Cook County Protective Order Template Violates HIPAA With Regard to PHI Disclosures

This alert was featured in Hinshaw's Annual Guide to Illinois Medical Malpractice Decisions: 2020 Edition

Issue

Is an insurer considered a "covered entity" subject to HIPAA regulations regarding protected health information?

Rosemarie Haage v. Alfonso Monitel Zavala, et al. (State Farm Mutual Insurance Company, Intervenor-Appellant), 2020 IL App (2d) 190499 (2020)

Case Summary

These consolidated automobile negligence cases arose out of automobile collisions that occurred in 2016 and 2017. State Farm sought an interlocutory appeal after the trial court granted plaintiffs' motions for qualified protective orders pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended in sections of Titles 18, 26, 29, and 42 of the United States Code)) ("HIPAA qualified protective orders").

The proposed qualified protective orders would: (1) require any person or entity in possession of protected health information (PHI) received pursuant to the protective order, including an insurance company, to return or destroy any and all PHI pertaining to the plaintiffs within 60 days after the conclusion of the litigation in compliance with 45 C.F.R. § 164.512(e)(1)(v)(B); and (2) prohibit the parties, their attorneys, and their insurers from using or disclosing PHI for any purpose other than the litigation at issue in compliance with 45 C.F.R. § 164.512(e)(1)(v)(A). State Farm objected to the qualified protective orders, arguing that they would impose "significant restrictions and obligations" upon it, and requested the court to use the form template protective order used by Cook County Circuit Court.

On appeal, the Haage court first confirmed that State Farm was not a "covered entity" under HIPAA because it was not a "health care clearing house" or a "health care provider" as those terms are defined under HIPAA at 45 C.F.R. § 160.103. The appellate court confirmed, in a de novo review of HIPAA regulations, that State Farm's status as a "non-covered entity" did not exempt it from obeying the terms of a HIPAA qualified protective order. The court acknowledged that HIPAA authorized different methods for disclosure of PHI, but the only one addressed in the appeal was disclosures in the course of a judicial proceeding without a court order under 45 C.F.R. 164.512(e)(1)(ii), which applied regardless of whether the disclosure was made to a covered entity or a non-covered entity. The court noted that its analysis was limited to disclosures under protective orders because neither State Farm nor plaintiffs sought the disclosure of PHI by any means other than a protective order.

Significantly, the court found the Cook County protective order, which State Farm requested be applied in the alternative, was not compliant with HIPAA. The order would have divorced State Farm from any obligation to limit the use or disclosure of PHI to the litigation, or to return or destroy the PHI at the end of the litigation, which violated HIPAA's requirements set forth in 45 C.F.R. § 164.512(e)(1)(v) for PHI disclosures in response to a protective order.

Takeaway

Be aware of HIPAA requirements associated with each alternative method for PHI disclosures. Not all court-approved standard templates for such disclosures necessarily comply with HIPAA's requirements.

Note: On September 30, 2020, the Illinois Supreme Court granted the petition for appeal of the Haage decision.

>> Return to Hinshaw's Annual Guide to Illinois Medical Malpractice Decisions: 2020 Edition