Summary
The Supreme Court of Illinois affirmed orders requiring qualified protective orders governing the disclosure, use, and destruction of protected health information in automobile injury litigation. The court held that a property and casualty insurer receiving protected health information under such an order must comply with its restrictions, including limits on nonlitigation use and the return-or-destroy requirement. The court also addressed whether HIPAA preempts conflicting Illinois insurance law and remanded the cases for further proceedings.
Topics
Practice areas
Questions Presented
- Whether a property and casualty insurer that is not a HIPAA covered entity must comply with the restrictions in a HIPAA qualified protective order when seeking to obtain protected health information from a covered entity.
- Whether Illinois insurance statutes and administrative regulations require property and casualty insurers to use, disclose, or retain protected health information beyond the conclusion of litigation.
- Whether the Cook County standard protective order, which omits HIPAA's use-or-disclosure prohibition and return-or-destroy requirement, is preempted by HIPAA's Privacy Rule.
- Whether the McCarran-Ferguson Act's reverse-preemption doctrine shields the disputed Illinois insurance provisions or protective order from federal preemption.
- Whether the trial courts abused their discretion by entering plaintiffs' qualified protective orders rather than State Farm's proposed alternative orders.
Holdings
- A property and casualty insurer that is not itself a HIPAA covered entity must comply with the restrictions of a valid HIPAA qualified protective order when it seeks to obtain protected health information from a covered entity in litigation.
- The Illinois Insurance Code and cited Illinois administrative regulations did not affirmatively require State Farm to use, disclose, or retain the plaintiffs' protected health information after the litigation concluded.
- The Cook County standard protective order is contrary to and preempted by HIPAA's Privacy Rule because it permits insurers to use and disclose PHI outside litigation and does not require return or destruction of the PHI at the conclusion of litigation.
- The McCarran-Ferguson Act does not shield the disputed Illinois insurance provisions or the Cook County standard protective order from HIPAA preemption because the state law did not invalidate, impair, or supersede the state-law requirements at issue.
- The trial courts did not abuse their discretion by entering the plaintiffs' HIPAA qualified protective orders and denying State Farm's alternative protective orders.
Key quotations
“A QPO is a judicial or administrative order, or a stipulation by the parties, that (1) “[p]rohibits the parties from using or disclosing the [PHI] for any purpose other than the litigation or proceeding for which such information was requested” and (2) “[r]equires the return to the covered entity or destruction of the [PHI] (including all copies made) at the end of the litigation or proceeding.”” (¶ 62)
“The Privacy Rule applies in these cases to potentially preempt Illinois insurance regulatory law governing the use, disclosure, and retention of PHI.” (¶ 104)
“However, the Cook County standard protective order is contrary to the Privacy Rule because it falls below the floor of privacy that the Privacy Rule mandates.” (¶ 104)
Factual background
Rosemarie Haage and Agnieszka Surlock brought separate automobile personal-injury actions arising from vehicle collisions; Edward Surlock also asserted a loss-of-consortium claim. The plaintiffs sought HIPAA qualified protective orders permitting disclosure of relevant protected health information while prohibiting use or disclosure outside the litigation and requiring return or destruction of the information after the litigation. State Farm, the liability insurer for defendants in the actions, intervened and sought alternative orders allowing it to retain, use, disclose, and dispose of protected health information for insurance-regulatory, fraud-detection, reporting, and other business purposes.
Procedural history
The Lake County circuit court entered qualified protective orders requiring that protected health information be used only for the litigation and returned or destroyed at its conclusion. It denied State Farm's request for a Cook County standard protective order that would permit insurers to retain, use, disclose, and dispose of the information for additional insurance-related purposes. The appellate court affirmed, and the Illinois Supreme Court affirmed the appellate judgment and remanded both cases to the circuit court.
Remand instructions
The cases are remanded to the circuit court of Lake County for further proceedings.