Chicago Sun-Times v. Cook County Health & Hospital System

Digitally signed by Reporter of Decisions Reason: I attest to Illinois Official Reports the accuracy and integrity of this document Appellate Court Date: 2022.01.19 13:16:40 -06'00'

Chicago Sun-Times v. Cook County Health & Hospital System, 2021 IL App (1st) 192551

Appellate Court CHICAGO SUN-TIMES, Plaintiff-Appellant, v. COOK COUNTY Caption HEALTH AND HOSPITAL SYSTEM, Defendant-Appellee.

District & No. First District, Fifth Division No. 1-19-2551

Filed June 30, 2021

Decision Under Appeal from the Circuit Court of Cook County, No. 18-CH-14507; the Review Hon. Eve M. Reilly, Judge, presiding.

Judgment Reversed and remanded.

Counsel on Joshua Burday, Matthew Topic, and Merrick Wayne, of Loevy & Appeal Loevy, of Chicago, for appellant.

Kimberly M. Foxx, State’s Attorney, of Chicago (Cathy McNeil Stein, Martha Victoria Jimenez, and James Beligratis, Assistant State’s Attorneys, of counsel), for appellee.

Panel JUSTICE CUNNINGHAM delivered the judgment of the court, with opinion. Presiding Justice Delort and Justice Hoffman concurred in the judgment and opinion.

OPINION

¶1 Plaintiff-appellant, the Chicago Sun-Times (Sun-Times), filed suit against defendant- appellee Cook County Health and Hospital System (CCHHS) in the circuit court of Cook County, alleging that CCHHS failed to produce records in response to the Sun-Times’ request for documents pursuant to the Freedom of Information Act (FOIA) (5 ILCS 140/1 et seq. (West 2018)). The trial court granted CCHHS’s motion for summary judgment, finding that the records sought were private information under FOIA and therefore barred from production. The court then denied the Sun-Times’ partial motion for summary judgment. The Sun-Times appeals that ruling. For the following reasons, we reverse the judgment of the circuit court of Cook County and remand the case for further proceedings.

¶2 BACKGROUND ¶3 On September 10, 2018, the Sun-Times requested two categories of information from CCHHS, as set forth below: “1. Written policy and/or related policy documents, and/or internal memos or communications setting policy or providing guidelines, instructions and/or directives to staff in the reporting of patients who have suffered gunshot wounds to law enforcement agencies as required by state statue [sic] (20 ILCS 2630/3.2). 2. Without providing identifying patient information, we seek the time/date of admission of patients seeking treatment for gunshot wounds through CCHHS between Jan. 1, 2015 through the present day who were not been [sic] accompanied by a law enforcement officer at the time of their admission as well as the corresponding time/date that law enforcement officials were notified of the patients’ admission as required by state statue [sic] (20 ILCS 2630/3.2).” ¶4 CCHHS provided the policies requested in part 1 of the Sun-Times’ request, but as to part 2, CCHHS stated that it was exempt from providing the requested time/date information pursuant to sections 7(1)(a) and 7(1)(b) of FOIA. Section 7(1)(a) exempts from disclosure records that federal or state law prohibit from disclosure, and section 7(1)(b) exempts “[p]rivate information” from disclosure. Id. § 7(1)(a), (b). ¶5 On November 21, 2018, the Sun-Times filed a complaint in the circuit court of Cook County, alleging that CCHHS wrongfully withheld the information requested in part 2 of its September 10, 2018, FOIA request. The Sun-Times sought, inter alia, an order requiring CCHHS to produce the requested records and enjoining CCHHS from withholding nonexempt public records under FOIA. ¶6 The parties filed cross-motions for summary judgment. In support of CCHHS’s motion for summary judgment, it attached affidavits of Deborah Fortier, the FOIA officer for CCHHS, and Justin Mis, the trauma coordinator at John H. Stroger Jr. Hospital of Cook County (Stroger Hospital). Ms. Fortier averred that Stroger Hospital was the only CCHHS entity that had records potentially responsive to the Sun-Times’ request. Mr. Mis, in turn, averred that the electronic trauma registry at Stroger Hospital contains entries for each individual patient arriving at the hospital and includes information such as the patient’s name, date and time of arrival, medical records number, and the patient’s chief complaint. Mr. Mis stated that he could “run” a report listing only the mechanism of injury (i.e., gunshot wound) and the time of arrival

-2-

in the emergency department. However, that report would not include whether the patient was accompanied by a law enforcement officer or when law enforcement was notified, if at all. Instead, Mr. Mis would have to cross-reference the information in that report with a log kept by trauma department clerks that indicates the time and date law enforcement officers request access to a patient. Significantly, the log does not indicate whether law enforcement access was prompted by notification to law enforcement by Stroger Hospital. In order to determine if a gunshot victim arrived with a law enforcement officer or if a law enforcement officer was notified of a gunshot victim’s admission, the specific patient’s medical record would have to be accessed. ¶7 Ms. Fortier averred that the trauma registry entries Mr. Mis referred to as well as the log of when law enforcement officers requested access to a patient contained protected health information as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (see 45 C.F.R. pts. 160, 162, 164) and could not be “de-identified” 1 sufficiently to allow compliance with HIPAA. Further, Ms. Fortier averred that the records that the Sun- Times sought were medical records and protected from disclosure under Illinois law. ¶8 Based on Ms. Fortier and Mr. Mis’s affidavits, CCHHS argued in its motion for summary judgment that it was exempt from disclosing the records requested by the Sun-Times. ¶9 The Sun-Times’ motion for summary judgment argued that HIPAA permits the disclosure of the year of treatment and year of notification to law enforcement and that, therefore, CCHHS could provide the requested information in a de-identified report. The Sun-Times did not argue that the specific time or date of admission or notification to law enforcement was disclosable under FOIA. ¶ 10 On November 15, 2019, the trial court granted CCHHS’s motion for summary judgment. Specifically, the trial court stated that, because the “year” identifier the Sun-Times was seeking was part of a medical record, it was exempt from disclosure under section 7(1)(b) of FOIA. The court further explained that, in the absence of case law affirmatively stating that medical records could be redacted, it could not find in favor of the Sun-Times. The Sun-Times appealed.

¶ 11 ANALYSIS ¶ 12 We note that we have jurisdiction to review this matter, as the Sun-Times filed a timely notice of appeal following the entry of summary judgment. Ill. S. Ct. R. 301 (eff. Feb. 1, 1994); R. 303 (eff. July 1, 2017). ¶ 13 Summary judgment is appropriate only when “ ‘the pleadings, depositions, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law.’ ” 1010 Lake Shore Ass’n v. Deutsche Bank National Trust Co., 2015 IL 118372, ¶ 20 (quoting 735 ILCS 5/2- 1005(c) (West 2008)). All supporting materials are strictly construed against the movant and in favor of the opposing party. Mashal v. City of Chicago, 2012 IL 112341, ¶ 49. Where parties file cross-motions for summary judgment, as here, they agree that there are no issues of material fact and invite the court to decide the case based on the record. Dome Tax Services

1 De-identification requires removing any identifying information from the relevant record.

-3-

Co. v. Weber, 2019 IL App (3d) 170767, ¶ 8. We review de novo an order granting summary judgment. Nationwide Financial, LP v. Pobuda, 2014 IL 116717, ¶ 24. ¶ 14 In this case, the trial court granted summary judgment in favor of CCHHS after finding that it was exempt from disclosing the year of admission of patients with gunshot wounds unaccompanied by a law enforcement officer and the year, if any, that law enforcement was notified of the admission. ¶ 15 Initially, CCHHS argues that the Sun-Times forfeited review of this issue because, in its original FOIA request and its complaint, it sought the “time/date” that patients with gunshot wounds were admitted to CCHHS and the “time/date” that law enforcement was notified, yet in its motion for summary judgment, it sought only the year of admission and notification. It is sufficient to note that the year is unquestionably part of the “time/date” and that the narrowing of the request reflects an implicit concession by the Sun-Times that it was not entitled to the more specific date and time information. So while we recognize a narrowing of its request, we do not find that the Sun-Times forfeited this issue. ¶ 16 Turning to the merits, it is helpful to begin with a general understanding of FOIA. FOIA was implemented with an eye toward opening governmental records “ ‘to the light of public scrutiny.’ ” Stern v. Wheaton-Warrenville Community Unit School District 200, 233 Ill. 2d 396, 405 (2009) (quoting Bowie v. Evanston Community Consolidated School District No. 65, 128 Ill. 2d 373, 378 (1989)). Of course, FOIA is not intended to violate individual privacy. 5 ILCS 140/1 (West 2018). But to the extent that FOIA contains restraints on the “full and complete” disclosure of governmental records, those restraints should be seen as “limited exceptions to the principle that the people of this State have a right to full disclosure of information relating to the decisions, policies, procedures, rules, standards, and other aspects of government activity that affect the conduct of government and the lives of any or all of the people.” Id. In other words, FOIA should be liberally construed to allow the public ready access to government information, and exemptions to disclosure should be narrowly interpreted so as not to defeat FOIA’s overarching purpose. Hites v. Waubonsee Community College, 2016 IL App (2d) 150836, ¶ 53. ¶ 17 In this case, CCHHS relies on two exemptions in support of its denial of the Sun-Times’ FOIA request: section 7(1)(a), which makes exempt from disclosure “[i]nformation specifically prohibited from disclosure by federal or State law or rules and regulations implementing federal or State law,” and section 7(1)(b), which makes exempt “[p]rivate information.” 5 ILCS 140/7(1)(a), (b) (West 2018). The public body that claims an exemption from disclosure bears the burden of proving by clear and convincing evidence that the requested information is exempt. Id. § 1.2. ¶ 18 Beginning with section 7(1)(a), CCHHS argues that regulations implementing HIPAA (Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended in various sections of Titles 18, 26, 29, and 42 of the United States Code)), prohibit disclosure of the requested records. Indeed, HIPAA limits the use and disclosure of “protected health information,” which is defined as “individually identifiable health information.” 45 C.F.R. § 160.103 (2013). “Health information,” in turn, is defined as information that is created by a health care provider relating to the past, present, or future physical health or condition of an individual. Id. But health information that does not identify an individual “and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual” is not individually identifiable health information. Id. § 164.514(a).

-4-

¶ 19 CCHHS maintains that the year of treatment for a gunshot wound and the year that law enforcement were notified of that treatment are individually identifiable health information that cannot be disclosed to respond to a FOIA request. We disagree. HIPAA states that health information can be de-identified (and disclosed) if “identifiers of the individual” are removed. Examples of identifiers are names, geographic subdivisions smaller than a state, telephone numbers, Social Security numbers, medical records numbers, and “[a]ll elements of dates (except year) directly related to an individual, including birth date, admission date, discharge date, [and] date of death.” (Emphasis added.) Id. § 164.514(b)(2)(i)(A)-(C), (G), (H). Here, the Sun-Times seeks only the year of admission for patients with gunshot wounds, without any identifiers. Further, the year of notification to law enforcement does not convey any identifying information. ¶ 20 Nevertheless, CCHHS claims that removing individual identifiers is not sufficient to de- identify information if the covered entity has “actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.” Id. § 164.514(b)(2)(ii). Ms. Fortier averred in her affidavit that she was “concerned” that someone with the date and time of admission of a Stroger Hospital patient with a gunshot wound could discover the identity of that patient through media accounts of shootings. But this is far from “actual knowledge” of the ability to identify a patient and amounts to speculation. More significantly, the Sun-Times is seeking only the year of admission of patients with gunshot wounds and the year law enforcement was notified. By CCHHS’s own admission, thousands of patients are admitted to Stroger Hospital with gunshot wounds every year. It strains credulity to imagine that any specific patient could be identified merely by the year they were admitted and the year law enforcement was notified of their admission. ¶ 21 This is true even for the “short” years CCHHS refers to in its brief. The Sun-Times requested data from October 1, 2015 to September 10, 2018. CCHHS points out that only three months of data are requested from 2015 and only eight months of data from 2018. It theorizes that these “short” data years will make it easier to “re-identify” patients. But it is CCHHS’s burden to prove this contention with clear and convincing evidence. CCHHS has not alleged that Stroger Hospital treated so few gunshot victims over the 2015 and 2018 “short years” that they could actually be sufficiently identified solely by the year of their treatment and nothing further. In the absence of such evidence, this argument does not withstand scrutiny. ¶ 22 CCHHS further argues that, even if the requested information could be de-identified, it would still need to parse protected health information in order to ascertain the nature of that information. Specifically, in order to determine whether and when law enforcement was notified of a patient who was admitted with a gunshot wound, Mr. Mis averred that it would be necessary to review the gunshot wound victim’s medical records. CCHHS contends that using medical records for this purpose is a violation of HIPAA in and of itself. Again, we disagree. The regulations explicitly provide that a covered entity may use protected health information “to create information that is not individually identifiable health information or disclose protected health information only to a business associate for such purpose, whether or not the de-identified information is to be used by the covered entity.” Id. § 164.502(d)(1). In other words, HIPAA permits a covered entity to review medical records—protected health information—to “create information” that is not individually identifiable health information. This is exactly what is required in order for CCHHS to comply with the Sun-Times’ request.

-5-

For all of these reasons, we conclude that HIPAA does not bar disclosure of the requested records in the manner suggested by CCHHS. ¶ 23 CCHHS also cites Illinois law as a basis for refusing to disclose the requested records. To be sure, there is a strong public policy in Illinois in favor of protecting the rights of individuals with respect to their medical information. Coy v. Washington County Hospital District, 372 Ill. App. 3d 1077, 1082 (2007). To that end, there are several state laws cited by CCHHS that prohibit or limit the release of medical information. For example, the Code of Civil Procedure provides that communications between a patient and a doctor are privileged. 735 ILCS 5/8- 802 (West 2018). The Hospital Licensing Act states that information regarding hospital patients “must be protected from inappropriate disclosure” and prohibits the hospital’s employees from disclosing the “nature or details of services provided to patients” unless “authorized or required by law.” 210 ILCS 85/6.17(b), (d) (West 2018). Also, the Medical Patient Rights Act states that every patient has a right to privacy and confidentiality in health care. 410 ILCS 50/3(d) (West 2018). ¶ 24 But the logic that led us to conclude that disclosure of the requested information does not violate HIPAA regulations compels us to reach the same conclusion here. Disclosure of the year of admission of a patient with a gunshot wound and the year in which law enforcement was notified of that admission in no way violates a patient’s right to privacy, as that information does not identify a particular patient. Therefore, Illinois law does not prohibit the release of that information. ¶ 25 Next, we consider whether section 7(1)(b), prohibiting the disclosure of “private information,” supports CCHHS’s refusal to turn over the records. The definition of “private information” includes “medical records.” 5 ILCS 140/2(c-5) (West 2018). “Medical records” is not defined in FOIA, but CCHHS urges us to adopt the definition in section 250.1510 of the Illinois Administrative Code. That section addresses hospital licensing requirements and requires hospitals to maintain a minimum level of content for patients’ medical records, including “admission information.” 77 Ill. Adm. Code 250.1510(b)(2)(A) (2019). But when a term is undefined in a statute, we do not turn to an entirely unrelated statute in order to ascertain its meaning. Rather, it is appropriate to consult a dictionary for that purpose. See Lacey v. Village of Palatine, 232 Ill. 2d 349, 363 (2009). And Black’s Law Dictionary defines “medical record[ ]” as “documents that compose a medical patient’s healthcare history.” Black’s Law Dictionary (11th ed. 2019). While the year of a patient’s hospital admission may be found in a patient’s medical record, it, standing alone, is not a medical record under this definition. In other words, the year of admission for a specific injury is not private information where it is entirely divorced from any personally identifying information. 2 ¶ 26 Lastly, CCHHS argues that the requested information will not answer the question of whether it is in compliance with its statutory obligation to notify law enforcement of a gunshot

2 To the extent CCHHS argues that medical records need not be redacted and are “exempt in totality,” it cites no authority for this proposition. And, indeed, section 7 of FOIA states the opposite: “When a request is made to inspect or copy a public record that contains information that is exempt from disclosure under the Section, but also contains information that is not exempt from disclosure, the public body may elect to redact the information that is exempt. The public body shall make the remaining information available for inspection and copying.” (Emphasis added.) 5 ILCS 140/7(1) (West 2018).

-6-

victim seeking treatment. But merely because the redacted information may not tell the whole story, it does not follow that CCHHS may refuse to provide it. See Heinrich v. White, 2012 IL App (2d) 110564, ¶ 19 (rejecting claim that redacted information would not prove useful as basis for noncompliance with FOIA). ¶ 27 In sum, neither section 7(1)(a) nor section 7(1)(b) of FOIA exempts CCHHS from responding to the Sun-Times’ FOIA request. Accordingly, we conclude that the trial court erred in granting summary judgment in favor of CCHHS.

¶ 28 CONCLUSION ¶ 29 For the foregoing reasons, we reverse the judgment of the circuit court of Cook County and remand the case for further proceedings consistent with this opinion.

¶ 30 Reversed and remanded.

-7-