June 17, 2016), https://www.healthit.gov/sites/default/files/non-covered_entities_report_june_17_2016.pdf [https://perma.cc/3HRT-TMA7].
State Farm's reliance on this passage is unpersuasive. While the Privacy Rule does not protect all health information wherever it is found, nothing in the language quoted above indicates that a noncovered entity is exempt from obeying a HIPAA qualified protective order entered with respect to PHI that it has received from a covered entity in response to a HIPAA qualified protective order.
¶ 47 State Farm also asserts that "[a] plaintiff should be well-aware that PHI disclosed by a covered entity to the recipient has the potential to be subject to redisclosure by the recipient." In support of this assertion, State Farm relies on section 164.508(c)(2)(iii) of the Privacy Rule ( 45 C.F.R. § 164.508(c)(2)(iii) (2018) ). Section 164.508 of the Privacy Rule is entitled "Uses and disclosures for which an authorization is required." 45 C.F.R. § 164.508 (2018). It sets forth the process by which a
covered entity may disclose PHI with a valid authorization . See 45 C.F.R. § 164.508 (2018). To be "valid" for purposes of section 164.508, the authorization must, among other things, "contain statements adequate to place the individual on notice of * * * [t]he potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this subpart." 45 C.F.R. § 164.508(c)(2)(iii) (2018). Section 164.508 makes clear that redisclosure in this context applies only with respect to PHI disclosed with a valid authorization. In this case, we are not dealing with the disclosure of PHI pursuant to a valid authorization. Thus, State Farm's reliance on this provision is misplaced.
¶ 48 Citing a passage from the Federal Register, State Farm next observes that HHS has stated that, because its jurisdiction under the statute is limited to covered entities, "once protected health information leaves the purview of * * * [a] covered entit[y], * * * the information is no longer afforded protection under this rule." Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,567. Again, nothing in the language of this passage indicates that a noncovered entity is exempt from obeying the restrictions in a HIPAA qualified protective order entered with respect to PHI that has been produced by a covered entity.
¶ 49 In short, while State Farm is not a "covered entity" under HIPAA, it has not directed us to any specific language in HIPAA, the Privacy Rule, or any other regulation, authority, or case law indicating that a noncovered entity that receives PHI from a covered entity in response to a HIPAA qualified protective order is exempt from complying with the order's restrictions regarding the use or disclosure of the PHI. Thus, if State Farm wishes to access the PHI at issue, it must abide by the terms of the HIPAA qualified protective orders entered by the trial courts.
¶ 50 C. Illinois Law
¶ 51 Next, State Farm argues that the trial courts erred in entering the HIPAA qualified protective orders, because they conflict with State Farm's obligations under state law. According to State Farm, it must be permitted to use and retain plaintiffs' PHI to fulfill its obligation with respect to various provisions of the Illinois Insurance Code ( 215 ILCS 5/1 et seq. (West 2018)) and the administrative regulations governing its business operations. As a result, State Farm maintains, the trial courts should instead have entered the Cook County protective orders. According to State Farm, the Cook County protective order "strikes the proper balance between a litigant's interest in PHI and the State's interest in allowing property and casualty insurers to retain PHI beyond litigation."
¶ 52 To begin, State Farm directs us to article XL of the Insurance Code ( 215 ILCS 5/1001 et seq. (West 2018)), which is titled "Insurance Information and Privacy Protection." 215 ILCS 5/art. XL (West 2018). One of the stated purposes of article XL is to "maintain a balance between the need for information by those conducting the business of insurance and the public's need for fairness in insurance information practices, including the need to minimize intrusiveness." 215 ILCS 5/1001 (West 2018). Citing section 1014 of article XL ( 215 ILCS 5/1014 (West 2018) ), State Farm argues that Illinois law protects personal or privileged information received in handling claims while still allowing property and casualty insurers to make disclosures reasonably necessary to rate-making, anti-fraud programs, consumer-protection research, and regulatory compliance. Specifically, section 1014 provides
that "[a]n insurance institution, agent or insurance-support organization shall not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure" meets one of the enumerated exceptions. (Emphasis added.) 215 ILCS 5/1014 (West 2018). However, as plaintiffs point out, there is a clear difference between language stating that an insurer "shall not disclose" personal or privileged information and language mandating the retention or use of PHI for a particular purpose. The passage to which State Farm directs us does not contain any mandatory affirmative language requiring the retention of PHI or its use for any particular purpose. This language in no way supports State Farm's claim that state law requires it to retain or otherwise use PHI.
¶ 53 State Farm further asserts that insurers retain records for a variety of legal and operational reasons. For instance, State Farm notes that insurers are prohibited from engaging in improper claims practices. See 215 ILCS 5/154.5, 154.6 (West 2018). To this end, section 919.30 of Title 50 of the Illinois Administrative Code requires insurers to make their claim files available to the Director of the Illinois Department of Insurance (Director) for examination upon request. 50 Ill. Adm. Code 919.30(a) (1989). According to State Farm, the requirements governing the examination process conflict with the "return or destroy provisions" of the protective orders entered here.
¶ 54 With respect to examinations by the Director as part of improper-claims practice, section 919.30 provides in relevant part as follows:
"b) Each company shall maintain claim data that should be accessible and retrievable for examination by the Director. A company shall be able to provide the claim number, line of coverage, date of loss and date of payment of the claim, date of denial, or date claim closed without payment. This data must be available for all open and/or closed files for the current year and the two preceding years. The examiners' review may include but need not be limited to an examination of the following claims:
1) Claims Closed with Payment;
2) Claims Denied;
3) Claims Closed Without Payment;
4) First Party Automobile Total Losses; and/or Subrogation Claims.
c) Detailed documentation shall be contained in each claim file in order to permit reconstruction of the company's activities relative to each claim file." 50 Ill. Adm. Code 919.30 (1989).
According to State Farm, because this regulation requires maintaining "detailed documentation" in each claim file "to permit the reconstruction of the insurer's activities," it effectively mandates an insurer "to maintain all records of each claim for ‘all open and/or closed files for the current year and the two preceding years.’ " However, we find no language in section 919.30 requiring an insurer to expressly retain PHI. Rather, the regulation refers to "claim data," which it describes as "the claim number, line of coverage, date of loss and date of payment of the claim, date of denial, or date claim closed without payment." Moreover, we see no reason why keeping in the company's file a copy of the HIPAA qualified protection order, specifying that the company was prohibited from using or disclosing PHI for any purpose other than the litigation and was required to return or destroy the PHI at the end of the litigation, would not suffice to establish "the company's activities relative to each file." For these reasons, we are unpersuaded by State Farm's claim that the requirements
governing examinations for improper-claims practice conflict with the "return or destroy" provisions of the protective orders entered in this case.
¶ 55 State Farm also asserts that the HIPAA qualified protective orders prevent insurers from performing functions related to fraud detection and deterrence. State Farm asserts that, because the Illinois Department of Insurance relies on property and casualty insurers to detect and combat insurance fraud, Illinois law authorizes them to report information, including PHI, to the Illinois Department of Insurance and insurance support organizations, such as the National Insurance Crime Bureau and the Insurance Services Organization. See 215 ILCS 5/155.23 (West 2018). According to State Farm, if insurers must return to covered entities or destroy all PHI within 60 days of the end of litigation, they cannot later provide necessary information to help the state with fraud detection and prevention.
¶ 56 The statute State Farm cites authorizes the Director
"to promulgate reasonable rules requiring insurers * * * doing business in the State of Illinois to report factual information in their possession that is pertinent to suspected fraudulent insurance claims, fraudulent insurance applications, or premium fraud after [the Director] has made a determination that the information is necessary to detect fraud or arson." (Emphases added.) 215 ILCS 5/155.23(1) (West 2018).
We find State Farm's reliance on section 155.23 unpersuasive for two principal reasons. First, the statute applies only to suspected fraudulent insurance claims, fraudulent insurance applications, or premium fraud and only after the Director has determined that the information is necessary to detect fraud or arson. In this case, there is no indication of fraud and no evidence that the Director has determined that any PHI is necessary to detect fraud or arson. Thus, there can be no factual information pertinent to any suspected fraud. Second, the statute requires an insurer to report only factual information in their possession. An insurer that has returned or destroyed PHI in accordance with a HIPAA qualified protective order cannot violate the statute, because it does not possess any such information.
¶ 57 State Farm claims that other purposes for which property and casualty insurers retain claims files include actuarial and rate development, reinsurance evaluation and pricing, and long-tail exposure. However, State Farm neither develops this argument nor cites any statute, policy, or regulation that would require it to use or retain PHI for any of those purposes. As such, we find any such claim forfeited. See Ill. S. Ct. R. 341(h)(7) (eff. May 25, 2018) (requiring appellant's brief to include argument "which shall contain the contentions of the appellant and the reasons therefor, with citation of the authorities"); Lee v. Lee , 2019 IL App (2d) 180923, ¶ 24, 440 Ill.Dec. 1, 149 N.E.3d 551.
"Reinsurance" is "[i]nsurance of all or part of one insurer's risk by a second insurer, who accepts the risk in exchange for a percentage of the original premium." Black's Law Dictionary (11th ed. 2019). "Long-tail claims" are "claims that are made or settled a long time after the insurance policy has expired." Collins English Dictionary, https://www.collinsdictionary.com/us/dictionary/english/long-tail-claims (last visited Feb. 21, 2020) [https://perma.cc/3SQ7-CQSQ].
¶ 58 Lastly, we address State Farm's reliance on part 901 of Title of 50 of the Illinois Administrative Code (50 Ill. Adm. Code 901) in support of its claim that it must be permitted to use and retain plaintiffs' PHI to fulfill its obligations with
respect to Illinois law. Section 901.5 of Title 50 of the Illinois Administrative Code provides that "[n]o domestic company shall destroy any books, records, documents, accounts or vouchers, hereafter referred to as ‘records’, except in conformity with the requirements of this Part." 50 Ill. Adm. Code 901.5, codified at 7 Ill. Reg. 4213 (eff. Mar. 28, 1983). Section 901.20 of Title 50 sets out a time period for the disposal and destruction of records:
"The company is authorized to dispose of or destroy records in its custody that do not have sufficient administrative, legal or fiscal value to warrant their further preservation and are not needed:
a) in the transaction of current business;
b) for the final settlement or disposition of any claim arising out of a policy of insurance issued by the company, except that these records must be maintained for the current year plus 5 years; or
c) to determine the financial condition of the company for the period since the date of the last examination report of the company officially filed with the Department of Insurance, except that these records must be maintained for at least the current year plus 5 years." 50 Ill. Adm. Code 901.20 (2016).
According to State Farm, part 901 sets out a detailed process for the destruction of an insurer's records. Yet, it asserts, the HIPAA qualified protective orders entered in this case "create[ ] a Catch-22 for * * * insurers, which must decide whether to comply with its ‘return or destroy’ provisions or continue to comply with the regulations requiring the maintenance of complete claim records for much longer periods."
¶ 59 Although part 901 of Title 50 defines the term "records," State Farm does not explain how PHI falls within this definition. The term "records" is defined in section 901.10 of Title 50 as follows:
" ‘Records’ material means all books, papers and documentary materials regardless of physical form or characteristics, made, produced, executed or received by any domestic insurance company pursuant to law or in connection with the transaction of its business and preserved or appropriate for preservation by such company or its successors as evidence of the organization, function, policies, decisions, procedures, obligations and business activities of the company or because of the informational data contained therein. If doubt arises as to whether certain papers are ‘non-record’ materials, it should be assumed that the documents are ‘records’." (Emphasis added.) 50 Ill. Adm. Code 901.10, codified at 7 Ill. Reg. 4213 (eff. Mar. 28, 1983).
In this case, State Farm does not explain how plaintiffs' PHI is "appropriate for preservation," especially given that (1) the trial courts entered HIPAA qualified protective orders expressly requiring the destruction of PHI within 60 days after the conclusion of the litigation and (2) State Farm failed to cite any statute, regulation, or case law that affirmatively requires the retention of PHI or its use for a particular purpose. See Small , 280 F.R.D. at 279-80 (rejecting similar argument by State Farm, in part because section 901.10 of Title 50 does not specifically reference medical records). Moreover, as noted, a copy of the HIPAA qualified protective order in the file would explain why the PHI was not present. Thus, this provision does not support State Farm's position.
¶ 60 In short, State Farm has failed to direct us to any provision of the Insurance Code or the Illinois Administrative Code
that requires it to use or disclose plaintiffs' PHI after the conclusion of the litigation. We find nothing in the statutory and administrative regulations cited by State Farm in its brief requiring it to retain PHI or use it for any particular purpose after the conclusion of litigation. As such, we reject State Farm's argument that the terms of the HIPAA qualified protective order conflict with its obligations under state law.
¶ 61 D. Preemption
¶ 62 Although we have concluded that the terms of the HIPAA qualified protective orders do not conflict with State Farm's obligations under state law, to the extent that they could be so construed, we agree with the trial courts that the state law provisions are preempted by HIPAA. As noted earlier, among HIPAA's purposes were to establish national privacy standards and fair information practices regarding individually identifiable health information. Brende , 153 P.3d at 1114 ; Wade , 922 F. Supp. 2d at 687 (citing South Carolina Medical Ass'n , 327 F.3d at 348 ); Law , 307 F. Supp. 2d at 710 ; U.S. Dep't of Health & Human Servs., Office for Civil Rights, Summary of the HIPAA Privacy Rule 1 (May 2003), https://www.hhs.gov/sites/default/files/ privacysummary.pdf [https://perma.cc/F66C-T4TR]. To this end, HIPAA and its regulations establish a "uniform federal ‘floor’ of privacy protections for individual medical information." Stein, supra , at 434; see also Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,471 ("The protections [(provided by HIPAA and its regulations)] are a mandatory floor, which other governments and any covered entity may exceed."); 45 C.F.R. § 164.502(a) (2018). Thus, HIPAA preempts "contrary" state laws unless the state law is "more stringent" than the standards set forth in the Privacy Rule. 42 U.S.C. § 1320d-7 (2018) ; 45 C.F.R. §§ 160.202, 160.203(b), 164.502(a) (2018) ; Giangiulio , 365 Ill. App. 3d at 840, 302 Ill.Dec. 812, 850 N.E.2d 249 ; Stein, supra , at 434. A state law is "contrary" to HIPAA if a "covered entity or business associate would find it impossible to comply with both the State and Federal requirements" or if the "provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of [HIPAA]." 45 C.F.R. § 160.202 (2018). Whether a state law is preempted by federal law is a question of law, subject to de novo review. Fosler v. Midwest Care Center II, Inc. , 398 Ill. App. 3d 563, 569, 340 Ill.Dec. 282, 928 N.E.2d 1 (2009).
¶ 63 In this case, a covered entity cannot comply with HIPAA if the statutory and administrative regulations, as interpreted by State Farm, are inserted in the qualified protective order. In this regard, the Cook County protective order does not require an insurer to return or destroy PHI at the conclusion of litigation and would permit the insurer to use and retain PHI outside of litigation. This directly conflicts with the requirements for a HIPAA qualified protective order under section 164.512(e)(1)(v) of the Privacy Rule. Likewise, by eliminating these two requirements, the Cook County protective order would not provide the confidentiality and protection of PHI envisioned when the Privacy Rule was promulgated. Stated differently, any requirement that an insurer be allowed to use and retain PHI beyond the conclusion of litigation would lower the floor of privacy protections HIPAA mandates. As such, the Cook County protective order acts as an obstacle to accomplishing and executing HIPAA's full purposes and objectives.
¶ 64 In so holding, we also observe that section 160.203(a)(1) of the Privacy Rule provides that HIPAA will not preempt a
contrary state law if the Secretary of HHS determines, in response to a request by a state, that the state law is necessary to, inter alia , "prevent fraud and abuse related to the provision of or payment for health care" or "ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation." 45 C.F.R. §§ 160.203(a)(1)(i), (ii), 160.204 (2018). State Farm does not indicate that any such exception was requested by the state with respect to an insurer's purported obligations under Illinois law. In the absence of such a waiver from the federal government, a HIPAA qualified protective order prohibits the use or disclosure of PHI for any purpose other than the litigation or proceeding for which such information was requested and requires the return or destruction of PHI at the end of the litigation or proceeding.
¶ 65 E. Reverse Preemption
¶ 66 Typically, when a state law conflicts with a federal law, the federal law preempts the state law, rendering the state law without effect. U.S. Const., art. VI, cl. 2 ; Altria Group, Inc. v. Good , 555 U.S. 70, 76, 129 S.Ct. 538, 172 L.Ed.2d 398 (2008) ; Milliman, Inc. v. Roof , 353 F. Supp. 3d 588, 600 (E.D. Ky. 2018). However, the McCarran-Ferguson Act ( 15 U.S.C. § 1011 et seq. (2018) ) created an exception to this rule with respect to state laws that regulate the "business of insurance." Milliman, Inc. , 353 F. Supp. 3d at 600-01. The trial courts here asked the parties to address the implications, if any, of the McCarran-Ferguson Act to these cases. Neither party argued that the McCarran-Ferguson Act applied, so the courts did not further address the issue. State Farm briefly mentions the McCarran-Ferguson Act in its brief but does not fully develop the issue. Nevertheless, we find it appropriate to briefly discuss this matter.
¶ 67 The McCarran-Ferguson Act provides, in relevant part, that "[n]o Act of Congress shall be construed to invalidate, impair, or supersede any law enacted by any State for the purpose of regulating the business of insurance, or which imposes a fee or tax upon such business, unless such Act specifically relates to the business of insurance." 15 U.S.C. § 1012(b) (2018). "[T]he McCarran-Ferguson Act gives rise to the doctrine of ‘reverse preemption,’ which, if applicable, can cause state insurance laws to trump federal laws that interfere with them." Western Insurance Co. v. A & H Insurance, Inc. , 784 F.3d 725, 727 (10th Cir. 2015). Under the statute, a state law will reverse preempt a federal law if (1) the federal statute does not specifically relate to the business of insurance, (2) the state statute was enacted for the purpose of regulating the business of insurance, and (3) the federal statute would invalidate, impair, or supersede the state statute. United States v. Rhode Island Insurers' Insolvency Fund , 80 F.3d 616, 619 (1st Cir. 1996). Ultimately, we conclude that the McCarran-Ferguson Act does not compel reverse preemption in this case, because HIPAA does not invalidate, impair, or supersede any state insurance law or regulation cited by State Farm.
¶ 68 The United States Supreme Court has stated that "invalidate" means "to render ineffective, generally without providing a replacement rule or law" and that "supersede" means "to displace (and thus render ineffective) while providing a substitute rule." (Internal quotation marks omitted.) Humana Inc. v. Forsyth , 525 U.S. 299, 307, 119 S.Ct. 710, 142 L.Ed.2d 753 (1999). "To impair" for purposes of the McCarran-Ferguson Act means to "frustrate any declared state policy" or "interfere with a State's administrative regime." Humana Inc. , 525 U.S. at 310, 119 S.Ct. 710. As noted above, nothing in any Illinois statute or regulation State Farm
cites requires the retention of PHI or its use for any particular purpose. Thus, the HIPAA qualified protective orders entered in this case do not "invalidate, impair, or supersede" the Illinois statutes and regulations State Farm cites. As such, we conclude that the doctrine of reverse preemption does not apply here.
¶ 69 F. Alternative Methods of Disclosing PHI
¶ 70 Alternatively, State Farm argues that the Privacy Rule did not require the trial courts to enter the HIPAA qualified protective orders proposed by plaintiffs to the exclusion of other authorized means of permitted disclosure of PHI. State Farm notes, for instance, that the Privacy Rule permits the disclosure of PHI "[i]n response to an order of a court." 45 C.F.R. § 164.512(e)(1)(i) (2018). According to State Farm, "[n]othing in this section [(of the Privacy Rule)] says that the ‘order of the court’ can only be a qualified protective order." State Farm also notes that, absent a court order, the Privacy Rule allows the disclosure of PHI "[i]n response to a subpoena, discovery request, or other lawful process," provided that the party seeking the information either notifies the individual whose information is requested or makes a "reasonable effort[ ]" to secure a qualified protective order. 45 C.F.R. § 164.512(e)(1)(ii) (2018). State Farm points out that, of the authorized means of disclosure, only a HIPAA qualified protective order carries the restrictions that prohibit the use of PHI outside litigation and require the return of PHI to the covered entity or its destruction at the end of the litigation. See 45 C.F.R. § 164.512(e)(1)(v) (2018). State Farm therefore argues that the trial courts erred in rejecting any alternative to plaintiffs' proposed protective orders. Although we agree that the Privacy Rule provides several different methods by which a covered entity may disclose PHI in the course of a judicial proceeding, neither plaintiffs nor State Farm sought the disclosure of PHI by any means other than a protective order. Plaintiffs' motions referenced HIPAA and the Privacy Rule, and they proposed the HIPAA qualified protective order, which expressly cites the restrictions set forth in section 164.512(e)(1)(v) of the Privacy Rule ( 45 C.F.R. § 164.512(e)(1)(v) (2018) ). Likewise, in its objections to plaintiffs' motions, State Farm proposed the Cook County protective order. The record reflects that the trial courts considered and ruled on this issue. Given these circumstances, we find that the trial courts did not err in declining to consider an alternate authorized method of disclosing PHI.
¶ 71 IV. CONCLUSION
¶ 72 For the reasons set forth above, we affirm the judgment of the circuit court of Lake County.
¶ 73 Affirmed.
Presiding Justice Birkett and Justice Zenoff concurred in the judgment and opinion.