Haage v. Zavala

2021 IL 125918

IN THE SUPREME COURT OF THE STATE OF ILLINOIS

(Docket No. 125918)

ROSEMARIE HAAGE, Appellee, v. ALFONSO MONTIEL ZAVALA et al. (State Farm Mutual Automobile Insurance Company, Appellant).

Opinion filed September 23, 2021.

JUSTICE NEVILLE delivered the judgment of the court, with opinion.

Chief Justice Anne M. Burke and Justices Garman, Theis, Michael J. Burke, Overstreet, and Carter concurred in the judgment and opinion.

OPINION

¶1 In each of two automobile personal injury actions, plaintiffs moved for entry of a qualified protective order (QPO) pursuant to the Health Insurance Portability and Accountability Act (HIPAA) (Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended in scattered sections of Titles 18, 26, 29, and 42 of the United States Code)) and its implementing regulations (45 C.F.R. pts. 160, 164 (2018))

(hereinafter Privacy Rule). Plaintiffs’ proposed QPOs would allow protected health information (PHI) to be released, but subject to the following restrictions: (1) nonlitigation use or disclosure of PHI is prohibited and (2) PHI must be returned or destroyed at the conclusion of the litigation. See 45 C.F.R. § 164.512(e)(1)(v) (2018). State Farm Mutual Automobile Insurance Company (State Farm), the liability insurer for the named defendants, intervened in each lawsuit and sought entry of its own protective order, which expressly allowed insurance companies to use, disclose, and maintain PHI for purposes beyond the litigation and expressly exempted insurers from the “return or destroy” requirement.

¶2 In both cases the circuit court of Lake County granted plaintiffs’ motions, entered their QPOs, and denied State Farm’s motions. State Farm filed an interlocutory appeal in each case. Ill. S. Ct. R. 307(a)(1) (eff. Nov. 1, 2017). The appellate court consolidated the two cases and affirmed. 2020 IL App (2d) 190499.

¶3 State Farm petitioned this court for leave to appeal as a matter of right (Ill. S. Ct. R. 317 (eff. July 1, 2017)) or, alternatively, as a matter of discretion (Ill. S. Ct. R. 315 (eff. Oct. 1, 2019)). We granted State Farm leave to appeal. For the following reasons, we now affirm the judgment of the appellate court and remand the cases to the trial court for further proceedings.

¶4 I. BACKGROUND ¶5 A. Underlying Complaints

¶6 In November 2017, plaintiff Rosemarie Haage filed a multicount complaint (No. 17-L-897) against defendants Alfonso Montiel Zavala, Patricia Santiago, Jose Pacheco-Villanuevo, Okan Esmez, and Rosalina Esmez. Haage sought to recover damages for bodily injuries sustained in a multiple-vehicle collision near the intersection of Lakeview Parkway and Route 60 in Vernon Hills.

¶7 In January 2018, plaintiffs Agnieszka Surlock and Edward Surlock filed a two- count complaint (No. 18-L-39) against defendant Dragoslav Starcevic. The Surlock plaintiffs sought damages for Agnieszka’s bodily injuries and Edward’s loss of consortium as a result of a collision between an automobile driven by Agnieszka and an automobile driven by Starcevic at the intersection of Grand Avenue and

-2-

Route 45 in Lindenhurst. ¶8 B. Plaintiffs’ Motions for QPOs

¶9 In August 2018, plaintiffs, represented by the same attorney, filed nearly identical motions for QPOs allowing the disclosure of protected health information in their respective lawsuits. HIPAA’s privacy standards are known collectively as the “Privacy Rule.” Deborah F. Buckman, Annotation, Validity, Construction, and Application of Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Regulations Promulgated Thereunder, 194 A.L.R. Fed. 133, 148 (2004). The Privacy Rule is codified at parts 160 and 164 of Title 42 of the Code of Federal Regulations (45 C.F.R. pts. 160, 164 (2018)).

¶ 10 Plaintiffs’ QPO motions alleged as follows. First, the treating physicians, hospitals, and other health care providers for Haage and Agnieszka are subject to the Privacy Rule. Second, these covered entities possess their PHI in the form of medical records. Third, both the plaintiffs and the defendants in each case “will require that the parties, their attorneys, their attorneys’ agents, consultants and various witnesses and other personnel receive and review copies of the [PHI]” pertaining to Haage and Agnieszka. Fourth, HIPAA potentially prohibits covered entities from disclosing PHI in judicial proceedings other than by an authorization or QPO.

¶ 11 Therefore, plaintiffs submitted HIPAA QPOs that permit the use and disclosure of the PHI of Haage and Agnieszka. Relevant here, the proffered QPOs found that 45 C.F.R. § 164.512(e)(1)(v)(A), (B) (2018) requires the following two obligations. Paragraph 9 of the proposed QPOs finds that it is necessary to “[p]rohibit the parties and any other persons or entities from using or disclosing the PHI for any purpose other than the litigation or proceeding for which it was requested.” Paragraph 10 of the proposed QPOs finds that it is necessary to “[r]equire the return of the PHI to the covered entity or the destruction of the information at the end of the litigation or proceeding.”

¶ 12 Accordingly, each proposed QPO ordered: “The PHI of any party in this lawsuit may not be disclosed for any reason without that party’s prior written consent or an Order of this court specifying the scope of the PHI to be disclosed, the recipients

-3-

of the disclosed PHI, and the purpose of the disclosure.” Each proposed QPO also ordered as follows:

“Within 60 days after the conclusion of the litigation, including appeals, the parties, their attorneys, insurance companies and any person or entity in possession of PHI received pursuant to this Order, shall return Plaintiff’s PHI to the covered entity or destroy any and all copies of PHI pertaining to Plaintiff, including any electronically stored copy or image, except that counsel are not required to secure the return or destruction of PHI submitted to the Court. ‘Conclusion of the Litigation’ shall be defined as the point at which final orders disposing of the entire case as to any Defendant have been entered, or the time at which all trial and appellate proceedings have been exhausted as to any Defendant.”

¶ 13 C. State Farm’s Petitions to Intervene and File Objections

¶ 14 In September 2018, State Farm filed nearly identical petitions to intervene in each lawsuit. See 735 ILCS 5/2-408(a)(2) (West 2018). State Farm maintained that it was the casualty and liability insurer for at least one of the defendants in the Haage lawsuit and for defendant Starcevic in the Surlock lawsuit. State Farm alleged that plaintiffs’ proposed QPOs would impose upon it significant restrictions and obligations, and the attorney representing its policyholders is not conversant with either the legal issues raised by plaintiffs’ proposed QPOs or the statutes and regulations applicable to State Farm’s business operations. The trial courts granted State Farm’s petitions to intervene and granted State Farm leave to file objections.

¶ 15 In its objections to plaintiffs’ proposed QPOs, State Farm requested that the trial courts (1) deny plaintiffs’ motions for their QPOs and (2) grant State Farm’s motions to enter its tendered alternative orders (see Ill. S. Ct. R. 201(c)(1) (eff. July 1, 2014)). State Farm initially argued that, as a property and casualty insurer, it is not a “covered entity” under HIPAA. State Farm also argued that plaintiffs’ proposed QPOs contained restrictions that would directly conflict with its obligations and rights under Illinois law, specifically in two ways. First, State Farm argued that requiring it to return or destroy all copies of PHI following the conclusion of the litigation would interfere with its statutory and administrative obligations to maintain complete documentation of all books, records, and

-4-

accounts, including claim files and claim data, and to make that information available for examination upon request by the Illinois Department of Insurance. Second, State Farm argued that restricting the use of PHI to the litigation at issue would interfere “with State Farm’s rights under Illinois law to use a claimant’s information to perform certain insurance functions.” State Farm asked the trial courts to deny plaintiffs’ proposed QPOs.

¶ 16 State Farm also asserted that the law division of the circuit court of Cook County has “entered a standard medical protective order authorizing production of health information that omits unnecessary restrictions and explicitly accommodates casualty insurers’ obligations.” State Farm tendered and sought entry of the Cook County standard protective order.

¶ 17 The Cook County standard protective order lacks the PHI “use or disclosure” prohibition and the “return or destroy” requirement that plaintiffs’ proposed QPOs provide.

¶ 18 Rather, the Cook County standard protective order expressly permits insurance companies to maintain, use, disclose, and dispose of PHI for the following purposes:

“1. Reporting; investigating; evaluating, adjusting, negotiating, arbitrating, litigating, or settling claims;

2. Compliance reporting or filing;

3. Conduct described in [section 1014 of the Illinois Insurance Code] 215 ILCS 5/1014;

4. Required inspections and audits;

5. Legally required reporting to private, federal, or state governmental organizations ***;

6. Rate setting and regulation;

7. Statistical information gathering;

8. Underwriting, reserve, loss, and actuarial calculation;

-5-

9. Drafting policy language;

10. Workers’ compensation; and

11. Determining the need for and procuring excess or umbrella coverage or reinsurance.”

Also, paragraph 5 of the Cook County standard protective order specifically exempts insurance companies from the “return or destroy” requirement of 45 C.F.R. § 164.512(e)(1)(v)(B) (2018). State Farm urged the trial courts to adopt and enter the tendered Cook County standard protective order.

¶ 19 D. Plaintiffs’ Replies

¶ 20 Plaintiffs responded that their proposed QPOs would not impose undue restrictions or obligations on nonhealth insurers for two reasons. First, plaintiffs argued that there was no language in either the Illinois Insurance Code or the Illinois Administrative Code that requires nonhealth insurers to retain, use, or disclose PHI. Second, plaintiffs asserted that State Farm does not require PHI to perform “certain insurance functions.” Plaintiffs further noted that there has never been an administrative disciplinary action taken against State Farm for failing to maintain PHI. Therefore, according to plaintiffs, their proposed QPOs would not affect the reporting obligations of nonhealth insurers such as State Farm.

¶ 21 Plaintiffs alternatively asserted that, absent a waiver from the federal government, (1) HIPAA prohibits the use or disclosure of PHI for any purpose other than the litigation or proceeding for which such information was requested and (2) HIPAA requires the return or destruction of PHI at the end of the litigation or proceeding. Therefore, according to plaintiffs, to the extent that any state law or regulation permits State Farm to use, store, maintain or distribute PHI outside of the scope of litigation and for State Farm’s own business operations, it is preempted by HIPAA.

¶ 22 Plaintiffs further responded that whether or not State Farm is a “covered entity” is irrelevant. Plaintiffs reasoned that, even if State Farm is exempt from HIPAA as a casualty and liability insurer, the plaintiff-authorized PHI, the QPO entered by the court, and the parties to whom the PHI is released are all subject to HIPAA.

-6-

Thus, according to plaintiffs, “State Farm had no right to the information to begin with.” Rather, plaintiffs argued that State Farm “only obtains an ability to review PHI because of a valid protective order. Therefore, regardless of whether State Farm is a ‘covered entity’ under HIPAA, it must still abide by the court order and the terms of HIPAA if it wants access to the PHI.”

¶ 23 E. Trial Courts’ Orders

¶ 24 In February 2019, the trial courts in the Haage and Surlock lawsuits held a combined hearing on plaintiffs’ motions for QPOs. In May 2019, the trial courts issued memorandum opinions and orders that granted plaintiffs’ motions to enter their proposed QPOs and denied State Farm’s request for the entry of the Cook County standard protective order.

¶ 25 The trial courts found that HIPAA preempts Illinois law to the extent that State Farm’s obligations and rights under state law conflict with HIPAA. The trial courts found that it would be impossible to comply with both Illinois law and HIPAA requirements for a QPO. The trial courts specifically found that the Cook County standard protective order violated 45 C.F.R. § 164.512(e)(1)(v)(A), (B) (2018), to the extent that it (1) would allow insurance companies to maintain, use, disclose, and dispose of PHI outside of the litigation and (2) would not require insurers to return or destroy the PHI at the conclusion of the litigation. The trial courts found that the Cook County standard protective order “would eliminate the two requirements set forth by the Department [of Health and Human Services (HHS)] for a qualified protective order and would not provide the confidentiality and protection of PHI” envisioned when HHS promulgated the Privacy Rule. The trial courts found that without these two requirements, “a covered entity no longer has a valid HIPAA qualified protective order to allow disclosure of PHI.”

¶ 26 The trial courts also acknowledged that “property and casualty liability insurers are not covered entities under HIPAA.” However, each trial court found that not being a covered entity “does not exempt State Farm from obeying a protective order entered by this court with respect to PHI which has been produced by a covered entity.” (Emphasis in original.) Rather, each trial court ruled that “[a]ll parties receiving the PHI are bound to follow the qualified protective order of the court regardless of whether they are a covered entity under HIPAA in the first instance.”

-7-

¶ 27 The trial courts next rejected State Farm’s argument that plaintiffs’ motions for QPOs should be deemed as proposals for a court order under a different section of the Privacy Rule. Each trial court reasoned that, “[w]hile the HIPAA regulations do provide several different ways in which a covered entity is permitted to disclose PHI, Plaintiff has chosen to secure a qualified protective order.”

¶ 28 Accordingly, the trial courts entered plaintiffs’ proposed QPOs in both lawsuits. The QPOs included the following relevant provisions:

“8. Within 60 days after the conclusion of the litigation, including appeals, the parties, their attorneys, insurance companies and any person or entity in possession of PHI received pursuant to this Order, shall return Plaintiff’s PHI to the covered entity or destroy any and all copies of PHI pertaining to Plaintiff, including any electronically stored copy or image, except that counsel are not required to secure the return or destruction of PHI submitted to the Court.

***

12. All requests by or on behalf of any Defendant for protected health information, including but not limited to subpoenas, shall be accompanied by a complete copy of this Order. The parties—including their insurers and counsel—are prohibited from using or disclosing protected health information for any purpose other than this litigation. ‘Disclose’ shall have the same *** scope and definition as set forth in 45 C.F.R. § 160.103: ‘the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.’ ” (Emphases added.)

¶ 29 F. Appellate Court

¶ 30 In each case, State Farm filed an interlocutory appeal to the appellate court. See Ill. S. Ct. R. 307(a)(1) (eff. Nov. 1, 2017). The appellate court granted State Farm’s motion to consolidate the appeals and denied plaintiffs’ motion to dismiss. 2020 IL App (2d) 190499, ¶ 33.

¶ 31 The appellate court acknowledged that State Farm, as a property and casualty insurer, did not fit within the specific regulatory definition of a “ ‘covered entity,’ ” as defined by the Privacy Rule, because it was not a “ ‘health plan,’ ” a “ ‘health

-8-

care clearinghouse,’ ” or a “ ‘health care provider who transmits any health information in electronic form.’ ” Id. ¶¶ 39-40 (quoting 45 C.F.R. § 160.103 (2018)). However, the appellate court agreed with the trial courts that “State Farm, as an entity wishing to receive PHI from a covered entity in response to a HIPAA qualified protective order, is bound to comply with the use and disclosure restrictions set forth in the orders.” Id. ¶ 44. Thus, the appellate court concluded that, “if State Farm wishes to access the PHI at issue, it must abide by the terms of the HIPAA qualified protective orders entered by the trial courts.” Id. ¶ 49.

¶ 32 State Farm next argued that it must be permitted to use and retain plaintiffs’ PHI to fulfill its obligations under Illinois insurance regulatory law and that the Cook County standard protective order “ ‘strikes the proper balance between a litigant’s interest in PHI and the State’s interest in allowing property and casualty insurers to retain PHI beyond litigation.’ ” Id. ¶ 51. The appellate court concluded that “State Farm failed to cite any statute, regulation, or case law that affirmatively requires the retention of PHI or its use for a particular purpose.” Id. ¶ 59. Further, the appellate court found nothing in the provisions of the Insurance Code and the Illinois Administrative Code cited by State Farm that requires State Farm to retain PHI or use it for any particular purpose after the conclusion of the litigation. Accordingly, the appellate court rejected State Farm’s argument that the terms of plaintiffs’ QPOs conflict with State Farm’s obligations under state law. Id. ¶ 60.

¶ 33 The appellate court next held that, to the extent that plaintiffs’ QPOs could be considered to conflict with State Farm’s obligations under state law, HIPAA and the Privacy Rule preempt state law. Id. ¶¶ 62-64. The appellate court also concluded that the doctrine of reverse preemption, as provided by the McCarran-Ferguson Act (15 U.S.C. § 1011 et seq. (2018)), which is potentially relevant specifically to insurance regulation, did not apply in this case. 2020 IL App (2d) 190499, ¶¶ 66- 68.

¶ 34 Lastly, State Farm assigned error to the trial courts’ rejection of any alternative to plaintiffs’ QPOs. The appellate court acknowledged that the Privacy Rule provides several different methods by which a covered entity may disclose PHI during litigation. However, the appellate court observed that plaintiffs and State Farm sought the disclosure of PHI through QPOs. Accordingly, the appellate court

-9-

held that the trial courts did not err in declining to consider an alternative method of disclosing PHI. Id. ¶ 70.

¶ 35 State Farm appeals to this court. We granted the National Insurance Crime Bureau leave to submit an amicus curiae brief in support of State Farm’s position. The Illinois Trial Lawyers Association and the Illinois Public Interest Research Group were each granted leave to submit an amicus curiae brief in support of plaintiffs’ position. Ill. S. Ct. R. 345 (eff. Sept. 20, 2010).

¶ 36 II. ANALYSIS

¶ 37 Before this court, the parties present several arguments in relation to the following issues. First, the parties disagree on the applicability of the Privacy Rule and its preemptive effect on Illinois insurance regulatory law governing the use, disclosure, and retention of PHI. Second, the parties disagree on whether Illinois insurance regulatory law mandates that a property and casualty insurer use, disclose, and retain PHI beyond litigation. Third, the parties disagree on the preemptive effect of the Privacy Rule on the Cook County standard protective order.

¶ 38 A. Standard of Review

¶ 39 State Farm filed an interlocutory appeal to the appellate court pursuant to Illinois Supreme Court Rule 307(a)(1) (eff. Nov. 1, 2017), which provides for an appeal from an interlocutory order “granting, modifying, refusing, dissolving, or refusing to dissolve or modify an injunction.” This court has held that “an interlocutory order circumscribing the publication of information is reviewable as an interlocutory injunctive order, pursuant to Rule 307(a)(1).” Skolnick v. Altheimer & Gray, 191 Ill. 2d 214, 221 (2000); see In re Daveisha C., 2014 IL App (1st) 133870, ¶ 25 (“Supreme Court Rule 307(a)(1) allows review of *** a protective order entered during the discovery phase of the proceedings.”).

¶ 40 “As this court has explained, ‘in an interlocutory appeal, the scope of review is normally limited to an examination of whether or not the trial court abused its discretion in granting or refusing the requested interlocutory relief.’ ” West Bend

- 10 -

Mutual Insurance Co. v. TRRS Corp., 2020 IL 124690, ¶ 31 (quoting In re Lawrence M., 172 Ill. 2d 523, 526 (1996)). An abuse of discretion occurs only when the trial court’s decision is arbitrary, fanciful, or unreasonable or where no reasonable person would take the view adopted by the trial court. In re Marriage of Heroy, 2017 IL 120205, ¶ 24; Seymour v. Collins, 2015 IL 118432, ¶ 41. “When, however, the interlocutory appeal involves a question of law, the reviewing court resolves that legal question independently of the trial court’s judgment and, to the extent necessary, may consider substantive issues to determine whether the trial court acted within its authority.” West Bend Mutual Insurance Co., 2020 IL 124690, ¶ 32; see Loyola Academy v. S&S Roof Maintenance, Inc., 146 Ill. 2d 263, 274 (1992).

¶ 41 In this case, State Farm presents issues that require us to construe various statutory and administrative provisions. Issues of statutory construction present questions of law that we review de novo. In re Appointment of Special Prosecutor, 2019 IL 122949, ¶ 22; Cohen v. Chicago Park District, 2017 IL 121800, ¶ 17; In re M.M., 2016 IL 119932, ¶ 15. Under the de novo standard, the reviewing court performs the same analysis that the trial court would perform. People v. McDonald, 2016 IL 118882, ¶ 32; see Choate v. Indiana Harbor Belt R.R. Co., 2012 IL 112948, ¶ 21.

¶ 42 B. Canons of Statutory Construction

¶ 43 The same familiar principles of statutory construction that apply to state legislation also apply to federal legislation enacted by Congress. See, e.g., Standard Mutual Insurance Co. v. Lay, 2013 IL 114617, ¶ 26; Italia Foods, Inc. v. Sun Tours, Inc., 2011 IL 110350, ¶ 12. Additionally, because administrative regulations have the force and effect of law, the familiar rules that govern construction of statutes also apply to the construction of administrative regulations. Kean v. Wal-Mart Stores, Inc., 235 Ill. 2d 351, 368 (2009); Union Electric Co. v. Department of Revenue, 136 Ill. 2d 385, 391 (1990).

¶ 44 The primary objective in statutory construction is to ascertain and give effect to the intent of the legislature. The most reliable indicator of legislative intent is the language of the statute, which must be given its plain and ordinary meaning. In re Appointment of Special Prosecutor, 2019 IL 122949, ¶ 23; In re M.M., 2016 IL

- 11 -

119932, ¶ 16. In construing a federal statute, “ ‘[o]ur task is to give effect to the will of Congress, and where its will has been expressed in reasonably plain terms, that language must ordinarily be regarded as conclusive.’ ” Negonsott v. Samuels, 507 U.S. 99, 104 (1993) (quoting Griffin v. Oceanic Contractors, Inc., 458 U.S. 564, 570 (1982)). In construing a statute, a court must view a statute as a whole. Therefore, words and phrases must be construed in light of other relevant statutory provisions and not in isolation. United States National Bank of Oregon v. Independent Insurance Agents of America, Inc., 508 U.S. 439, 455 (1993); In re Appointment of Special Prosecutor, 2019 IL 122949, ¶ 23; Chicago Teachers Union, Local No. 1 v. Board of Education of the City of Chicago, 2012 IL 112566, ¶ 15. Each word, clause, and sentence of a statute must be given a reasonable meaning, if possible, and should not be rendered superfluous. TRW Inc. v. Andrews, 534 U.S. 19, 31 (2001); Chicago Teachers Union, 2012 IL 112566, ¶ 15. Additionally, the court may consider the reason for the law, the problems sought to be remedied, the purposes to be achieved (National Bank of Oregon, 508 U.S. at 455; In re M.M., 2016 IL 119932, ¶ 16), and the consequences of construing the statute one way or another (American Tobacco Co. v. Patterson, 456 U.S. 63, 71 (1982); In re Appointment of Special Prosecutor, 2019 IL 122949, ¶ 23).

¶ 45 C. Statutory Overview of HIPAA

¶ 46 “HIPAA is ‘a complex piece of legislation that addresses the exchange of health-related information.’ ” Cohan v. Ayabe, 322 P.3d 948, 954 (Haw. 2014) (quoting National Abortion Federation v. Ashcroft, No. 03 Civ. 8695(RCC), 2004 WL 555701, at *2 (S.D.N.Y. Mar. 19, 2004)). Subtitle F of Title II of HIPAA, captioned “Administrative Simplification,” consists of sections 261 through 264 of the statute. As amended in 2010, the purpose of this subtitle is

“to improve *** the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of uniform standards and requirements for the electronic transmission of certain health information and to reduce the clerical burden on patients, health care providers, and health plans.” Pub. L. 104-191 § 261, 110 Stat. 1936, 2021 (1996).

- 12 -

¶ 47 In furtherance of these statutory purposes, various individual provisions in section 262 outline whom the regulations were to cover, what information was to be covered, what types of transactions were to be covered, what time limits and standards would govern compliance with HIPAA, and what penalties would accrue for HIPAA violations. 42 U.S.C. §§ 1320d to 1320d-9 (2018).

¶ 48 To effectuate these statutory directives, section 262 instructed the United States HHS to adopt uniform standards “to enable health information to be exchanged electronically.” 42 U.S.C. § 1320d-2(a)(1) (2018). In section 264 of HIPAA, Congress provided a two-step process to address how to afford certain protections to the privacy of health information maintained under HIPAA. First, within 12 months of HIPAA’s enactment, HHS was directed to submit to Congress “detailed recommendations on standards with respect to the privacy of individually identifiable health information.” HIPAA, Pub. L. No. 104-191 § 264(a), 110 Stat. 1936, 2033. Congress directed HHS to address subjects including as follows: “(1) The rights that an individual who is a subject of individually identifiable health information should have. (2) The procedures that should be established for the exercise of such rights. (3) The uses and disclosures of such information that should be authorized or required.” Id. § 264(b).

¶ 49 Second, if Congress did not enact further legislation pursuant to the recommendations from HHS within 36 months of HIPAA’s enactment, HHS was to promulgate final regulations providing for such standards. Id. § 264(c)(1). HIPAA further provided that the privacy regulations promulgated by HHS “shall not supercede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than the requirements, standards, or implementation specifications imposed under the regulation.” Id. § 264(c)(2); see generally South Carolina Medical Ass’n v. Thompson, 327 F.3d 346, 348-49 (4th Cir. 2003) (summarizing statute); Buckman, supra, at 145-48 (same).

¶ 50 D. Privacy Rule Overview

¶ 51 In September 1997, HHS did submit recommendations for protecting the privacy of individually identifiable heath information. However, Congress ultimately failed to enact any additional legislation. Arons v. Jutkowitz, 880 N.E.2d

- 13 -

831, 840 (N.Y. 2007); South Carolina Medical Ass’n, 327 F.3d at 349. In November 1999, HHS issued proposed “Standards for Privacy of Individually Identifiable Health Information” (64 Fed. Reg. 59,918 (Nov. 3, 1999)), and in December 2000, HHS promulgated its final rule. 65 Fed. Reg. 82,462 (Dec. 28, 2000). These standards are known collectively as the “Privacy Rule.” Buckman, supra, at 148; U.S. Dep’t of Health & Human Servs., Office for Civil Rights, Summary of the HIPAA Privacy Rule 2 (May 2003), https://www.hhs.gov/sites/default/files/privacysummary.pdf [https://perma.cc/F66C-T4TR] (hereinafter Summary of the HIPAA Privacy Rule). In August 2002, HHS amended the Privacy Rule (67 Fed. Reg. 53,182 (Aug. 14, 2002)). The Privacy Rule is codified at parts 160 and 164 of Title 45 of the Code of Federal Regulations (45 C.F.R. pts. 160, 164 (2018)).

¶ 52 According to HHS, the purposes of the Privacy Rule include: “[t]o protect and enhance the rights of consumers by *** controlling the inappropriate use” of their health information and “to improve the efficiency and effectiveness of health care delivery by creating a national framework for health privacy protection that builds on efforts by states, health systems, and individual organizations and individuals.” 65 Fed. Reg. at 82,463. HHS explained as follows:

“In enacting HIPAA, Congress recognized the fact that administrative simplification cannot succeed if we do not also protect the privacy and confidentiality of personal health information. The provision of high-quality health care requires the exchange of personal, often-sensitive information between an individual and a skilled practitioner. Vital to that interaction is the patient’s ability to trust that the information shared will be protected and kept confidential. Yet many patients are concerned that their information is not protected. Among the factors adding to this concern are the growth of the number of organizations involved in the provision of care and the processing of claims, the growing use of electronic information technology, increased efforts to market health care and other products to consumers, and the increasing ability to collect highly sensitive information about a person’s current and future health status as a result of advances in scientific research.

Rules requiring the protection of health privacy in the United States have been enacted primarily by the states. While virtually every state has enacted one

- 14 -

or more laws to safeguard privacy, these laws vary significantly from state to state and typically apply to only part of the health care system. ***

Until now, virtually no federal rules existed to protect the privacy of health information and guarantee patient access to such information. This final rule establishes, for the first time, a set of basic national privacy standards and fair information practices that provides all Americans with a basic level of protection and peace of mind that is essential to their full participation in their care. The rule sets a floor of ground rules for health care providers, health plans, and health care clearinghouses to follow, in order to protect patients and encourage them to seek needed care. The rule seeks to balance the needs of the individual with the needs of the society. It creates a framework of protection that can be strengthened by both the federal government and by states as health information systems continue to evolve.” Id. at 82,463-64.

¶ 53 HHS explains that many of the provisions of the Privacy Rule, as codified, “are presented as ‘standards.’ Generally, the standards indicate what must be accomplished under the regulation and implementation specifications describe how the standards must be achieved.” Id. at 82,488.

¶ 54 The Privacy Rule prohibits a “covered entity” or “business associate” from using a person’s “protected health information” except as mandated or permitted by its provisions. 45 C.F.R. § 164.502(a) (2018). PHI is defined as “individually identifiable health information” that is kept or transmitted in electronic or any other form of media. Id. § 160.103. Further, “individually identifiable health information” means information, including demographic data, that (1) is created or received by a “covered entity”; (2) relates “to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual”; and (3) identifies, or reasonably can be used to identify, the individual. Id. “Covered entities” refer to health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form. Id. §§ 160.103, 164.104(a). A “business associate” refers to a person, not a member of a covered entity’s workforce, who uses or discloses PHI in performing certain activities or functions on behalf of a covered entity. Id. § 160.103.

- 15 -¶ 55 E. The Privacy Rule Applies to State Farm

¶ 56 Both plaintiffs and State Farm agree that State Farm is not a “covered entity” as defined by HIPAA because a property and casualty insurer is not a “health plan,” “health care clearinghouse,” or a “health care provider who transmits any health information in electronic form.” See id. § 160.103. The appellate court observed that State Farm had not cited any specific language in HIPAA, the Privacy Rule, or any other source of law “indicating that a noncovered entity that receives PHI from a covered entity in response to a HIPAA qualified protective order is exempt from complying with the order’s restrictions regarding the use or disclosure of the PHI.” 2020 IL App (2d) 190499, ¶ 49.

¶ 57 Before this court, State Farm argues that “because property and casualty insurers like State Farm are not covered entities, their business operations do not fall within HIPAA’s privacy and security obligations.” Further, according to State Farm, “property and casualty insurers like State Farm do not become a ‘covered entity’ when they receive PHI from a ‘covered entity’ in the ordinary course of handling claims.”

¶ 58 State Farm maintains that property and casualty insurers logically “fall outside HIPAA given the role of liability insurance in the administration of justice.” State Farm argues that “property and casualty insurers do not enter into a physician- patient relationship with anyone and their role is not to provide *** health care services.” Rather, according to State Farm, property and casualty insurers “insure their policyholders against the risk of bodily injury or property damage (including for liability to others) that results from an accident—not to offer medical or health care to the injured person.”

¶ 59 We cannot accept State Farm’s reasoning. Generally, a personal injury action requires proof of an injury (Golla v. General Motors Corp., 167 Ill. 2d 353, 360 (1995)), which necessarily requires disclosure of relevant PHI. State Farm’s logic leads to the denial of any request for a QPO in a judicial proceeding where a defendant is insured by a casualty insurer. This court has noted “the dominant role played by the insurance industry in the field of personal injury litigation.” Sullivan v. Midlothian Park District, 51 Ill. 2d 274, 280 (1972). Scholars have similarly recognized:

- 16 -

“The key stakeholders in litigation—at least on the defense side—are seldom the individual litigants who have been sued. Rather, insurers are the entities who regularly pay not only the cost of defending claims but also any settlement or judgment. Insured parties retain some authority to make substantive litigation decisions, but the practical reality is that insurers drive litigation outcomes.” Chris Guthrie & Jeffrey J. Rachlinski, Insurers, Illusions of Judgment and Litigation, 59 Vand. L. Rev. 2017, 2019 (2006).

See William P. Lynch, Why Settle for Less? Improving Settlement Conferences in Federal Court, 94 Wash. L. Rev. 1233, 1251 (2019) (“Insurers play a key role in the civil justice system. In most personal injury litigation, the individual defendant is insured, and the insurer provides a defense and exercises complete control over whether to settle the case.”).

¶ 60 Thus, if we were to accept State Farm’s argument, there would be few instances in which a QPO could be requested. It was clearly not the intent of Congress that a QPO would be unavailable whenever an alleged tortfeasor was insured by a liability insurer. HIPAA contains no such limitation, and this court must not add such a limitation under the guise of statutory construction. See People ex rel. Birkett v. Dockery, 235 Ill. 2d 73, 81 (2009) (“we cannot rewrite a statute, and depart from its plain language, by reading into it exceptions, limitations or conditions not expressed by the legislature”); Hines v. Department of Public Aid, 221 Ill. 2d 222, 230 (2006) (same).

¶ 61 There are two exceptions to the prohibition against the use or disclosure of an individual’s PHI. First, a covered entity may use or disclose PHI pursuant to a valid authorization. 45 C.F.R. §§ 164.502(a)(1)(iv), 164.508 (2018).

¶ 62 Second, and relevant to this appeal, a covered entity may use or disclose PHI in the course of litigation. Id. §§ 164.502(a)(1)(vi), 164.512(e). Use or disclosure of PHI is permissible to comply with an order of a court or administrative tribunal, so long as only the PHI expressly authorized by the order is disclosed. Id. § 164.512(e)(1)(i). Absent a judicial or administrative order, a covered entity may disclose PHI in response to a subpoena, discovery request, or other lawful process if (1) the covered entity has received satisfactory assurances that the party seeking the disclosure has made reasonable efforts to ensure that the individual has been given notice of the request or (2) the covered entity has made reasonable efforts to

- 17 -

secure a “qualified protective order.” Id. § 164.512(e)(1)(ii), (iv). A QPO is a judicial or administrative order, or a stipulation by the parties, that (1) “[p]rohibits the parties from using or disclosing the [PHI] for any purpose other than the litigation or proceeding for which such information was requested” and (2) “[r]equires the return to the covered entity or destruction of the [PHI] (including all copies made) at the end of the litigation or proceeding.” Id. § 164.512(e)(1)(v).

¶ 63 Importantly, State Farm is not the disclosing party but rather is the party wishing to obtain plaintiffs’ PHI. Therefore, in the absence of a court order pursuant to section 164.512(e)(1)(i), the Privacy Rule authorizes a covered entity to disclose PHI to State Farm in this litigation only pursuant to (1) a subpoena, discovery request, or other lawful process, provided that adequate notice was given to plaintiffs, or (2) a QPO containing the required “use and disclosure” prohibition and the “return or destroy” requirement. Id. § 164.512(e)(1)(ii), (iv). Here, State Farm is not appealing from any independent disclosure orders or any issues pertaining to discovery, service of process, and notice. Accordingly, State Farm can receive plaintiffs’ PHI only in response to a valid QPO.

¶ 64 State Farm argues that we should view its tendered protective orders as a request for an independent disclosure order pursuant to section 164.512(e)(1)(i). We reject this argument. Section 164.512(e)(1)(i) specifically mandates that “the covered entity disclose[ ] only the [PHI] expressly authorized by such order.” (Emphases added.) Id. § 164.512(e)(1)(i). Thus, pursuant to this section, a covered entity is prohibited from disclosing PHI that is not “expressly authorized” by the order. However, State Farm’s tendered protective orders do not address what PHI the covered entity is expressly authorized to disclose. State Farm’s tendered protective orders have no language that limits or restricts the PHI permitted to be disclosed. Such an order would be impermissible for several reasons.

¶ 65 State Farm’s tendered protective orders violate Rule 201 to the extent that they permit the disclosure of any and all PHI. Rule 201(b)(1) provides in relevant part: “Except as provided in these rules, a party may obtain by discovery full disclosure regarding any matter relevant to the subject matter involved in the pending action, whether it relates to the claim or defense of the party seeking disclosure or of any other party ***.” Ill. S. Ct. R. 201(b)(1) (eff. July 1, 2014). “[T]he relevance requirement safeguards against ‘improper and abusive’ discovery and acts as an

- 18 -

‘independent constraint on discovery.’ ” People ex rel. Madigan v. Stateline Recycling, LLC, 2020 IL 124417, ¶ 32 (quoting Kunkel v. Walton, 179 Ill. 2d 519, 533 (1997)). Therefore, even if State Farm’s tendered protective orders could be viewed to require covered entities to disclose plaintiffs’ PHI, they would still be improper because they do not satisfy the relevancy requirement of Rule 201(b).

¶ 66 Even if we were to consider State Farm’s tendered protective orders as compliant with section 164.512(e)(1)(i), they would still violate the state constitutional right to privacy. The Illinois Constitution guarantees, in pertinent part, that “[t]he people shall have the right to be secure in their persons, houses, papers and other possessions against unreasonable *** invasions of privacy.” Ill. Const. 1970, art. I, § 6. In Kunkel, this court stated as follows:

“This court has observed that the Illinois Constitution goes beyond federal constitutional guarantees by expressly recognizing a zone of personal privacy, and that the protection of that privacy is stated broadly and without restrictions. [Citation.] The confidentiality of personal medical information is, without question, at the core of what society regards as a fundamental component of individual privacy. Physicians are privy to the most intimate details of their patients’ lives, touching on diverse subjects like mental health, sexual health and reproductive choice. Moreover, some medical conditions are poorly understood by the public, and their disclosure may cause those afflicted to be unfairly stigmatized. Respect for the privacy of medical information is a central feature of the physician-patient relationship. Under the Hippocratic Oath, and modern principles of medical ethics derived from it, physicians are ethically bound to maintain patient confidences. See Petrillo v. Syntex Laboratories, Inc., 148 Ill. App. 3d 581, 589 (1986).

In addition, this court has recognized that ‘[a] person has a reasonable expectation that he will not be forced to submit to a close scrutiny of his personal characteristics, unless for a valid reason. *** [T]he individual’s privacy interest in his physical person *** must be protected.’ [Citation.] We believe that this privacy interest pertaining to individual physical characteristics necessarily encompasses personal medical information.” Kunkel, 179 Ill. 2d at 537-38.

- 19 -

In Kunkel, this court cautioned: “The text of our constitution does not accord absolute protection against invasions of privacy. Rather, it is unreasonable invasions of privacy that are forbidden. In the context of civil discovery, reasonableness is a function of relevance.” (Emphasis in original.) Id. at 538.

¶ 67 Where the privacy interest in medical information is involved, it “is reasonable to require full disclosure of medical information that is relevant to the issues in the lawsuit.” Id. However, State Farm’s tendered protective orders are unlimited in the PHI to be disclosed without regard to the issues being litigated. The scope of the PHI required by State Farm’s protective orders would be unreasonable and, therefore, unconstitutional.

¶ 68 In sum, the Privacy Rule applies to State Farm. Therefore, State Farm can receive plaintiffs’ PHI only in response to a valid QPO.

¶ 69 F. Illinois Insurance Regulatory Law Does Not Mandate Use, Disclosure, or Retention of PHI

¶ 70 State Farm contends that the trial courts should have entered State Farm’s tendered Cook County standard protective order or a similar protective order “expressly allowing for the retention, use, and disclosure of information by property and casualty insurers in conformity to federal and state law and regulations.” State Farm complains that the trial courts’ QPOs prevent State Farm from fulfilling its obligations under the Illinois Insurance Code and supporting administrative regulations. State Farm’s argument requires analysis of the preemptive effect of the Privacy Rule on Illinois insurance regulatory law.

¶ 71 1. Preemption Principles

¶ 72 The supremacy clause of the United States Constitution provides that federal law “shall be the supreme Law of the Land ***, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.” U.S. Const., art. VI, cl. 2. The determination of whether state law is preempted turns on the intent of Congress. When interpreting a federal statute pertaining to a subject traditionally governed by state law, courts are reluctant to find preemption unless Congress’s preemptive

- 20 -

intent is clear and manifest. CSX Transportation, Inc. v. Easterwood, 507 U.S. 658, 664 (1993); Village of Mundelein v. Wisconsin Central R.R., 227 Ill. 2d 281, 288 (2008). One of the circumstances in which state law is preempted under the supremacy clause is where the express language of a federal statute indicates an intent to preempt state law. Wisconsin Public Intervenor v. Mortier, 501 U.S. 597, 604-05 (1991); Village of Mundelein, 227 Ill. 2d at 288. If the federal statute contains an express exemption provision, “the task of statutory construction must in the first instance focus on the plain wording of the clause, which necessarily contains the best evidence of Congress’ pre-emptive intent.” CSX Transportation, 507 U.S. at 664; Village of Mundelein, 227 Ill. 2d at 289.

¶ 73 HIPAA and the Privacy Rule establish a uniform federal floor or baseline of privacy protection for PHI, which states are free to exceed. See Giangiulio v. Ingalls Memorial Hospital, 365 Ill. App. 3d 823, 839 (2006); Cohan, 322 P.3d at 955. When HHS promulgated the Privacy Rule, the agency stressed: “It is important to understand this regulation as a new federal floor of privacy protections that does not disturb more protective rules or practices. *** The protections are a mandatory floor, which other governments and any covered entity may exceed.” 65 Fed. Reg. at 82,471.

¶ 74 Consequently, “State laws that are contrary to the Privacy Rule are preempted by the federal requirements, which means that the federal requirements will apply.” Summary of the HIPAA Privacy Rule, supra, at 17; 45 C.F.R. § 160.203 (2018). A state law is “contrary” to HIPAA if a “covered entity or business associate would find it impossible to comply with both the State and Federal requirements” or if the “provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of [HIPAA].” 45 C.F.R. § 160.202 (2018).

¶ 75 However, section 264 of HIPAA provides that the Privacy Rule “shall not supersede a contrary provision of State law, if the provision of State law imposes requirements, standards, or implementation specifications that are more stringent than [those] imposed under the regulation.” Pub. L. No. 104-191 § 264(c)(2), 110 Stat. 1936, 2033-34. Implementing this statutory mandate, the Privacy Rule provides that the general rule of federal preemption of contrary state law will not occur if the state law is “more stringent” than the applicable standard promulgated in the Privacy Rule. 45 C.F.R. § 160.203(b) (2018). The state law is “more

- 21 -

stringent” where it meets one or more of several criteria including where state law prohibits or restricts a use or disclosure of PHI where the Privacy Rule would allow it (id. § 160.202(1) (defining “more stringent”)) or, generally, where the state law provides greater privacy protection (id. § 160.202(6) (same)). See South Carolina Medical Ass’n, 327 F.3d at 355 (listing criteria).

¶ 76 Importantly, we add that these preemption provisions of HIPAA and the Privacy Rule speak in terms of a specific provision of HIPAA or the Privacy Rule and a specific provision of state law. In proposing the Privacy Rule, HHS explained what HIPAA requires as follows:

“The initial question that arises in the preemption analysis is, what does one compare? The statute directs this analysis by requiring the comparison of a ‘provision of State law [that] imposes requirements, standards, or implementation specifications’ with ‘the requirements, standards, or implementation specifications imposed under’ the federal regulation. The statute thus appears to contemplate that what will be compared are the State and federal requirements that are analogous, i.e., that address the same subject matter.” 64 Fed. Reg. 59,918, 59,995 (proposed Nov. 3, 1999) (to be codified at 45 C.F.R. pts. 160 to 164) (quoting Pub. L. No. 104-191 § 264 (c)(2), 110 Stat.1936, 2033-34).

Therefore, when a court engages in a HIPAA preemption analysis, the issue is not whether HIPAA generally “is contrary to and more stringent than the entirety of a state’s laws on the privacy of a patient’s medical information. Rather, the issue is whether or not a specific provision of HIPAA is contrary to and more stringent than a specific provision of state law.” State ex rel. Proctor v. Messina, 320 S.W.3d 145, 149 (Mo. 2010) (en banc).

¶ 77 2. Contested Provisions of Illinois Insurance Regulatory Law

¶ 78 Before this court, State Farm maintains its position that Illinois insurance regulatory law requires State Farm to use, disclose, and retain PHI for various regulatory purposes. We discuss each in turn.

- 22 -

¶ 79 State Farm contends that “property and casualty insurers are legally required to retain documentation in their claim files for examination by regulators.” The Insurance Code prohibits insurers from engaging in improper claims practices. See 215 ILCS 5/154, 154.6 (West 2018). To this end, section 919.30 of Title 50 of the Illinois Administrative Code requires insurers to make their claim files available to the Director of the Illinois Department of Insurance (Director) for examination upon request. 50 Ill. Adm. Code 919.30 (1989). Regarding examinations by the Director, section 919.30 provides in relevant part:

“b) Each company shall maintain claim data that should be accessible and retrievable for examination by the Director. A company shall be able to provide the claim number, line of coverage, date of loss and date of payment of the claim, date of denial, or date claim closed without payment. This data must be available for all open and/or closed files for the current year and the two preceding years. The examiners’ review may include but need not be limited to an examination of the following claims:

1) Claims Closed With Payment;

2) Claims Denied;

3) Claims Closed Without Payment;

4) First Party Automobile Total Losses; and/or Subrogation Claims.

c) Detailed documentation shall be contained in each claim file in order to permit reconstruction of the company’s activities relative to each claim file.” Id.

Further, “documentation” includes “all pertinent communications, transactions, notes and work papers” “properly dated and compiled in sufficient detail in order to allow for the reconstruction of all pertinent events relative to each claim file. Documentation shall include but not be limited to bills, explanations of benefits and worksheets.” 50 Ill. Adm. Code 919.40 (1989).

¶ 80 State Farm argues that this regulation requires it to maintain, in each claim file, detailed documentation that includes medical bills, which necessarily contain PHI.

- 23 -

According to State Farm, this insurance examination process conflicts with the “return or destroy” requirement of the trial court’s QPOs.

¶ 81 We reject this argument. State Farm could establish its “activities relative to each file” by simply including in the file a copy of the QPO, specifying that the insurer was prohibited from using or disclosing PHI for any purpose other than the litigation and was required to return or destroy the PHI at the end of the litigation. The appellate court correctly reached a similar conclusion. See 2020 IL App (2d) 190499, ¶ 54.

¶ 82 State Farm next contends that property and casualty insurers are prohibited from destroying company records except in conformity with the requirements of the Insurance Code and its administrative regulations. State Farm relies on part 901 of Title 50 of the Illinois Administrative Code (50 Ill. Adm. Code 901 (2016)). Section 901.5 provides that “[n]o domestic company shall destroy any books, records, documents, accounts or vouchers, hereafter referred to as ‘records’, except in conformity with the requirements of this Part.” 50 Ill. Adm. Code 901.5 (2016). Section 901.20 of Title 50 sets out a time period for the disposal and destruction of records:

“The company is authorized to dispose of or destroy records in its custody that do not have sufficient administrative, legal or fiscal value to warrant their further preservation and are not needed:

a) in the transaction of current business;

b) for the final settlement or disposition of any claim arising out of a policy of insurance issued by the company, except that these records must be maintained for the current year plus 5 years; or

c) to determine the financial condition of the company for the period since the date of the last examination report of the company officially filed with the Department of Insurance, except that these records must be maintained for at least the current year plus 5 years.” 50 Ill. Adm. Code 901.20 (2016).

Further, the term “records” is defined in section 901.10 of Title 50 as follows:

- 24 -

“ ‘Records’ material means all books, papers and documentary materials regardless of physical form or characteristics, made, produced, executed or received by any domestic insurance company pursuant to law or in connection with the transaction of its business and preserved or appropriate for preservation by such company or its successors as evidence of the organization, function, policies, decisions, procedures, obligations and business activities of the company or because of the informational data contained therein. If doubt arises as to whether certain papers are ‘non-record’ materials, it should be assumed that the documents are ‘records’.” 50 Ill. Adm. Code 901.10 (2016).

Before this court, State Farm argues that this definition of “records” is broad enough to include medical bills and records. State Farm maintains its position that part 901 sets out a detailed process for the destruction of an insurer’s records, which conflicts with the trial courts’ QPOs.

¶ 83 We reject this argument. In this case, State Farm does not explain how plaintiffs’ PHI is “appropriate for preservation,” especially given that (1) the trial courts entered HIPAA QPOs expressly requiring the destruction of PHI within 60 days after the conclusion of the litigation and (2) State Farm failed to cite any statute, regulation, or case law that affirmatively requires the retention of PHI or its use for a particular purpose. State Farm has made this argument in other courts, including the appellate court here, and those courts have correctly rejected it. See 2020 IL App (2d) 190499, ¶ 59; State ex rel. State Farm Mutual Automobile Insurance Co. v. Marks, 741 S.E.2d 75, 83-84 (W. Va. 2012); Small v. Ramsey, 280 F.R.D. 264, 279-80 (N.D. W. Va. 2012). Further, as earlier noted, retention of a copy of the QPO in the file would explain why the PHI was not present. Thus, part 901 of Title 50 of the Illinois Administrative Code does not support State Farm’s position.

¶ 84 State Farm next contends that the trial courts’ QPOs prevent insurers from performing functions related to fraud detection and deterrence. State Farm maintains its position that, because the Illinois Department of Insurance relies on property and casualty insurers to detect and combat insurance fraud, Illinois law authorizes them to report information, including PHI, to the Illinois Department of Insurance and insurance support organizations, such as the National Insurance Crime Bureau and the Insurance Services Organization. See 215 ILCS 5/155.23

- 25 -

(West 2018). State Farm argues that, if insurers must return to covered entities or destroy all PHI within 60 days of the end of litigation, they cannot later provide necessary information to help the state with fraud detection and prevention.

¶ 85 The statute State Farm cites authorizes the Director

“to promulgate reasonable rules requiring insurers *** doing business in the State of Illinois to report factual information in their possession that is pertinent to suspected fraudulent insurance claims, fraudulent insurance applications, or premium fraud after [the Director] has made a determination that the information is necessary to detect fraud or arson. Claim information may include:

(a) Dates and description of accident or loss.

(b) Any insurance policy relevant to the accident or loss.

(c) Name of the insurance company claims adjustor and claims adjustor supervisor processing or reviewing any claim or claims made under any insurance policy relevant to the accident or loss.

(d) Name of claimant’s or insured’s attorney.

(e) Name of claimant’s or insured’s physician, or any person rendering or purporting to render medical treatment.

(f) Description of alleged injuries, damage or loss.

(g) History of previous claims made by the claimant or insured.

(h) Places of medical treatment.

(i) Policy premium payment record.

(j) Material relating to the investigation of the accident or loss, including statements of any person, proof of loss, and any other relevant evidence.

(k) any facts evidencing fraud or arson.” Id. § 155.23(1).

- 26 -

State Farm’s reliance on section 155.23 is unpersuasive for two reasons. First, the statute applies only to suspected fraudulent insurance claims or applications, or premium fraud, and only after the Director has determined that the information is necessary to detect fraud or arson. In this case, there is no indication of fraud and no evidence that the Director has determined that any PHI is necessary to detect fraud or arson. Therefore, there can be no factual information pertinent to any suspected fraud. Second, the statute requires an insurer to report only factual information in its possession. An insurer that has returned or destroyed PHI in accordance with a HIPAA QPO cannot violate the statute, because it does not possess any such information.

¶ 86 State Farm next asserts that the trial courts’ QPOs “impede compliance with federal reporting requirements.” State Farm argues that, under the Medicare secondary payor statute (42 U.S.C. § 1395y(b)(2) (2018)), “automobile or liability insurers must report payments made to Medicare beneficiaries, along with information about the alleged cause of injury, incident, or illness.” According to State Farm: “Retention of medical records is crucial to this process. Additionally, insurers need medical records if Medicare seeks recovery of a ‘conditional payment.’ ”

¶ 87 We also reject this argument. This statute does not require a liability insurer to retain PHI after litigation even for Medicare beneficiaries. If State Farm is to pay a settlement or judgment, all it need do is to report the payment and the alleged cause of injury. Id. § 1395y(b)(8)(B)(i), (ii). This does not require State Farm to retain or disclose PHI after the conclusion of litigation.

¶ 88 Lastly, State Farm maintains its position that Illinois law protects personal or privileged information received in handling claims while still allowing property and casualty insurers to make disclosures necessary for rate-making, anti-fraud programs, and consumer-protection research. Article XL of the Insurance Code provides as follows:

“The purpose of this Article is to establish standards for the collection, use and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents or insurance-support organizations; to maintain a balance between the need for information by those conducting the business of insurance and the public’s need for fairness in insurance information practices,

- 27 -

including the need to minimize intrusiveness; to establish a regulatory mechanism to enable natural persons to ascertain what information is being or has been collected about them in connection with insurance transactions and to have access to such information for the purpose of verifying or disputing its accuracy; to limit the disclosure of information collected in connection with insurance transactions; and to enable insurance applicants and policyholders to obtain the reasons for any adverse underwriting decision.” 215 ILCS 5/1001 (West 2018).

This provision does not contain any affirmative language that mandates the use, disclosure, or retention of PHI for any purpose.

¶ 89 State Farm has failed to direct us to, nor have we found, any provision of the Insurance Code or the Illinois Administrative Code that requires it to use or disclose plaintiffs’ PHI after the conclusion of the litigation. As such, we reject State Farm’s argument that the trial courts’ QPOs conflict with its obligations under state law. Since there is no conflict, the Privacy Rule does not preempt or otherwise nullify these specific provisions in the Insurance Code and its administrative regulations.

¶ 90 G. Privacy Rule Preempts Cook County Standard Protective Order

¶ 91 State Farm assigns error to the conclusion of the trial and appellate courts that its alternative tendered protective orders are preempted by the Privacy Rule. State Farm argues that the absence of the “use or disclose” prohibition and the “return or destroy” requirement “cannot be an obstacle to accomplishing HIPAA’s full purposes and objectives” because those restrictions are not required for a court order pursuant to section 164.512(e)(1)(i). Rather, those restrictions apply only to discovery processes that are not accompanied by a court order. 45 C.F.R. § 164.512(e)(1)(ii) (2018).

¶ 92 We recognize that the Privacy Rule does not require a court order entered pursuant to section 164.512(e)(1)(i) to include the “use or disclose” prohibition and the “return or destroy” requirement of section 164.512(e)(1)(ii). This provision does not expressly dictate any criteria for judges to exercise their discretion. However, in response to a court order pursuant to section 164.512(e)(1)(i), a

- 28 -

covered entity may disclose “only the [PHI] expressly authorized by such order.” Id. § 164.512(e)(1)(i).

¶ 93 We must construe the language of section 164.512(e)(1) as a whole, in light of HIPAA and the entire Privacy Rule. See National Bank of Oregon, 508 U.S. at 455. Accordingly, we consider plaintiffs and State Farm to have followed the better approach in this litigation. Parties should first seek a protective order that meets the definition of a QPO under section 164.512(e)(1)(v) to pursue discovery under the provisions of section 164.512(e)(1)(ii). Should the parties then encounter any difficulty with the acquisition of necessary discovery, they may seek a court order as contemplated under section 164.512(e)(1)(i) for that specific, targeted information. See, e.g., Lohr v. UnitedHealth Group Inc., No. 1:12CV718, 2013 WL 4500692, at *5 (M.D.N.C. Aug. 21, 2013).

¶ 94 As earlier discussed, the Cook County standard protective order does not address what PHI the covered entity is expressly authorized to disclose. Therefore, we conclude that, in this case, a covered entity cannot comply with both the Privacy Rule and State Farm’s tendered protective orders. The Cook County standard protective order does not prohibit the insurer from using and disclosing PHI outside of litigation and does not require an insurer to return or destroy PHI at the conclusion of litigation. These concessions directly conflict with the requirements for a HIPAA QPO under section 164.512(e)(1)(v) of the Privacy Rule. Likewise, by eliminating the “use or disclose” prohibition and the “return or destroy” requirement, the Cook County standard protective order would not provide the confidentiality and protection of PHI envisioned when the Privacy Rule was promulgated. To accept State Farm’s argument would render superfluous and nugatory section 164.512(e)(1)(ii), which we cannot do. TRW Inc., 534 U.S. at 31. In other words, any requirement that an insurer be allowed to use and retain PHI beyond the conclusion of litigation would lower the floor of privacy protection that HIPAA and the Privacy Rule mandate. As such, the Cook County standard protective order acts as an obstacle to accomplishing and executing HIPAA’s full purposes and objectives. 45 C.F.R. § 160.202 (2018).

¶ 95 Therefore, we hold that the Cook County standard protective order is preempted by the Privacy Rule. We next determine whether the McCarran-Ferguson Act

- 29 -

shields the Cook County standard protective order from traditional preemption. ¶ 96 H. Reverse Preemption

¶ 97 The trial courts asked the parties to address the implications of the McCarran- Ferguson Act (15 U.S.C. § 1011 et seq. (2018)), which gives rise to the doctrine of “reverse preemption.” If applicable, the reverse preemption doctrine allows state laws that regulate insurance to prevail over general federal rules. Lovilia Coal Co. v. Williams, 143 F.3d 317, 324 (7th Cir. 1998); United States v. Rhode Island Insurers’ Insolvency Fund, 80 F.3d 616, 620 (1st Cir. 1996) (collecting cases). The parties did not argue that the McCarran-Ferguson Act applied in these cases, and the trial courts did not address the issue. The appellate court observed: “State Farm briefly mentions the McCarran-Ferguson Act in its brief but does not fully develop the issue. Nevertheless, we find it appropriate to briefly address this matter.” 2020 IL App (2d) 190499, ¶ 66. The appellate court held that the doctrine of reverse preemption did not apply to shield Illinois insurance law from Privacy Rule preemption. Id. ¶ 68.

¶ 98 Before this court, State Farm contends that the appellate court’s holding that the Privacy Rule preempts any conflicting state law is inconsistent with its holding that there is no conflict between the Privacy Rule and state law for reverse preemption purposes. State Farm misapprehends the McCarran-Ferguson Act and the reverse preemption doctrine.

¶ 99 As earlier mentioned, the general rule is that, “[w]here a state statute conflicts with, or frustrates, federal law, the former must give way.” CSX Transportation, 507 U.S. at 663. However, the McCarran-Ferguson Act carved out an exception to this general rule where state laws regulate the “business of insurance.” 15 U.S.C. § 1011 (2018). Section 2(b) of the McCarran-Ferguson Act provides: “No Act of Congress shall be construed to invalidate, impair, or supersede any law enacted by any State for the purpose of regulating the business of insurance *** unless such Act specifically relates to the business of insurance.” Id. § 1012(b). The United States Supreme Court has explained:

“[T]he Act does not seek to insulate state insurance regulation from the reach of all federal law. Rather, it seeks to protect state regulation primarily against

- 30 -

inadvertent federal intrusion—say, through enactment of a federal statute that describes an affected activity in broad, general terms, of which the insurance business happens to constitute one part.” (Emphasis omitted.) Barnett Bank of Marion County v. Nelson, 517 U.S. 25, 39 (1996).

¶ 100 The McCarran-Ferguson Act “transformed the legal landscape by overturning the normal rules of preemption.” United States Department of Treasury v. Fabe, 508 U.S. 491, 507 (1993). Section 2(b) imposes “a rule that state laws enacted ‘for the purpose of regulating the business of insurance’ do not yield to conflicting federal statutes unless a federal statute specifically requires otherwise.” Id. Under the McCarran-Ferguson Act, a state law will reverse preempt a federal law if (1) the state law was enacted for the purpose of regulating the business of insurance; (2) the federal law does not specifically relate to the business of insurance; and (3) the federal law would invalidate, impair, or supersede the state law. Humana Inc. v. Forsyth, 525 U.S. 299, 307 (1999). All three criteria must be satisfied for the doctrine of reverse preemption to preclude application of a federal law. See Lovilia Coal, 143 F.3d at 324; Rhode Island Insurers’ Insolvency Fund, 80 F.3d at 619.

¶ 101 The appellate court concluded that “nothing in any Illinois statute or regulation State Farm cites requires the retention of PHI or its use for any particular purpose. Thus, the HIPAA qualified protective orders entered in this case do not ‘invalidate, impair, or supersede’ the Illinois statutes and regulations State Farm cites.” 2020 IL App (2d) 190499, ¶ 68. Therefore, the appellate court correctly held that the doctrine of reverse preemption does not apply in this case. Id.

¶ 102 There is no inconsistency between this holding and our prior conclusion, with which the appellate court agreed, that the Privacy Rule preempts any conflicting state law. State Farm and plaintiffs agree with the appellate court’s holding that the McCarran-Ferguson Act does not apply here. Therefore, the doctrine of reverse preemption cannot shield the pertinent Illinois Insurance Code sections and regulations from federal preemption.

¶ 103 III. CONCLUSION

¶ 104 As a matter of law, we conclude as follows. The Privacy Rule applies in these cases to potentially preempt Illinois insurance regulatory law governing the use,

- 31 -

disclosure, and retention of PHI. The trial courts’ QPOs do not conflict with Illinois insurance regulatory law because nothing in the Insurance Code or administrative regulations mandates that a property and casualty insurer use, disclose, and retain PHI beyond litigation. However, the Cook County standard protective order is contrary to the Privacy Rule because it falls below the floor of privacy that the Privacy Rule mandates. Therefore, it is preempted by the Privacy Rule. Further, the reverse preemption doctrine provided by the McCarran-Ferguson Act does not shield the disputed provisions of Illinois insurance regulatory law from preemption. Therefore, we hold that the trial courts did not abuse their discretion in entering the QPOs pursuant to HIPAA and the Privacy Rule.

¶ 105 For the foregoing reasons, the judgment of the appellate court is affirmed, and the cases are remanded to the circuit court of Lake County for further proceedings.

¶ 106 Affirmed and remanded.

- 32 -