Haage v. Zavala

2021 IL 125918IN THE
SUPREME COURT
OF
THE STATE OF ILLINOIS
(Docket No. 125918)
ROSEMARIE HAAGE, Appellee, v. ALFONSO MONTIEL ZAVALA et al.
(State Farm Mutual Automobile Insurance Company, Appellant).
Opinion filed September 23, 2021.
JUSTICE NEVILLE delivered the judgment of the court, with opinion.
Chief Justice Anne M. Burke and Justices Garman, Theis, Michael J. Burke,
Overstreet, and Carter concurred in the judgment and opinion.
OPINION
¶1 In each of two automobile personal injury actions, plaintiffs moved for entry of
a qualified protective order (QPO) pursuant to the Health Insurance Portability and
Accountability Act (HIPAA) (Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified
as amended in scattered sections of Titles 18, 26, 29, and 42 of the United States
Code)) and its implementing regulations (45 C.F.R. pts. 160, 164 (2018))
(hereinafter Privacy Rule). Plaintiffs’ proposed QPOs would allow protected health
information (PHI) to be released, but subject to the following restrictions:
(1) nonlitigation use or disclosure of PHI is prohibited and (2) PHI must be returned
or destroyed at the conclusion of the litigation. See 45 C.F.R. § 164.512(e)(1)(v)
(2018). State Farm Mutual Automobile Insurance Company (State Farm), the
liability insurer for the named defendants, intervened in each lawsuit and sought
entry of its own protective order, which expressly allowed insurance companies to
use, disclose, and maintain PHI for purposes beyond the litigation and expressly
exempted insurers from the “return or destroy” requirement.
¶2 In both cases the circuit court of Lake County granted plaintiffs’ motions,
entered their QPOs, and denied State Farm’s motions. State Farm filed an
interlocutory appeal in each case. Ill. S. Ct. R. 307(a)(1) (eff. Nov. 1, 2017). The
appellate court consolidated the two cases and affirmed. 2020 IL App (2d) 190499.
¶3 State Farm petitioned this court for leave to appeal as a matter of right (Ill. S.
Ct. R. 317 (eff. July 1, 2017)) or, alternatively, as a matter of discretion (Ill. S. Ct.
R. 315 (eff. Oct. 1, 2019)). We granted State Farm leave to appeal. For the
following reasons, we now affirm the judgment of the appellate court and remand
the cases to the trial court for further proceedings.
¶4 I. BACKGROUND
¶5 A. Underlying Complaints
¶6 In November 2017, plaintiff Rosemarie Haage filed a multicount complaint
(No. 17-L-897) against defendants Alfonso Montiel Zavala, Patricia Santiago, Jose
Pacheco-Villanuevo, Okan Esmez, and Rosalina Esmez. Haage sought to recover
damages for bodily injuries sustained in a multiple-vehicle collision near the
intersection of Lakeview Parkway and Route 60 in Vernon Hills.
¶7 In January 2018, plaintiffs Agnieszka Surlock and Edward Surlock filed a two-
count complaint (No. 18-L-39) against defendant Dragoslav Starcevic. The Surlock
plaintiffs sought damages for Agnieszka’s bodily injuries and Edward’s loss of
consortium as a result of a collision between an automobile driven by Agnieszka
and an automobile driven by Starcevic at the intersection of Grand Avenue and
-2-
Route 45 in Lindenhurst.
¶8 B. Plaintiffs’ Motions for QPOs
¶9 In August 2018, plaintiffs, represented by the same attorney, filed nearly
identical motions for QPOs allowing the disclosure of protected health information
in their respective lawsuits. HIPAA’s privacy standards are known collectively as
the “Privacy Rule.” Deborah F. Buckman, Annotation, Validity, Construction, and
Application of Health Insurance Portability and Accountability Act of 1996
(HIPAA) and Regulations Promulgated Thereunder, 194 A.L.R. Fed. 133, 148
(2004). The Privacy Rule is codified at parts 160 and 164 of Title 42 of the Code
of Federal Regulations (45 C.F.R. pts. 160, 164 (2018)).
¶ 10 Plaintiffs’ QPO motions alleged as follows. First, the treating physicians,
hospitals, and other health care providers for Haage and Agnieszka are subject to
the Privacy Rule. Second, these covered entities possess their PHI in the form of
medical records. Third, both the plaintiffs and the defendants in each case “will
require that the parties, their attorneys, their attorneys’ agents, consultants and
various witnesses and other personnel receive and review copies of the [PHI]”
pertaining to Haage and Agnieszka. Fourth, HIPAA potentially prohibits covered
entities from disclosing PHI in judicial proceedings other than by an authorization
or QPO.
¶ 11 Therefore, plaintiffs submitted HIPAA QPOs that permit the use and disclosure
of the PHI of Haage and Agnieszka. Relevant here, the proffered QPOs found that
45 C.F.R. § 164.512(e)(1)(v)(A), (B) (2018) requires the following two obligations.
Paragraph 9 of the proposed QPOs finds that it is necessary to “[p]rohibit the parties
and any other persons or entities from using or disclosing the PHI for any purpose
other than the litigation or proceeding for which it was requested.” Paragraph 10 of
the proposed QPOs finds that it is necessary to “[r]equire the return of the PHI to
the covered entity or the destruction of the information at the end of the litigation
or proceeding.”
¶ 12 Accordingly, each proposed QPO ordered: “The PHI of any party in this lawsuit
may not be disclosed for any reason without that party’s prior written consent or an
Order of this court specifying the scope of the PHI to be disclosed, the recipients
-3-
of the disclosed PHI, and the purpose of the disclosure.” Each proposed QPO also
ordered as follows:
“Within 60 days after the conclusion of the litigation, including appeals, the
parties, their attorneys, insurance companies and any person or entity in
possession of PHI received pursuant to this Order, shall return Plaintiff’s PHI
to the covered entity or destroy any and all copies of PHI pertaining to Plaintiff,
including any electronically stored copy or image, except that counsel are not
required to secure the return or destruction of PHI submitted to the Court.
‘Conclusion of the Litigation’ shall be defined as the point at which final orders
disposing of the entire case as to any Defendant have been entered, or the time
at which all trial and appellate proceedings have been exhausted as to any
Defendant.”
¶ 13 C. State Farm’s Petitions to Intervene and File Objections
¶ 14 In September 2018, State Farm filed nearly identical petitions to intervene in
each lawsuit. See 735 ILCS 5/2-408(a)(2) (West 2018). State Farm maintained that
it was the casualty and liability insurer for at least one of the defendants in the
Haage lawsuit and for defendant Starcevic in the Surlock lawsuit. State Farm
alleged that plaintiffs’ proposed QPOs would impose upon it significant restrictions
and obligations, and the attorney representing its policyholders is not conversant
with either the legal issues raised by plaintiffs’ proposed QPOs or the statutes and
regulations applicable to State Farm’s business operations. The trial courts granted
State Farm’s petitions to intervene and granted State Farm leave to file objections.
¶ 15 In its objections to plaintiffs’ proposed QPOs, State Farm requested that the
trial courts (1) deny plaintiffs’ motions for their QPOs and (2) grant State Farm’s
motions to enter its tendered alternative orders (see Ill. S. Ct. R. 201(c)(1) (eff. July
1, 2014)). State Farm initially argued that, as a property and casualty insurer, it is
not a “covered entity” under HIPAA. State Farm also argued that plaintiffs’
proposed QPOs contained restrictions that would directly conflict with its
obligations and rights under Illinois law, specifically in two ways. First, State Farm
argued that requiring it to return or destroy all copies of PHI following the
conclusion of the litigation would interfere with its statutory and administrative
obligations to maintain complete documentation of all books, records, and
-4-
accounts, including claim files and claim data, and to make that information
available for examination upon request by the Illinois Department of Insurance.
Second, State Farm argued that restricting the use of PHI to the litigation at issue
would interfere “with State Farm’s rights under Illinois law to use a claimant’s
information to perform certain insurance functions.” State Farm asked the trial
courts to deny plaintiffs’ proposed QPOs.
¶ 16 State Farm also asserted that the law division of the circuit court of Cook
County has “entered a standard medical protective order authorizing production of
health information that omits unnecessary restrictions and explicitly accommodates
casualty insurers’ obligations.” State Farm tendered and sought entry of the Cook
County standard protective order.
¶ 17 The Cook County standard protective order lacks the PHI “use or disclosure”
prohibition and the “return or destroy” requirement that plaintiffs’ proposed QPOs
provide.
¶ 18 Rather, the Cook County standard protective order expressly permits insurance
companies to maintain, use, disclose, and dispose of PHI for the following
purposes:
“1. Reporting; investigating; evaluating, adjusting, negotiating, arbitrating,
litigating, or settling claims;
2. Compliance reporting or filing;
3. Conduct described in [section 1014 of the Illinois Insurance Code] 215
ILCS 5/1014;
4. Required inspections and audits;
5. Legally required reporting to private, federal, or state governmental
organizations ***;
6. Rate setting and regulation;
7. Statistical information gathering;
8. Underwriting, reserve, loss, and actuarial calculation;
-5-
9. Drafting policy language;
10. Workers’ compensation; and
11. Determining the need for and procuring excess or umbrella coverage or
reinsurance.”
Also, paragraph 5 of the Cook County standard protective order specifically
exempts insurance companies from the “return or destroy” requirement of 45
C.F.R. § 164.512(e)(1)(v)(B) (2018). State Farm urged the trial courts to adopt and
enter the tendered Cook County standard protective order.
¶ 19 D. Plaintiffs’ Replies
¶ 20 Plaintiffs responded that their proposed QPOs would not impose undue
restrictions or obligations on nonhealth insurers for two reasons. First, plaintiffs
argued that there was no language in either the Illinois Insurance Code or the
Illinois Administrative Code that requires nonhealth insurers to retain, use, or
disclose PHI. Second, plaintiffs asserted that State Farm does not require PHI to
perform “certain insurance functions.” Plaintiffs further noted that there has never
been an administrative disciplinary action taken against State Farm for failing to
maintain PHI. Therefore, according to plaintiffs, their proposed QPOs would not
affect the reporting obligations of nonhealth insurers such as State Farm.
¶ 21 Plaintiffs alternatively asserted that, absent a waiver from the federal
government, (1) HIPAA prohibits the use or disclosure of PHI for any purpose
other than the litigation or proceeding for which such information was requested
and (2) HIPAA requires the return or destruction of PHI at the end of the litigation
or proceeding. Therefore, according to plaintiffs, to the extent that any state law or
regulation permits State Farm to use, store, maintain or distribute PHI outside of
the scope of litigation and for State Farm’s own business operations, it is preempted
by HIPAA.
¶ 22 Plaintiffs further responded that whether or not State Farm is a “covered entity”
is irrelevant. Plaintiffs reasoned that, even if State Farm is exempt from HIPAA as
a casualty and liability insurer, the plaintiff-authorized PHI, the QPO entered by
the court, and the parties to whom the PHI is released are all subject to HIPAA.
-6-
Thus, according to plaintiffs, “State Farm had no right to the information to begin
with.” Rather, plaintiffs argued that State Farm “only obtains an ability to review
PHI because of a valid protective order. Therefore, regardless of whether State
Farm is a ‘covered entity’ under HIPAA, it must still abide by the court order and
the terms of HIPAA if it wants access to the PHI.”
¶ 23 E. Trial Courts’ Orders
¶ 24 In February 2019, the trial courts in the Haage and Surlock lawsuits held a
combined hearing on plaintiffs’ motions for QPOs. In May 2019, the trial courts
issued memorandum opinions and orders that granted plaintiffs’ motions to enter
their proposed QPOs and denied State Farm’s request for the entry of the Cook
County standard protective order.
¶ 25 The trial courts found that HIPAA preempts Illinois law to the extent that State
Farm’s obligations and rights under state law conflict with HIPAA. The trial courts
found that it would be impossible to comply with both Illinois law and HIPAA
requirements for a QPO. The trial courts specifically found that the Cook County
standard protective order violated 45 C.F.R. § 164.512(e)(1)(v)(A), (B) (2018), to
the extent that it (1) would allow insurance companies to maintain, use, disclose,
and dispose of PHI outside of the litigation and (2) would not require insurers to
return or destroy the PHI at the conclusion of the litigation. The trial courts found
that the Cook County standard protective order “would eliminate the two
requirements set forth by the Department [of Health and Human Services (HHS)]
for a qualified protective order and would not provide the confidentiality and
protection of PHI” envisioned when HHS promulgated the Privacy Rule. The trial
courts found that without these two requirements, “a covered entity no longer has
a valid HIPAA qualified protective order to allow disclosure of PHI.”
¶ 26 The trial courts also acknowledged that “property and casualty liability insurers
are not covered entities under HIPAA.” However, each trial court found that not
being a covered entity “does not exempt State Farm from obeying a protective order
entered by this court with respect to PHI which has been produced by a covered
entity.” (Emphasis in original.) Rather, each trial court ruled that “[a]ll parties
receiving the PHI are bound to follow the qualified protective order of the court
regardless of whether they are a covered entity under HIPAA in the first instance.”
-7-
¶ 27 The trial courts next rejected State Farm’s argument that plaintiffs’ motions for
QPOs should be deemed as proposals for a court order under a different section of
the Privacy Rule. Each trial court reasoned that, “[w]hile the HIPAA regulations do
provide several different ways in which a covered entity is permitted to disclose
PHI, Plaintiff has chosen to secure a qualified protective order.”
¶ 28 Accordingly, the trial courts entered plaintiffs’ proposed QPOs in both lawsuits.
The QPOs included the following relevant provisions:
“8. Within 60 days after the conclusion of the litigation, including appeals,
the parties, their attorneys, insurance companies and any person or entity in
possession of PHI received pursuant to this Order, shall return Plaintiff’s PHI
to the covered entity or destroy any and all copies of PHI pertaining to Plaintiff,
including any electronically stored copy or image, except that counsel are not
required to secure the return or destruction of PHI submitted to the Court.
***
12. All requests by or on behalf of any Defendant for protected health
information, including but not limited to subpoenas, shall be accompanied by a
complete copy of this Order. The parties—including their insurers and
counsel—are prohibited from using or disclosing protected health information
for any purpose other than this litigation. ‘Disclose’ shall have the same ***
scope and definition as set forth in 45 C.F.R. § 160.103: ‘the release, transfer,
provision of access to, or divulging in any manner of information outside the
entity holding the information.’ ” (Emphases added.)
¶ 29 F. Appellate Court
¶ 30 In each case, State Farm filed an interlocutory appeal to the appellate court. See
Ill. S. Ct. R. 307(a)(1) (eff. Nov. 1, 2017). The appellate court granted State Farm’s
motion to consolidate the appeals and denied plaintiffs’ motion to dismiss. 2020 IL
App (2d) 190499, ¶ 33.
¶ 31 The appellate court acknowledged that State Farm, as a property and casualty
insurer, did not fit within the specific regulatory definition of a “ ‘covered entity,’ ”
as defined by the Privacy Rule, because it was not a “ ‘health plan,’ ” a “ ‘health
-8-
care clearinghouse,’ ” or a “ ‘health care provider who transmits any health
information in electronic form.’ ” Id. ¶¶ 39-40 (quoting 45 C.F.R. § 160.103(2018)). However, the appellate court agreed with the trial courts that “State Farm,
as an entity wishing to receive PHI from a covered entity in response to a HIPAA
qualified protective order, is bound to comply with the use and disclosure
restrictions set forth in the orders.” Id. ¶ 44. Thus, the appellate court concluded
that, “if State Farm wishes to access the PHI at issue, it must abide by the terms of
the HIPAA qualified protective orders entered by the trial courts.” Id. ¶ 49.
¶ 32 State Farm next argued that it must be permitted to use and retain plaintiffs’
PHI to fulfill its obligations under Illinois insurance regulatory law and that the
Cook County standard protective order “ ‘strikes the proper balance between a
litigant’s interest in PHI and the State’s interest in allowing property and casualty
insurers to retain PHI beyond litigation.’ ” Id. ¶ 51. The appellate court concluded
that “State Farm failed to cite any statute, regulation, or case law that affirmatively
requires the retention of PHI or its use for a particular purpose.” Id. ¶ 59. Further,
the appellate court found nothing in the provisions of the Insurance Code and the
Illinois Administrative Code cited by State Farm that requires State Farm to retain
PHI or use it for any particular purpose after the conclusion of the litigation.
Accordingly, the appellate court rejected State Farm’s argument that the terms of
plaintiffs’ QPOs conflict with State Farm’s obligations under state law. Id. ¶ 60.
¶ 33 The appellate court next held that, to the extent that plaintiffs’ QPOs could be
considered to conflict with State Farm’s obligations under state law, HIPAA and
the Privacy Rule preempt state law. Id. ¶¶ 62-64. The appellate court also concluded
that the doctrine of reverse preemption, as provided by the McCarran-Ferguson Act
(15 U.S.C. § 1011 et seq. (2018)), which is potentially relevant specifically to
insurance regulation, did not apply in this case. 2020 IL App (2d) 190499, ¶¶ 66-
68.
¶ 34 Lastly, State Farm assigned error to the trial courts’ rejection of any alternative
to plaintiffs’ QPOs. The appellate court acknowledged that the Privacy Rule
provides several different methods by which a covered entity may disclose PHI
during litigation. However, the appellate court observed that plaintiffs and State
Farm sought the disclosure of PHI through QPOs. Accordingly, the appellate court
-9-
held that the trial courts did not err in declining to consider an alternative method
of disclosing PHI. Id. ¶ 70.
¶ 35 State Farm appeals to this court. We granted the National Insurance Crime
Bureau leave to submit an amicus curiae brief in support of State Farm’s position.
The Illinois Trial Lawyers Association and the Illinois Public Interest Research
Group were each granted leave to submit an amicus curiae brief in support of
plaintiffs’ position. Ill. S. Ct. R. 345 (eff. Sept. 20, 2010).
¶ 36 II. ANALYSIS
¶ 37 Before this court, the parties present several arguments in relation to the
following issues. First, the parties disagree on the applicability of the Privacy Rule
and its preemptive effect on Illinois insurance regulatory law governing the use,
disclosure, and retention of PHI. Second, the parties disagree on whether Illinois
insurance regulatory law mandates that a property and casualty insurer use,
disclose, and retain PHI beyond litigation. Third, the parties disagree on the
preemptive effect of the Privacy Rule on the Cook County standard protective
order.
¶ 38 A. Standard of Review
¶ 39 State Farm filed an interlocutory appeal to the appellate court pursuant to
Illinois Supreme Court Rule 307(a)(1) (eff. Nov. 1, 2017), which provides for an
appeal from an interlocutory order “granting, modifying, refusing, dissolving, or
refusing to dissolve or modify an injunction.” This court has held that “an
interlocutory order circumscribing the publication of information is reviewable as
an interlocutory injunctive order, pursuant to Rule 307(a)(1).” Skolnick v. Altheimer
& Gray, 191 Ill. 2d 214, 221 (2000); see In re Daveisha C., 2014 IL App (1st)
133870, ¶ 25 (“Supreme Court Rule 307(a)(1) allows review of *** a protective
order entered during the discovery phase of the proceedings.”).
¶ 40 “As this court has explained, ‘in an interlocutory appeal, the scope of review is
normally limited to an examination of whether or not the trial court abused its
discretion in granting or refusing the requested interlocutory relief.’ ” West Bend
- 10 -
Mutual Insurance Co. v. TRRS Corp., 2020 IL 124690, ¶ 31 (quoting In re
Lawrence M., 172 Ill. 2d 523, 526 (1996)). An abuse of discretion occurs only when
the trial court’s decision is arbitrary, fanciful, or unreasonable or where no
reasonable person would take the view adopted by the trial court. In re Marriage of
Heroy, 2017 IL 120205, ¶ 24; Seymour v. Collins, 2015 IL 118432, ¶ 41. “When,
however, the interlocutory appeal involves a question of law, the reviewing court
resolves that legal question independently of the trial court’s judgment and, to the
extent necessary, may consider substantive issues to determine whether the trial
court acted within its authority.” West Bend Mutual Insurance Co., 2020 IL 124690,
¶ 32; see Loyola Academy v. S&S Roof Maintenance, Inc., 146 Ill. 2d 263, 274
(1992).
¶ 41 In this case, State Farm presents issues that require us to construe various
statutory and administrative provisions. Issues of statutory construction present
questions of law that we review de novo. In re Appointment of Special Prosecutor,
2019 IL 122949, ¶ 22; Cohen v. Chicago Park District, 2017 IL 121800, ¶ 17; In re
M.M., 2016 IL 119932, ¶ 15. Under the de novo standard, the reviewing court
performs the same analysis that the trial court would perform. People v. McDonald,
2016 IL 118882, ¶ 32; see Choate v. Indiana Harbor Belt R.R. Co., 2012 IL 112948,
¶ 21.
¶ 42 B. Canons of Statutory Construction
¶ 43 The same familiar principles of statutory construction that apply to state
legislation also apply to federal legislation enacted by Congress. See, e.g., Standard
Mutual Insurance Co. v. Lay, 2013 IL 114617, ¶ 26; Italia Foods, Inc. v. Sun Tours,
Inc., 2011 IL 110350, ¶ 12. Additionally, because administrative regulations have
the force and effect of law, the familiar rules that govern construction of statutes
also apply to the construction of administrative regulations. Kean v. Wal-Mart
Stores, Inc., 235 Ill. 2d 351, 368 (2009); Union Electric Co. v. Department of
Revenue, 136 Ill. 2d 385, 391 (1990).
¶ 44 The primary objective in statutory construction is to ascertain and give effect to
the intent of the legislature. The most reliable indicator of legislative intent is the
language of the statute, which must be given its plain and ordinary meaning. In re
Appointment of Special Prosecutor, 2019 IL 122949, ¶ 23; In re M.M., 2016 IL
- 11 -
119932, ¶ 16. In construing a federal statute, “ ‘[o]ur task is to give effect to the
will of Congress, and where its will has been expressed in reasonably plain terms,
that language must ordinarily be regarded as conclusive.’ ” Negonsott v. Samuels,
507 U.S. 99, 104 (1993) (quoting Griffin v. Oceanic Contractors, Inc., 458 U.S.
564, 570 (1982)). In construing a statute, a court must view a statute as a whole.
Therefore, words and phrases must be construed in light of other relevant statutory
provisions and not in isolation. United States National Bank of Oregon v.
Independent Insurance Agents of America, Inc., 508 U.S. 439, 455 (1993); In re
Appointment of Special Prosecutor, 2019 IL 122949, ¶ 23; Chicago Teachers
Union, Local No. 1 v. Board of Education of the City of Chicago, 2012 IL 112566,
¶ 15. Each word, clause, and sentence of a statute must be given a reasonable
meaning, if possible, and should not be rendered superfluous. TRW Inc. v. Andrews,
534 U.S. 19, 31 (2001); Chicago Teachers Union, 2012 IL 112566, ¶ 15.
Additionally, the court may consider the reason for the law, the problems sought to
be remedied, the purposes to be achieved (National Bank of Oregon, 508 U.S. at
455; In re M.M., 2016 IL 119932, ¶ 16), and the consequences of construing the
statute one way or another (American Tobacco Co. v. Patterson, 456 U.S. 63, 71
(1982); In re Appointment of Special Prosecutor, 2019 IL 122949, ¶ 23).
¶ 45 C. Statutory Overview of HIPAA
¶ 46 “HIPAA is ‘a complex piece of legislation that addresses the exchange of
health-related information.’ ” Cohan v. Ayabe, 322 P.3d 948, 954 (Haw. 2014)
(quoting National Abortion Federation v. Ashcroft, No. 03 Civ. 8695(RCC), 2004
WL 555701, at *2 (S.D.N.Y. Mar. 19, 2004)). Subtitle F of Title II of HIPAA,
captioned “Administrative Simplification,” consists of sections 261 through 264 of
the statute. As amended in 2010, the purpose of this subtitle is
“to improve *** the efficiency and effectiveness of the health care system, by
encouraging the development of a health information system through the
establishment of uniform standards and requirements for the electronic
transmission of certain health information and to reduce the clerical burden on
patients, health care providers, and health plans.” Pub. L. 104-191 § 261, 110
Stat. 1936, 2021 (1996).
- 12 -
¶ 47 In furtherance of these statutory purposes, various individual provisions in
section 262 outline whom the regulations were to cover, what information was to
be covered, what types of transactions were to be covered, what time limits and
standards would govern compliance with HIPAA, and what penalties would accrue
for HIPAA violations. 42 U.S.C. §§ 1320d to 1320d-9 (2018).
¶ 48 To effectuate these statutory directives, section 262 instructed the United States
HHS to adopt uniform standards “to enable health information to be exchanged
electronically.” 42 U.S.C. § 1320d-2(a)(1) (2018). In section 264 of HIPAA,
Congress provided a two-step process to address how to afford certain protections
to the privacy of health information maintained under HIPAA. First, within 12
months of HIPAA’s enactment, HHS was directed to submit to Congress “detailed
recommendations on standards with respect to the privacy of individually
identifiable health information.” HIPAA, Pub. L. No. 104-191 § 264(a), 110 Stat.
1936, 2033. Congress directed HHS to address subjects including as follows: “(1)
The rights that an individual who is a subject of individually identifiable health
information should have. (2) The procedures that should be established for the
exercise of such rights. (3) The uses and disclosures of such information that should
be authorized or required.” Id. § 264(b).
¶ 49 Second, if Congress did not enact further legislation pursuant to the
recommendations from HHS within 36 months of HIPAA’s enactment, HHS was
to promulgate final regulations providing for such standards. Id. § 264(c)(1).
HIPAA further provided that the privacy regulations promulgated by HHS “shall
not supercede a contrary provision of State law, if the provision of State law
imposes requirements, standards, or implementation specifications that are more
stringent than the requirements, standards, or implementation specifications
imposed under the regulation.” Id. § 264(c)(2); see generally South Carolina
Medical Ass’n v. Thompson, 327 F.3d 346, 348-49 (4th Cir. 2003) (summarizing
statute); Buckman, supra, at 145-48 (same).
¶ 50 D. Privacy Rule Overview
¶ 51 In September 1997, HHS did submit recommendations for protecting the
privacy of individually identifiable heath information. However, Congress
ultimately failed to enact any additional legislation. Arons v. Jutkowitz, 880 N.E.2d
- 13 -
831, 840 (N.Y. 2007); South Carolina Medical Ass’n, 327 F.3d at 349. In
November 1999, HHS issued proposed “Standards for Privacy of Individually
Identifiable Health Information” (64 Fed. Reg. 59,918 (Nov. 3, 1999)), and in
December 2000, HHS promulgated its final rule. 65 Fed. Reg. 82,462 (Dec. 28,
2000). These standards are known collectively as the “Privacy Rule.” Buckman,
supra, at 148; U.S. Dep’t of Health & Human Servs., Office for Civil Rights,
Summary of the HIPAA Privacy Rule 2 (May 2003),
https://www.hhs.gov/sites/default/files/privacysummary.pdf
[https://perma.cc/F66C-T4TR] (hereinafter Summary of the HIPAA Privacy Rule).
In August 2002, HHS amended the Privacy Rule (67 Fed. Reg. 53,182 (Aug. 14,
2002)). The Privacy Rule is codified at parts 160 and 164 of Title 45 of the Code
of Federal Regulations (45 C.F.R. pts. 160, 164 (2018)).
¶ 52 According to HHS, the purposes of the Privacy Rule include: “[t]o protect and
enhance the rights of consumers by *** controlling the inappropriate use” of their
health information and “to improve the efficiency and effectiveness of health care
delivery by creating a national framework for health privacy protection that builds
on efforts by states, health systems, and individual organizations and individuals.”
65 Fed. Reg. at 82,463. HHS explained as follows:
“In enacting HIPAA, Congress recognized the fact that administrative
simplification cannot succeed if we do not also protect the privacy and
confidentiality of personal health information. The provision of high-quality
health care requires the exchange of personal, often-sensitive information
between an individual and a skilled practitioner. Vital to that interaction is the
patient’s ability to trust that the information shared will be protected and kept
confidential. Yet many patients are concerned that their information is not
protected. Among the factors adding to this concern are the growth of the
number of organizations involved in the provision of care and the processing of
claims, the growing use of electronic information technology, increased efforts
to market health care and other products to consumers, and the increasing ability
to collect highly sensitive information about a person’s current and future health
status as a result of advances in scientific research.
Rules requiring the protection of health privacy in the United States have
been enacted primarily by the states. While virtually every state has enacted one
- 14 -
or more laws to safeguard privacy, these laws vary significantly from state to
state and typically apply to only part of the health care system. ***
Until now, virtually no federal rules existed to protect the privacy of health
information and guarantee patient access to such information. This final rule
establishes, for the first time, a set of basic national privacy standards and fair
information practices that provides all Americans with a basic level of
protection and peace of mind that is essential to their full participation in their
care. The rule sets a floor of ground rules for health care providers, health plans,
and health care clearinghouses to follow, in order to protect patients and
encourage them to seek needed care. The rule seeks to balance the needs of the
individual with the needs of the society. It creates a framework of protection
that can be strengthened by both the federal government and by states as health
information systems continue to evolve.” Id. at 82,463-64.
¶ 53 HHS explains that many of the provisions of the Privacy Rule, as codified, “are
presented as ‘standards.’ Generally, the standards indicate what must be
accomplished under the regulation and implementation specifications describe how
the standards must be achieved.” Id. at 82,488.
¶ 54 The Privacy Rule prohibits a “covered entity” or “business associate” from
using a person’s “protected health information” except as mandated or permitted
by its provisions. 45 C.F.R. § 164.502(a) (2018). PHI is defined as “individually
identifiable health information” that is kept or transmitted in electronic or any other
form of media. Id. § 160.103. Further, “individually identifiable health
information” means information, including demographic data, that (1) is created or
received by a “covered entity”; (2) relates “to the past, present, or future physical
or mental health or condition of an individual; the provision of health care to an
individual; or the past, present, or future payment for the provision of health care
to an individual”; and (3) identifies, or reasonably can be used to identify, the
individual. Id. “Covered entities” refer to health plans, health care clearinghouses,
and health care providers who transmit any health information in electronic form.
Id. §§ 160.103, 164.104(a). A “business associate” refers to a person, not a member
of a covered entity’s workforce, who uses or discloses PHI in performing certain
activities or functions on behalf of a covered entity. Id. § 160.103.
- 15 -
¶ 55 E. The Privacy Rule Applies to State Farm
¶ 56 Both plaintiffs and State Farm agree that State Farm is not a “covered entity”
as defined by HIPAA because a property and casualty insurer is not a “health plan,”
“health care clearinghouse,” or a “health care provider who transmits any health
information in electronic form.” See id. § 160.103. The appellate court observed
that State Farm had not cited any specific language in HIPAA, the Privacy Rule, or
any other source of law “indicating that a noncovered entity that receives PHI from
a covered entity in response to a HIPAA qualified protective order is exempt from
complying with the order’s restrictions regarding the use or disclosure of the PHI.”
2020 IL App (2d) 190499, ¶ 49.
¶ 57 Before this court, State Farm argues that “because property and casualty
insurers like State Farm are not covered entities, their business operations do not
fall within HIPAA’s privacy and security obligations.” Further, according to State
Farm, “property and casualty insurers like State Farm do not become a ‘covered
entity’ when they receive PHI from a ‘covered entity’ in the ordinary course of
handling claims.”
¶ 58 State Farm maintains that property and casualty insurers logically “fall outside
HIPAA given the role of liability insurance in the administration of justice.” State
Farm argues that “property and casualty insurers do not enter into a physician-
patient relationship with anyone and their role is not to provide *** health care
services.” Rather, according to State Farm, property and casualty insurers “insure
their policyholders against the risk of bodily injury or property damage (including
for liability to others) that results from an accident—not to offer medical or health
care to the injured person.”
¶ 59 We cannot accept State Farm’s reasoning. Generally, a personal injury action
requires proof of an injury (Golla v. General Motors Corp., 167 Ill. 2d 353, 360
(1995)), which necessarily requires disclosure of relevant PHI. State Farm’s logic
leads to the denial of any request for a QPO in a judicial proceeding where a
defendant is insured by a casualty insurer. This court has noted “the dominant role
played by the insurance industry in the field of personal injury litigation.” Sullivan
v. Midlothian Park District, 51 Ill. 2d 274, 280 (1972). Scholars have similarly
recognized:
- 16 -
“The key stakeholders in litigation—at least on the defense side—are seldom
the individual litigants who have been sued. Rather, insurers are the entities
who regularly pay not only the cost of defending claims but also any settlement
or judgment. Insured parties retain some authority to make substantive litigation
decisions, but the practical reality is that insurers drive litigation outcomes.”
Chris Guthrie & Jeffrey J. Rachlinski, Insurers, Illusions of Judgment and
Litigation, 59 Vand. L. Rev. 2017, 2019 (2006).
See William P. Lynch, Why Settle for Less? Improving Settlement Conferences in
Federal Court, 94 Wash. L. Rev. 1233, 1251 (2019) (“Insurers play a key role in
the civil justice system. In most personal injury litigation, the individual defendant
is insured, and the insurer provides a defense and exercises complete control over
whether to settle the case.”).
¶ 60 Thus, if we were to accept State Farm’s argument, there would be few instances
in which a QPO could be requested. It was clearly not the intent of Congress that a
QPO would be unavailable whenever an alleged tortfeasor was insured by a liability
insurer. HIPAA contains no such limitation, and this court must not add such a
limitation under the guise of statutory construction. See People ex rel. Birkett v.
Dockery, 235 Ill. 2d 73, 81 (2009) (“we cannot rewrite a statute, and depart from
its plain language, by reading into it exceptions, limitations or conditions not
expressed by the legislature”); Hines v. Department of Public Aid, 221 Ill. 2d 222,
230 (2006) (same).
¶ 61 There are two exceptions to the prohibition against the use or disclosure of an
individual’s PHI. First, a covered entity may use or disclose PHI pursuant to a valid
authorization. 45 C.F.R. §§ 164.502(a)(1)(iv), 164.508 (2018).
¶ 62 Second, and relevant to this appeal, a covered entity may use or disclose PHI in
the course of litigation. Id. §§ 164.502(a)(1)(vi), 164.512(e). Use or disclosure of
PHI is permissible to comply with an order of a court or administrative tribunal, so
long as only the PHI expressly authorized by the order is disclosed. Id.
§ 164.512(e)(1)(i). Absent a judicial or administrative order, a covered entity may
disclose PHI in response to a subpoena, discovery request, or other lawful process
if (1) the covered entity has received satisfactory assurances that the party seeking
the disclosure has made reasonable efforts to ensure that the individual has been
given notice of the request or (2) the covered entity has made reasonable efforts to
- 17 -
secure a “qualified protective order.” Id. § 164.512(e)(1)(ii), (iv). A QPO is a
judicial or administrative order, or a stipulation by the parties, that (1) “[p]rohibits
the parties from using or disclosing the [PHI] for any purpose other than the
litigation or proceeding for which such information was requested” and
(2) “[r]equires the return to the covered entity or destruction of the [PHI] (including
all copies made) at the end of the litigation or proceeding.” Id. § 164.512(e)(1)(v).
¶ 63 Importantly, State Farm is not the disclosing party but rather is the party wishing
to obtain plaintiffs’ PHI. Therefore, in the absence of a court order pursuant to
section 164.512(e)(1)(i), the Privacy Rule authorizes a covered entity to disclose
PHI to State Farm in this litigation only pursuant to (1) a subpoena, discovery
request, or other lawful process, provided that adequate notice was given to
plaintiffs, or (2) a QPO containing the required “use and disclosure” prohibition
and the “return or destroy” requirement. Id. § 164.512(e)(1)(ii), (iv). Here, State
Farm is not appealing from any independent disclosure orders or any issues
pertaining to discovery, service of process, and notice. Accordingly, State Farm can
receive plaintiffs’ PHI only in response to a valid QPO.
¶ 64 State Farm argues that we should view its tendered protective orders as a request
for an independent disclosure order pursuant to section 164.512(e)(1)(i). We reject
this argument. Section 164.512(e)(1)(i) specifically mandates that “the covered
entity disclose[ ] only the [PHI] expressly authorized by such order.” (Emphases
added.) Id. § 164.512(e)(1)(i). Thus, pursuant to this section, a covered entity is
prohibited from disclosing PHI that is not “expressly authorized” by the order.
However, State Farm’s tendered protective orders do not address what PHI the
covered entity is expressly authorized to disclose. State Farm’s tendered protective
orders have no language that limits or restricts the PHI permitted to be disclosed.
Such an order would be impermissible for several reasons.
¶ 65 State Farm’s tendered protective orders violate Rule 201 to the extent that they
permit the disclosure of any and all PHI. Rule 201(b)(1) provides in relevant part:
“Except as provided in these rules, a party may obtain by discovery full disclosure
regarding any matter relevant to the subject matter involved in the pending action,
whether it relates to the claim or defense of the party seeking disclosure or of any
other party ***.” Ill. S. Ct. R. 201(b)(1) (eff. July 1, 2014). “[T]he relevance
requirement safeguards against ‘improper and abusive’ discovery and acts as an
- 18 -
‘independent constraint on discovery.’ ” People ex rel. Madigan v. Stateline
Recycling, LLC, 2020 IL 124417, ¶ 32 (quoting Kunkel v. Walton, 179 Ill. 2d 519,
533 (1997)). Therefore, even if State Farm’s tendered protective orders could be
viewed to require covered entities to disclose plaintiffs’ PHI, they would still be
improper because they do not satisfy the relevancy requirement of Rule 201(b).
¶ 66 Even if we were to consider State Farm’s tendered protective orders as
compliant with section 164.512(e)(1)(i), they would still violate the state
constitutional right to privacy. The Illinois Constitution guarantees, in pertinent
part, that “[t]he people shall have the right to be secure in their persons, houses,
papers and other possessions against unreasonable *** invasions of privacy.” Ill.
Const. 1970, art. I, § 6. In Kunkel, this court stated as follows:
“This court has observed that the Illinois Constitution goes beyond federal
constitutional guarantees by expressly recognizing a zone of personal privacy,
and that the protection of that privacy is stated broadly and without restrictions.
[Citation.] The confidentiality of personal medical information is, without
question, at the core of what society regards as a fundamental component of
individual privacy. Physicians are privy to the most intimate details of their
patients’ lives, touching on diverse subjects like mental health, sexual health
and reproductive choice. Moreover, some medical conditions are poorly
understood by the public, and their disclosure may cause those afflicted to be
unfairly stigmatized. Respect for the privacy of medical information is a central
feature of the physician-patient relationship. Under the Hippocratic Oath, and
modern principles of medical ethics derived from it, physicians are ethically
bound to maintain patient confidences. See Petrillo v. Syntex Laboratories, Inc.,
148 Ill. App. 3d 581, 589 (1986).
In addition, this court has recognized that ‘[a] person has a reasonable
expectation that he will not be forced to submit to a close scrutiny of his
personal characteristics, unless for a valid reason. *** [T]he individual’s
privacy interest in his physical person *** must be protected.’ [Citation.] We
believe that this privacy interest pertaining to individual physical characteristics
necessarily encompasses personal medical information.” Kunkel, 179 Ill. 2d at
537-38.
- 19 -
In Kunkel, this court cautioned: “The text of our constitution does not accord
absolute protection against invasions of privacy. Rather, it is unreasonable
invasions of privacy that are forbidden. In the context of civil discovery,
reasonableness is a function of relevance.” (Emphasis in original.) Id. at 538.
¶ 67 Where the privacy interest in medical information is involved, it “is reasonable
to require full disclosure of medical information that is relevant to the issues in the
lawsuit.” Id. However, State Farm’s tendered protective orders are unlimited in the
PHI to be disclosed without regard to the issues being litigated. The scope of the
PHI required by State Farm’s protective orders would be unreasonable and,
therefore, unconstitutional.
¶ 68 In sum, the Privacy Rule applies to State Farm. Therefore, State Farm can
receive plaintiffs’ PHI only in response to a valid QPO.
¶ 69 F. Illinois Insurance Regulatory Law Does Not
Mandate Use, Disclosure, or Retention of PHI
¶ 70 State Farm contends that the trial courts should have entered State Farm’s
tendered Cook County standard protective order or a similar protective order
“expressly allowing for the retention, use, and disclosure of information by property
and casualty insurers in conformity to federal and state law and regulations.” State
Farm complains that the trial courts’ QPOs prevent State Farm from fulfilling its
obligations under the Illinois Insurance Code and supporting administrative
regulations. State Farm’s argument requires analysis of the preemptive effect of the
Privacy Rule on Illinois insurance regulatory law.
¶ 71 1. Preemption Principles
¶ 72 The supremacy clause of the United States Constitution provides that federal
law “shall be the supreme Law of the Land ***, any Thing in the Constitution or
Laws of any State to the Contrary notwithstanding.” U.S. Const., art. VI, cl. 2. The
determination of whether state law is preempted turns on the intent of Congress.
When interpreting a federal statute pertaining to a subject traditionally governed by
state law, courts are reluctant to find preemption unless Congress’s preemptive
- 20 -
intent is clear and manifest. CSX Transportation, Inc. v. Easterwood, 507 U.S. 658,
664 (1993); Village of Mundelein v. Wisconsin Central R.R., 227 Ill. 2d 281, 288
(2008). One of the circumstances in which state law is preempted under the
supremacy clause is where the express language of a federal statute indicates an
intent to preempt state law. Wisconsin Public Intervenor v. Mortier, 501 U.S. 597,
604-05 (1991); Village of Mundelein, 227 Ill. 2d at 288. If the federal statute
contains an express exemption provision, “the task of statutory construction must
in the first instance focus on the plain wording of the clause, which necessarily
contains the best evidence of Congress’ pre-emptive intent.” CSX Transportation,
507 U.S. at 664; Village of Mundelein, 227 Ill. 2d at 289.
¶ 73 HIPAA and the Privacy Rule establish a uniform federal floor or baseline of
privacy protection for PHI, which states are free to exceed. See Giangiulio v.
Ingalls Memorial Hospital, 365 Ill. App. 3d 823, 839 (2006); Cohan, 322 P.3d at
955. When HHS promulgated the Privacy Rule, the agency stressed: “It is important
to understand this regulation as a new federal floor of privacy protections that does
not disturb more protective rules or practices. *** The protections are a mandatory
floor, which other governments and any covered entity may exceed.” 65 Fed. Reg.
at 82,471.
¶ 74 Consequently, “State laws that are contrary to the Privacy Rule are preempted
by the federal requirements, which means that the federal requirements will apply.”
Summary of the HIPAA Privacy Rule, supra, at 17; 45 C.F.R. § 160.203 (2018). A
state law is “contrary” to HIPAA if a “covered entity or business associate would
find it impossible to comply with both the State and Federal requirements” or if the
“provision of State law stands as an obstacle to the accomplishment and execution
of the full purposes and objectives of [HIPAA].” 45 C.F.R. § 160.202 (2018).
¶ 75 However, section 264 of HIPAA provides that the Privacy Rule “shall not
supersede a contrary provision of State law, if the provision of State law imposes
requirements, standards, or implementation specifications that are more stringent
than [those] imposed under the regulation.” Pub. L. No. 104-191 § 264(c)(2), 110
Stat. 1936, 2033-34. Implementing this statutory mandate, the Privacy Rule
provides that the general rule of federal preemption of contrary state law will not
occur if the state law is “more stringent” than the applicable standard promulgated
in the Privacy Rule. 45 C.F.R. § 160.203(b) (2018). The state law is “more
- 21 -
stringent” where it meets one or more of several criteria including where state law
prohibits or restricts a use or disclosure of PHI where the Privacy Rule would allow
it (id. § 160.202(1) (defining “more stringent”)) or, generally, where the state law
provides greater privacy protection (id. § 160.202(6) (same)). See South Carolina
Medical Ass’n, 327 F.3d at 355 (listing criteria).
¶ 76 Importantly, we add that these preemption provisions of HIPAA and the
Privacy Rule speak in terms of a specific provision of HIPAA or the Privacy Rule
and a specific provision of state law. In proposing the Privacy Rule, HHS explained
what HIPAA requires as follows:
“The initial question that arises in the preemption analysis is, what does one
compare? The statute directs this analysis by requiring the comparison of a
‘provision of State law [that] imposes requirements, standards, or
implementation specifications’ with ‘the requirements, standards, or
implementation specifications imposed under’ the federal regulation. The
statute thus appears to contemplate that what will be compared are the State and
federal requirements that are analogous, i.e., that address the same subject
matter.” 64 Fed. Reg. 59,918, 59,995 (proposed Nov. 3, 1999) (to be codified
at 45 C.F.R. pts. 160 to 164) (quoting Pub. L. No. 104-191 § 264 (c)(2), 110
Stat.1936, 2033-34).
Therefore, when a court engages in a HIPAA preemption analysis, the issue is not
whether HIPAA generally “is contrary to and more stringent than the entirety of a
state’s laws on the privacy of a patient’s medical information. Rather, the issue is
whether or not a specific provision of HIPAA is contrary to and more stringent than
a specific provision of state law.” State ex rel. Proctor v. Messina, 320 S.W.3d 145,
149 (Mo. 2010) (en banc).
¶ 77 2. Contested Provisions of Illinois Insurance Regulatory Law
¶ 78 Before this court, State Farm maintains its position that Illinois insurance
regulatory law requires State Farm to use, disclose, and retain PHI for various
regulatory purposes. We discuss each in turn.
- 22 -
¶ 79 State Farm contends that “property and casualty insurers are legally required to
retain documentation in their claim files for examination by regulators.” The
Insurance Code prohibits insurers from engaging in improper claims practices. See
215 ILCS 5/154, 154.6 (West 2018). To this end, section 919.30 of Title 50 of the
Illinois Administrative Code requires insurers to make their claim files available to
the Director of the Illinois Department of Insurance (Director) for examination
upon request. 50 Ill. Adm. Code 919.30 (1989). Regarding examinations by the
Director, section 919.30 provides in relevant part:
“b) Each company shall maintain claim data that should be accessible and
retrievable for examination by the Director. A company shall be able to provide
the claim number, line of coverage, date of loss and date of payment of the
claim, date of denial, or date claim closed without payment. This data must be
available for all open and/or closed files for the current year and the two
preceding years. The examiners’ review may include but need not be limited to
an examination of the following claims:
1) Claims Closed With Payment;
2) Claims Denied;
3) Claims Closed Without Payment;
4) First Party Automobile Total Losses; and/or Subrogation Claims.
c) Detailed documentation shall be contained in each claim file in order to
permit reconstruction of the company’s activities relative to each claim file.”
Id.Further, “documentation” includes “all pertinent communications, transactions,
notes and work papers” “properly dated and compiled in sufficient detail in order
to allow for the reconstruction of all pertinent events relative to each claim file.
Documentation shall include but not be limited to bills, explanations of benefits and
worksheets.” 50 Ill. Adm. Code 919.40 (1989).
¶ 80 State Farm argues that this regulation requires it to maintain, in each claim file,
detailed documentation that includes medical bills, which necessarily contain PHI.
- 23 -
According to State Farm, this insurance examination process conflicts with the
“return or destroy” requirement of the trial court’s QPOs.
¶ 81 We reject this argument. State Farm could establish its “activities relative to
each file” by simply including in the file a copy of the QPO, specifying that the
insurer was prohibited from using or disclosing PHI for any purpose other than the
litigation and was required to return or destroy the PHI at the end of the litigation.
The appellate court correctly reached a similar conclusion. See 2020 IL App (2d)
190499, ¶ 54.
¶ 82 State Farm next contends that property and casualty insurers are prohibited from
destroying company records except in conformity with the requirements of the
Insurance Code and its administrative regulations. State Farm relies on part 901 of
Title 50 of the Illinois Administrative Code (50 Ill. Adm. Code 901 (2016)). Section
901.5 provides that “[n]o domestic company shall destroy any books, records,
documents, accounts or vouchers, hereafter referred to as ‘records’, except in
conformity with the requirements of this Part.” 50 Ill. Adm. Code 901.5 (2016).
Section 901.20 of Title 50 sets out a time period for the disposal and destruction of
records:
“The company is authorized to dispose of or destroy records in its custody
that do not have sufficient administrative, legal or fiscal value to warrant their
further preservation and are not needed:
a) in the transaction of current business;
b) for the final settlement or disposition of any claim arising out of a
policy of insurance issued by the company, except that these records must
be maintained for the current year plus 5 years; or
c) to determine the financial condition of the company for the period
since the date of the last examination report of the company officially filed
with the Department of Insurance, except that these records must be
maintained for at least the current year plus 5 years.” 50 Ill. Adm. Code
901.20 (2016).
Further, the term “records” is defined in section 901.10 of Title 50 as follows:
- 24 -
“ ‘Records’ material means all books, papers and documentary materials
regardless of physical form or characteristics, made, produced, executed or
received by any domestic insurance company pursuant to law or in connection
with the transaction of its business and preserved or appropriate for preservation
by such company or its successors as evidence of the organization, function,
policies, decisions, procedures, obligations and business activities of the
company or because of the informational data contained therein. If doubt arises
as to whether certain papers are ‘non-record’ materials, it should be assumed
that the documents are ‘records’.” 50 Ill. Adm. Code 901.10 (2016).
Before this court, State Farm argues that this definition of “records” is broad
enough to include medical bills and records. State Farm maintains its position that
part 901 sets out a detailed process for the destruction of an insurer’s records, which
conflicts with the trial courts’ QPOs.
¶ 83 We reject this argument. In this case, State Farm does not explain how
plaintiffs’ PHI is “appropriate for preservation,” especially given that (1) the trial
courts entered HIPAA QPOs expressly requiring the destruction of PHI within 60
days after the conclusion of the litigation and (2) State Farm failed to cite any
statute, regulation, or case law that affirmatively requires the retention of PHI or its
use for a particular purpose. State Farm has made this argument in other courts,
including the appellate court here, and those courts have correctly rejected it. See
2020 IL App (2d) 190499, ¶ 59; State ex rel. State Farm Mutual Automobile
Insurance Co. v. Marks, 741 S.E.2d 75, 83-84 (W. Va. 2012); Small v. Ramsey, 280
F.R.D. 264, 279-80 (N.D. W. Va. 2012). Further, as earlier noted, retention of a
copy of the QPO in the file would explain why the PHI was not present. Thus, part
901 of Title 50 of the Illinois Administrative Code does not support State Farm’s
position.
¶ 84 State Farm next contends that the trial courts’ QPOs prevent insurers from
performing functions related to fraud detection and deterrence. State Farm
maintains its position that, because the Illinois Department of Insurance relies on
property and casualty insurers to detect and combat insurance fraud, Illinois law
authorizes them to report information, including PHI, to the Illinois Department of
Insurance and insurance support organizations, such as the National Insurance
Crime Bureau and the Insurance Services Organization. See 215 ILCS 5/155.23
- 25 -
(West 2018). State Farm argues that, if insurers must return to covered entities or
destroy all PHI within 60 days of the end of litigation, they cannot later provide
necessary information to help the state with fraud detection and prevention.
¶ 85 The statute State Farm cites authorizes the Director
“to promulgate reasonable rules requiring insurers *** doing business in the
State of Illinois to report factual information in their possession that is pertinent
to suspected fraudulent insurance claims, fraudulent insurance applications, or
premium fraud after [the Director] has made a determination that the
information is necessary to detect fraud or arson. Claim information may
include:
(a) Dates and description of accident or loss.
(b) Any insurance policy relevant to the accident or loss.
(c) Name of the insurance company claims adjustor and claims adjustor
supervisor processing or reviewing any claim or claims made under any
insurance policy relevant to the accident or loss.
(d) Name of claimant’s or insured’s attorney.
(e) Name of claimant’s or insured’s physician, or any person rendering
or purporting to render medical treatment.
(f) Description of alleged injuries, damage or loss.
(g) History of previous claims made by the claimant or insured.
(h) Places of medical treatment.
(i) Policy premium payment record.
(j) Material relating to the investigation of the accident or loss, including
statements of any person, proof of loss, and any other relevant evidence.
(k) any facts evidencing fraud or arson.” Id. § 155.23(1).
- 26 -
State Farm’s reliance on section 155.23 is unpersuasive for two reasons. First, the
statute applies only to suspected fraudulent insurance claims or applications, or
premium fraud, and only after the Director has determined that the information is
necessary to detect fraud or arson. In this case, there is no indication of fraud and
no evidence that the Director has determined that any PHI is necessary to detect
fraud or arson. Therefore, there can be no factual information pertinent to any
suspected fraud. Second, the statute requires an insurer to report only factual
information in its possession. An insurer that has returned or destroyed PHI in
accordance with a HIPAA QPO cannot violate the statute, because it does not
possess any such information.
¶ 86 State Farm next asserts that the trial courts’ QPOs “impede compliance with
federal reporting requirements.” State Farm argues that, under the Medicare
secondary payor statute (42 U.S.C. § 1395y(b)(2) (2018)), “automobile or liability
insurers must report payments made to Medicare beneficiaries, along with
information about the alleged cause of injury, incident, or illness.” According to
State Farm: “Retention of medical records is crucial to this process. Additionally,
insurers need medical records if Medicare seeks recovery of a ‘conditional
payment.’ ”
¶ 87 We also reject this argument. This statute does not require a liability insurer to
retain PHI after litigation even for Medicare beneficiaries. If State Farm is to pay a
settlement or judgment, all it need do is to report the payment and the alleged cause
of injury. Id. § 1395y(b)(8)(B)(i), (ii). This does not require State Farm to retain or
disclose PHI after the conclusion of litigation.
¶ 88 Lastly, State Farm maintains its position that Illinois law protects personal or
privileged information received in handling claims while still allowing property and
casualty insurers to make disclosures necessary for rate-making, anti-fraud
programs, and consumer-protection research. Article XL of the Insurance Code
provides as follows:
“The purpose of this Article is to establish standards for the collection, use and
disclosure of information gathered in connection with insurance transactions by
insurance institutions, agents or insurance-support organizations; to maintain a
balance between the need for information by those conducting the business of
insurance and the public’s need for fairness in insurance information practices,
- 27 -
including the need to minimize intrusiveness; to establish a regulatory
mechanism to enable natural persons to ascertain what information is being or
has been collected about them in connection with insurance transactions and to
have access to such information for the purpose of verifying or disputing its
accuracy; to limit the disclosure of information collected in connection with
insurance transactions; and to enable insurance applicants and policyholders to
obtain the reasons for any adverse underwriting decision.” 215 ILCS 5/1001
(West 2018).
This provision does not contain any affirmative language that mandates the use,
disclosure, or retention of PHI for any purpose.
¶ 89 State Farm has failed to direct us to, nor have we found, any provision of the
Insurance Code or the Illinois Administrative Code that requires it to use or disclose
plaintiffs’ PHI after the conclusion of the litigation. As such, we reject State Farm’s
argument that the trial courts’ QPOs conflict with its obligations under state law.
Since there is no conflict, the Privacy Rule does not preempt or otherwise nullify
these specific provisions in the Insurance Code and its administrative regulations.
¶ 90 G. Privacy Rule Preempts Cook County
Standard Protective Order
¶ 91 State Farm assigns error to the conclusion of the trial and appellate courts that
its alternative tendered protective orders are preempted by the Privacy Rule. State
Farm argues that the absence of the “use or disclose” prohibition and the “return or
destroy” requirement “cannot be an obstacle to accomplishing HIPAA’s full
purposes and objectives” because those restrictions are not required for a court
order pursuant to section 164.512(e)(1)(i). Rather, those restrictions apply only to
discovery processes that are not accompanied by a court order. 45 C.F.R.
§ 164.512(e)(1)(ii) (2018).
¶ 92 We recognize that the Privacy Rule does not require a court order entered
pursuant to section 164.512(e)(1)(i) to include the “use or disclose” prohibition and
the “return or destroy” requirement of section 164.512(e)(1)(ii). This provision
does not expressly dictate any criteria for judges to exercise their discretion.
However, in response to a court order pursuant to section 164.512(e)(1)(i), a
- 28 -
covered entity may disclose “only the [PHI] expressly authorized by such order.”
Id. § 164.512(e)(1)(i).
¶ 93 We must construe the language of section 164.512(e)(1) as a whole, in light of
HIPAA and the entire Privacy Rule. See National Bank of Oregon, 508 U.S. at 455.
Accordingly, we consider plaintiffs and State Farm to have followed the better
approach in this litigation. Parties should first seek a protective order that meets the
definition of a QPO under section 164.512(e)(1)(v) to pursue discovery under the
provisions of section 164.512(e)(1)(ii). Should the parties then encounter any
difficulty with the acquisition of necessary discovery, they may seek a court order
as contemplated under section 164.512(e)(1)(i) for that specific, targeted
information. See, e.g., Lohr v. UnitedHealth Group Inc., No. 1:12CV718, 2013 WL
4500692, at *5 (M.D.N.C. Aug. 21, 2013).
¶ 94 As earlier discussed, the Cook County standard protective order does not
address what PHI the covered entity is expressly authorized to disclose. Therefore,
we conclude that, in this case, a covered entity cannot comply with both the Privacy
Rule and State Farm’s tendered protective orders. The Cook County standard
protective order does not prohibit the insurer from using and disclosing PHI outside
of litigation and does not require an insurer to return or destroy PHI at the
conclusion of litigation. These concessions directly conflict with the requirements
for a HIPAA QPO under section 164.512(e)(1)(v) of the Privacy Rule. Likewise,
by eliminating the “use or disclose” prohibition and the “return or destroy”
requirement, the Cook County standard protective order would not provide the
confidentiality and protection of PHI envisioned when the Privacy Rule was
promulgated. To accept State Farm’s argument would render superfluous and
nugatory section 164.512(e)(1)(ii), which we cannot do. TRW Inc., 534 U.S. at 31.
In other words, any requirement that an insurer be allowed to use and retain PHI
beyond the conclusion of litigation would lower the floor of privacy protection that
HIPAA and the Privacy Rule mandate. As such, the Cook County standard
protective order acts as an obstacle to accomplishing and executing HIPAA’s full
purposes and objectives. 45 C.F.R. § 160.202 (2018).
¶ 95 Therefore, we hold that the Cook County standard protective order is preempted
by the Privacy Rule. We next determine whether the McCarran-Ferguson Act
- 29 -
shields the Cook County standard protective order from traditional preemption.
¶ 96 H. Reverse Preemption
¶ 97 The trial courts asked the parties to address the implications of the McCarran-
Ferguson Act (15 U.S.C. § 1011 et seq. (2018)), which gives rise to the doctrine of
“reverse preemption.” If applicable, the reverse preemption doctrine allows state
laws that regulate insurance to prevail over general federal rules. Lovilia Coal Co.
v. Williams, 143 F.3d 317, 324 (7th Cir. 1998); United States v. Rhode Island
Insurers’ Insolvency Fund, 80 F.3d 616, 620 (1st Cir. 1996) (collecting cases). The
parties did not argue that the McCarran-Ferguson Act applied in these cases, and
the trial courts did not address the issue. The appellate court observed: “State Farm
briefly mentions the McCarran-Ferguson Act in its brief but does not fully develop
the issue. Nevertheless, we find it appropriate to briefly address this matter.” 2020
IL App (2d) 190499, ¶ 66. The appellate court held that the doctrine of reverse
preemption did not apply to shield Illinois insurance law from Privacy Rule
preemption. Id. ¶ 68.
¶ 98 Before this court, State Farm contends that the appellate court’s holding that the
Privacy Rule preempts any conflicting state law is inconsistent with its holding that
there is no conflict between the Privacy Rule and state law for reverse preemption
purposes. State Farm misapprehends the McCarran-Ferguson Act and the reverse
preemption doctrine.
¶ 99 As earlier mentioned, the general rule is that, “[w]here a state statute conflicts
with, or frustrates, federal law, the former must give way.” CSX Transportation,
507 U.S. at 663. However, the McCarran-Ferguson Act carved out an exception to
this general rule where state laws regulate the “business of insurance.” 15 U.S.C.
§ 1011 (2018). Section 2(b) of the McCarran-Ferguson Act provides: “No Act of
Congress shall be construed to invalidate, impair, or supersede any law enacted by
any State for the purpose of regulating the business of insurance *** unless such
Act specifically relates to the business of insurance.” Id. § 1012(b). The United
States Supreme Court has explained:
“[T]he Act does not seek to insulate state insurance regulation from the reach
of all federal law. Rather, it seeks to protect state regulation primarily against
- 30 -
inadvertent federal intrusion—say, through enactment of a federal statute that
describes an affected activity in broad, general terms, of which the insurance
business happens to constitute one part.” (Emphasis omitted.) Barnett Bank of
Marion County v. Nelson, 517 U.S. 25, 39 (1996).
¶ 100 The McCarran-Ferguson Act “transformed the legal landscape by overturning
the normal rules of preemption.” United States Department of Treasury v. Fabe,
508 U.S. 491, 507 (1993). Section 2(b) imposes “a rule that state laws enacted ‘for
the purpose of regulating the business of insurance’ do not yield to conflicting
federal statutes unless a federal statute specifically requires otherwise.” Id. Under
the McCarran-Ferguson Act, a state law will reverse preempt a federal law if (1) the
state law was enacted for the purpose of regulating the business of insurance; (2) the
federal law does not specifically relate to the business of insurance; and (3) the
federal law would invalidate, impair, or supersede the state law. Humana Inc. v.
Forsyth, 525 U.S. 299, 307 (1999). All three criteria must be satisfied for the
doctrine of reverse preemption to preclude application of a federal law. See Lovilia
Coal, 143 F.3d at 324; Rhode Island Insurers’ Insolvency Fund, 80 F.3d at 619.
¶ 101 The appellate court concluded that “nothing in any Illinois statute or regulation
State Farm cites requires the retention of PHI or its use for any particular purpose.
Thus, the HIPAA qualified protective orders entered in this case do not ‘invalidate,
impair, or supersede’ the Illinois statutes and regulations State Farm cites.” 2020
IL App (2d) 190499, ¶ 68. Therefore, the appellate court correctly held that the
doctrine of reverse preemption does not apply in this case. Id.¶ 102 There is no inconsistency between this holding and our prior conclusion, with
which the appellate court agreed, that the Privacy Rule preempts any conflicting
state law. State Farm and plaintiffs agree with the appellate court’s holding that the
McCarran-Ferguson Act does not apply here. Therefore, the doctrine of reverse
preemption cannot shield the pertinent Illinois Insurance Code sections and
regulations from federal preemption.
¶ 103 III. CONCLUSION
¶ 104 As a matter of law, we conclude as follows. The Privacy Rule applies in these
cases to potentially preempt Illinois insurance regulatory law governing the use,
- 31 -
disclosure, and retention of PHI. The trial courts’ QPOs do not conflict with Illinois
insurance regulatory law because nothing in the Insurance Code or administrative
regulations mandates that a property and casualty insurer use, disclose, and retain
PHI beyond litigation. However, the Cook County standard protective order is
contrary to the Privacy Rule because it falls below the floor of privacy that the
Privacy Rule mandates. Therefore, it is preempted by the Privacy Rule. Further, the
reverse preemption doctrine provided by the McCarran-Ferguson Act does not
shield the disputed provisions of Illinois insurance regulatory law from preemption.
Therefore, we hold that the trial courts did not abuse their discretion in entering the
QPOs pursuant to HIPAA and the Privacy Rule.
¶ 105 For the foregoing reasons, the judgment of the appellate court is affirmed, and
the cases are remanded to the circuit court of Lake County for further proceedings.
¶ 106 Affirmed and remanded.
- 32 -