A recent decision by the Circuit Court of Cook County -- Marc Shull v. Eric Ellis -- has terminated the entry of “routine” HIPAA protective orders for purposes of litigation and the release of medical records. Prior to this decision, Cook County Circuit Court judges routinely entered HIPAA protective orders authorizing the release of protected health information (PHI) without the express authorization of the patient or patient’s representative. However, the court’s decision in Shull attempts to balance a person’s constitutional right to personal privacy, which the Illinois Supreme Court has extended to personal medical information, with the disclosure of PHI for litigation purposes.
Importantly, this decision comes after the court recognized that even plaintiffs filing personal injury actions have an expectation of privacy when it comes to their PHI -- regardless of the fact that they are putting their health at issue -- and the use of “routine” HIPAA protective orders infringed on a plaintiff’s right to privacy, guaranteed by the Illinois Constitution, by failing to inform a plaintiff that the disclosure of their PHI could be used outside the scope of litigation, by disclosing the information to an insurer, which has broad discretion in utilizing said information. Of particular note, this decision only applies to the disclosure of PHI after the filing of a lawsuit, and not at the pre-litigation stage.
Under the new procedure, a plaintiff now must personally sign the court’s HIPAA protective order and expressly waive his/her constitutional right to privacy. Moreover, counsel for the plaintiff must also sign the HIPAA protective order and both signatures must be obtained prior to the entry of the order.
At this point, you might be wondering how this impacts you. Ultimately, the implications of this decision may mean a delay in obtaining a HIPAA protective order, which may delay the beginning phases of a case, including obtaining medical records via subpoena, completing written discovery, and deposing a plaintiff and/or plaintiff’s medical witnesses. What was once a simple entry of a standard order now requires the signature of a plaintiff and his counsel, and has the potential to delay a case at a minimum of weeks, if not months. Furthermore, this decision should likely end situations where a hospital or medical provider requests a specific authorization from a plaintiff in addition to a subpoena, as a plaintiff will have already signed off on the express release of his/her PHI. While this particular point has yet to be addressed in a Cook County Court, it is unlikely that judges will look favorably upon a provider’s request for an authorization after a plaintiff has already authorized the release of his/her PHI through the explicit waiver of their right to privacy.
Furthermore, and more importantly, this decision does not prohibit a health care practitioner from releasing a patient’s records to the medical entity’s personal counsel for the purposes of defending the health care practitioner. Regardless, a Cook County case where the plaintiff’s PHI is at issue will not move forward until a plaintiff signs on the dotted line.