Recent Illinois Case law sets avenue for plaintiff’s attorneys to limit the use of protected health information obtained through litigation of personal injury claims via HIPAA.
Protective orders and protected health information:
In this newsletter, we will be discussing the recent Illinois Appellate Case Haage v. Zavala and Protective orders entered in personal injury cases pursuant to the Health Insurance Portability and Accountability Act of 1966 (herein HIPAA) and the rules promogulated pursuant to that Act.
All people have a right to privacy regarding their medical treatment and health; however, some of these protections and privileges are waived when a personal injury plaintiff seeks compensation for bodily injury. The extent to which these protections are waived is often a contentious subject during the litigation of personal injury claims.
Plaintiff’s attorneys often seek to restrict how far back in time the defense can obtain medical records for the plaintiff’s medical care. Likewise, they often try to prevent the defense from obtaining records for treatment that the plaintiff deems irrelevant. The defense, on the other hand, often seeks to have as much access as possible to plaintiff’s pre accident medical care to evaluate the existence of pre-existing conditions and the plaintiff’s activity level before the accident, in comparison to after the accident.
It is common practice in personal injury cases for the parties and courts to enter a Protective Order controlling the disclosure of protected health information by medical providers and to whom the protected information may be disclosed to by the parties during the litigation. We have been seeing plaintiff’s attorneys recently push to limit the ability for liability insurers and defense counsel to retain medical records and documents described as protected health information (herein PHI) under the HIPAA laws after the close of litigation. Plaintiffs are doing this by pushing the courts to require that parties either destroy or return the PHI within a time frame of the close of the case, usually 60 days.
Underlying facts of case:
This issue was addressed in the recent Illinois Appellate Court Case Haage v. Zavala[i]. The Haage case arose from two personal injury automobile accident cases. The plaintiffs in Haage proposed that the protective orders “(1) prohibited the parties and any other persons or entities from using or disclosing PHI for any purpose other than the litigation for which it was requested and (2) required the return or destruction of the PHI within 60 days after the conclusion of the litigation.”[ii] State Farm Insurance petitioned to intervene in the case and proposed the use of a protective order that did not include return and destroy provisions.[iii] The trial court approved the plaintiff’s proposed order and stated that any individual or entry receiving the order must comply with its provisions.[iv]
State Farm asserted they were exempt from the protective orders and that the entry of the same as proposed would prevent them with complying with their obligations under the Illinois Insurance Code.[v] Likewise, they asserted that such restrictions in the use of PHI would interfere with State Farm’s rights to use that information for claims administration, detection/investigation of fraud, underwriting, rate making and guaranty fund functions, reinsurance and excess loss insurance and research including actuarial, medical, scientific and public policy.[vi]
Court’s analysis of the applicable law and ruling:
The Haage court provided a great discussion of some of the basic concepts of the HIPAA laws and regulations. For instance, the Privacy Rule as adopted in the Code of Federal Regulations prohibits the disclosure of an individual’s PHI by a “covered entity” or “business associate” unless that individual has consented to the same or the disclosure is permitted under the rules.[vii] PHI is defined as “individually identifiable health information”.[viii]
Qualified protective orders under the Privacy Rule are an order from the court or a stipulation by the parties to the legal action that (1) prohibits those “parties from using or disclosing the [PHI] for any purpose other than the litigation or proceeding for which such information was requested” and (2) mandates that the PHI be returned “to the covered entity or destruction of the” PHI and any copies thereof at the close of the legal action.[ix]
The court noted that the HIPAA laws and regulations created a floor of privacy protections for an individual’s medical information. Further, these laws pre-empt any contrary State provisions unless those contrary provisions are more stringent than the HIPAA Privacy Rule.[x] Additionally, the court noted that State Farm did not qualify as a “covered entity” under the HIPAA laws.[xi]
The question for the court then became “whether a ‘non-covered entity’ that receives PHI from a covered entity in response to a HIPAA qualified protective order is bound to comply with any of the order’s restrictions regarding the use of and disclosure of PHI.”[xii] The court found that, since State Farm is an entity that is wanting to obtain PHI (obviously to investigate the underlying bodily injury claim), it must “abide by the terms of the HIPAA qualified protective orders entered by the court.” Meaning that State Farm must comply with the use and disclosure requirements set forth in the order entered by the court if they want to access the PHI.[xiii]
The Haage court did not find that State Farm’s arguments that they were required to use and disclose PHI under the Illinois Insurance Codes and regulations to be convincing.[xiv] The court noted that State Farm’s preferred order that did not include return or destroy provisions at the close of litigation would lower the floor of the privacy protections that the Privacy Rule for HIPAA provided. Hence, the court considered State Farm’s position that they should be able to use and retain PHI outside litigation would be an obstacle to accomplishing HIPAA’s purposes and objectives.[xv] The Appellate court in Haage affirmed the trial court’s approval of the Plaintiff’s proposed HIPAA order with destroy/return provisions and that State Farm must abide by those provisions.[xvi]
Practical Effect of Case:
This case could be taken up to the Illinois Supreme Court, but this has not been determined at the time of this writing. There is no doubt that plaintiff’s attorneys will utilize this case to push for language tracking the Privacy Rule within protective orders, which is more restrictive than many insurance companies and defendants would prefer. Trial court judges will be more likely to approve an order with return and destroy provisions in light of the precedent set in Haage case.
Failure to comply with return and destroy provisions could open defendants, counsel and insurers up to potential lawsuits or sanctions for noncompliance with court orders. Defendants, insurers and defense attorneys must carefully review any proposed HIPAA protective order prior to entry of the same. The defense should push for the entry of an order that does not contain such return and destroy provisions. If an agreed order is entered that does not require the return/destruction of PHI, then the concerns regarding return/destruction should be avoided. In practice I have often pushed for language in protective orders stating that PHI can be “maintained and destroyed pursuant to in place file retention policies for law firms and insurers.”
Defense attorneys must consult with their client and claims representatives regarding dissemination of PHI if the defense cannot convince the plaintiff to enter an order that does not include return and destroy provisions. Obviously, defense counsel has to advise the defendant and insurer of the facts of the case, which inevitably includes information about the plaintiff’s health in a personal injury case. This is made more difficult by the fact that PHI has a very general definition, PHI is defined as “individually identifiable health information” transmitted or maintained via electronic media or other medium.[xvii]
The defense should consider alternative methods for providing this information to their clients and insurers that do not include transmission of actual medical records. Potential avenues would include providing summaries of medical records excluding as much identifying information as possible or secure cloud storage where the records are not downloaded or transferred. Alternatively, if PHI must be transferred to other persons or entities during litigation, a plan should be implemented for the return/destruction of the PHI at the close of litigation.
[i] Haage v. Zavala, et. al., 2020 IL App (2d) 190499;
[ii] Haage at ¶ 2;
[iii] Haage at ¶23;
[iv] Haage at ¶3;
[v] Haage at ¶ 2;
[vi] Haage at ¶21;
[vii] Haage at ¶ 8;
[viii] Haage at ¶ 8 citing 45 C.F.R. § 160.103(2018)
[ix] Haage at ¶ 9, citing 45 C.F.R. 164.512 (2018);
[x] Haage at ¶10;
[xi] Haage at ¶40;
[xii] Haage at ¶44;
[xiii] Haage at ¶44 & 49;
[xiv] Haage at ¶60;
[xv] Haage at ¶ 63;
[xvi] Haage at ¶3 and 72;
[xvii] 45 C.F.R. §160.103 (2020).
This trial revolved around a car collision personal injury claim occurring in Sangamon County Illinois. Jason G. Schutte represented the defendant. We admitted fault and proceeded to trial on the issue of damages. Plaintiff complained of numerous injuries to his neck, back and lower extremities. The defense pointed out numerous gaps in plaintiff's post accident medical treatment, that his complaints changed in type and location during his post accident treatment and that plaintiff suffered from extensive degenerative conditions that existed before the accident.
Plaintiff's demanded $15,000.00 to settle the case before the trial. Plaintiff requested an award from the jury of just over $18,000.00. The defense recommended that the jury enter a verdict awarding slightly under $4000.00 to settle the case. The jury returned a verdict of $7592.00 which did not award all of plaintiff's claimed medical bills.
This lawsuit revolved around a personal injury dog bite claim occurring at a residential property in Crawford County, Illinois. Jason Schutte represented and defended the landlord who owned the property where the bite occurred. Plaintiff was visiting a tenant who rented the property and owned the dog in question. Plaintiff was bitten by the tenant's dog upon entering the residence.
Plaintiff filed suit against the landlord asserting causes of action for negligence and violation of the Illinois Animal Control Act. Jason obtained summary judgment in favor of his client on both causes of action.
Plaintiff fell and injured herself at a grocery store. Plaintiff sought to utilize the snow removal contractor’s contract with the property owner as basis to establish liability for her fall on snow/ice at the property. Plaintiff did not establish that (1) she relied on contract between property owner and snow removal contractors to remove all snow/ice or (2) that snow/ice was unnatural accumulation, thus barring her recovery in this personal injury action.
Facts of Case:
This case revolves around a slip and fall injury occurring at Food 4 Less, a grocery store, on November 12, 2013.[i] Plaintiff Jordan slipped on an access ramp on “black ice” near the store entrance. She did not observe the ice until after the fall. There was no snow on the ground and the temperature was below 32 degrees. Plaintiff suffered an ankle injury requiring surgery.[ii]
Defendant Food 4 Less had a contract with Cherry Logistics which in turn had a contract with Pete’s Lawn Care to provide snow and ice removal on the location where the fall took place. Plaintiff Jordan was not aware of either contract at the time of her fall at the property. She testified via deposition that she had never heard of Cherry Logistics or Pete’s Lawn Care.[iii]
Food 4 Less’s contract with Cherry Logistics provided that Cherry Logistics would monitor weather conditions and “act reasonably” in determining when to apply de-icer to the store’s sidewalks and parking lot.[iv]
“Cherry Logistics’ contract with Pete’s Lawn Care contained much more detail on the obligations of Pete’s Lawn Care. Subsection b (“Salting”), from that contract provided:
Subsection c of the contract, which governed Handicap areas, provided that “[e]xtra attention must be given to all handicap sidewalk ramp access areas and designated handicap parking spaces during business hours. These areas must be cleared of any snow, slush, or ice down to bare pavement at all times.”
Subsection h governed when services were to commence and stated:
Food 4 Less store’s hours of operation were from 6 a.m. to midnight.[vii]
Weather reports submitted by the plaintiff indicated that there was light precipitation on the day before prior to the fall. Rain began around 11:00 a.m., at which time the temperature was 45 degrees. Light snow began as temperatures fell through the afternoon. A low temperature of 25 degrees was reached shortly after midnight. There was no precipitation on the day of the accident; however, the temperature stayed below 32 degrees in the morning, then rose to 33 degrees from around in the afternoon, then dropping below 32 degrees. Pete’s did not perform any snow or ice removal actions at the location in question in November 2013, prior to plaintiff’s fall.[viii]
Plaintiff sued both Food 4 Less and Pete’s Lawn Care. She alleged “that defendants were negligent in monitoring weather conditions to determine whether snow and ice removal services were required, and they were also negligent in removing snow and ice from access ramps on the property.”[ix] The trial court granted summary judgment in “finding that there was no evidence (i) of an unnatural accumulation of snow or ice, (ii) that defendants had actual or constructive notice of snow or ice, or (iii) that defendants breached any contractual duty.”[x]
The Appellate court noted that the natural accumulation rule provides that property owners do not owe a general duty to remove natural accumulations of snow and ice from their property. Hence, to succeed in a slip and fall case caused by snow or ice, the plaintiff must generally establish that (1) the accumulation of snow or ice was unnatural and (2) that the defendant had actual or constructive knowledge of the condition.[xi]
There was no argument in this case that the ice accumulation in question was unnatural, rather, plaintiff asserted that defendants voluntarily assumed a contractual duty to remove natural accumulations of ice, and were liable in tort to third parties for negligently failing to fulfill that duty.[xii]
The court noted that plaintiff’s cause of action for voluntarily assuming a duty to remove snow/ice was governed by section 324A of the Restatement (Second) of Torts:
““One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from his failure to exercise reasonable care to protect his undertaking, if
(a) his failure to exercise reasonable care increases the risk of such harm, or
(b) he has undertaken to perform a duty owed by the other to the third person, or
(c) the harm is suffered because of reliance of the other or the third person upon the undertaking.” Restatement (Second) of Torts § 324A (1965).”[xiii]
The court noted that sections (a) and (b) did not apply to the facts of this case, leaving only section (c) as the possible avenue for liability. Plaintiff did not assert that she personally relied on the two contracts at issue in this case. In fact, she admitted in her deposition that she had never heard of Cherry Logistics or Pete’s Lawn Care.[xiv]
Liability under subsection (c) can also be based upon reliance of the third party or “the other”—i.e., the party to whom the defendant undertook to provide services. Plaintiff asserted that “(i) Food 4 Less relied on Cherry Logistics to perform snow and ice removal per the terms of their contract; (ii) likewise, Cherry Logistics relied on Pete’s Lawn Care to fulfill its contractual duty; and (iii) their reliance entitles Jordan, as a third-party beneficiary of the Food/Cherry and Cherry/Pete contracts, to recover in tort for her injuries because Pete’s Lawn Care allegedly failed to fulfill its contractual duties.”[xv] The court rejected plaintiff’s arguments on this point.
The Jordan court noted that Illinois courts are split regarding whether a party who contracts to remove snow and ice, and then fails to do so, can be liable under section 324A(c) to third parties. That being said, “Illinois courts have repeatedly rejected the argument that the existence of a snow removal contract overrides the natural accumulation rule.”[xvi]
The Jordan court ruled that merely entering into a snow removal contract does not create in the contracting parties a duty to protect third parties from natural accumulations of snow and ice when the third parties did not personally rely on the contract. Because Jordan did not present evidence that (1) the ice on which she fell was an unnatural accumulation or that (2) she relied on the Food/Cherry and Cherry/Pete contracts, she could not establish liability against the defendants and summary judgment was appropriate.[xvii]
Effect of Case:
As mentioned above, the Jordan court noted (and discussed in further detail in the opinion) that there are split authorities on the issue of third party liability in voluntary assumption of duty situations; however, this case presents a common sense approach to evaluation of these types of claims.
Generally a plaintiff must show that there was an unnatural accumulation of snow/ice in order to establish liability against the property owner or snow removal contractor. If this cannot be done, then an alternative avenue to establish liability would be through the assumption of duty cause of action described herein. If the plaintiff intends to pursue this avenue, they will need to establish (1) that there was an assumed duty to remove all snow/ice (as we are assuming that there is no evidence of unnatural accumulation) and (2) that the plaintiff relied on this assumed duty. If these factors cannot be met, then the plaintiff likely will not be able to establish liability against the defendant.
[i] Jordan v. Kroger Co d/b/a Food 4 Less and Pete’s Lawn Care, Inc., 2018 IL App (1st) 180582, ¶4;
[iii] Id. at ¶5;
[v] Id. at ¶6;
[vi] Id. at ¶¶6-8;
[vii] Id. at ¶¶6-8;
[viii] Id. at ¶9;
[ix] Id. ¶10;
[x] Id. ¶¶10 & 14;
[xi] Id.at ¶18;
[xii] Id. at ¶19;
[xiii] Id. at ¶20;
[xiv] Id. at ¶¶21-22;
[xv] Id at ¶22;
[xvi] Id. at ¶23;
[xvii] Id. at ¶35;