On November 30, 2022, the Illinois Supreme Court issued a ruling on the question of whether the year that a patient is admitted to a hospital is exempt from disclosure under the Freedom of Information Act. In a 6-1 ruling, the Court held that the information is not exempt from disclosure.
The Chicago Sun-Times (“Sun-Times”) was researching whether the Cook County Health and Hospital System (“Cook County”) was meeting a statutory requirement to notify law enforcement for walk-in gunshot wound patients who are treated at hospitals operated by Cook County. As part of the investigation, Sun-Times submitted a Freedom of Information Act (“FOIA”) request to Defendant seeking the time/date of admission of patients seeking treatment for gunshot wounds who were not accompanied by a law enforcement officer at the time of their admission. As part of the request, the Sun-Times was also seeking the time/date that law enforcement officials were notified of the patients’ admission as required by Illinois statute (20 ILCS 2630/3.2).
Cook County denied the FOIA request, asserting that answering the request would amount to a violation of FOIA Sections 7(1)(a) (implicating HIPAA protections) and 7(1)(b) (prohibiting disclosure of private information, i.e., medical records), claiming that the release of admission times would make the patients identifiable. The Sun-Times then filed suit against Cook County to enforce its FOIA request.
The circuit court entered summary judgment in favor of Cook County, holding that the year identifier was part of a medical record, and was exempt from disclosure under FOIA. The Illinois First District Appellate Court reversed the trial court, holding that the year element, alone, does not convey identifying information on the patient. 2021 IL App (1st) 192551. Applying the plain and ordinary meaning of “medical records,” the appellate court found the term to mean “documents that compose a medical patient’s healthcare history.” Id. (quoting Black’s Law Dictionary (11th ed. 2019)). The Illinois First District held that the fact that the year of admission can be found in a patient’s medical record does not, alone, make the year of admission a medical record. Id.
On appeal to the Illinois Supreme Court, Cook County re-asserted its arguments at the appellate level that (1) HIPAA prohibits covered entities from using and disclosing their patients’ private health information to comply with a FOIA request and (2) the responsive records constitute “medical records” that FOIA categorically exempts from disclosure. 2022 IL 127519, ¶20.
The Illinois legislature, in the enactment of FOIA, declared the underlying public policy to be that “all persons are entitled to full and complete information regarding the affairs of government and the official acts and policies of those who represent them as public officials and public employees consistent with the terms of [FOIA].” Id. at ¶26. FOIA should be “construed liberally to achieve the goal of providing the public with easy access to government information.” Id. at ¶27.
The first claimed exemption by Cook County was that HIPAA prohibited the disclosure of the requested information. Cook County argued that answering a public records request is not a permitted use under HIPAA. Id. at ¶32. The Illinois Supreme Court held that the conflict between FOIA and HIPAA can be reconciled in this case to allow for the disclosure of government records while simultaneously protecting patient privacy. Id. HIPAA’s privacy rule prohibits the use or disclosure of an individual’s personal health information by a covered entity unless consented to in writing by the individual. Id. at ¶34. HIPAA further defines “protected health information” as all “individually identifiable health information” kept by a covered entity that is transmitted or maintained in any form or medium. Id. Per the HIPAA statute, “individually identifiable health information” includes information that created by a health care provider and relates to the past, present, or future condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of heath care to an individual. Id. This information also must identify the individual or there must be a reasonable basis to believe the information can be used to identify the individual. Id.
Cook County argued that creating the report amounted to a “use” of protected health information, as they would need to access the patient information to compile the report. Id. at ¶35. However, HIPAA expressly states that a covered entity may use protected health information to create de-identified information for use by a person other than the covered entity. Id. at ¶36. Once de-identified, health information is no longer subject to HIPAA protection. Id. at ¶37. If the information is determined by the covered entity to not be able to be used alone or in combination with other information to identify an individual who is the subject of the information, and specific identifiers are removed, such as names, elements of dates (except year), social security numbers, account numbers, biometric identifiers, then the information is no longer protected health information. Id. HIPAA Section 164.514(b)(2)(i) specifically excludes the year element from the date identifiers that must be removed for de-identification. Id. at ¶38.
The Illinois Supreme Court held that because the Sun-Times specifically asked Cook County to withhold identifying patient information, did not seek any other identifiers, and confined its request to the year elements of the walk-in patients and law enforcement notification, the Sun-Times’s request was not exempted from disclosure under HIPAA and Section 7(1)(a) of FOIA.
Cook County’s second argument for denying the Sun-Times’s FOIA request was based on the idea that the request contained private information, where disclosure is not permitted by Section 7(1)(b) of FOIA. “Private information” is defined by the statute as being unique identifiers and includes “medical records” within the definition. Id. at ¶46. Cook County argued that medical records, in their entirety, qualified as private information, rather than specific information found in a patient’s medical records. Id. at ¶47. As “medical records” is not defined by FOIA, the Illinois Supreme Court adopted the appellate court’s approach in applying the plain and ordinary meaning of the term. Id.
The Illinois Supreme Court held that while the year element requested by the Sun-Times is found in patient medical records, the year element itself is not a document of a patient’s healthcare history to qualify as a medical record. Id. at ¶49. Cook County countered by arguing that the process of matching the year of admission to the year of law enforcement notification would require processing of medical records which include personally identifying language. Id. at ¶50. However, Section 7(1)(b) of FOIA does not prohibit the use of medical records, but the disclosure of them. Id. Cook County, in the Court’s view, was able to use the medical records to comply with the FOIA request without disclosing any identifiable private information in the process. Id. The Illinois Supreme Court further noted that adopting Cook County’s interpretation would shield from disclosure all information concerning patient care undertaken by a public body. The Court then affirmed the ruling of the Illinois First District Appellate Court and remanded the case back to the trial court for further proceedings.
This holding would seem to open the door for more disclosures being required by government-run healthcare facilities or governments which provide medical care to its residents. The onus is on the government to show that personal identifying information would be disclosed if a FOIA request was issued. The Court in this case also, notably, chose not make a ruling on whether the request qualified as unduly burdensome with regard to compiling the reports to answer the FOIA request. Pending an ultimate ruling on that issue, government-run healthcare facilities and government entities may be put in a position which requires them to deploy a large number of hours and resources into fulfilling a FOIA request so long as the request is targeted at information that is not covered as personal identifying information. Following this ruling, it will be harder for a government-run healthcare facility, or government which provides healthcare to its residents, to deny a FOIA request.
For more information, please contact Michael Airdo at mairdo@airdowerwas.com or (312) 506-4480.