Chicago Sun-Times v. Cook County Health & Hospital System , 2021 IL App (1st) 192551 ( 2021 )

Digitally signed
by Reporter of
Decisions
Reason: I attest to
Illinois Official Reports the accuracy and
integrity of this
document
Appellate Court Date: 2022.01.19
13:16:40 -06'00'
Chicago Sun-Times v. Cook County Health & Hospital System,
2021 IL App (1st) 192551Appellate Court CHICAGO SUN-TIMES, Plaintiff-Appellant, v. COOK COUNTY
Caption HEALTH AND HOSPITAL SYSTEM, Defendant-Appellee.
District & No. First District, Fifth Division
No. 1-19-2551
Filed June 30, 2021
Decision Under Appeal from the Circuit Court of Cook County, No. 18-CH-14507; the
Review Hon. Eve M. Reilly, Judge, presiding.
Judgment Reversed and remanded.
Counsel on Joshua Burday, Matthew Topic, and Merrick Wayne, of Loevy &
Appeal Loevy, of Chicago, for appellant.
Kimberly M. Foxx, State’s Attorney, of Chicago (Cathy McNeil Stein,
Martha Victoria Jimenez, and James Beligratis, Assistant State’s
Attorneys, of counsel), for appellee.
Panel JUSTICE CUNNINGHAM delivered the judgment of the court, with
opinion.
Presiding Justice Delort and Justice Hoffman concurred in the
judgment and opinion.
OPINION
¶1 Plaintiff-appellant, the Chicago Sun-Times (Sun-Times), filed suit against defendant-
appellee Cook County Health and Hospital System (CCHHS) in the circuit court of Cook
County, alleging that CCHHS failed to produce records in response to the Sun-Times’ request
for documents pursuant to the Freedom of Information Act (FOIA) (5 ILCS 140/1 et seq. (West
2018)). The trial court granted CCHHS’s motion for summary judgment, finding that the
records sought were private information under FOIA and therefore barred from production.
The court then denied the Sun-Times’ partial motion for summary judgment. The Sun-Times
appeals that ruling. For the following reasons, we reverse the judgment of the circuit court of
Cook County and remand the case for further proceedings.
¶2 BACKGROUND
¶3 On September 10, 2018, the Sun-Times requested two categories of information from
CCHHS, as set forth below:
“1. Written policy and/or related policy documents, and/or internal memos or
communications setting policy or providing guidelines, instructions and/or directives
to staff in the reporting of patients who have suffered gunshot wounds to law
enforcement agencies as required by state statue [sic] (20 ILCS 2630/3.2).
2. Without providing identifying patient information, we seek the time/date of
admission of patients seeking treatment for gunshot wounds through CCHHS between
Jan. 1, 2015 through the present day who were not been [sic] accompanied by a law
enforcement officer at the time of their admission as well as the corresponding
time/date that law enforcement officials were notified of the patients’ admission as
required by state statue [sic] (20 ILCS 2630/3.2).”
¶4 CCHHS provided the policies requested in part 1 of the Sun-Times’ request, but as to part
2, CCHHS stated that it was exempt from providing the requested time/date information
pursuant to sections 7(1)(a) and 7(1)(b) of FOIA. Section 7(1)(a) exempts from disclosure
records that federal or state law prohibit from disclosure, and section 7(1)(b) exempts
“[p]rivate information” from disclosure. Id. § 7(1)(a), (b).
¶5 On November 21, 2018, the Sun-Times filed a complaint in the circuit court of Cook
County, alleging that CCHHS wrongfully withheld the information requested in part 2 of its
September 10, 2018, FOIA request. The Sun-Times sought, inter alia, an order requiring
CCHHS to produce the requested records and enjoining CCHHS from withholding nonexempt
public records under FOIA.
¶6 The parties filed cross-motions for summary judgment. In support of CCHHS’s motion for
summary judgment, it attached affidavits of Deborah Fortier, the FOIA officer for CCHHS,
and Justin Mis, the trauma coordinator at John H. Stroger Jr. Hospital of Cook County (Stroger
Hospital). Ms. Fortier averred that Stroger Hospital was the only CCHHS entity that had
records potentially responsive to the Sun-Times’ request. Mr. Mis, in turn, averred that the
electronic trauma registry at Stroger Hospital contains entries for each individual patient
arriving at the hospital and includes information such as the patient’s name, date and time of
arrival, medical records number, and the patient’s chief complaint. Mr. Mis stated that he could
“run” a report listing only the mechanism of injury (i.e., gunshot wound) and the time of arrival
-2-
in the emergency department. However, that report would not include whether the patient was
accompanied by a law enforcement officer or when law enforcement was notified, if at all.
Instead, Mr. Mis would have to cross-reference the information in that report with a log kept
by trauma department clerks that indicates the time and date law enforcement officers request
access to a patient. Significantly, the log does not indicate whether law enforcement access
was prompted by notification to law enforcement by Stroger Hospital. In order to determine if
a gunshot victim arrived with a law enforcement officer or if a law enforcement officer was
notified of a gunshot victim’s admission, the specific patient’s medical record would have to
be accessed.
¶7 Ms. Fortier averred that the trauma registry entries Mr. Mis referred to as well as the log
of when law enforcement officers requested access to a patient contained protected health
information as defined by the Health Insurance Portability and Accountability Act of 1996
(HIPAA) (see 45 C.F.R. pts. 160, 162, 164) and could not be “de-identified” 1 sufficiently to
allow compliance with HIPAA. Further, Ms. Fortier averred that the records that the Sun-
Times sought were medical records and protected from disclosure under Illinois law.
¶8 Based on Ms. Fortier and Mr. Mis’s affidavits, CCHHS argued in its motion for summary
judgment that it was exempt from disclosing the records requested by the Sun-Times.
¶9 The Sun-Times’ motion for summary judgment argued that HIPAA permits the disclosure
of the year of treatment and year of notification to law enforcement and that, therefore,
CCHHS could provide the requested information in a de-identified report. The Sun-Times did
not argue that the specific time or date of admission or notification to law enforcement was
disclosable under FOIA.
¶ 10 On November 15, 2019, the trial court granted CCHHS’s motion for summary judgment.
Specifically, the trial court stated that, because the “year” identifier the Sun-Times was seeking
was part of a medical record, it was exempt from disclosure under section 7(1)(b) of FOIA.
The court further explained that, in the absence of case law affirmatively stating that medical
records could be redacted, it could not find in favor of the Sun-Times. The Sun-Times
appealed.
¶ 11 ANALYSIS
¶ 12 We note that we have jurisdiction to review this matter, as the Sun-Times filed a timely
notice of appeal following the entry of summary judgment. Ill. S. Ct. R. 301 (eff. Feb. 1, 1994);
R. 303 (eff. July 1, 2017).
¶ 13 Summary judgment is appropriate only when “ ‘the pleadings, depositions, and admissions
on file, together with the affidavits, if any, show that there is no genuine issue as to any material
fact and that the moving party is entitled to a judgment as a matter of law.’ ” 1010 Lake Shore
Ass’n v. Deutsche Bank National Trust Co., 2015 IL 118372, ¶ 20 (quoting 735 ILCS 5/2-
1005(c) (West 2008)). All supporting materials are strictly construed against the movant and
in favor of the opposing party. Mashal v. City of Chicago, 2012 IL 112341, ¶ 49. Where parties
file cross-motions for summary judgment, as here, they agree that there are no issues of
material fact and invite the court to decide the case based on the record. Dome Tax Services
1
De-identification requires removing any identifying information from the relevant record.
-3-
Co. v. Weber, 2019 IL App (3d) 170767, ¶ 8. We review de novo an order granting summary
judgment. Nationwide Financial, LP v. Pobuda, 2014 IL 116717, ¶ 24.
¶ 14 In this case, the trial court granted summary judgment in favor of CCHHS after finding
that it was exempt from disclosing the year of admission of patients with gunshot wounds
unaccompanied by a law enforcement officer and the year, if any, that law enforcement was
notified of the admission.
¶ 15 Initially, CCHHS argues that the Sun-Times forfeited review of this issue because, in its
original FOIA request and its complaint, it sought the “time/date” that patients with gunshot
wounds were admitted to CCHHS and the “time/date” that law enforcement was notified, yet
in its motion for summary judgment, it sought only the year of admission and notification. It
is sufficient to note that the year is unquestionably part of the “time/date” and that the
narrowing of the request reflects an implicit concession by the Sun-Times that it was not
entitled to the more specific date and time information. So while we recognize a narrowing of
its request, we do not find that the Sun-Times forfeited this issue.
¶ 16 Turning to the merits, it is helpful to begin with a general understanding of FOIA. FOIA
was implemented with an eye toward opening governmental records “ ‘to the light of public
scrutiny.’ ” Stern v. Wheaton-Warrenville Community Unit School District 200, 233 Ill. 2d
396, 405 (2009) (quoting Bowie v. Evanston Community Consolidated School District No. 65,
128 Ill. 2d 373, 378 (1989)). Of course, FOIA is not intended to violate individual privacy. 5
ILCS 140/1 (West 2018). But to the extent that FOIA contains restraints on the “full and
complete” disclosure of governmental records, those restraints should be seen as “limited
exceptions to the principle that the people of this State have a right to full disclosure of
information relating to the decisions, policies, procedures, rules, standards, and other aspects
of government activity that affect the conduct of government and the lives of any or all of the
people.” Id. In other words, FOIA should be liberally construed to allow the public ready access
to government information, and exemptions to disclosure should be narrowly interpreted so as
not to defeat FOIA’s overarching purpose. Hites v. Waubonsee Community College, 2016 IL
App (2d) 150836, ¶ 53.
¶ 17 In this case, CCHHS relies on two exemptions in support of its denial of the Sun-Times’
FOIA request: section 7(1)(a), which makes exempt from disclosure “[i]nformation
specifically prohibited from disclosure by federal or State law or rules and regulations
implementing federal or State law,” and section 7(1)(b), which makes exempt “[p]rivate
information.” 5 ILCS 140/7(1)(a), (b) (West 2018). The public body that claims an exemption
from disclosure bears the burden of proving by clear and convincing evidence that the
requested information is exempt. Id. § 1.2.
¶ 18 Beginning with section 7(1)(a), CCHHS argues that regulations implementing HIPAA
(Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended in various sections of Titles
18, 26, 29, and 42 of the United States Code)), prohibit disclosure of the requested records.
Indeed, HIPAA limits the use and disclosure of “protected health information,” which is
defined as “individually identifiable health information.” 45 C.F.R. § 160.103 (2013). “Health
information,” in turn, is defined as information that is created by a health care provider relating
to the past, present, or future physical health or condition of an individual. Id. But health
information that does not identify an individual “and with respect to which there is no
reasonable basis to believe that the information can be used to identify an individual” is not
individually identifiable health information. Id. § 164.514(a).
-4-
¶ 19 CCHHS maintains that the year of treatment for a gunshot wound and the year that law
enforcement were notified of that treatment are individually identifiable health information
that cannot be disclosed to respond to a FOIA request. We disagree. HIPAA states that health
information can be de-identified (and disclosed) if “identifiers of the individual” are removed.
Examples of identifiers are names, geographic subdivisions smaller than a state, telephone
numbers, Social Security numbers, medical records numbers, and “[a]ll elements of dates
(except year) directly related to an individual, including birth date, admission date, discharge
date, [and] date of death.” (Emphasis added.) Id. § 164.514(b)(2)(i)(A)-(C), (G), (H). Here, the
Sun-Times seeks only the year of admission for patients with gunshot wounds, without any
identifiers. Further, the year of notification to law enforcement does not convey any identifying
information.
¶ 20 Nevertheless, CCHHS claims that removing individual identifiers is not sufficient to de-
identify information if the covered entity has “actual knowledge that the information could be
used alone or in combination with other information to identify an individual who is a subject
of the information.” Id. § 164.514(b)(2)(ii). Ms. Fortier averred in her affidavit that she was
“concerned” that someone with the date and time of admission of a Stroger Hospital patient
with a gunshot wound could discover the identity of that patient through media accounts of
shootings. But this is far from “actual knowledge” of the ability to identify a patient and
amounts to speculation. More significantly, the Sun-Times is seeking only the year of
admission of patients with gunshot wounds and the year law enforcement was notified. By
CCHHS’s own admission, thousands of patients are admitted to Stroger Hospital with gunshot
wounds every year. It strains credulity to imagine that any specific patient could be identified
merely by the year they were admitted and the year law enforcement was notified of their
admission.
¶ 21 This is true even for the “short” years CCHHS refers to in its brief. The Sun-Times
requested data from October 1, 2015 to September 10, 2018. CCHHS points out that only three
months of data are requested from 2015 and only eight months of data from 2018. It theorizes
that these “short” data years will make it easier to “re-identify” patients. But it is CCHHS’s
burden to prove this contention with clear and convincing evidence. CCHHS has not alleged
that Stroger Hospital treated so few gunshot victims over the 2015 and 2018 “short years” that
they could actually be sufficiently identified solely by the year of their treatment and nothing
further. In the absence of such evidence, this argument does not withstand scrutiny.
¶ 22 CCHHS further argues that, even if the requested information could be de-identified, it
would still need to parse protected health information in order to ascertain the nature of that
information. Specifically, in order to determine whether and when law enforcement was
notified of a patient who was admitted with a gunshot wound, Mr. Mis averred that it would
be necessary to review the gunshot wound victim’s medical records. CCHHS contends that
using medical records for this purpose is a violation of HIPAA in and of itself. Again, we
disagree. The regulations explicitly provide that a covered entity may use protected health
information “to create information that is not individually identifiable health information or
disclose protected health information only to a business associate for such purpose, whether or
not the de-identified information is to be used by the covered entity.” Id. § 164.502(d)(1). In
other words, HIPAA permits a covered entity to review medical records—protected health
information—to “create information” that is not individually identifiable health information.
This is exactly what is required in order for CCHHS to comply with the Sun-Times’ request.
-5-
For all of these reasons, we conclude that HIPAA does not bar disclosure of the requested
records in the manner suggested by CCHHS.
¶ 23 CCHHS also cites Illinois law as a basis for refusing to disclose the requested records. To
be sure, there is a strong public policy in Illinois in favor of protecting the rights of individuals
with respect to their medical information. Coy v. Washington County Hospital District, 372 Ill.
App. 3d 1077, 1082 (2007). To that end, there are several state laws cited by CCHHS that
prohibit or limit the release of medical information. For example, the Code of Civil Procedure
provides that communications between a patient and a doctor are privileged. 735 ILCS 5/8-
802 (West 2018). The Hospital Licensing Act states that information regarding hospital
patients “must be protected from inappropriate disclosure” and prohibits the hospital’s
employees from disclosing the “nature or details of services provided to patients” unless
“authorized or required by law.” 210 ILCS 85/6.17(b), (d) (West 2018). Also, the Medical
Patient Rights Act states that every patient has a right to privacy and confidentiality in health
care. 410 ILCS 50/3(d) (West 2018).
¶ 24 But the logic that led us to conclude that disclosure of the requested information does not
violate HIPAA regulations compels us to reach the same conclusion here. Disclosure of the
year of admission of a patient with a gunshot wound and the year in which law enforcement
was notified of that admission in no way violates a patient’s right to privacy, as that information
does not identify a particular patient. Therefore, Illinois law does not prohibit the release of
that information.
¶ 25 Next, we consider whether section 7(1)(b), prohibiting the disclosure of “private
information,” supports CCHHS’s refusal to turn over the records. The definition of “private
information” includes “medical records.” 5 ILCS 140/2(c-5) (West 2018). “Medical records”
is not defined in FOIA, but CCHHS urges us to adopt the definition in section 250.1510 of the
Illinois Administrative Code. That section addresses hospital licensing requirements and
requires hospitals to maintain a minimum level of content for patients’ medical records,
including “admission information.” 77 Ill. Adm. Code 250.1510(b)(2)(A) (2019). But when a
term is undefined in a statute, we do not turn to an entirely unrelated statute in order to ascertain
its meaning. Rather, it is appropriate to consult a dictionary for that purpose. See Lacey v.
Village of Palatine, 232 Ill. 2d 349, 363 (2009). And Black’s Law Dictionary defines “medical
record[ ]” as “documents that compose a medical patient’s healthcare history.” Black’s Law
Dictionary (11th ed. 2019). While the year of a patient’s hospital admission may be found in a
patient’s medical record, it, standing alone, is not a medical record under this definition. In
other words, the year of admission for a specific injury is not private information where it is
entirely divorced from any personally identifying information. 2
¶ 26 Lastly, CCHHS argues that the requested information will not answer the question of
whether it is in compliance with its statutory obligation to notify law enforcement of a gunshot
2
To the extent CCHHS argues that medical records need not be redacted and are “exempt in
totality,” it cites no authority for this proposition. And, indeed, section 7 of FOIA states the opposite:
“When a request is made to inspect or copy a public record that contains information that is exempt
from disclosure under the Section, but also contains information that is not exempt from disclosure, the
public body may elect to redact the information that is exempt. The public body shall make the
remaining information available for inspection and copying.” (Emphasis added.) 5 ILCS 140/7(1)
(West 2018).
-6-
victim seeking treatment. But merely because the redacted information may not tell the whole
story, it does not follow that CCHHS may refuse to provide it. See Heinrich v. White, 2012 IL
App (2d) 110564, ¶ 19 (rejecting claim that redacted information would not prove useful as
basis for noncompliance with FOIA).
¶ 27 In sum, neither section 7(1)(a) nor section 7(1)(b) of FOIA exempts CCHHS from
responding to the Sun-Times’ FOIA request. Accordingly, we conclude that the trial court
erred in granting summary judgment in favor of CCHHS.
¶ 28 CONCLUSION
¶ 29 For the foregoing reasons, we reverse the judgment of the circuit court of Cook County
and remand the case for further proceedings consistent with this opinion.
¶ 30 Reversed and remanded.
-7-