Chicago Sun-Times v. Cook County Health and Hospital System

2022 IL 127519

IN THE SUPREME COURT OF THE STATE OF ILLINOIS

(Docket No. 127519)

CHICAGO SUN-TIMES, Appellee v. COOK COUNTY HEALTH AND HOSPITALS SYSTEM, Appellant.

Opinion filed November 30, 2022.

JUSTICE MICHAEL J. BURKE delivered the judgment of the court, with opinion.

Justices Anne M. Burke, Neville, Overstreet, Carter, and Holder White concurred in the judgment and opinion.

Chief Justice Theis dissented, with opinion.

OPINION

¶1 Plaintiff, the Chicago Sun-Times, sent defendant, Cook County Health and Hospitals System, a request under the Freedom of Information Act (FOIA) (5 ILCS 140/1 et seq. (West 2018)) for information about gunshot wound patients who

arrive at defendant’s emergency rooms unaccompanied by law enforcement. Plaintiff was investigating whether defendant was meeting a requirement to notify local law enforcement when so-called “walk-in” gunshot wound patients are treated. 20 ILCS 2630/3.2 (West 2018). Plaintiff asked for the “time/date” of each relevant hospital admission and the corresponding “time/date” of law enforcement notification.

¶2 Defendant asserted two FOIA exemptions and withheld the records, claiming they contained (1) personal health information prohibited from disclosure by the Health Insurance Portability and Accountability Act (HIPAA) (Pub. L. No. 104- 191, 110 Stat. 1936 (1996) (codified as amended in scattered sections of Titles 18, 26, 29, and 42 of the United States Code); 5 ILCS 140/7(1)(a) (West 2018)) and (2) private information barred from disclosure under FOIA (5 ILCS 140/7(1)(b) (West 2018)).

¶3 Plaintiff initiated a FOIA enforcement action, arguing that the year listed on each record was discoverable, even if the time of day, day of month, and month were not. Id. § 11(a). The Cook County circuit court ruled for defendant on the parties’ cross-motions for summary judgment. The appellate court reversed, holding that HIPAA and FOIA permitted the release of the year elements of the records as long as the individual identifying information was redacted, or “de- identified” to maintain patient confidentiality. 2021 IL App (1st) 192551.

¶4 The issue presented is whether the year of each walk-in gunshot wound patient admission and the year of the corresponding law enforcement notification of each admission are exempt from disclosure under section 7(1)(a), which incorporates privacy laws such as HIPAA, or section 7(1)(b), which prohibits the disclosure of private information, including medical records. In light of the narrow scope of plaintiff’s request, we hold that the responsive information is not exempt from disclosure under the two exemptions addressed in the parties’ cross-motions for summary judgment. We affirm the appellate court’s judgment, reverse the circuit court’s judgment, and remand the cause for further proceedings.

¶5 I. BACKGROUND ¶6 On September 10, 2018, plaintiff requested the following information at issue:

-2-

“Without providing identifying patient information, we seek the time/date of admission of patients seeking treatment for gunshot wounds through [defendant] between Jan. 1, 2015 through the present day who were not been [sic] accompanied by a law enforcement officer at the time of their admission as well as the corresponding time/date that law enforcement officials were notified of the patients’ admission as required by state statue [sic] (20 ILCS 2630/3.2).”

¶7 On October 26, 2018, Deborah Fortier, defendant’s FOIA officer, answered the request in relevant part as follows:

“According to Trauma administration, there is a trauma registry that logs arrival information of all trauma patients not just walk in gunshot patients, however that log is identifiable private patient health/medical information that is protected from release by medical privacy laws and regulations, including but not limited to HIPAA. Further, there is no independent written record of patient information that simply tracks times/dates of walk in gunshot patients and reporting; so, there is no existing document that is responsive to your request. Respectfully, [defendant] is not required under the FOIA to create a document that is not kept in the regular course of business in order to respond to your request. Further, it would be improper and a violation of state and federal medical privacy laws, including but not limited to HIPAA, for [defendant] to release the specific arrival times and dates and reporting dates of individual walk in gunshot patients, as this could allow for patient identification. This patient information, which is individual protected patient health/medical information, is therefore exempt from public release under Sections 2(c-5) and 7(1)(a) of the FOIA. This would also include where arrival times and dates and date of any reporting would be entered into individual patient medical records; medical records are not public records and are private records per se under Section 2(c-5) of the FOIA. In fact, it would be a violation of medical privacy laws, for [defendant’s] staff to review or even access patient medical information to respond to a FOIA request, as responding to a public records request is not a lawful purpose to access patient medical information.”

¶8 On November 21, 2018, plaintiff filed a complaint alleging defendant improperly withheld the information. Plaintiff sought, inter alia, an order requiring

-3-

defendant to produce the requested records and enjoining defendant from withholding public records that are not exempt under FOIA.

¶9 The parties filed cross-motions for summary judgment on the issue of whether the information concerning the timing of walk-in patient admission and police notification was exempt from disclosure under section 7 of FOIA. Defendant attached to its motion the affidavit of Fortier, who averred that John H. Stroger Jr. Hospital of Cook County (Stroger Hospital) was the only entity that possessed records that were potentially responsive to plaintiff’s request.

¶ 10 Defendant also attached the affidavit of Justin Mis, Stroger Hospital’s trauma coordinator. Mis averred that the electronic trauma registry at Stroger Hospital contains entries for each patient arriving at the hospital. Each entry includes the patient’s name, date and time of arrival, medical record number, and the patient’s chief complaint. Mis conceded that he could generate a report listing only the mechanism of injury, such as gunshot wound, and the patient’s time of arrival in the emergency department. However, the report would not state whether the patient was accompanied by a law enforcement officer or when law enforcement was notified, if at all. To determine which patients were unaccompanied, Mis would need to cross-reference the report with the “patient access log.” The log shows the time and date a law enforcement officer requested access to a patient, but it would not indicate whether the request was prompted by hospital notification. Ultimately, Mis would need to access the medical record of each gunshot wound patient to determine whether he or she arrived at Stroger Hospital with law enforcement or if law enforcement was notified of the admission.

¶ 11 Fortier averred that the trauma registry and the patient access log contained protected health information as defined by HIPAA. Fortier claimed defendant could not remove enough identifying information from the trauma registry and the patient access log to fulfill the FOIA request and still comply with HIPAA. Further, Fortier averred that the responsive records constituted medical records that are protected from disclosure under Illinois law.

¶ 12 Plaintiff argued in its summary judgment motion that FOIA permitted disclosure of the requested information in a de-identified report. Specifically, plaintiff argued HIPAA permits the disclosure of the year of treatment and year of

-4-

law enforcement notification. Plaintiff conceded that HIPAA bars disclosure of other elements of a date field, such as time of day, day of month, or month.

¶ 13 On November 15, 2019, the circuit court entered summary judgment for defendant. The court stated that, because the year identifier was part of a medical record, it was exempt from disclosure under section 7(1)(b) of FOIA. The court explained that, without case law expressly permitting the redaction of medical records for FOIA purposes, the responsive information was not improperly withheld.

¶ 14 The appellate court reversed the summary judgment and remanded for further proceedings. 2021 IL App (1st) 192551, ¶ 29. The court determined that plaintiff had not forfeited review by revising its request at the summary judgment stage. Id. ¶ 15. Plaintiff initially requested “time/date” information, but plaintiff’s summary judgment motion conceded that just the year element was releasable. The court observed that “narrowing of the request reflects an implicit concession by [plaintiff] that it was not entitled to the more specific date and time information.” Id.

¶ 15 The appellate court held section 7(1)(a) of FOIA did not exempt the year of patient admission and police notification in gunshot-wound cases because the year element, alone, does not convey identifying information. Id. ¶ 19 (citing 45 C.F.R. § 164.514(b)(2)(i)(A)-(C), (G), (H) (2018)). The court held that removing individual identifiers would de-identify the information in compliance with HIPAA. Id.

¶ 16 Considering the sheer number of gunshot-wound patients treated at Stroger Hospital during the relevant time period, the court also rejected defendant’s claim that it had “ ‘actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.’ ” Id. ¶ 20 (quoting 45 C.F.R. § 164.514(b)(2)(ii) (2018)).

¶ 17 The appellate court separately held that the year information was not exempt under section 7(1)(b) of FOIA, which prohibits the disclosure of “private information,” including “medical records.” Id. ¶ 25 (citing 5 ILCS 140/2(c-5) (West 2018)). Noting that FOIA does not define “medical records,” the court declined to adopt the definition set forth in the Illinois Administrative Code, instead relying on the plain and ordinary meaning of the words. Id. (citing 77 Ill. Adm. Code

-5-

250.1510(b)(2)(A) (2019)). The dictionary definition of “medical record” is “ ‘documents that compose a medical patient’s healthcare history.’ ” Id. (quoting Black’s Law Dictionary (11th ed. 2019)). The court concluded that, “[w]hile the year of a patient’s hospital admission may be found in a patient’s medical record, it, standing alone, is not a medical record under this definition.” (Emphasis in original.) Id.

¶ 18 Defendant filed a petition for leave to appeal, which we allowed pursuant to Illinois Supreme Court Rule 315 (eff. Oct. 1, 2020).

¶ 19 II. ANALYSIS

¶ 20 On appeal, defendant renews its arguments that (1) HIPAA prohibits covered entities from using and disclosing their patients’ private health information to comply with a FOIA request and (2) the responsive records, even with the unique identifiers redacted, constitute “medical records” that FOIA categorically exempts from disclosure.

¶ 21 Defendant alternatively argues that complying with the FOIA request would be unduly burdensome. Fortier’s response alluded to the impracticality of processing the records, but the parties did not raise the issue in their cross-motions for summary judgment, and the issue was not addressed by the lower courts.

¶ 22 Plaintiff contends that the appellate court’s judgment should be affirmed because plaintiff seeks only the year element of the date field from the records. 1 For the following reasons, we agree with plaintiff that defendant can de-identify the records and comply with the request without violating HIPAA’s privacy rule or FOIA’s prohibition against disclosing medical records. We do not reach the question of whether the request was unduly burdensome.

1 Although defendant criticizes plaintiff’s FOIA request as “reformulated after the fact and during the pendency of litigation,” the parties have adopted plaintiff’s interpretation of “time/date” to mean “year.” We consider the issues, as presented by the parties, in terms of whether the year element is releasable.

-6-¶ 23 A. Summary Judgment ¶ 24 This appeal arises from the parties’ cross-motions for summary judgment.

“[S]ummary judgment should be granted only where the pleadings, depositions, admissions and affidavits on file, when viewed in the light most favorable to the nonmoving party, show that there is no genuine issue as to any material fact and that the moving party is clearly entitled to judgment as a matter of law.” Pielet v. Pielet, 2012 IL 112064, ¶ 29.

See 735 ILCS 5/2-1005 (West 2018). “When parties file cross-motions for summary judgment, they mutually agree that there are no genuine issues of material fact and that only a question of law is involved.” Jones v. Municipal Employees’ Annuity & Benefit Fund, 2016 IL 119618, ¶ 26. We review summary judgment de novo. Pielet, 2012 IL 112064, ¶ 30. De novo review also applies to our interpretation of FOIA and HIPAA. In re Appointment of Special Prosecutor, 2019 IL 122949, ¶ 22 (issues of statutory construction present questions of law that we review de novo).

¶ 25 B. Statutory Interpretation

¶ 26 The objective of statutory interpretation is to ascertain and give effect to the legislature’s intent, and the most reliable indicator of that intent is the language of the statute, given its plain and ordinary meaning. Id. ¶ 23. The General Assembly has declared FOIA’s underlying public policy to be that “all persons are entitled to full and complete information regarding the affairs of government and the official acts and policies of those who represent them as public officials and public employees consistent with the terms of this Act.” 5 ILCS 140/1 (West 2018). “It is a fundamental obligation of government to operate openly and provide public records as expediently and efficiently as possible in compliance with this Act.” Id.

¶ 27 This clear expression of legislative intent means that public records are presumed to be open and accessible. Special Prosecutor, 2019 IL 122949, ¶ 25. FOIA should be construed liberally to achieve the goal of providing the public with easy access to government information. Id.

-7-

¶ 28 FOIA prescribes rules to ensure governmental compliance, including requiring a prompt response to a request for inspection or a copy of documents: “[e]ach public body shall, promptly, either comply with or deny a request for public records within 5 business days after its receipt of the request, unless the time for response is properly extended.” 5 ILCS 140/3(d) (West 2018). When a person has been denied access to a public record, he “may file suit for injunctive or declaratory relief” and may seek attorney fees and civil penalties from the public body. Id. § 11(a), (i), (j). The circuit court is vested with “jurisdiction to enjoin the public body from withholding public records and to order the production of any public records improperly withheld from the person seeking access.” Id. § 11(d); Special Prosecutor, 2019 IL 122949, ¶ 57.

¶ 29 However, a public body may withhold information that is exempt from disclosure. 5 ILCS 140/7 (West 2018). A public body claiming an exemption bears the burden of proving by clear and convincing evidence that the requested information is exempt. Id. § 1.2. When a request is made to inspect or copy a public record that contains information that is exempt from disclosure under section 7 but also contains information that is not exempt, the public body may elect to redact the information that is exempt. Id. § 7(1). In that case, the public body shall make the remaining information available for inspection and copying. Id.

¶ 30 Defendant asserted two exemptions, claiming (1) HIPAA prohibits the use and disclosure of the information and (2) the information is “private information” under FOIA. Id. § 7(1)(a), (b). Plaintiff responds that defendant can comply with HIPAA and FOIA by redacting the exempt information from the medical records while making the requested information available.

¶ 31 1. Section 7(1)(a)

¶ 32 The first exemption cited by defendant exposes tension between two strong public policies: FOIA’s promotion of the open disclosure of government records and HIPAA’s protection of private health information. Defendant claims that “answering a public records request *** is not a permitted use under HIPAA.” But when statutes potentially conflict, they must be construed in harmony with one another if reasonably possible. Knolls Condominium Ass’n v. Harms, 202 Ill. 2d

-8-

450, 458-59 (2002). The two statutory schemes can be reconciled in this case to facilitate the disclosure of government records while protecting patient privacy.

¶ 33 FOIA exempts “[i]nformation specifically prohibited from disclosure by federal or State law or rules and regulations implementing federal or State law.” 5 ILCS 140/7(1)(a) (West 2018). Defendant asserts that HIPAA, a federal law, specifically prohibits the disclosure of the year of admission of each walk-in gunshot wound patient and the year of each corresponding law enforcement notification.

¶ 34 HIPAA’s privacy rule prohibits the “use or disclosure” of an individual’s personal health information by a covered entity, like defendant, unless the individual has consented in writing or unless the use or disclosure is otherwise specifically permitted or required by the privacy rule. 45 C.F.R. §§ 164.502, 164.506, 164.508, 164.510, 164.512 (2018). HIPAA defines “protected health information,” as all “individually identifiable health information” kept by a covered entity that is transmitted or maintained in any form or medium, including electronic media. Id. § 160.103. “Individually identifiable health information” includes demographic information collected from an individual that

“(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and

(i) That identifies the individual; or

(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.” Id.

¶ 35 The parties correctly agree the responsive records contain protected health information, but defendant argues, “[r]eviewing medical records in response to a FOIA request is not a permitted use of protected health information.” To determine whether a public body can comply with the FOIA request without violating HIPAA, we must consider how the public body would use the protected health information to process the request. Here, Fortier, defendant’s FOIA officer, and Mis, Stroger

-9-

Hospital’s trauma administrator, described defendant’s record keeping. The records containing the requested information could be sorted in two databases: the trauma registry, which records each patient’s arrival at Stroger Hospital, and the patient access log, which shows the time and date a law enforcement officer requested access to a patient. From these databases, defendant could generate a report showing the arrival times of gunshot wound patients and the corresponding times that law enforcement asked to see the patient. But defendant would need to examine the medical record of each patient on the list to ascertain whether law enforcement’s request for access to a patient was prompted by the hospital’s notification.

¶ 36 The data processing described by Fortier and Mis qualifies as “use” of individually identifiable health information under HIPAA. Id. (“Use means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.”). However, HIPAA expressly states that a covered entity may use protected health information to create de-identified information for use by a person other than the covered entity: “[a] covered entity may use protected health information to create information that is not individually identifiable health information or disclose protected health information only to a business associate for such purpose, whether or not the de-identified information is to be used by the covered entity.” Id. § 164.502(d)(1).

¶ 37 Health information, once de-identified, no longer meets the standard of individually identifiable health information subject to HIPAA’s protection. Id. § 164.514(a) (“Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information.”). And HIPAA contains an implementation specification to facilitate de- identification. A covered entity may determine that health information is not individually identifiable health information if (1) the covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information (id. § 164.514(b)(2)(ii)) and (2) the following identifiers are removed:

“(A) Names;

- 10 -

(B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:

(1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and

(2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.

(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;

(D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses; (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers;

- 11 -

(P) Biometric identifiers, including finger and voice prints;

(Q) Full face photographic images and any comparable images; and

(R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section[.]” (Emphasis added.) Id. § 164.514(b)(2)(i).

¶ 38 Section 164.514(b)(2)(i) specifically excludes the year element from the date identifiers that must be removed for de-identification. Accordingly, plaintiff confined its request to the year elements directly related to the walk-in gunshot wound patients involved. Plaintiff specifically asked defendant to withhold “identifying patient information” and did not seek any other identifiers that could be used to identify an individual.

¶ 39 Moreover, there was no evidence that defendant has “actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.” Id. § 164.514(b)(2)(ii). Defendant estimated that Stroger Hospital treated as many as 2000 gunshot wound victims during the relevant time period, which diminishes the risk of identifying any one individual. The appellate court astutely observed, “[i]t strains credulity to imagine that any specific patient could be identified merely by the year they were admitted and the year law enforcement was notified of their admission.” 2021 IL App (1st) 192551, ¶ 20.

¶ 40 The de-identification process is a permitted use of protected health information under HIPAA (45 C.F.R. § 164.502(d)(1)) (2018)), and the removal of all the enumerated individual identifiers except the year element would meet HIPAA’s de- identification requirements for disclosure (id. § 164.514(b)(2)(i)). Under the circumstances, we hold that defendant’s use of the patients’ protected health information to process plaintiff’s FOIA request would not run afoul of HIPAA’s privacy rule because the year element related to each patient admission and police notification is not individually identifiable health information. That said, we expressly limit our holding to the facts presented, as the exemption could apply to a future request involving fewer patients where the year element of a record could be used for identification. See id. § 164.514(b)(2)(ii).

- 12 -

¶ 41 Defendant contends King v. Cook County Health & Hospital System, 2020 IL App (1st) 190925, compels a different result. In King, the FOIA requester asked for the zip codes used to create a map of the locations of individuals who had previously received mental health services while detained in the Cook County jail. Id. ¶ 1. The public body, which coincidentally happens to be defendant in this case, asserted section 7(1)(a) as an exemption on the ground that disclosure would violate the Mental Health and Developmental Disabilities Confidentiality Act (Confidentiality Act) (740 ILCS 110/1 et seq. (West 2016)), which incorporates HIPAA regulations by reference. King, 2020 IL App (1st) 190925, ¶ 28 (citing 45 C.F.R. § 164.514 (2016) and 740 ILCS 110/2 (West 2016)).

¶ 42 To determine whether the zip codes were confidential information under the Confidentiality Act, the Appellate Court, First District, examined HIPAA and its pertinent regulations. Id. ¶ 27. The court held that the individuals’ zip code information was protected health information but could be released after de- identification. Id. ¶ 28.

¶ 43 Defendant contends that HIPAA permitted the release of the redacted zip codes in King “[b]ecause the information had been collected for an authorized use, and the use was for a legitimate transaction of public business.” Defendant contrasts King with this case, where defendant claims the necessary redactions would be a misuse of protected health information under HIPAA. Defendant is mistaken.

¶ 44 In King, the redacted zip codes were releasable because they had been de- identified according to the implementation specifications set forth in section 164.514(b)(2)(i)(B) of HIPAA (45 C.F.R. § 164.514(b)(2)(i)(B) (2018)). King, 2020 IL App (1st) 190925, ¶ 31 (“HIPAA regulations provide that a covered entity may determine that private health information is not individually identifiable only if the last three digits of a zip code are removed, where the geographic unit formed by combining all the zip codes with the same three initial digits contains more than 20,000 people”). Like the redacted zip codes in King, the year elements in this case are not individually identifiable health information if properly de-identified, regardless of how the public body previously used the information. 45 C.F.R. § 164.502(d)(1) (2018) (“A covered entity may use protected health information to create information that is not individually identifiable health information or disclose protected health information only to a business associate for such purpose,

- 13 -

whether or not the de-identified information is to be used by the covered entity.”). ¶ 45 2. Section 7(1)(b)

¶ 46 Defendant also asserts the responsive records are exempt because they contain “[p]rivate information,” where disclosure is not required by another provision of FOIA, a state or federal law, or a court order. 5 ILCS 140/7(1)(b) (West 2018).

“ ‘Private information’ means unique identifiers, including a person’s social security number, driver’s license number, employee identification number, biometric identifiers, personal financial information, passwords or other access codes, medical records, home or personal telephone numbers, and personal email addresses. Private information also includes home address and personal license plates, except as otherwise provided by law or when compiled without possibility of attribution to any person.” (Emphasis added.) Id. § 2(c-5).

¶ 47 Defendant argues, without citation of authority, “the entirety of a ‘medical record’—not merely certain discrete information found in such a record—is exempt from disclosure.” We disagree. The year element is not “private information” under FOIA and so is not exempt under section 7(1)(b).

¶ 48 Defendant cites provisions in the Medical Rights Act (410 ILCS 50/3(d) (West 2018)), the Managed Care Reform and Patient Rights Act (215 ILCS 134/5(a)(4) (West 2018)), and the Hospital Licensing Act (210 ILCS 85/6.17(d) (West 2018)) for the proposition that “individuals have a right to an expectation of privacy related to their medical information.” These statutory schemes define “medical records,” but FOIA, which is the operative statute in this case, does not. So, we adopt the approach taken by the appellate court, which is to resort to the plain and ordinary meaning of the term. Special Prosecutor, 2019 IL 122949, ¶ 23.

¶ 49 Defendant concedes that the plain and ordinary meaning of “medical records” is “[t]he documents that compose a medical patient’s healthcare history.” Black’s Law Dictionary 1177 (11th ed. 2019). Although the year element requested by plaintiff is found in medical records, the year element by itself, stripped of context, is not a document of a patient’s healthcare history.

- 14 -

¶ 50 Defendant argues that, even if maintaining patient anonymity permits disclosure of the year element, the process of matching the year of patient admission to the year of police notification would require “some form of personally identifiable information such as the medical record number.” Processing the FOIA request might involve accessing medical records, including their reference numbers, to match the year of patient admission to the year of law enforcement notification. But section 7(1)(b) of FOIA prohibits the disclosure, not the use, of medical records. Theoretically, defendant can use the medical record numbers to match the year elements of patient admission and law enforcement notification and then renumber the matched records before turning them over to plaintiff.

¶ 51 Defendant concludes that the exemption for medical records would be rendered superfluous if a public body could simply redact personally identifying information and release the rest of the record. However, the exemption for private information under section 7(1)(b) plainly covers “unique identifiers,” which confirms that the removal of uniquely identifying information from a patient’s healthcare history renders the remainder of the document releasable. Adopting defendant’s broad interpretation that “medical records” are exempt in their entirety would potentially shield from disclosure all information concerning patient care undertaken by a public body.

¶ 52 3. Unduly Burdensome

¶ 53 Defendant alternatively argues that, even if the year element of the responsive records is not exempt from disclosure, the information was not withheld improperly. Defendant asserts the steps for processing the request, including the de-identification of the records, would be unduly burdensome under section 3(g) of FOIA. 5 ILCS 140/3(g) (West 2018). Defendant adds that plaintiff’s “reformulation” of the request at the summary judgment stage would make compliance even more burdensome.

¶ 54 Section 3(g) provides,

“[r]equests calling for all records falling within a category shall be complied with unless compliance with the request would be unduly burdensome for the

- 15 -

complying public body and there is no way to narrow the request and the burden on the public body outweighs the public interest in the information.” Id.

Plaintiff’s request for information about walk-in gunshot wound patients concerns a distinct category of records, so section 3(g) potentially applies.

¶ 55 Plaintiff responds that defendant has failed to preserve the issue for review. See, e.g., Lazenby v. Mark’s Construction, Inc., 236 Ill. 2d 83, 92 (2010) (the failure to raise an issue in the circuit court or appellate court results in forfeiture). Plaintiff claims defendant was required to invoke section 3(g) as an affirmative defense and in its motion for summary judgment, or risk forfeiture. Plaintiff does not develop its forfeiture argument besides asserting “this court need not address the merits of [defendant’s] burden claim because it failed to properly raise the issue below.” We decline to advocate for plaintiff on the potentially complex issue of what measures a public body must take to preserve the unduly burdensome defense under FOIA. People ex rel. Illinois Department of Labor v. E.R.H. Enterprises, Inc., 2013 IL 115106, ¶ 56 (“a reviewing court is not simply a depository into which a party may dump the burden of argument and research”).

¶ 56 Setting forfeiture aside, this action’s procedural posture illustrates why weighing the evidence on the burdens associated with processing the request would be premature at this point. Cross-motions for summary judgment, like those filed in this case, ordinarily signify the parties’ mutual agreement that there are no genuine issues of material fact and that only a question of law remains. Jones, 2016 IL 119618, ¶ 26. However, defendant did not invoke section 3(g) in its motion for summary judgment, which was perhaps a tacit acknowledgment that a question of fact exists about whether processing the request would be unduly burdensome. The record contains some evidence, but the lower courts did not reach the issue because the parties have focused on the two exemptions concerning HIPAA and medical records.

¶ 57 Because the litigation did not progress beyond the summary judgment stage, we confine our review to the summary judgment entered for defendant and decline to delve into the factual question of the burdens associated with processing the request. That said, the circuit court is free to address the procedural and substantive issues surrounding the unduly burdensome nature of the request if defendant asserts

- 16 -

section 3(g) on remand. We emphasize that we express no opinion on the matter. ¶ 58 III. CONCLUSION

¶ 59 The parties disputed in their cross-motions for summary judgment whether two exemptions authorized defendant to withhold the year of admission for walk-in gunshot wound patients and the corresponding year of police notification from January 1, 2015, through September 10, 2018. Defendant claims (1) the information is prohibited from disclosure under HIPAA and (2) the information is “private information” under FOIA. 5 ILCS 140/7(1)(a), (b) (West 2018). We hold that the HIPAA regulations and FOIA exemptions cited by defendant do not bar the release of the year elements of the responsive records as long as the remaining individual identifying information is removed to maintain patient confidentiality. We affirm the appellate court judgment, reverse the circuit court judgment, and remand the cause to the circuit court for further proceedings consistent with this opinion.

¶ 60 Appellate court judgment affirmed. ¶ 61 Circuit court judgment reversed. ¶ 62 Cause remanded. ¶ 63 CHIEF JUSTICE THEIS, dissenting:

¶ 64 Contrary to how the majority frames it, the issue in this case is not whether the year that each walk-in gunshot wound patient was admitted to the hospital and the year that law enforcement was notified of the admission are exempt from disclosure under the Freedom of Information Act (FOIA) (5 ILCS 140/1 et seq. (West 2018)). Rather, the issue is whether FOIA requires a public body to review its records to piece together information to create a new document in response to a FOIA request. FOIA imposes no such requirements on the public body. Therefore, I respectfully dissent.

- 17 -

¶ 65 The majority correctly observes that FOIA’s underlying public policy is that “all persons are entitled to full and complete information regarding the affairs of government and the official acts and policies of those who represent them as public officials and public employees consistent with the terms of this Act.” 5 ILCS 140/1 (West 2018). At the same time, FOIA is not intended to “disrupt the duly- undertaken work of any public body independent of the fulfillment of any of the fore-mentioned rights of the people to access to information.” Id. Further, FOIA

“is not intended to create an obligation on the part of any public body to maintain or prepare any public record which was not maintained or prepared by such public body at the time when this Act becomes effective, except as otherwise required by applicable local, State or federal law.” Id.

¶ 66 As an initial matter, I question whether the request at issue sought public records that were subject to production under FOIA. As courts have ruled, a “request to inspect or copy must reasonably identify a public record and not general data, information, or statistics.” Chicago Tribune Co. v. Department of Financial & Professional Regulation, 2014 IL App (4th) 130427, ¶ 33; see also Kenyon v. Garrels, 184 Ill. App. 3d 28, 32 (1989) (observing that FOIA “does not compel the agency to provide answers to questions posed by the inquirer”). Here, as modified on appeal, plaintiff’s FOIA request sought the year of

“admission of patients seeking treatment for gunshot wounds through [defendant] between Jan. 1, 2015, through the present day who were not *** accompanied by a law enforcement officer at the time of their admission as well as the corresponding [year] that law enforcement officials were notified of the patients’ admission as required by state statue [sic].”

This appears to be a request for general information, rather than a request for public records under FOIA. 2

2 By contrast, plaintiff’s other request (which is not at issue in this appeal) asked the hospital for “[w]ritten policy and/or related policy documents, and/or internal memos or communications setting policy or providing guidelines, instructions and/or directives to staff in the reporting of patients who have suffered gunshot wounds to law enforcement agencies as required by state statute.” The hospital provided plaintiff with those policies.

- 18 -

¶ 67 Setting that question aside, the majority notes that the Cook County Health and Hospitals System is required to notify local law enforcement when a person who is not accompanied by a law enforcement officer arrives for treatment for a gunshot wound. 20 ILCS 2630/3.2 (West 2018). The hospital is not, however, required to keep a written log of when it notifies law enforcement. See id. In response to plaintiff’s FOIA request and again in its summary judgment filings, the hospital explained that there is no written record that tracks the year a gunshot wound patient arrived at the hospital unaccompanied by law enforcement and the year that law enforcement was notified. In other words, there is no public record that contains the information that plaintiff seeks.

¶ 68 Neither plaintiff nor the majority appear to dispute that the hospital does not possess the information that plaintiff has requested. See In re Wade, 969 F.2d 241, 246 (7th Cir. 1992) (“Without evidence of bad faith, the veracity of the government’s submissions regarding reasons for withholding the documents should not be questioned.”). Nonetheless, the majority would require the hospital to comb through the medical records of each gunshot wound patient to see whether the hospital’s staff included a notation about whether the patient arrived with law enforcement or if law enforcement was notified of the admission. According to the majority, the hospital can then “use the medical record numbers to match the year elements of patient admission and law enforcement notification and then renumber the matched records before turning them over to plaintiff.” Supra ¶ 50. This presumably would require the hospital to create a chart that includes a reference number for the patient and the years of patient admission and law enforcement notification.

¶ 69 The majority would impose these requirements even though FOIA “is not designed to compel the compilation of data the governmental body does not ordinarily keep.” Kenyon, 184 Ill. App. 3d at 32. FOIA also does not require a public body to generate new records in response to FOIA requests. Martinez v. Cook County State’s Attorney’s Office, 2018 IL App (1st) 163153, ¶ 30; see also Hites v. Waubonsee Community College, 2016 IL App (2d) 150836, ¶ 74 (distinguishing between performing a search for data on a database that contains public records, which is permissible under FOIA, and creating a new record or performing research, which is not). And to the extent that the majority would require the hospital to produce redacted medical records (see supra ¶ 51), it is not

- 19 -

clear to me that a gunshot wound patient’s medical records pertain to the transaction of public business. See 5 ILCS 140/2(c) (West 2018) (defining “public records,” in part, as all “documentary materials pertaining to the transaction of public business, *** having been prepared by or for, or having been or being used by, received by, in the possession of, or under the control of any public body”).

¶ 70 FOIA does not require a public body to compile information that it does not otherwise keep, nor does it require a public body to create a new record in response to a FOIA request. Accordingly, I would affirm the trial court’s grant of summary judgment in the hospital’s favor. For these reasons, I respectfully dissent.

- 20 -