finding counsel’s conduct amounted to what is known as a “Petrillo violation” under Illinois law
How later courts described this case
- finding counsel’s conduct amounted to what is known as a “Petrillo violation” under Illinois law
- observing that Illinois law concerning disclosure is generally “far more restrictive” than HIPAA
- observing that Illinois law concerning disclosure is generally “far more restrictive” than HIPPA
Written by the judges who cited it.
The opinion
JUSTICE QUINN, specially concurring:
I completely concur with the majority’s holding and the reasoning behind it. I write separately to note that the protections provided to medical patients in Illinois by Petrillo v. Syntex Laboratories, Inc., 148 Ill. App. 3d 581 (1986), are now provided to medical patients throughout the United States by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) ( 42 U.S.C. § 201 (2000)). Pursuant to this Act, the Department of Health and Human Services (HHS) adopted a “Privacy Rule” which regulates when “Protected Health Information” (PHI) may be disclosed. 45 C.F.R. §§ 160 , 164 (2004).
“Except as otherwise permitted or required, Protected Health Information (PHI) may not be disclosed without a valid authorization, and any use or disclosure must be consistent with the authorization granted. The Privacy Rule applies to both written and oral communications. The HIPAA regulation applicable to judicial proceedings is 45 C.F.R. § 164.512 (e)(1). Subsections 164.512(e)(l)(i) and (e)(l)(ii) define the circumstances in which a healthcare provider may reveal PHI in the course of a judicial proceeding. Nowhere do the regulations permit healthcare providers to discuss PHI with defense attorneys because a lawsuit is pending. Nowhere do any of the HIPAA regulations permit or purport to permit ex parte communications. The regulations are simply silent about the issue.
HIPAA’s regulations for judicial proceedings permit disclosure of PHI only under the following conditions:
‘ (i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or
(ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if:
(A) The covered entity receives satisfactory assurance, as described in paragraph (e)(1) (iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or
(B) The covered entity receives satisfactory assurance, as described in paragraph (e)(l)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (c)(l)(v) of this section.’
These sections may be summarized as allowing disclosure only in response to: (1) a court order expressly authorizing the disclosure of the requested PHI, or (2) a subpoena or discovery request issued pursuant to the Rules of Civil Procedure, if a qualified protective order has been requested or a good-faith effort has been made to give notice to the individual and any objections have been resolved.” D. Wirtes, R. Lamberth & J. Gomez, An Important Consequence of HIPAA: No More Ex Parte Communications Between Defense Attorneys and Plaintiffs Treating Physicians, 27:1 Am. J. Trial Advoc., at 5-6 (2003).
In National Abortion Federation v. Ashcroft, No. 04 C 55 (N.D. Ill. February 6, 2004), the federal district court considered the interplay of HIPAA and Illinois law. The court reviewed Illinois’ Code of Civil Procedure (735 ILCS 5/8 — 802 (West 2002)), the Medical Patients Rights Act (410 ILCS 50/3(a), (d) (West 2002)), and the Hospital Licensing Act (210 ILCS 85/6.17(d) (West 2002)). The district court first held, “Illinois law concerning when nonparty patient medical records may be disclosed by hospitals or doctors is far more restrictive [than HIPAA.]” National Abortion Federation, slip op. at 7. Further:
“Because we find that Illinois law is more stringent than HIPAA’s disclosure requirements and that it would be impossible for Northwestern to comply with both Judge Casey’s HIPAA-pursuant Order and various provisions of Illinois law, Illinois’s nonparty patient privacy laws are not preempted by HIPAA and its subsequent regulations.” National Abortion Federation, slip op. at 9-10.
The parameters of HIPAA will be discussed and resolved by the courts over the years to come, and I certainly do not attempt to do so in this concurrence. However, I do believe that Illinois’ statutes and the holding in Petrillo have provided Illinois practitioners with a strong foundation upon which to build.