Cook County Uses HIPAA To Further Limit Discovery And Use Of Litigants’ Medical Records

by Kathleen M. Klein

On November 5, 2021, Cook County courts amended the standard HIPAA order used in cases throughout its divisions. The order is known as the HIPAA Qualified Protective Order (“QPO”), and it governs litigants’ ability to get an injured plaintiff’s medical records from treating physicians. Counsel for plaintiffs and defendants have long disagreed on the proper scope of the QPO, with plaintiffs arguing to limit record disclosure, and defendants arguing to allow wider discovery. The amendment to the QPO was inspired by the Illinois Supreme Court’s decision in Haage v. Zavala, in which the Illinois Supreme Court ruled that a proper QPO must require records to be destroyed or returned at the close of a case.

The Cook County amendments to the QPO, however, arguably went beyond the scope of the Haage holding. The new QPO, as it exists now, includes a bar on “any and all” records subpoenas, substantively limiting requests to a 5-year period prior to the incident, and to the ‘part of the body’ at issue. The QPO imposes other requirements on defendants that will increase the logistical burden and cost of records subpoenas, including requiring the requestor to provide copies to all other parties within 7 days of receipt. It is unclear whether the requesting defendant will bear the entire cost of obtaining records alone, or whether cost-sharing with other parties—who now get their records from the requesting defendant—will be permitted. 

The order requires return or destruction of all records within 60 days of the close of the case. This prohibits parties, counsel, and the parties’ insurers from using PHI for any purpose other than the litigation in which the order was entered. This poses a significant challenge for insurers who routinely include Protected Health Information, records, or bills in their permanent files or statistical reporting. The insurer in Haage raised similar issues, which the Court found unconvincing, noting in particular that an insurer could place in its file a copy of the QPO requiring record destruction, to justify the absence of medical records or bills from its file. The order further requires, at the close of the case, that affidavits be provided certifying that all records were returned or destroyed within 60 days. Thus, counsel will be required to attest to destruction of records by its insurer and all its retained experts.

There are a wide variety of potential implications of the QPO that have yet to be explored. For example, are treating physician deponents permitted to answer questions at deposition about treatment provided more than five years prior to the care at issue? Does the court have the ability or authority to waive or expand the time frame? Are there “good cause” exceptions for inability to certify destruction, for example, a physician who ceases to practice and can no longer be located? What are the implications for technology within attorney or insurer offices, including systemwide backups of files containing medical records?  There has been significant pushback on the order from portions of the legal community, and we expect the court to amend the new HIPAA order in the coming months. It is unlikely the court will completely drop the time frame limitation or the destruction requirement, but it is yet to be determined what alterations may mean for parties’ ability to obtain records about a plaintiff and their medical conditions. In the meantime, we expect motion practice and disagreements between plaintiff and defense attorneys as these new requirements are put into practice. Counsel should abide by the notice deadlines in the new order, evaluate individual case facts for any necessary case-by-case requests for enlargement of the scope of subpoenas, and preserve objections to these limitations for further review by the courts. As each case presents unique challenges, so too the application of the new QPO will vary from case to case, and the courts will have to address these issues on the fly.