ROSEMARIE HAAGE, Plaintiff-Appellee, v. ALFONSO MONTIEL ZAVALA, PATRICIA SANTIAGO, JOSE PACHECO VILLANUEVO, OKAN ESMEZ, and ROSALINA ESMEZ, Defendants (State Farm Mutual Automobile Insurance Company, Intervenor-Appellant).–AGNIESZKA SURLOCK and EDWARD SURLOCK, Plaintiffs-Appellees, v. DRAGOSLAV STARCEVIC, Defendant (State Farm Mutual Automobile Insurance Company, Intervenor-Appellant).
Nos. 2-19-0499, 2-19-0500 cons.
Appellate Court of Illinois, Second District
March 13, 2020
Rehearing denied April 2, 2020
2020 IL App (2d) 190499
Decision Under Review: Appeal from the Circuit Court of Lake County, Nos. 17-L-897, 18-L-39; the Hon. Mitchell L. Hoffman and the Hon. Diane E. Winter, Judges, presiding. Judgment: Affirmed.
Counsel on Appeal: Glen E. Amundsen and Michael Resis, of SmithAmundsen LLC, of Chicago, for appellant. Robert D. Fink and Kenneth A. Koppelman, of Collison Law Offices, of Chicago, for appellees.
OPINION
I. INTRODUCTION
¶ 1 This consolidated appeal concerns the scope of protective orders involving the
¶ 2 Following a combined hearing and additional briefing, the trial court in each case granted plaintiffs’ motions for the HIPAA qualified protective orders and denied State Farm’s request for the Cook County protective orders. The trial courts determined, among other things, that (1) to the extent that State Farm’s obligations and rights under Illinois law conflict with HIPAA requirements, the federal statute and its regulations preempt state law and (2) any individual or entity receiving PHI in response to a HIPAA qualified protective order is bound to follow the terms of the order. State Farm filed an interlocutory appeal in each case, pursuant to
II. BACKGROUND
¶ 3 To provide context to the parties’ arguments, we briefly review the relevant provisions of HIPAA before discussing the facts underlying this appeal.
A. HIPAA
¶ 4 In 1996, Congress passed, and President Clinton signed into law,
¶ 5 The Privacy Rule prohibits the use or disclosure of an individual’s PHI by a “covered entity” or “business associate” unless the individual has consented in writing or unless the use or disclosure is otherwise specifically permitted or required by the Privacy Rule.
¶ 6 Relevant to this dispute, the Privacy Rule permits a “covered entity” to use or disclose PHI, in the course of any judicial or administrative proceeding, without the written authorization of the individual to whom it belongs.
¶ 7 HIPAA and its regulations establish a “uniform federal ‘floor’ of privacy protections for individual medical information.” Scott D. Stein, What Litigators Need to Know About HIPAA, 36 J. Health L. 433, 434 (2003); see also Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,471 (“The protections [(provided by HIPAA and its regulations)] are a mandatory floor, which other governments and any covered entity may exceed.”);
B. Underlying Facts
1. Haage Complaint
¶ 8 On November 15, 2017, plaintiff, Rosemarie Haage, filed a five-count complaint against defendants Alfonso Montiel Zavala, Patricia Santiago, Jose Pacheco-Villanuevo, Okan Esmez, and Rosalina Esmez. The action arose out of a multi-vehicle collision near the intersection of Lakeview Parkway and Route 60 in Vernon Hills. Count I of the complaint alleged negligence on the part of Zavala, count II alleged negligent entrustment on the part of Santiago, count III alleged negligence on the part of Pacheco-Villanuevo, count IV alleged negligence on the part of Okan Esmez, and count V alleged negligent entrustment on the part of Rosalina Esmez. All counts sought to recover damages for, inter alia, Haage’s bodily injuries.
2. Surlock Complaint
¶ 9 On January 11, 2018, plaintiffs, Agnieszka and Edward Surlock, filed a two-count complaint against defendant Dragoslav Starcevic. The action arose out of an automobile accident between Agnieszka and Starcevic on January 24, 2016, at the intersection of Grand Avenue and Route 45 in Lindenhurst. Count I of the complaint alleged negligence and sought to recover damages for, inter alia, Agnieszka’s bodily injuries. Count II of the complaint alleged loss of consortium on behalf of Edward, Agnieszka’s husband.
3. Motions for Entry of Protective Orders
¶ 10 On August 23, 2018, the Surlocks and Haage each filed a “Motion for Entry of Protective Order and Authorization to Disclose Protected Health Information” in their respective lawsuits. The motions alleged that Agnieszka’s and Haage’s treating physicians, hospitals, and other healthcare providers, all of whom are “covered entities” as defined by the Privacy Rule, possess their PHI. The motions further alleged that both the prosecution and the defense in each case “will require that the parties, their attorneys, their attorneys’ agents, consultants and various witnesses and other personnel receive and review copies of the protected health information” but that HIPAA “potentially prohibits covered entities from disclosing protected health information in judicial proceedings other than by authorization or Qualified Protective Order.” See
4. Petitions to Intervene
¶ 11 On September 17, 2018, State Farm filed a petition to intervene in the Surlock case as a matter of right pursuant to
5. State Farm’s Objections
¶ 12 In support of its objections, State Farm initially argued that the HIPAA qualified protective orders proposed by plaintiffs seek to bind it to HIPAA’s requirements, even though it is exempt from the statute’s application. In this regard, State Farm asserted that, as a property and casualty insurer, it is not a “covered entity” under HIPAA. State Farm also argued that restrictions in the proposed HIPAA qualified protective orders would directly conflict with its obligations and rights under Illinois law in two principal ways. First, State Farm asserted that requiring it to return or destroy all copies of PHI following the conclusion of the litigation would interfere with its obligations under provisions of both the Illinois Insurance Code and the Illinois Administrative Code, which require it to maintain a complete record of all books, records, and accounts, including claim files and claim data, and to make that information available for examination upon request to the Illinois Department of Insurance. See
¶ 13 State Farm also questioned the use of a qualified protective order in light of the fact that the Privacy Rule provides
6. Plaintiffs’ Replies to State Farm’s Objections
¶ 14 In their replies to State Farm’s objections, plaintiffs argued that, absent a waiver from the federal government, HIPAA prohibits the use or disclosure of PHI for any purpose other than the litigation or proceeding for which such information was requested and requires the return or destruction of PHI at the end of the litigation or proceeding. See
¶ 15 Plaintiffs further asserted that no fact or law supports State Farm’s claim that their proposed HIPAA qualified protective orders impose upon insurers undue restrictions or obligations. According to plaintiffs, there is no language in either the Illinois Insurance Code or the Illinois Administrative Code requiring non-health
¶ 16 Plaintiffs also asserted that whether State Farm is exempt from HIPAA because it is not a “covered entity” is “a moot point” because a determination of that issue does not control a court’s ability to enter a HIPAA qualified protective order restricting what a “non-covered entity” can do with PHI received from a covered entity. In this regard, State Farm obtains the ability to review plaintiffs’ PHI only because of a valid protective order. Thus, if State Farm wishes to access the PHI at issue, it must abide by the terms of any HIPAA qualified protective order entered by the court. Plaintiffs concluded that, if State Farm’s arguments are accepted, then a court could never enter a meaningful protective order that would require the destruction of PHI at the conclusion of litigation, as clearly required by HIPAA.
7. Trial Court Proceedings and Orders
¶ 17 On February 13, 2019, the trial courts held a combined hearing on plaintiffs’ motions for HIPAA protective orders. On May 15, 2019, following additional briefing by the parties, the trial courts issued a memorandum opinion and order granting plaintiffs’ motions. In so ruling, the trial courts determined that, to the extent that State Farm’s obligations and rights under Illinois law conflict with HIPAA’s requirements, the federal statute preempts state law. The courts noted that it would be impossible to comply with both Illinois law and HIPAA requirements for a qualified protective order. Specifically, in direct conflict with HIPAA, adoption of the Cook County protective order would allow insurance companies to disclose, maintain, use, and dispose of PHI outside of the litigation and would not require insurers to return the PHI at the end of the litigation. See
¶ 18 Next, the courts addressed State Farm’s claim that plaintiffs’ proposed HIPAA qualified protective orders seek to bind it to HIPAA’s requirements although it is expressly exempt from the statute’s application. While the courts agreed that, as a property and casualty liability insurer, State Farm is not a covered entity under HIPAA, they also determined that State Farm is not exempt from obeying a protective order entered with respect to PHI that has been produced by a covered entity. The courts concluded that all parties receiving PHI must follow the qualified protective order, regardless of whether
¶ 19 Finally, the courts considered whether to avoid conflict with State Farm’s alleged obligations and rights under Illinois law by treating plaintiffs’ motions as proposals for a court order pursuant to
¶ 20 Accordingly, the courts denied State Farm’s request for the Cook County protective orders and granted plaintiffs’ motions for the HIPAA qualified protective orders. On May 15, 2019, the court in the Surlock case entered a HIPAA qualified protective order. On May 16, 2019, the court in the Haage case entered a HIPAA qualified protective order. Relevant here, the HIPAA qualified protective orders entered by the courts provided:
“8. Within 60 days after the conclusion of the litigation, including appeals, the parties, their attorneys, insurance companies and any person or entity in possession of PHI received pursuant to this Order, shall return Plaintiff’s PHI to the covered entity or destroy any and all copies of PHI pertaining to Plaintiff, including any electronically stored copy or image, except that counsel are not required to secure the return or destruction of PHI submitted to the Court.
* * *
12. All requests by or on behalf of any Defendant for protected health information, including but not limited to subpoenas, shall be accompanied by a complete copy of this Order. The parties—including their insurers and counsel—are prohibited from using or disclosing protected health information for any purpose other than this litigation. ‘Disclose’ shall have the same *** scope and definition as set forth in
45 C.F.R. § 160.103 : ‘the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.’ ” (Emphases added.)
8. Postentry Proceedings
¶ 21 On June 6, 2019, State Farm filed a motion to stay portions of the HIPAA qualified protective orders, pursuant to
III. ANALYSIS
¶ 22 On appeal, State Farm argues that it is not a “covered entity” subject to HIPAA and that, therefore, the trial court erred in finding that HIPAA and the Privacy Rule preempted its obligations under state law. State Farm further contends that the HIPAA qualified protective orders entered by the trial courts conflict in two principal ways with the use, retention, and disclosure of PHI authorized by the
¶ 23 In response, plaintiffs contend that the trial court did not err in entering the HIPAA qualified protective orders. Plaintiffs do not dispute that State Farm is not a “covered entity” under HIPAA, but they argue that this fact does not discharge State Farm from obeying a protective order entered by the court with respect to PHI that has been produced by a “covered entity.” Plaintiffs further argue that neither the
A. Covered Entity
¶ 24 State Farm initially argues that, as a property and casualty insurer, it is not a “covered entity” under HIPAA and, therefore, is not subject to HIPAA’s Privacy Rule. Whether State Farm falls within the definition of a “covered entity” for purposes of HIPAA requires us to construe the Privacy Rule. “Because administrative regulations have the force and effect of law, the familiar rules that govern construction of statutes also apply to the construction of administrative regulations.” Kean v. Wal-Mart Stores, Inc., 235 Ill. 2d 351, 368 (2009). The cardinal rule of statutory construction is to ascertain and give effect to the intent of the drafter. State Bank of Cherry v. CGB Enterprises, Inc., 2013 IL 113836, ¶ 56. The most reliable indicator of the drafter’s intent is the language of the regulation itself, which must be given its plain and ordinary meaning. Id. If the language of the enactment is clear, we must apply it as written, without resort to extrinsic aids. Id. Moreover, we will not depart from the plain meaning of an administrative regulation
¶ 25 The Privacy Rule defines a “covered entity” as a “health plan,” “health care clearinghouse,” or “health care provider who transmits any health information in electronic form.”
¶ 26 Likewise, State Farm does not constitute a “health care clearinghouse” or a “health care provider” as those terms are defined by the Privacy Rule. A “health care clearinghouse” is defined as a public or private entity that either “[p]rocesses or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction” or “[r]eceives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity.”
B. Application of HIPAA
¶ 27 The trial courts agreed that State Farm, as a property and casualty insurer, is not a covered entity under HIPAA. They then determined that State Farm’s status as a “non-covered entity” did not exempt it from obeying a protective order entered with respect to PHI produced by a covered entity. The trial courts held that all parties receiving PHI are bound to follow a HIPAA qualified protective order regardless of whether the party is a covered entity under HIPAA in the first instance, reasoning that a qualified protective order would “lose[ ] its effectiveness in protecting a patient’s PHI if a non-covered entity may ignore the restrictions required by HIPAA.” The question thus becomes whether a “non-covered entity” that receives PHI from a covered entity in response to a HIPAA qualified protective order is bound to comply with any of the order’s restrictions regarding the use and disclosure of PHI. State Farm insists that, because it is not a covered entity, it is not subject to any use or disclosure restrictions. Plaintiffs counter that, although State Farm is not a covered entity for purposes of HIPAA, this fact does not discharge it from obeying a HIPAA qualified protective order entered with respect to PHI that has been produced by a covered entity. Whether State Farm’s status as a “non-covered entity” exempts it from obeying the terms of a HIPAA qualified protective order requires us to construe the Privacy Rule. As such, it presents an issue of statutory construction, which is subject to de novo review. Van Dyke, 2019 IL 121452, ¶ 45; State Bank of Cherry, 2013 IL 113836, ¶ 22.
¶ 28
“(A) The covered entity receives satisfactory assurance, as described in
paragraph (e)(1)(iii) of this section , from the party seeking the information that reasonable efforts have been made by suchparty to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or (B) The covered entity receives satisfactory assurance, as described in
paragraph (e)(1)(iv) of this section , from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements ofparagraph (e)(1)(v) of this section .”45 C.F.R. § 164.512(e)(1)(ii)(A) ,(B) (2018).
For the purposes of
“For purposes of
paragraph (e)(1) of this section , a qualified protective order means, with respect to [PHI] requested underparagraph (e)(1)(ii) of this section , an order of a court *** that:(A) Prohibits the parties from using or disclosing the [PHI] for any purpose other than the litigation or proceeding for which such information was requested; and
(B) Requires the return to the covered entity or destruction of the [PHI] (including all copies made) at the end of the litigation or proceeding.”
45 C.F.R. § 164.512(e)(1)(v) (2018).
Thus, in the absence of an order of the court, HIPAA authorizes a covered entity to disclose PHI in a judicial proceeding, pursuant to a subpoena, discovery request, or other lawful process, provided that adequate notice was given to the individual whose information is to be produced or a qualified protective order containing the specified restrictions has been entered in the litigation.
¶ 29 It is important to note that State Farm is not the disclosing party in this case. Rather, it is the party wishing to obtain PHI. In this regard, after plaintiffs moved for the HIPAA qualified protective orders with respect to the disclosure of their PHI, State Farm intervened and filed objections, requesting entry of an alternative HIPAA protective order, the Cook County protective order. As the plain language of the Privacy Rule indicates, a covered entity may disclose PHI to State Farm only if the protective order meets the requirements of
¶ 30 Citing various extrinsic sources, including the Federal Register, State Farm contends that the trial courts’ reasoning “ignores that possession of PHI does not convert a non-covered entity into a covered entity under HIPAA and its regulations.” To be sure, the passages State Farm cites support the notion that Congress did not intend property and casualty insurers to constitute “covered entities” for purposes of HIPAA. See Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,567 (“Congress did not include life insurers and casualty insurance carriers as ‘health plans’ for purposes of this rule and therefore they are not covered entities.”); Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,568 (“[P]roperty and casualty insurers *** are not covered entities, as they do not meet the statutory definition of ‘health plan.’ ”); Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,578 (“ ‘[E]xcepted benefits’ as defined under
¶ 31 State Farm further asserts that HHS has recognized that the Privacy Rule does not protect all PHI “wherever it is found.” In support of this position, State Farm directs us to the following passages from a report authored by HHS:
“The HIPAA Rules apply only to organizations known as covered entities and their business associates. HIPAA does not apply to individuals or to other types of organizations that do not qualify as covered entities or business associates, even those that may handle or store an individual’s health information.
* * *
The HIPAA Privacy Rule does not protect all health information wherever it is found. Because the rules apply only to covered entities and their business associates, the protections do not extend to data about the health of individuals held by [noncovered entities].” U.S. Dep’t of Health & Human Servs., Examining Oversight of the Privacy & Security of Health Data Collected by Entities Not Regulated by HIPAA 13, 15 (June 17, 2016), https://www.healthit.gov/sites/default/files/non-covered_entities_report_june_17_2016.pdf [https://perma.cc/3HRT-TMA7].
State Farm’s reliance on this passage is unpersuasive. While the Privacy Rule does not protect all health information wherever it is found, nothing in the language quoted above indicates that a noncovered entity is exempt from obeying a HIPAA qualified protective order entered with respect to PHI that it has received from a covered entity in response to a HIPAA qualified protective order.
¶ 32 State Farm also asserts that “[a] plaintiff should be well-aware that PHI disclosed by a covered entity to the recipient has the potential to be subject to redisclosure by the recipient.” In support of this assertion, State Farm relies on
¶ 33 Citing a passage from the Federal Register, State Farm next observes that HHS has stated that, because its jurisdiction under the statute is limited to covered entities, “once protected health information leaves the purview of *** [a] covered entit[y], *** the information is no longer afforded protection under this rule.” Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,567. Again, nothing in the language of this passage indicates that a noncovered entity is exempt from obeying the restrictions in a HIPAA qualified protective order entered with respect to PHI that has been produced by a covered entity.
¶ 34 In short, while State Farm is not a “covered entity” under HIPAA, it has not directed us to any specific language in HIPAA, the Privacy Rule, or any other regulation, authority, or case law indicating that a noncovered entity that receives PHI from a covered entity in response to a HIPAA qualified protective order is exempt from complying with the order’s restrictions regarding the use or disclosure of the PHI. Thus, if State Farm wishes to access the PHI at issue, it must abide by the terms of the HIPAA qualified protective orders entered by the trial courts.
C. Illinois Law
¶ 35 Next, State Farm argues that the trial courts erred in entering the HIPAA qualified protective orders because they conflict with State Farm’s obligations under state law. According to State Farm, it must be permitted to use and retain plaintiffs’ PHI to fulfill its obligation with respect to various provisions of the
¶ 36 To begin, State Farm directs us to
¶ 37 State Farm further asserts that insurers retain records for a variety of legal and operational reasons. For instance, State Farm notes that insurers are prohibited from engaging in improper claims practices. See
¶ 38 With respect to examinations by the Director as part of improper-claims practice,
“b) Each company shall maintain claim data that should be accessible and retrievable for examination by the Director. A company shall be able to provide the claim number, line of coverage, date of loss and date of payment of the claim, date of denial, or date claim closed without payment. This data must be available for all open and/or closed files for the current year and the two preceding years. The examiners’ review may include but need not be limited to an examination of the following claims:
1) Claims Closed with Payment;
2) Claims Denied;
3) Claims Closed Without Payment;
4) First Party Automobile Total Losses; and/or Subrogation Claims.
c) Detailed documentation shall be contained in each claim file in order to permit reconstruction of the company’s activities relative to each claim file.”
50 Ill. Adm. Code 919.30 (1989).
According to State Farm, because this regulation requires maintaining “detailed documentation” in each claim file “to permit the reconstruction of the insurer’s activities,” it effectively mandates an insurer “to maintain all records of each claim for ‘all open and/or closed files for the current year and the two preceding years.’ ” However, we find no language in
¶ 39 State Farm also asserts that the HIPAA qualified protective orders prevent insurers from performing functions related to fraud detection and deterrence. State Farm asserts that, because the Illinois Department of Insurance relies on property and casualty insurers to detect and combat insurance fraud, Illinois law authorizes them to report information, including PHI, to the Illinois Department of Insurance and insurance support organizations, such as the National Insurance Crime Bureau and the Insurance Services Organization. See
¶ 40 The statute State Farm cites authorizes the Director “to promulgate reasonable rules requiring insurers *** doing business in the State of Illinois to report factual information in their possession that is pertinent to suspected fraudulent insurance claims, fraudulent insurance applications, or premium fraud after [the Director] has made a determination that the information is necessary to detect fraud or arson.” (Emphases added.)
¶ 41 State Farm claims that other purposes for which property and casualty insurers retain claims files include actuarial and rate development, reinsurance evaluation and pricing, and long-tail exposure.2 However, State Farm neither develops this argument nor cites any statute, policy, or regulation that would require it to use or retain PHI for any of those purposes. As such, we find any such claim forfeited. See
¶ 42 Lastly, we address State Farm’s reliance on
“The company is authorized to dispose of or destroy records in its custody that do not have sufficient administrative, legal or fiscal value to warrant their further preservation and are not needed:
a) in the transaction of current business;
b) for the final settlement or disposition of any claim arising out of a policy of insurance issued by the company, except that these records must be maintained for the current year plus 5 years; or
c) to determine the financial condition of the company for the period since the date of the last examination report of the company officially filed with the Department of Insurance, except that these records must be maintained for at least the current year plus 5 years.”
50 Ill. Adm. Code 901.20 (2016).
According to State Farm, part 901 sets out a detailed process for the destruction of an insurer’s records. Yet, it asserts, the HIPAA qualified protective orders entered in this case “create[ ] a Catch-22 for *** insurers, which must decide whether to comply with its ‘return or destroy’ provisions or continue to comply with the regulations requiring the maintenance of complete claim records for much longer periods.”
¶ 43 Although
“ ‘Records’ material means all books, papers and documentary materials regardless of physical form or characteristics, made, produced, executed or received by any domestic insurance company pursuant to law or in connection with the transaction of its business and preserved or appropriate for preservation by such company or its successors as evidence of the organization, function, policies, decisions, procedures, obligations and business activities of the company or because of the informational data contained therein. If doubt arises as to whether certain papers are ‘non-record’ materials, it should be assumed that the documents are ‘records’.” (Emphasis added.)
50 Ill. Adm. Code 901.10 , codified at 7 Ill. Reg. 4213 (eff. Mar. 28, 1983).
In this case, State Farm does not explain how plaintiffs’ PHI is “appropriate for preservation,” especially given that (1) the trial courts entered HIPAA qualified protective orders expressly requiring the destruction of PHI within 60 days after the conclusion of the litigation and (2) State Farm failed to cite any statute, regulation, or case law that affirmatively requires the retention of PHI or its use for a particular purpose. See Small, 280 F.R.D. at 279-80 (rejecting similar argument by State Farm, in part because
¶ 44 In short, State Farm has failed to direct us to any provision of the
D. Preemption
¶ 45 Although we have concluded that the terms of the HIPAA qualified protective orders do not conflict with State Farm’s obligations under state law, to the extent that they could be so construed, we agree with the trial courts that the state law provisions are preempted by HIPAA. As noted earlier, among HIPAA’s purposes were to establish national privacy standards and fair information practices regarding individually identifiable health information. Brende, 153 P.3d at 1114; Wade, 922 F. Supp. 2d at 687 (citing South Carolina Medical Ass’n, 327 F.3d at 348); Law, 307 F. Supp. 2d at 710; U.S. Dep’t of Health & Human Servs., Office for Civil Rights, Summary of the HIPAA Privacy Rule 1 (May 2003), https://www.hhs.gov/sites/default/files/privacysummary.pdf [https://perma.cc/F66C-T4TR]. To this end, HIPAA and its regulations establish a “uniform federal ‘floor’ of privacy protections for individual medical information.” Stein, supra, at 434; see also Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. at 82,471 (“The protections [(provided by HIPAA and its regulations)] are a mandatory floor, which other governments and any covered entity may exceed.”);
¶ 46 In this case, a covered entity cannot comply with HIPAA if the statutory and administrative regulations, as interpreted by State Farm, are inserted in the qualified protective order. In this regard, the Cook County protective order does not require an insurer to return or destroy PHI at the conclusion of litigation and would permit the insurer to use and retain PHI outside of litigation. This directly conflicts with the requirements for a HIPAA qualified protective order under ¶ 47 In so holding, we also observe that ¶ 48 Typically, when a state law conflicts with a federal law, the federal law preempts the state law, rendering the state law without effect. U.S. Const., art. VI, cl. 2; Altria Group, Inc. v. Good, 555 U.S. 70, 76 (2008); Milliman, Inc. v. Roof, 353 F. Supp. 3d 588, 600 (E.D. Ky. 2018). However, the ¶ 49 The McCarran-Ferguson Act provides, in relevant part, that “[n]o Act of Congress shall be construed to invalidate, impair, or supersede any law enacted by any State for the purpose of regulating the business of insurance, or which imposes a fee or tax upon such business, unless such Act specifically relates to the business of insurance.” ¶ 50 The United States Supreme Court has stated that “invalidate” means “to render ineffective, generally without providing a replacement rule or law” and that “supersede” means “to displace (and thus render ineffective) while providing a substitute rule.” (Internal quotation marks omitted.) Humana Inc. v. Forsyth, 525 U.S. 299, 307 (1999). “To impair” for purposes of the McCarran-Ferguson Act means to “frustrate any declared state policy” or “interfere with a State’s administrative regime.” Humana Inc., 525 U.S. at 310. As noted above, nothing in any Illinois statute or regulation State Farm ¶ 51 Alternatively, State Farm argues that the Privacy Rule did not require the trial courts to enter the HIPAA qualified protective orders proposed by plaintiffs to the exclusion of other authorized means of permitted disclosure of PHI. State Farm notes, for instance, that the Privacy Rule permits the disclosure of PHI “[i]n response to an order of a court.” ¶ 52 For the reasons set forth above, we affirm the judgment of the circuit court of Lake County. ¶ 53 Affirmed.E. Reverse Preemption
F. Alternative Methods of Disclosing PHI
IV. CONCLUSION