Oral argument — Surlock v. Starcevic

Please be seated Mr. Reese's Good morning Counsel, may it please the court. My name is Mike Reese's and I'm here today on behalf of Intervenor Appellant State Farm State Farm is heavily regulated as a liability insurer under Illinois law, which is carefully crafted requirements for retaining, disclosing, and destroying medical information in claim files State Farm and other liability insurers. Is there a specific statute that requires State Farm to retain quote-unquote medical records? You have actually a couple of statutes, your honor. One statute is actually in the administrative code, and it is 901.5 which talks about retaining records for the current year and a minimum retention period of not less than five years. I think that regulation may have been amended to be not less than seven years But does it say specifically medical records? No, it says And what do you know, do you know what percentage of claim files actually have PIPA protected medical records in the files as opposed to just the hospital bill or totals? The record would not answer that question, your honor. What we did provide in the way of evidence is three affidavits, four affidavits actually, affidavits from a former insurance regulator, and two affidavits from insurance industry experts, and typically what's going to happen is because State Farm is a liability insurer, it's going to need to get the medical information from the plaintiff either before suit with a valid authorization or after suit through a court order. But that's the point. Yes, I'm trying to understand because you know in terms of this reverse preemption argument that's really not fully developed in the briefs, but most cases are resolved without litigation, even personal injury cases, and those cases will not have quote-unquote medical records in them. They'll have totals, correct? No, they may, we may need to have the actual records to be able to evaluate the claims before suit and for that reason the but you do raise a good point, the insurance code and the regulations don't distinguish between records that are received before suit and records that are received after suit. But the effect of this order would mean that as you pointed out, in cases where you have or claims without a lawsuit, we would, State Farm would be able to keep the medical records, there would be no return of destroyed provisions, and those records would be available either for inspection or audit to evaluate a number of different purposes or to share information with the Department of Insurance or with support organizations. It's only in the subset of claims that actually result in litigation and litigation in this county, Lake County, where the appeal originates from, where we would have these return or destroyed provisions. Justice, let me ask you this question. Yes. I take it it's your basic position, State Farm is not a covered entity under HIPAA, correct? Correct, and that's also Congress's position. But tell us how that status as a non-covered entity would exempt State Farm from complying with the protective order, cover the HIPAA matters of interest. Well, first, so first of all, the protective order is based upon the court's finding of federal preemption. If you eliminate the federal preemption finding by the two Lake County judges, then you're forced to say whether or not that protective order is proper under Supreme Court Rule 201C. And our position is that that order, both orders, are not proper under Rule 201C, that the Lake County judges actually misapplied Rule 201C by creating an unnecessary conflict with Illinois state law. If Illinois state law allows State Farm to retain those records in claim files for a minimal retention period, that's not less than, you know, the current year plus five years, that's a conflict with those provisions of the protective order that have the return or destroy provisions that say we have to return or destroy those records within 60 days of the end of litigation. All right, but without those two provisions, then the requirements of HIPAA are not met. All right, I'm sorry, but HIPAA only applies, okay, so HIPAA applies. Go ahead. Okay, so HIPAA applies to covered entities and HIPAA creates a procedure for the release of the protected information to non-covered entities. But at that point, HIPAA does not apply to the operations of liability insurers, which are expressly exempt from HIPAA under the statute. So you're saying because they don't fall within the definitions? They don't fall within the definitions of covered entities, and they have obtained the information through a HIPAA procedure. Once they receive the information properly through, say, a court order, not a qualified protective order, but just through a court order, once they have obtained that information, HIPAA does not apply to the redisclosure of that information as required or permitted. Wouldn't that totally undermine, if that was true, wouldn't it totally undermine and erode the protections that HIPAA was designed to cover? Absolutely not. Why? So HIPAA has protections in place when the information is with covered entities. Yes. HIPAA has information, has procedures in place that regulate how the information is going to be transmitted to others for use in litigation. And it sets forth a number of procedures, not just qualified protective orders. It says any court order that is expressly limited to the information is authorized to be released. That's as far as HIPAA goes. So what would prevent the insurance companies then from just releasing this medical information to anybody they'd ask for? Well, to begin with, you've got certain state privacy protections that are built into the administrative code and the insurance code. And the statute says very clearly that the information is privileged from, this is under Illinois state law now, is privileged from disclosure except in certain instances. Some of those instances are, one, detect and prevent insurance related fraud or criminal activity. That's built into the statute. If State Farm were to just go out and, you know, publish somebody's private protected medical information in a way that violates a court order that limits the release of that information, okay, as authorized, State Farm would be open to a lawsuit, I suspect. And we would not be claiming that HIPAA would somehow protect us in that situation. Now, a minute, a couple minutes ago, you said, well, let's put preemption aside. Yes. But if there were a conflict, if we believe there is a conflict between HIPAA and the state insurance law, do you agree that the federal HIPAA law would preempt any state obligations? I'm sorry, I would have to know where's the conflict. If the, I'd have to know where the conflict is because if HIPAA creates a floor concerning a covered entity. Can't go below the floor, and Illinois hasn't asked for a waiver to go below the floor, right? But because HIPAA does not apply to State Farm or other liability insurers, once they receive their records in an authorized way under HIPAA, HIPAA stops. And you know what the proof of that is? Look at what the authorization is before suit. Before suit, the authorization says that the plaintiff has to be notified that the information has the, quote, potential, close quote, to be re-disclosed by the recipient and no longer subject to HIPAA. Well, if it can be re-disclosed, and you have to put the plaintiff on notice of that before suit, well, why would HIPAA apply to the re-disclosure under a court order that has actually authorized the release of the information in the lawsuit? And what I would direct the court's attention to is a case like Tom's Act versus Ingalls Memorial. That's a case that applied the provision of 164.512, referring to a court order. Not a qualified protective order, just a court order that authorized the release of information. What about the Illinois Constitution, the right of privacy, and the, applying the rationale in Cohen versus Ayabi, the white Supreme Court? The argument you've made is that the Illinois Constitution's right of privacy will protect from further disclosure, right, Mr. Reeses? The right of, well, we've had a few cases on the right of privacy under the state constitution, and they recognize that the right of privacy is not absolute. It only protects against what is an unreasonable invasion. And in Cohen, the Hawaii Supreme Court, Hawaii has a constitution similar to ours, like 10 other states, that have a right of privacy. And the court said the very purpose of disclosing Cohen's medical health information in discovery is to resolve the underlying dispute. To allow this information to be used outside the litigation, regardless of whether or not it's identified or not, would reach beyond what Hawaii's constitution permits in the absence of a showing of compelling state interest. What's the compelling state interest here? Well, the compelling state interest deals with the regulation of insurance companies, and how insurance companies, and Judge Ehrlich made that finding in the Cook County order. But even more to the point than Hawaii, if you look at the Supreme Court cases of, look, In re Laquisha, and the, But that's a state interest. Berger case. Preserving DNA. That's right. And what the court said was. Here you're talking about a private industry. The insurance business, while highly regulated, is still a private business. It is, and it has a public, and there's a public interest in seeing it's regulated. But going back to, look at a case like Berger. The point is that once the plaintiff files suit and puts his or her physical condition into issue, it's discovery rules and not HIPAA that govern the disclosure of that information. And because the use of that information does not violate privacy rights, our retention of that information after litigation is not, under Laquisha, a separate invasion of the right of privacy. And as a matter of fact, to go back to Judge Ehrlich's decision, he noted that you can strike the balance, even, you know, looking at the HIPAA, I'm sorry, at the Hawaii case law, by giving the plaintiff, you know, getting an explicit waiver of that right of privacy from the plaintiff. Mr. Regis, let me ask you this. One of the points you argued was that Illinois law requires an insurance company to retain the health information for various purposes. Yes. Otherwise, it could potentially be subject to disciplinary actions, correct? Yes. Are you, can you call our attention to any disciplinary cases pending against any insurance company in the state as a result of this? No, Your Honor. When we provided the affidavits, we wanted to give the court the statutory and the regulatory framework, and we wanted to give you, for lack of a better description, the big picture of what goes on under the insurance code as opposed to just citing a specific case. Now, I think what you might also be referring to is the plaintiff had gotten some FOIA responses that specifically asked whether the regulator was collecting medical information or protected health information per se, and the response was, well, they don't specifically collect that information, right? They don't. But the response went on to say that, and it doesn't deny that they look at information in claim files, and those claim files may, in fact, contain medical information, which is protected from disclosure under the Freedom of Information Act and the insurance code. So, you know, we really could not pull a claim file and say, well, look at, you know, look at, look at the information that the regulator or the auditor had a look at because that way we're protected from disclosure. We couldn't do that. Now, there's currently a matter pending to amend Supreme Court Rule 218. Is that correct? Yes. A total to amend. Yes. What's the status of that? Your Honor, I know that there was testimony in a public hearing last June, and no further action has been taken at that time. And I would imagine that there is a great need for uniformity in this area, and I'm confident that the Rules Committee and the Supreme Court ultimately will need to look at this issue and provide for an order that does allow for the same rules in all 104 counties in the state of Illinois. I think that's my cue. If you could, one second. Yes. I just had one question. In your briefs, you argue fraud must be reported. Yes. Well, can't fraud be reported? Usually fraud, if there's fraud, is going to be discovered during the course of litigation, correct? It can be a pattern or a practice that goes across state lines that may take some time. And after claims have been resolved or lawsuits have been settled and dismissed. Exactly. But ordinarily, the suspicion of a fraud usually occurs during the course of litigation. The lawyers who are reviewing the medical records, correct? Am I correct? That's been my experience. Yes. I mean, as a former state's attorney, I'm sure you're right. You're going to learn about the fraud, or at least your suspicions. It's like a doctor who's doing, you know, he's billing for, you know, foot surgery when all he's doing is having his clients put their feet in a pool. Right, it won't be the first case though, it might be the 15th case. Exactly. But that can be documented without the actual medical records because it's discovered during the course of litigation. And so why would you need the medical records to report or investigate possible fraud? I don't know how you go back in time. Grand juries. But how do you go back in time? Grand juries. You report it. Okay, and, but you're going to have, you're already going to have, well, but if you don't have the information, if you don't have the medical records, because they were returned or destroyed in the first case that was settled, and now two years later, you are in case number 15. It's the same doctor, it's the same procedure, you know, I'm not, I'm sorry, we've got affidavits that aren't rebutted that say that you, that State Farm and other liable insurers need to have that information available. It can't simply lose that information in 60 days of the end of the lawsuit. Thank you, Mr. Priest. You'll have time for a book. Thank you. Thank you. Mr. Fink. Good morning, Your Honors. Robert Fink on behalf of the plaintiffs in this matter. First, I think it should be noted that there is an important issue here, and that is that State Farm asked for a qualified protective order. They did not ask for an order pursuant to E-1, to Section 512E-1. Well, that qualified protective order had certain exceptions with regard to the retention of records, and did not have certainly the second provision that they had to be returned at the end of litigation, right? The Cook County order is different. I completely agree. But nonetheless, they were, it may have been an incorrect qualified protective order, but they were asking for a qualified protective order that falls under E-2. It does not fall under E-1. And when it falls under E-2, and State Farm concedes this point in their brief, if it is a qualified protective order, it must, absolutely must, pursuant to HIPAA, include subsections A and B with the use and destruction or return provisions. And the court, the trial courts in this matter, didn't have a request from any party to proceed under E-1, which even had they had a request under E-1, there raises a very serious question as to what is the court going to do with that? But the cases that State Farm and the appellant, intervening appellant, cite to, such as Tomzak and the other cases, those are all cases in which the party being ordered are defendants. They are parties. That is, the court does not have to enter a qualified protective order. They already have jurisdiction over the individual or the entity where they can say, in the case of Tomzak, Ingalls Hospital, turn these records over pursuant to this court order. That's a proper use of E-1. How is a court, the trial court in this matter, for example, or in these matters, supposed to say to the plaintiff's hospital or treating physicians, without any jurisdiction, without any due process to the covered entity, turn over these medical records just pursuant to a court order? They can't. There's no jurisdiction over that entity. That is a necessary part. That is why a QPO is necessary. That's why, if you can't proceed under E-1, State Farm's entire argument here has a fundamental, has that fundamental flaw of the court couldn't have avoided E-2. It didn't have an option to. It has to be through a qualified protective order or other means. Yes, there could be authorizations, et cetera. There's certainly those options. So, can you point out to us specifically, in the limited time, what are the flaws of State Farm's argument? Sure. First and foremost, they asked for a qualified protective order. Second, E-1 is a flawed argument for two reasons. First is, as I stated, there's no jurisdiction over those covered entities. Also, the authorization, the Cook County, really it's the Cook County order, but the order that was submitted has another flaw in that they're, as State Farm recognized and, in fact, counsel just mentioned, requires express authorization for records. That is not done at all in the proposed record. If you look at the kind of records that are expressly authorized, if you look at those cases, expressly authorized is records such as, you know, from date such and such relating to, you know, very specific records. It is not, as State Farm has argued, that it is very broad. In fact, if you look at the order that State Farm proposed, there's no restriction at all. It says, you shall turn over protected health information without restriction, without time, without scope, all protected health information. The only restrictions are those that are specifically statutorily protected, such as mental health, HIV, AIDS, genetic testing, et cetera. So, are you specifically suggesting that the order that he proposed, the Cook County order, could undermine the protections of HIPAA? Without question. And that is why? Well, HIPAA is designed to protect the privacy rights of the individual. The order that they are submitting is going to undermine that, not only the HIPAA protections, but those guaranteed by the Illinois Constitution to the right to privacy, and that those records could become, are going to go past this litigation. They can be used for State Farm's business operations. My clients, who are not, have nothing to do with State Farm, other than they had the misfortune of being in an automobile accident with a State Farm insurer, their personal health information, their most sensitive personal information, is now going to be in the hands of a private company to be able to be used for their business purposes, and that puts, that is a violation of their right to their privacy. Under HIPAA? Under HIPAA and the Illinois Constitution. But don't they have obligations under the insurance code here in Illinois? I mean... They being State Farm? Yes. So, A, we do disagree with that. As noted, personal health information, medical records, none of that is ever expressly stated in any code, in any statute in the state of Illinois. Isn't the language broad enough to infer that that could be what was meant as well? I don't think that it is, because if you look at 901.5 of the administrative code, these are the records that are specifically enumerated, that the state of Illinois says they want them to keep. Those are, I'm sorry, it's 919.30. Claim data, they say we have to keep our claims file. Well, their claims file is really defined by 919.30B, and that is that they have to maintain their claim data, and they have to provide the claim number, the line coverage, date of loss, date of payment of the claim, date of denial, or date claim closed without payment. Well, that's a good point, but there are different types of claims, right? I mean, there's all different types of claims, and with respect to a claim for personal injury, it's common sense that that claim data would include some medical records, at least with regard to costs, right, medical costs. And that doesn't mean that they need to maintain that. Do they have, could they utilize it, pursue it to a qualified protective order so that they can properly adjust the claim? I think that that, yes. But the argument is that, under the McCarran-Ferguson Act, that HIPAA is not specifically an insurance statute, correct? HIPAA is not. No, I'm, I'm. So, so their argument is that it impairs the insurance industry's ability to detect and report fraud that they're required to do under state statutes. And I understand. So there's two things that I would say is, one, the department specifically indicates that they, the department, does not require or need protective health information. So they're not required to keep that information. Second, relative to, if there is, and let's just say that, that Illinois, you know, for purposes of argument here, that the state of Illinois does have a regulation which requires companies such as State Farm to maintain this information. Well, at that point, if they want to, if they, if state says that this is a compelling interest for fraud or any other reason, there's a process for that. If they want to fall below the floor that HIPAA sets for privacy, for privacy rights, then there is a process for that. They have to submit a, they have to seek an exemption from the department. It has not been done. State Farm has not claimed that it has been done. There is no, and the record is, the evidence is, is that there has not been, by the state of Illinois, a request for an exemption, which is what would be the necessary step in order to avoid that breach. They'd have to submit that to the Secretary of State. That is correct. Well, through the chief executive or his, his designate. You're saying there's a mechanism for them to be able to do what they say, but they have to take these additional steps. That's correct. If the state of Illinois, in fact, says, yes, we need this information for a particular purpose, and this particular purpose falls below the floor set by HIPAA, then yes, if that's the state of Illinois's position, then the state of Illinois has to follow this process. And that process is set out, you know, in 204A, 160.204A, and it's addressed, I believe, on page 10 of our response. So it's incumbent upon them to take that additional step. You're saying they shouldn't just be able to say, hey, we have a potential conflict here, we want to keep these records and use them the way we want to use them. The state, the state of Illinois, yes, that is correct. The other thing that, you know, that I would like to, to point out is the, not only is there no rule or regulation, but the, that the rules that they, that they cite to, they, yes, they are fairly vague. But when looking at these statutes, it's not proper to read in something like personal health information into that statute. The, and there's a difference, again, between what is permitted and what is required. They're permitted to put their, to keep these records in their claims files, but they are not required to maintain them. And there is nothing that would prevent the entry of the QPO, and certainly 201C does not, does not prevent that. I, I do disagree with counsel's interpretation of 201C on that front as well. What about, with respect to the right of privacy argument, what about Berger v. Lutheran General Hospital, where the court said the collection of personal health information in connection with actual or threatened malpractice, for non-litigation purposes, did not violate the state's constitutional right of privacy? And let me flip to that, but I believe the, sure, this was where, this was internal to the hospital, and they said that there, that it's not discovery subject to the Supreme Court rules. This, so this was under the, allowable under the license, hospital licensing act, where the information was being shared internally in terms of potential future litigation as well as pursuant to the licensing act. So I think that's a little bit of a, a very, a little, very different situation than what we face in these cases. Thank you very much. Thank you. Mr. Bates is rebuttal. Okay, let's talk about preemption first. We've had a number of court orders from around the country that support the retained use and possible disclosure of that information after the litigation ends. What the Lake County judges did in this case was they found that HIPAA preempted and imposed these return or destroy provisions. There is simply no other case that counsel has cited or that we're aware of that has ever extended HIPAA that far, not one case. Counsel faults the Cook County order. Well, granted, we're not in Cook County, but that order was the product of a good deal of work and collaboration between the plaintiff's bar and the defense bar over more than a year. And Judge Ehrlich's decision actually went through a number of different reconsiderations to get to the final point. I'm surprised that counsel says that we didn't tender a proper court order. The order that we tendered, which was the Cook County order, is completely proper as a court order that authorizes the release of that information and it does not conflict with state law. But that order is not really with the weight of authority now here in Illinois. I mean, the 16th Circuit and the 10th Circuit rejected it also. I'm aware that at the trial court level, there's a 16th Circuit decision out of Kane County that has not been appealed. By the way, we were not the insurance company involved in that case, so we weren't in a position to appeal. And as far as the Tassville County case is concerned, that's up on appeal. My reply brief is due sometime in the middle of February. So this is something that's going to be revisited, this issue. And we appreciate that this court is the first court in Illinois that's going to weigh in on this issue. Well, should we hold off issuing a decision until the Supreme Court and the Rules Committee finishes its business with respect to it? To be fair, Your Honor, I don't know if or when that is going to happen. And that's why we've taken the normal process of obtaining appellate review of an order that actually found federal preemption of state insurance law and regulations. At the risk of stating the obvious, federal preemption is disfavored. There is a presumption against preemption. You can't find preemption unless the intent of Congress to preempt is clear and manifest. If Congress wanted State Farm and other liability insurers to be covered entities, they could have done so, but they did not. One last thing. To start then maybe where Justice Burkett began with asking me a question about, you know, what does state law require about records? Okay, so we go back to 919.30, and it states, The detailed documentation shall be maintained in each claim file in order to permit reconstruction of activities, companies' activities relative to each claim file. And then the retention period for all open and closed files will be the current year and two preceding years. Well, that obviously conflicts with the return of destroyed provision within 60 days. How do you reconstruct the company's activities relative to each claim file if you have to destroy all of the medical bills and the medical records that the insurance company used to evaluate and settle the claim or pay the claim? It's just not possible. Well, you would have a copy of the court order requiring the return or destruction in the claims file. Yes. So that would be the reconstruction, that these medical records were available only for purposes of litigation, and that would then be reflected in the file, correct? If that's what would happen. If we were to agree with the plaintiff's position. Yes, if you were to agree with the plaintiff. Then that would be the end of it then. Well, but then that would prevent, you know, other purposes and uses for the information, including I go back to the insurance-related fraud. I go back to the fact that there are a number of different uses and purposes. For all the reasons set forth in the briefs, we ask you to vacate the Lake County orders and to either enter the order that we tendered or enter an order that allows for the use, retention, and disclosure of information in conformity with Illinois insurance law and regulations. Thank you very much. Mr. Fink, how would you respond to my inquiries whether or not this court should hold our disposition pending the Supreme Court's decision on the new rule? I'm very thankful that you asked me that question. My understanding, and I did testify at that hearing, is that that rule is currently in its debt. The Supreme Court has since issued amendments to the rules since that hearing, and those rules that were presented, discussed, and argued and presented for public hearing have since either been accepted and adopted by the Supreme Court or not. Whether or not the Supreme Court chooses to ever take action on this is certainly still an open question, but I can say that it is certainly my belief, and I think that the evidence shows, that the request to modify the rules to include the Cook County order as a model rule, a pursuant to rule, is that. Did not pass. Did not pass. For whatever reason, we don't know. Correct. There has been no public comment that I am aware of. So your position is we should not hold off, is that correct? That is absolutely correct, yes. And I think that's your position, Mr. Reese. I don't believe that you should hold off, so we're in agreement on that. But I am not prepared to say that it is a debt issue with the Supreme Court Rules Committee or with the Supreme Court. There just isn't one record, one or the other. Counsel may be right that there were a number of proposed rule changes to other rules than Rule 218, and there's been official action taken on them. But you can't say from any action that there will never be action. Nor should we draw an inference that the Supreme Court was not in favor of this. Right. Either way. Either way. All right. Thank you. The Court thanks both parties for their excellent arguments today. The case will be taken under advisement. A written decision will be issued to the courts.