Haage v. Zavala, 183 N.E.3d 830

Background:

Two Lake County personal-injury suits (Haage; Surlock) where plaintiffs sought HIPAA-qualified protective orders (QPOs) to obtain treating providers’ protected health information (PHI) for litigation.
Plaintiffs’ proposed QPOs required PHI be used only for the litigation and be returned or destroyed after conclusion (per 45 C.F.R. § 164.512(e)(1)(v)).
State Farm intervened as insurer, objected, and tendered the Cook County standard protective order that permits insurers to retain/use PHI for business purposes and exempts them from the return/destroy requirement.
Trial courts granted plaintiffs’ QPOs and denied State Farm’s orders; the appellate court affirmed; State Farm appealed to the Illinois Supreme Court.
The Supreme Court affirmed: HIPAA/Privacy Rule governs disclosure to non‑covered recipients via QPOs; Illinois insurance law does not mandate post‑litigation retention/use of PHI; the Cook County order is preempted; McCarran‑Ferguson reverse‑preemption does not apply.

Issues:

Issue	Plaintiff's Argument	Defendant's Argument	Held
Whether the Privacy Rule governs a non‑covered insurer that seeks PHI in litigation	QPOs bind any recipient of PHI; State Farm must follow QPO terms to receive PHI	State Farm is not a HIPAA "covered entity," so HIPAA obligations do not apply to it	Privacy Rule applies to recipients seeking PHI; non‑covered insurers may receive PHI only under a valid QPO or other authorized process
Whether Illinois insurance law requires insurers to retain/use PHI after litigation (conflict with QPO destruct/return requirement)	QPOs do not conflict because no state law affirmatively requires retention/use of PHI	State Farm says Insurance Code/regulations and administrative rules obligate retention, recordkeeping, fraud detection, and federal reporting, so it must retain PHI	No Illinois statute/regulation shown to mandate post‑litigation retention/use of PHI; QPOs do not conflict with state law
Whether the Cook County protective order (allowing insurer retention/use) is preempted by HIPAA	Plaintiffs: Cook County order undermines HIPAA floor and cannot substitute for a QPO	State Farm: order is permissible, §164.512(e)(1)(i) court orders need not include QPO terms	Cook County order conflicts with the Privacy Rule’s QPO requirements and is preempted because it lowers HIPAA’s required protections
Whether McCarran‑Ferguson reverse preemption shields Illinois insurance law or Cook County order	Plaintiffs: McCarran‑Ferguson does not apply because no conflicting state law was shown	State Farm: McCarran‑Ferguson should let conflicting state insurance rules govern	Reverse‑preemption does not apply: plaintiffs/appellant failed to identify state laws enacted to regulate insurance that are invalidated by HIPAA; McCarran‑Ferguson does not save the Cook County order

Key Cases Cited

Skolnick v. Altheimer & Gray, 191 Ill. 2d 214 (2000) (interlocutory protective orders reviewed as injunctions under Rule 307)
Kunkel v. Walton, 179 Ill. 2d 519 (1997) (constitutional privacy interest in medical information; relevance limits discovery)
CSX Transp., Inc. v. Easterwood, 507 U.S. 658 (1993) (reluctance to find federal preemption where states traditionally regulate)
Barnett Bank of Marion County v. Nelson, 517 U.S. 25 (1996) (McCarran‑Ferguson protects state insurance regulation from general federal statutes that do not specifically relate to insurance)
Humana Inc. v. Forsyth, 525 U.S. 299 (1999) (three‑part test for reverse preemption under McCarran‑Ferguson)
TRW Inc. v. Andrews, 534 U.S. 19 (2001) (statutory text must be given effect; do not render provisions superfluous)