New Cook County HIPAA Protective Order Includes Discovery Limitations

The Circuit Court of Cook County amended its Health Insurance Portability and Accountability Act (HIPAA) Protective Order following the Illinois Supreme Court’s recent determination of an insurer’s obligations with a plaintiff’s protected health information (PHI). In short, PHI obtained by insurance companies during litigation cannot be used outside the litigation context, and it must be returned/destroyed at its conclusion. See Haage v. Zavala, 2021 IL 125918. A copy of the new protective order can be found here.

Although the Circuit Court of Cook County promptly amended its HIPAA Protective Order to reflect that holding, it also includes additional provisions, outside the Illinois Supreme Court’s findings, which now place limitations on discoverable information that litigants need to know moving forward: Pursuant to the new protective order, “any subpoena must specifically be restricted to five (5) years prior to the incident and relate to the conditions(s) and portion(s) of the Plaintiff’s body complained of.”

The new protective order is considered controversial due to its blanket restrictions in discovery, restrictions that force a non-litigant to determine what records relate to the lawsuit and limit potentially relevant history, both of which deprive defendants their right to defend allegations against them. Take a products liability lawsuit for example, where a plaintiff suffers a cardiac event allegedly from ingestion of medication following knee surgery. A disinterested third-party is now responsible for determining what PHI is related to that cardiac event, and it is more likely than not the plaintiff’s cardiac, orthopedic, and general medical history in the preceding five years would be indicative of other underlying medical conditions or plaintiff’s pre-surgery quality of life.

Proponents of the new protective order, primarily the plaintiffs’ bar, support these discovery limitations, hoping it streamlines litigation and avoids unnecessary and unduly burdensome discovery. But “how is it unduly burdensome for a plaintiff to” provide information in a “case that the plaintiff filed?” See Vera Bradley Designs, Inc. v. Aixin Li, No. 20 C 2550, 2021 U.S. Dist. LEXIS 53365, *6 (N.D. Ill. March 22, 2021) (emphasis in original) (suggesting “unduly burdensome” boilerplate objections to standard discovery obligations are hypocritical). And the new protective order does not reduce the burden of litigation, it merely transitions the burden from litigants to third-party custodians to comb records and restrict production to those they deem are related to the “Plaintiff’s body complained of” and limit such production to five years opposed to the institutions’ retention policies.

Complex litigation is burdensome for all parties involved. But that burden should remain on litigants to determine what medical records relate to the lawsuit, a determination that cannot be made without looking at the plaintiff’s complete medical history. When a plaintiff initiates a lawsuit alleging personal injury, he places his PHI at issue. Illinois Supreme Court Rule 201 addresses the scope of discovery and provides “a party may obtain by discovery full disclosure regarding any matter relevant to the subject matter involved in the pending action.” (emphasis added).

In Haage, the defendant made a similar but an importantly distinct argument. There, the defense presented its own protective order that authorized disclosure of “any and all PHI,” which was appropriately rejected by the court. Haage, 2021 IL 125918, ¶ 65 (emphasis added). The court noted the “relevance requirement” under Rule 201 “safeguards against ‘improper and abusive’ discovery and acts as an ‘independent constraint on discovery.’” Id. (quoting People ex rel. Madigan v. Stateline Recycling, LLC, 2020 IL 124417, ¶ 32). And Illinois law has established safeguards from improper and abusive discovery. See, e.g., Norskog v. Pfiel, 197 Ill. 2d 60, 72 (2001) (“anyone seeking the nonconsensual release of mental health information faces a formidable challenge and must show that disclosure is authorized by the [Mental Health and Developmental Disabilities Confidentiality Act].”).

However, the disclosure of a plaintiff’s basic medical records, and its relevancy to the litigation, should be determined on a case-by-case basis, by the litigants themselves, and without limitation to time. Then, once discovery has concluded, only evidence that is determined, through expert testimony or otherwise, “having any tendency to make the existence of any fact that is of consequence to the determination of the action more probably or less probable” can be admissible at trial. Ill. R. Evid. 401, 402.

Thus, while Cook County’s new HIPAA Protective Order attempts to streamline the discovery and medical records process, it places unnecessary restrictions on discovery that should be determined by the litigants.

Key Takeaways

• Under the Circuit Court of Cook County’s new HIPAA Protective Order, subpoenas for medical records must “specifically be restricted to five (5) years prior to the incident” and requests must “relate to the condition(s) and portion(s) of the Plaintiff’s body complained of.”
• This form order may restrict a defendant’s ability to properly defend allegations, implicating state due process rights, as it prohibits the “full disclosure regarding any matter relevant to the subject matter involved” as provided by Supreme Court Rules.