Haage v. Zavala
158 N.E.3d 1171
Ill. App. Ct.2020Background:
- Consolidated appeals from two Illinois personal-injury suits in which plaintiffs sought HIPAA-qualified protective orders to permit disclosure of their protected health information (PHI) for litigation, limit use to the litigation, and require return/destruction within 60 days after conclusion.
- State Farm (liability insurer for defendants) successfully intervened and objected, arguing: it is not a HIPAA "covered entity" and the proposed orders would conflict with Illinois Insurance Code and administrative rules that (allegedly) require retention/use of claim records and permit use for claims handling, fraud detection, regulatory examinations, actuarial/reinsurance functions.
- Plaintiffs moved for protective orders that tracked 45 C.F.R. § 164.512(e)(1)(v): prohibit use/disclosure except for the litigation and require return/destruction thereafter; State Farm proposed the Cook County protective order that exempts insurers from the return/destroy requirement for specified insurer functions.
- Trial courts granted plaintiffs’ HIPAA qualified protective orders, rejected the Cook County order, and held that (a) State Farm is not a HIPAA covered entity but any recipient of PHI under a HIPAA qualified protective order must comply with its terms, and (b) to the extent state law conflicted with HIPAA, HIPAA preempted it.
- On interlocutory appeal, the Second District affirmed: State Farm is not a covered entity but is bound by HIPAA-qualified protective orders when it receives PHI pursuant to such orders; the Cook County order would conflict with HIPAA and lower the federal privacy floor; McCarran-Ferguson reverse preemption did not apply.
Issues:
| Issue | Plaintiff's Argument | State Farm's Argument | Held |
|---|---|---|---|
| Is State Farm a HIPAA "covered entity"? | Plaintiffs concede State Farm is not a covered entity, but note that does not excuse compliance with a court order. | State Farm: as a property & casualty insurer it is not a covered entity under HIPAA definitions. | Held: State Farm is not a covered entity under HIPAA. |
| Is a non-covered recipient bound by a HIPAA-qualified protective order when it receives PHI from a covered entity? | Plaintiffs: yes — anyone receiving PHI under a qualified order must follow its restrictions; otherwise the order would be ineffective. | State Farm: non-covered entities are not subject to HIPAA restrictions and may use/retain PHI as allowed by state law. | Held: A non-covered recipient who obtains PHI pursuant to a HIPAA-qualified protective order is bound by the order's terms. |
| Do the HIPAA-qualified orders conflict with Illinois Insurance Code / administrative rules (use/retention/examination/fraud functions)? | Plaintiffs: state law does not mandate retention/use of PHI that would defeat HIPAA-qualified order; any contrary state law is preempted. | State Farm: orders impede insurer obligations (record retention, regulatory exams, fraud reporting, underwriting/actuarial/reinsurance). | Held: No actual conflict shown in cited statutes/regulations; to the extent a conflict existed, HIPAA preempts contrary state law because the Cook County order would frustrate HIPAA’s privacy floor. |
| Does the McCarran-Ferguson Act permit state insurance law to trump HIPAA (reverse preemption)? | Plaintiffs: not raised; HIPAA governs the qualified protective order. | State Farm: McCarran-Ferguson may preserve state insurance law over federal law. | Held: McCarran-Ferguson inapplicable — State Farm failed to show HIPAA "invalidates, impairs, or supersedes" any state insurance law cited; reverse preemption not triggered. |
Key Cases Cited
- Giangiulio v. Ingalls Memorial Hospital, 365 Ill. App. 3d 823 (Ill. App. Ct.) (discussing HIPAA preemption framework and state-law interaction)
- Brende v. Hara, 153 P.3d 1109 (Haw. 2007) (stating HIPAA’s purpose to establish national privacy standards)
- Small v. Ramsey, 280 F.R.D. 264 (N.D. W. Va.) (concluding liability insurers are not HIPAA covered entities and rejecting similar insurer arguments)
- Humana Inc. v. Forsyth, 525 U.S. 299 (1999) (defining terms for McCarran-Ferguson reverse preemption analysis)
- Altria Group, Inc. v. Good, 555 U.S. 70 (2008) (federal preemption principles)