2025 IL App (1st) 240485 Fourth Division Filed December 18, 2025 No. 1-24-0485
IN THE APPELLATE COURT OF ILLINOIS FIRST DISTRICT
) MARVA BURNETTE, ) Plaintiff-Appellee, ) ) Appeal from the v. Circuit Court of Cook County. ) RUSSELL P. NOCKELS, M.D.; IGNACIO ) No. 23 L 000973 JUSUE-TORRES, M.D.; and LOYOLA ) UNIVERSITY MEDICAL CENTER, ) The Honorable Scott D. McKenna, Defendants ) Judge, presiding. ) (Loyola University Medical Center, Defendant- ) Appellant). )
JUSTICE OCASIO delivered the judgment of the court, with opinion. Presiding Justice Navarro and Justice Lyle concurred in the judgment and opinion.
OPINION
¶1 In this interlocutory appeal, we must decide whether the trial court properly exercised its
discretion when it allowed the plaintiff’s request for a live inspection at which her technical
consultant would oversee an unfiltered extraction of audit-trail data from the defendant hospital’s
electronic medical record system. We hold that the trial court correctly based its decision on the
discovery rules, not federal regulations, and that it otherwise exercised its discretion reasonably.
¶2 I. BACKGROUND
¶3 According to the complaint and its attachments, in May 2021, the plaintiff, Marva Burnette,
went to defendant Loyola University Medical Center (Loyola) for a lumbar spinal decompression No. 1-24-0485
and fusion. Instead, doctors performed the decompression and fusion procedure on vertebrae in
her upper back. In 2023, she sued Loyola and two physicians for malpractice.
¶4 In discovery, Burnette asked Loyola to produce her medical records and their associated audit
trails. Loyola produced the medical records. It also produced an audit trail for the period between
March 25, 2021, the day Burnette presented at Loyola with the complaints that led to the surgery,
and January 4, 2022, the day she notified Loyola that she was transferring her care to another
hospital. The data was produced both as five printable PDF files and five Microsoft Excel
spreadsheet files.
¶5 Burnette then moved to compel Loyola to produce a complete, unfiltered audit trail and to
permit an “inspection” that would amount to Burnette’s technical expert overseeing and directing
the retrieval of the audit-trail data from Loyola’s computer systems. She argued that the production
was incomplete because it did not contain any audit data showing changes that may have been
made to her medical record before March 25, 2021, or after January 4, 2022. She also contended
that the audit trails appeared to have not included several data fields that they should have and that,
because the audit trail was split across five files, there were four gaps in time between the last entry
in a spreadsheet and the first entry in the next one. Burnette asserted that she had a right to a
complete, unfiltered audit trail for her medical records under both Illinois statutory law and federal
regulations promulgated under the Health Insurance Portability and Accountability Act of 1996
(HIPAA) (Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of Titles
18, 26, 29, and 42 of the United States Code)).
¶6 The motion to compel was supported by two affidavits sworn to by Lee Neubecker, who
identified himself as a “computer forensics, data analytics, cyber security and technology
consultant” who had significant experience reviewing and analyzing electronic medical records
and audit trails. According to Neubecker, there were several problems with the audit trail produced
by Loyola. First, he noted that Loyola’s production had split the audit trail across five different
spreadsheets, which was unnecessary from a technical perspective but created a risk that some data
had been omitted by mistake. Second, he explained that a complete audit trail that went all the way
-2- No. 1-24-0485
to the date of production was necessary to identify whether any records had been modified before
being produced. Third, he opined that Loyola had filtered the audit trail data before producing it.
He noted that the spreadsheets did not include at least four “standard fields.” He also stated that
the entries in the “Event Type” field “appear[ed] to be limited to a handful” of the event types that
“commonly” appeared in Epic-generated audit trails, suggesting that the production was not
complete. To ensure that Loyola produced a complete, unfiltered audit trail, Neubecker
recommended that the court consider ordering a “supervised inspection” where Loyola personnel
would extract the audit data from its live system while he monitored and directed the process as
necessary. He opined that the supervised inspection would require no more than three hours,
excluding any follow-ups needed for specific documents, and that it was the most efficient way to
ensure that Burnette would receive a complete and accurate audit trail.
¶7 Loyola’s response contended that Burnette had a right to her medical records under applicable
law but not a right to be furnished copies of the audit trails for those records. Nevertheless, it
asserted that it had, in fact, produced a “complete” audit trail. Although conceding that the data it
produced covered a limited time period, it argued that Burnette had not shown that data generated
outside that period would be relevant and that, in any event, producing that data would be
disproportionately burdensome relative to its possible utility. Loyola disputed Burnette’s claim that
there were any gaps in the audit trail. It observed that three of the four “gaps” were only a matter
of minutes long and that the fourth “gap” was a 19-hour period in between two outpatient
appointments, reflecting nothing more than the fact that nobody accessed her record during those
time periods. Loyola also argued that its production of the audit trail split across five files, rather
than one file, was necessitated by the sheer volume of data involved. Emphasizing that each of the
five spreadsheets contained “approximately 1 megabyte of data,” Loyola contended that Burnette
could not “credibly argue that Defendant is required to maintain a system that can allow for the
-3- No. 1-24-0485
transfer of 6 megabytes of data in a single file.” 1 Loyola characterized Neubecker’s opinion that it
had produced a filtered version of the audit trail as being “simply untrue,” arguing that Neubecker’s
assertions that the production did not include certain fields or event types he would typically see
were unsupported and conclusory. Alternatively, Loyola argued that the proposed inspection
protocol, which called for Neubecker to supervise remotely, would violate HIPAA because Zoom
did not satisfy the security requirements for transmitting protected health information, and it asked
the court to be given a chance to depose Neubecker before being required to submit to an
inspection.
¶8 The court granted Burnette’s motion to compel, explaining as follows:
“Plaintiff is entitled to inspect the audit trail. We have been through
this on numerous other cases. They have an affidavit from someone
saying that it’s not being fully produced. I don’t see a competing
affidavit from the defense end saying, You know what? My IT guy—or
here’s the IT guy who says this information either is not locatable or
downloadable, or something of that nature. And there’s argument being
made, but I don’t see anything of evidentiary value[ ] indicating that the
information could not potentially be there in the system.
***
*** [T]he bottom line is according to the law, the CFR, everything—
I mean, this is the plaintiff’s records. And until the legislature takes this
up—and I would encourage you to talk to the [Illinois Trial Lawyers
Association] to have them do that—there needs to be set guidelines for
what needs to be stored, produced, and all that, but we don’t have that.
1 For context, the common law record in this appeal contains approximately 61 megabytes of data. A typical CD-ROM has a capacity of at least 650 megabytes.
-4- No. 1-24-0485
So the plaintiff is entitled to look at what is potentially in that
[EMR], so that will be the order today.”
After counsel for Loyola protested that an inspection under Neubecker’s proposed protocol would
violate HIPAA, the court agreed that Loyola was “entitled to a protocol.” It indicated that, if the
parties were unable to work one out by agreement, the court would set the terms of the inspection.
¶9 In a motion to reconsider, Loyola argued that the court had erred by finding that federal law
required it to disclose the audit trails to Burnette. It also contended that Neubecker’s
“unsubstantiated” affidavit did not make a prima facie case for an inspection. In denying the
motion, the court clarified that, in its understanding, Burnette had a right to access her full records,
but the manner of that access was left to the court’s discretion:
“[Y]ou’re asserting that I wrongfully relied on some mandatory federal
regulations that require an inspection. I don’t know—I don’t think I
framed it that it was—that federal law necessarily requires an audit trail
production to be in any certain [form] or any certain way.
But, I believe that what the federal regulations do require is that the
patient has access to its own—their own record. And how that’s done is
completely within the Court’s discretion.
I will submit to you that, you know, perhaps there’s not a federal—and
there’s—I don’t think the CFR lays out exactly how—how audit trails
are supposed to be developed. ***
*** [B]ut in the absence of that, it’s certainly within my discretion
to say that I have reason to believe or I—there’s at least a reasonable
potentiality here that the plaintiff has not been provided all of *** her
records. And at a minimum, I believe that an inspection is appropriate
to make that determination because they’re the ones—it’s their record,
it’s their case.
-5- No. 1-24-0485
They’re the ones that underwent the medical care. They should have
a right to confirm or deny that they have all the records. *** I’ll concede
that, I mean, there’s not any one factor that makes anything mandatory.
But I believe—so I don’t think I misapplied the law in that sense. If I
said that, I may have been [in] error.
But, that doesn’t affect the overall tenor of this, which is that if
there’s reason to believe that not everything has been produced in a
patient’s chart, or there’s reason to believe that they should at—or—or
at least at a minimum, they have a right to confirm that everything has
been produced that’s in their chart. To that extent, the motion to
reconsider will be denied.”
At that point, counsel for Loyola clarified that, as far as he understood it, the dispute was over the
audit trails, not the medical records. Burnette’s attorney responded that ascertaining whether the
entire medical record had, in fact, been produced was “the entire reason for the audit trail,” and
the court agreed:
“Yeah. I think—I think a plaintiff has—there’s a reason and there’s a
good reason why they should know whether the entirety of their char[t]
has been produced. And simply relying on defense representations, I
mean, that’s all well and good, but, I mean, if all we’re doing here is
confirming that—that the entirety has been produced, then the—the
inspection should confirm that on your side.”
¶ 10 At Loyola’s request, the court set a compliance date to allow it to decide whether to comply
or to seek to be held in friendly contempt. Loyola chose the latter course, and the court duly entered
a finding of civil contempt and imposed a sanction of $50, facilitating this appeal. See Ill. S. Ct.
R. 304(b)(5) (eff. Mar. 8, 2016).
-6- No. 1-24-0485
¶ 11 II. ANALYSIS
¶ 12 On appeal, Loyola challenges the trial court’s order compelling an inspection. Although that
order was nonfinal, and therefore not itself appealable, we have jurisdiction to review it because
Loyola’s noncompliance with the inspection order was the basis for the trial court’s later contempt
order. Norskog v. Pfiel, 197 Ill. 2d 60, 69 (2001). We generally review discovery orders for an
abuse of discretion (id. at 70), but the appropriate standard of review ultimately depends on the
nature of the specific question the trial court answered. People v. Cole, 2017 IL 120997, ¶ 19.
¶ 13 Loyola’s primary argument on appeal is that the trial court erred as a matter of law by finding
that Burnette was entitled to disclosure of the audit trail for her medical records under federal
health-information regulations. The parties both argue that, in granting Burnette’s motion to
compel, the trial court found that federal law required Loyola to produce the audit trial upon
demand. They dispute whether that proposition was legally sound: Loyola contends that federal
law grants patients only the right to access their medical records, not the associated audit trails,
while Burnette argues that her right of access includes both her records and the audit trails. See 45
C.F.R. § 164.524(a) (2014) (establishing right of access); 45 C.F.R. § 164.502(a)(2)(i) (2013)
(mandating disclosure upon request). If the court’s inspection order was premised on a
misunderstanding of law, as Loyola contends, then appellate review is necessary to ensure that its
exercise of discretion was not “frustrated by an erroneous rule of law.” People v. Williams, 188 Ill.
2d 365, 369 (1999). Because the question is one of law, our review is de novo. Id.
¶ 14 The parties’ framing of the issue assumes that the discoverability of the audit trails turned on
whether that data was encompassed within the HIPAA right of access. We do not agree.
¶ 15 Discovery is governed by the Illinois Supreme Court rules, not by federal regulations. See Ill.
S. Ct. R. 201(a) (eff. Mar. 17, 2023) (“Information is obtainable as provided in these rules ***.”).
Generally, the rules require “full disclosure regarding any matter relevant to the subject matter
involved in the pending action.” Ill. S. Ct. R. 201(b)(1) (eff. Mar. 17, 2023). This is a very broad
criterion that reaches not only material that would be relevant at trial but also material that can
lead to admissible evidence. Findlay v. Chicago Title Insurance Co., 2022 IL App (1st) 210889,
-7- No. 1-24-0485
¶ 115; accord Krupp v. Chicago Transit Authority, 8 Ill. 2d 37, 41 (1956). This “general duty to
disclose” (Dameron v. Mercy Hospital & Medical Center, 2020 IL 125219, ¶ 18) is then tempered
by other rules, such as provisions exempting privileged materials and giving the court discretion
to regulate discovery to prevent requests that are abusive, unreasonably burdensome, and so forth.
See Ill. S. Ct. R. 201(b)(2), (c) (eff. Mar. 17, 2023). The purpose of these rules is to ferret out the
truth, help attorneys prepare for trial, and eliminate surprise, thereby “promot[ing] an expeditious
and final determination of controversies in accordance with the substantive rights of the parties.”
D.C. v. S.A., 178 Ill. 2d 551, 561 (1997).
¶ 16 The HIPAA right of access serves purposes having nothing to do with resolving litigation. Its
goal is to make sure that patients have “easy access to their health information,” which “empowers
them to be more in control of decisions regarding their health and well-being.” U.S. Dep’t of Health
& Hum. Serv., Individuals’ Right Under HIPAA to Access Their Health Information 45 C.F.R.
§ 164.524, https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html (last
visited Dec. 5, 2025) [https://perma.cc/RRM9-QDK6]. The relevant regulation anticipates that
patients will obtain their health information directly from their providers, who will put in place
procedures to receive and act on access requests, communicate with requesters, internally review
certain kinds of denials, and ultimately decide how to facilitate access. See 45 C.F.R. § 164.524
(2014). The regulation does not anticipate that the right of access will be enforced through court-
mediated discovery procedures. To the contrary, the regulations treat discovery as a distinct process
that takes place outside of the right-to-access framework by exempting discovery responses from
the general rule of nondisclosure. See 45 C.F.R. § 164.512(e)(1) (2016); see Northwestern
Memorial Hospital v. Ashcroft, 362 F.3d 923, 925-26 (7th Cir. 2004) (explaining that
section 164.512(e) creates “a procedure for obtaining authority” to use protected health records
during litigation).
¶ 17 In short, the discovery rules are “procedural tools to effectuate the prompt and just disposition
of litigation, by educating the parties in advance of trial as to the real value of their claims and
defenses.” People ex rel. Terry v. Fisher, 12 Ill. 2d 231, 236 (1957). The HIPAA right of access is
-8- No. 1-24-0485
not animated by the same goals. Whether the right of access encompasses a particular data set has
no bearing on whether it is within the general scope of discovery. See Ill. S. Ct. R. 201(b)(1) (eff.
Mar. 17, 2023). At most, the existence of a right of access might inform the court’s assessment of
the burden a particular discovery request would impose on a party. Otherwise, the right of access
generally has no impact on discovery, and discovery disputes involving medical records and audit
data should be resolved by reference to the ordinary rules governing pretrial discovery, not the
HIPAA right of access.
¶ 18 From our review of the record, it appears that the trial court’s ruling on the motion to compel
was consistent with this analysis. Although the court referred to the HIPAA right of access at
points, it did so only in the context of Burnette’s right to access her medical records—something
neither party disputes are subject to disclosure—not the associated audit trails. At no point did it
find that the HIPAA right of access encompassed a right to access audit trails. Instead, the court
emphasized that the audit trails were subject to discovery because Burnette had shown an adequate
basis for believing that Loyola might not have disclosed the entirety of the underlying medical
records. In other words, it reasonably determined that the audit trails were a “matter relevant to the
subject matter involved in the pending action.” Id. Accordingly, the trial court’s exercise of
discretion was not frustrated by an erroneous rule of law.
¶ 19 Loyola also advances several other arguments that the trial court erred in granting the motion
to compel. We have reviewed those arguments, and we find no abuses of discretion. First, the trial
court reasonably relied on the unrebutted affidavits of Burnette’s technical consultant to find that
there was a genuine concern that Loyola had not produced an unfiltered audit trail and that an
inspection might reveal previously undisclosed records or audit data. Second, because the medical
records produced in discovery could have been accessed or modified at any point before the date
of the production, to the extent the trial court found that audit data generated after January 4, 2022,
was relevant and discoverable, it acted reasonably and did not abuse its discretion. Third, based on
the limited information before it, which indicated that an inspection would take no more than three
hours and require only one Loyola employee with sufficient knowledge of and access to the
-9- No. 1-24-0485
appropriate systems, the trial court reasonably determined that the burden of an inspection would
not outweigh its potential utility. Finally, as the trial court has not yet set a protocol for the
inspection, Loyola’s argument that the inspection would carry unacceptable security risks and
violate HIPAA is premature.
¶ 20 In summary, the trial court correctly resolved the motion to compel, based on the applicable
discovery rules. It neither premised its ruling on the HIPAA right of access, nor otherwise erred
when it granted the motion to compel. We therefore affirm the order allowing the motion to compel.
Consistent with our usual practice, we also vacate the order finding Loyola in friendly contempt.
See John Doe Corp. 1 v. Huizenga Managers Fund, LLC, 2021 IL App (2d) 200513, ¶ 94.
¶ 21 III. CONCLUSION
¶ 22 For the foregoing reasons, we affirm the trial court’s order granting the motion to compel and
vacate the order finding Loyola in friendly contempt.
¶ 23 Affirmed in part and vacated in part.
- 10 - No. 1-24-0485
Burnette v. Nockels, 2025 IL App (1st) 240485
Decision Under Review: Appeal from the Circuit Court of Cook County, No. 23-L- 000973; the Hon. Scott D. McKenna, Judge, presiding.
Attorneys Jennifer M. Suttle, Jason Gluskin, and Joseph E. Comer, of for Barker, Castro & Steinback, LLC, of Chicago, for appellant. Appellant:
Attorneys Leslie J. Rosen, of Leslie J. Rosen Attorney at Law, P.C., and for Jason Williams, of Smith Lacien, LLP, both of Chicago, and Appellee: Robert J. Rooth, of The Rooth Law Firm, of Evanston, for appellee.
- 11 -