A recent decision could dramatically narrow the use of protected health information (“PHI”) that is disclosed to an insurer following the conclusion of litigation in Illinois. With this decision comes possible far-reaching implications facing insurers going forward by preventing the development of future medical fraud litigation and monetary recoveries.
In Haage v. Zavala, et al. 2020 IL App (2d) 190499 (March 17, 2020), Plaintiffs filed negligence suits for auto collisions, and moved for entry of qualified protective orders pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”) (Pub. L. No. 104-191, 110 Stat. 1936 (1996) [codified as amended in scattered sections of Titles 18, 26, 29, and 42 of the United States Code)]. Generally, HIPAA prohibits the use or disclosure of an individual’s PHI by a covered entity or business associate unless an individual has consented in writing or the disclosure is otherwise specifically provided for by the Privacy Rule. 45 C.F.R. pt. 160, 164 (2018). In Haage, Plaintiff’s qualified protective orders, pursuant to HIPAA, stated that the PHI would be used only for purposes of the litigation and at the conclusion of the litigation must be returned to the provider or destroyed. State Farm intervened, filed objections to the Plaintiff’s qualified protective orders, and requested that the court instead enter protective orders similar to those used in the Law Division of the Circuit Court of Cook County, Illinois. 2020 IL App (2d) 190499 at ¶ 2. The Cook County protective order currently permits insurers to disclose, maintain, use, and dispose of protected health information (PHI) to comply with statutes and regulations for certain designated purposes. Most noteworthy, the order exempts insurers from any "return or destroy" provisions. Id. The appellate court ruled that, to the extent that HIPAA and its regulations conflict with state law, they preempt state law; and that any person or entity receiving PHI in response to a HIPAA qualified protective order is bound by the terms of that order. The court held that the Cook County protective order directly conflicts with HIPAA requirements in that it does not require an insurer to return or destroy PHI at the conclusion of litigation. Thus, as the court reasoned, the Cook County protective order would permit an insurer to use and retain PHI outside of litigation in violation of federal law.
The decision in Haage v. Zavala could have widespread repercussions for liability insurers throughout Illinois. For the time being, liability insurers and their defense counsel litigating in Cook County will be in limbo, waiting for the Illinois Supreme Court’s opportunity to resolve the conflict between the two appellate districts on the permissible use and retention of PHI. If the Illinois Supreme Court finds that the current Cook County protective order impermissibly gives liability insurers the ability to subvert federal privacy law, insurers must be aware of the broader implications. First and foremost, this decision has called into question the viability and application of the HIPAA order currently in place in the heavily litigated forum of Cook County. If the Illinois Supreme Court were to affirm the decision in Haage, liability insurers must put into place return and destroy measures for all medical and billing records following the conclusion of a case. Next, insurers could be stymied in litigating and seeking recovery for fraudulent treatment and overbilling practices, which normally come to light after a broad examination of treatment and billing records across the practice. Because the Second District held that the federal legislation preempts the duties on insurers under state law, liability insurers in maintaining PHI following settlement, arbitration, or judgments would be in violation of HIPAA to turn around and use that PHI for another matter. Any PHI shared and disseminated in the bringing of medical fraud suits involving treaters and overbilling would similarly be in violation of HIPAA “return or destroy” provisions. Under the current Cook County order in place, this practice is perfectly acceptable. However, under the decision just issued by the Second District, this practice could be found to run afoul of HIPAA and could therefore be proscribed.
If you have questions or need assistance in navigating this changing area of the law, please contact an attorney in HeplerBroom’s Insurance Law team.