IN THE UNITED STATES DISTRICT COURT FOR SOUTHERN DISTRICT OF ILLINOIS
YOLANDA JACKSON, ) ) Plaintiff, ) ) vs. ) ) WEXFORD HEALTH SOURCES, INC., ) EVA LEVEN, ) Case No. 3:20-cv-00900-DWD MOHAMMED SIDDIQUI, ) GAIL WALLS, ) NICKOLAS MITCHELL, ) CHARLIE FRERKING, ) JEREMY FRERICH, and ) ANDREW BENNETT, )
Defendants.
MEMORANDUM AND ORDER DUGAN, District Judge: Before the Court is Plaintiff’s Motion for Entry of a HIPAA-Qualified Protective Order (“Motion”) (Doc. 86) under § 164.512(e) of the Code of Federal Regulations. See 45 C.F.R. § 164.512(e). Defendants contest that Motion in a Joint Response (Doc. 90). The Court, consistent with this Memorandum and Order and the directives outlined below, GRANTS the Motion and ADOPTS the Proposed HIPAA-Qualified Protective Order. Background Decedent, Kevin Curtis, died while incarcerated at Menard Correctional Center. (Doc. 1, ¶ 1). Shortly before his death, Decedent allegedly received inadequate medical care from Defendants after he fell into a catatonic and unresponsive state. (Doc. 1, ¶¶ 26- 30). Plaintiff, as the mother and administrator of Decedent’s estate, filed a 6-count Complaint against Defendants for violations of 42 U.S.C. § 1983. (Doc. 1, generally). Plaintiff alleged, inter alia, Defendants caused Decedent’s injuries and death by engaging
in a widespread practice of providing inadequate medical care. (Doc. 1, ¶¶ 56-61). The Court previously entered a HIPAA-Qualified Protective Order (Doc. 41) for records produced by a covered entity under 45 C.F.R. § 160.103 pursuant to a request to produce or subpoena of protected health information (“PHI”). (Doc. 41, ¶ 2). The HIPAA- Qualified Protective Order extends only to PHI documenting Decedent’s physical and mental condition and receipt of medical care, including information related to sexually
transmitted diseases, from January 1, 2012, to September 5, 2018. (Doc. 41, ¶ 4). That HIPAA-Qualified Protective Order requires a separate protective order and authorization from the Court for disclosures of any other medical records. (Doc. 41, ¶ 5). Now, Plaintiff seeks to modify and extend the previously entered HIPAA- Qualified Protective Order to third party PHI, namely, the PHI of other prisoners in
Defendants’ care. Plaintiff argues a modification and extension is necessary to discover how those prisoners, not just Decedent, were treated by Defendants. Plaintiff reasons, consistent with Monell v. Department of Social Services and Seventh Circuit precedent, she is required to prove separate incidents of Defendants’ widespread practice of providing inadequate medical care. See 46 U.S. 658 (1978). Plaintiff argues Defendants, absent a
modified HIPAA-Qualified Protective Order extending to third parties, have refused to provide such information in discovery. Plaintiff presents a Proposed HIPAA-Qualified Protective Order (“Proposed Order”) in the event that the Court grants the Motion. In their Joint Response, Defendants argue any nonparty PHI disclosed in this case would be protected by the existing HIPAA-Qualified Protective Order (Doc. 41). As such,
Defendants suggest the Motion is actually a motion to compel that improperly seeks a discovery order and avoids addressing their objections to Plaintiff’s requests under Federal Rule of Civil Procedure 34. See Fed. R. Civ. P. 34. Defendants also argue Plaintiff’s Proposed Order is facially vague, overbroad, and confusing, as it does not expressly authorize the scope of disclosures, relating to third parties, that are sought by Plaintiff. Defendants purportedly explained to Plaintiff that they do not intend to produce the PHI
of any individual other than Decedent due to their objections to Plaintiff’s Rule 34 requests, which concern more than mere HIPAA protections. Defendants also submit that the parties have not agreed to the scope of discovery. In a Reply in Support of the Motion (Doc. 93), Plaintiff emphasizes that, contrary to the representations of Defendants, the Motion only seeks to make the disclosure of
third-party PHI lawful. Plaintiff also points out that, despite Defendants’ assertions, the current HIPAA-Qualified Protective Order is expressly limited to the PHI of Decedent, as requested by the parties at the time of its entry, and does not extend to third-party PHI. See (Doc. 29, ¶ 5). Further, Plaintiff clarifies that she is not seeking to compel any documents from Defendants or definitively decide the scope of discovery into third-party
medical records. Plaintiff posits that she is requesting a modified HIPAA-Qualified Protective Order as a necessary condition for the exchange of discovery that includes third-party medical information. In other words, Plaintiff seeks to make such discovery possible by ensuring the PHI of third parties remains confidential, is used only for purposes of the present litigation, and is kept only until the conclusion of this case. Analysis
The Federal Rules of Civil Procedure do not distinguish between public and private information. See Reed v. Wexford Health Sources, Inc., No. 20-1139, 2021 WL 5578076, *2 (S.D. Ill. Oct. 19, 2021) (citing Seattle Times Co. v. Rhinehart, 467 U.S. 20, 35-36 (1984)). Similarly, the Rules do not apply only to the parties in litigation, as third parties may have relevant information subject to discovery. Id. (quoting Rhinehart, 467 U.S. at 35).
This is true in cases presenting Monell claims, where third-party medical information is generally discoverable. See id. District courts “ ‘have routinely recognized that such claims often require a broad and substantial amount of discovery that would not be involved if the plaintiff sued only the individuals directly involved in the deprivation of” rights.’ [Citation omitted].” Id.; accord Arsberry v. Wexford Health Sources, Inc., No. 17-
50044, 2021 WL 5232733, *6 (N.D. Ill. Nov. 10, 2021). This is because a plaintiff must show an official policy, widespread custom or practice, or action by a final policy-maker was the “moving force” behind the constitutional injury. Dixon v. Cty of Cook, 819 F.3d 343, 348 (7th Cir. 2016) (quoting City of Canton v. Harris, 489 U.S. 378, 379 (1989)); accord Dean v. Wexford Health Sources, Inc., 18 F.4th 214, 235 (7th Cir. 2021). Customs and practices
must be so pervasive that acquiescence by final policymakers is apparent and amounted to a policy decision. Dixon, 819 F.3d at 348 (quoting Phelan v. Cook Cty, 463 F.3d 773, 790 (7th Cir. 2006)); accord Hildreth v. Butler, 960 F.3d 420, 426 (7th Cir. 2020). This requires proof that “systemic and gross deficiencies” impacted others and not just the person for whom the claim was brought. See Dixon, 819 F.3d at 343; Reed, No. 20-1139, 2021 WL 5578076, *2; accord Daniel v. Cook Cty, 833 F.3d 728, 734-35 (7th Cir. 2016); Hildreth, 960
F.3d at 426. The final policymaker must also know about and fail to correct the deficiencies. Dixon, 819 F.3d at 348 (citing Wellman v. Faulkner, 715 F.2d 269, 272 (7th Cir. 1983); City of St. Louis v. Praprotnik, 485 U.S. 112, 130 (1988)); accord Hildreth, 960 F.3d at 426. Due to the liberal nature of pretrial discovery in this and other contexts, the Court may enter protective orders. See Reed, No. 20-1139, 2021 WL 5578076, *2 (quoting Rhinehart, 467 U.S. at 34).
A party may move for a protective order under Rule 26(c)(1). See Fed. R. Civ. P. 26(c)(1). The motion must certify that the movant has, in good faith, conferred or attempted to confer with affected parties to resolve the dispute without Court action. Id. If good cause is shown, the Court may issue an order to protect a party from annoyance, embarrassment, oppression, or undue burden or expense, including an order specifying
the terms for disclosures in discovery. See Fed. R. Civ. P. 26(c)(1)(B); see also Reed, No. 20- 1139, 2021 WL 5578076, *2 (“[A] party must [also] show good cause in order to change or modify an existing protective order”). The burden of showing good cause is on the movant. Ball Corp. v. Air Tech of Michigan, Inc., 329 F.R.D. 599, 603 (N.D. Ind. 2019). The movant must “mak[e] a ‘particular and specific demonstration of fact, as distinguished
from stereotyped and conclusory statements.’ ” Id. (quoting Gulf Oil Co. v. Bernard, 452 U.S. 89, 102 n. 16 (1981)); accord Harrisonville Tel. Co. v. Illinois Commerce Comm’n, 472 F. Supp. 2d 1071, 1078 (S.D. Ill. 2006) (quoting 8 Charles Alan Wright, Arthur R. Miller & Richard L. Marcus, Federal Practice & Procedure § 2035 (3d ed. 1998 & Supp. 2006)); see also Andrew Corp. v. Rossi, 180 F.R.D. 338, 341 (N.D. Ill. 1998) (noting good cause generally requires specific examples of articulated reasoning, not stereotyped and conclusory
statements); Wiggins v. Burge, 173 F.R.D. 226, 229 (N.D. Ill. 1997) (noting, inter alia, good cause generally signifies a sound basis or legitimate need for judicial action). The Court has broad discretion to decide the appropriateness of and degree of protection required by a protective order. See Ball Corp., 329 F.R.D. at 603 (quoting Rhinehart, 467 U.S. at 36). HIPAA generally prevents the disclosure of an individual’s health-related information without that individual’s consent. See Reed, No. 20-1139, 2021 WL 5578076,
*2 (quoting Ligas v. Maram, No. 05-4331, 2007 WL 2316940, at *5 (N.D. Ill. Aug. 10, 2007)). However, subject to the applicable situations and requirements contained in § 164.512, a covered entity may disclose PHI without the written authorization of the individual or the opportunity of the individual to agree or object to the disclosure. See 45 C.F.R. § 164.512. For instance, a covered entity may disclose PHI to the extent that the disclosure
is required by law and the disclosure complies with and is limited to the relevant requirements of the law. See id. § 164.512(a)(1). Such a disclosure must satisfy the requirements of paragraph (c), (e), or (f) of § 164.512. See id. § 164.512(a)(2), (c), (e), (f). Paragraph (e) of § 164.512 provides the standards for disclosures in judicial and administrative proceedings. See id. § 164.512(e). A covered entity is permitted to disclose
PHI in the course of any judicial or administrative proceeding under the following circumstances: (1) in response to an order of a court or administrative tribunal, provided that the covered entity discloses only the PHI expressly authorized by such order; or (2) in response to a subpoena, discovery request, or other lawful process that is not accompanied by an order of a court or administrative tribunal, if the covered entity receives satisfactory assurance that the party seeking the PHI made reasonable efforts to
secure a qualified protective order under the requirements of paragraph (e)(1)(v) of § 164.512.1 See id. § 164.512(e)(1). In this context, a covered entity obtains satisfactory assurance if the party seeking the PHI provides a written statement and accompanying documentation demonstrating that it requested a qualified protective order from a court or administrative tribunal.2 See id. § 164.512(e)(1)(iv)(B). Likewise, a qualified protective order, relating to PHI that is requested under paragraph (e)(1)(ii) of § 164.512, means an
order of a court or administrative tribunal that prohibits the parties from using or disclosing the PHI for any purpose other than the litigation or proceeding for which it was requested and requires the return to the covered entity or destruction of the PHI (including all copies) at the end of the litigation or proceeding. See id. § 164.512(e)(1)(v). Importantly, § 164.512(e) creates only a procedure for obtaining the authority to
use medical records in litigation. Nw. Mem’l Hosp. v. Ashcroft, 362 F.3d 923, 925-26 (7th Cir. 2004); accord U.S. v. Bek, 493 F.3d 790, 802 (7th Cir. 2007). Whether the medical records are admissible in evidence is dependent upon separate evidentiary considerations. See Nw. Mem’l Hosp., 362 F.3d at 926; see also Dyjak v. Piephoff, No. 18-02003, 2022 WL 1569826,
1A covered entity is also permitted to disclose PHI in the course of any judicial or administrative proceeding, in response to a subpoena, discovery request, or other lawful process that is not accompanied by an order of a court or administrative tribunal, if the covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iii) of § 164.512, that reasonable efforts were made to ensure the individual who is the subject of the PHI was given notice of the request. See 45 C.F.R. § 164.512(e)(1)(ii)(A). 2A covered entity may also obtain satisfactory assurance for purposes of paragraph (e)(1)(ii)(B) if the party seeking the PHI provides a written statement and accompanying documentation demonstrating that the parties to the dispute have agreed to a qualified protective order and have presented that order to the court or administrative tribunal with jurisdiction. See 45 C.F.R. § 164.512(e)(1)(iv)(A). *3 (S.D. Ill. May 18, 2022) (“[T]he provisions of [HIPAA]… do not create a privilege against production or admission of evidence; they merely create a procedure for
obtaining protected medical records in litigation”); accord U.S. ex rel. Camillo v. Ancilla Systems, Inc., 233 F.R.D. 520, 522 (S.D. Ill. 2005). The Court emphasizes that HIPAA- qualified protective orders do not resolve questions of privilege or cure the objections that a party might raise with respect to the relevance, privilege, overbreadth, or undue burden and expenses of requests in discovery. See Reed, No. 20-1139, 2021 WL 5578076, *3 (quoting Ousterhout v. Zukowski, No. 11-9136, 2014 WL 804079, at *2 (N.D. Ill. Feb. 28,
2014), citing In re Sulfuric Acid Antitrust Litig., 231 F.R.D. 331, 337 (N.D. Ill. 2005)). Put another way, such orders do not divest the parties of their rights, remove opportunities to raise objections unrelated to HIPAA, or immediately require the production of documents. Id. (quoting Ousterhout, No. 11-9136, 2014 WL 804079, at *3). A HIPAA- qualified protective order merely limits the disclosure of the PHI after that information
is produced within the bounds of the Federal Rules of Civil Procedure. See id. Here, the Court FINDS good cause for the entry of a HIPAA-Qualified Protective Order that extends confidentiality protections to the PHI of third parties. Contrary to Defendants’ arguments, the current HIPAA-Qualified Protective Order (Doc. 41) extends only to the PHI of decedent and expressly requires a separate order and authorization
from the Court for disclosures of other medical records. Plaintiff has now persuasively argued that HIPAA-Qualified Protective Order is inadequate to protect any third-party PHI that is discovered for purposes proving her Monell claim. See Reed, No. 20-1139, 2021 WL 5578076, *2 (concluding the plaintiffs demonstrated good cause for a new HIPAA- qualified protective order, where there were changed circumstances since the entry of the prior HIPAA-qualified protective order, the plaintiffs received discovery responses that
objected to the disclosure of third-party medical information based on potential HIPAA violations, and discovery would not be limited to only the PHI of the plaintiff due to a Monell claim alleging widespread practices of inadequate care). Defendants’ arguments that Plaintiff’s Motion is a motion to compel and the Proposed Order is facially vague, overbroad, and confusing lacks merit and conflates the issue presented to the Court. Plaintiff admits that the Motion and Proposed Order seek to make the disclosure of third-
party PHI lawful without requiring the production of documents from Defendants or deciding the scope of third-party discovery. Further, as is discussed extensively in this Memorandum and Order, nothing contained herein divests Defendants of their rights, resolves or removes opportunities to raise objections unrelated to HIPAA, or requires the immediate production of documents. See Reed, No. 20-1139, 2021 WL 5578076, *3. Indeed,
the new HIPAA-Qualified Protective Order, outlined below, prohibits the use or disclosure of PHI for any other purpose or in any other proceeding, expressly preserves objections to requests for discovery, provides a right of redaction when believed necessary, and mandates the return or disposal of documents designated “Attorneys’ Eyes Only.” See infra ¶¶ 4(b), 5, 7-8; Reed, No. 20-1139, 2021 WL 5578076, *3 (concluding,
aside from good cause, the proposed HIPAA-qualified protective order met procedural requirements for disclosure under § 164.512(e)(1)(v), where the HIPAA-qualified protective order contained provisions that were identical to those described here). Accordingly, the Court, consistent with this Memorandum and Order and the directives that follow, GRANTS the Motion and ADOPTS the Proposed Order: HIPAA-QUALIFIED PROTECTIVE ORDER
1. The following words and terms are defined for purposes of this Protective Order: a) “Parties” shall mean Plaintiff, Defendants, any additional party that this Court may subsequently recognize as subject to this HIPAA-Qualified Protective Order, and their attorneys.
b) “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996, codified primarily at 18, 24, and 26 U.S.C. c) “Privacy Standards” shall mean the Standards for Privacy of Individually Identifiable Health Information. See 45 C.F.R. §§ 160 & 164. d) “PHI” shall mean protected health information as that term is used
in HIPAA and the Privacy Standards. “PHI” includes, but is not limited to, health information, including demographic information, relating to (a) the past, present, or future physical or mental condition of an individual, (b) the provision of care to an individual, or (c) the payment for care provided to an individual, which identifies the individual or which reasonably could be expected to identify the individual.
e) When used in this Order, the word “document” or “documents” means all written, recorded, or graphic matter whatsoever, including but not limited to material produced by any party pursuant to discovery, material produced by any party or non-party in this action (whether pursuant to Federal Rule of Civil Procedure 34, subpoena, or by agreement), deposition transcripts and exhibits and/or any portion of any court filings that quote from or summarize any of the foregoing.
f) “Non-parties” shall mean all those other than the plaintiffs or the defendants. g) “Attorneys’ Eyes Only” shall mean to be viewed only by counsel of record for the instant litigation, their paralegals and investigators, and retained expert witnesses. However, this definition shall not bar the parties themselves from viewing information with the “Attorneys’ Eyes Only” designation, as necessary in consultation
with their attorneys and for purposes of this litigation.3 Likewise, the Court and its staff shall not be barred from viewing information with the “Attorneys’ Eyes Only” designation, if and when such viewing is necessary for purposes of this litigation. 2. This Order governs all discovery related to the exchange or dissemination of information or the production of documents designated as PHI.
a) The parties shall be familiar with HIPAA and the Privacy Standards. b) The parties recognize that it may be necessary, during the course of this proceeding, to produce, disclose, receive, obtain, subpoena, and/or transmit PHI of non-parties to or from other parties and non-parties.
3Defendants disagreed with the Attorneys’ Eyes Only definition, as submitted to the Court, because it “would not allow for the parties themselves, including Defendants who are medical professionals, [to]… view[] the records.” In reply, Plaintiff took “no position on Defendants’ request to widen the categories of individuals permitted to view third-party PHI, except to ask the Court to confirm that such documents should be filed under seal, rather than publicly.” Therefore, the Court excepts the parties from the definition of “Attorneys’ Eyes Only,” as stated above, but emphasizes that the parties must adhere to the protective measures contained in this Order. c) Subject to the provisions of this Order, a judicial ruling is required before any “Attorneys’ Eyes Only” matter, produced in the pretrial discovery process
pursuant to this Order, can be placed under seal, when deemed admissible, and used at trial or otherwise filed with this Court so as to be of record. Further, as this Protective Order pertains to pretrial discovery, the parties understand that an interested member of the public has the right to challenge the placement under seal of any document deemed admissible and used at trial or otherwise filed with this Court so as to be of record. In the event of such a challenge, the party asserting confidentiality shall have the burden of
proving the propriety of that designation. 3. This Protective Order shall extend to all documentation as to all PHI regarding Parties and Non-parties. 4. The parties will abide by the following terms and conditions: a) Any PHI or other information disclosed pursuant to this Order shall
be designated “Attorneys’ Eyes Only” and shall be viewed only by counsel of record for the instant litigation, their paralegals and investigators, and retained expert witnesses. However, the parties themselves shall not be barred from viewing information with the “Attorneys’ Eyes Only” designation, as necessary in consultation with their attorneys and for purposes of this litigation. Likewise, the Court and its staff shall not be barred from
viewing information with the “Attorneys’ Eyes Only” designation, if and when such viewing is necessary for purposes of this litigation. b) The parties will not use or disclose the PHI released in this proceeding for any other purpose or in any other proceeding. c) The parties will store all PHI according to the Privacy Standards while such PHI is in their possession.
d) The parties shall assist each other in the release of PHI by waiving all notice requirements that may otherwise be necessary under HIPAA and the Privacy Standards. However, the parties agree to serve timely notices of any subpoenas issued, as required by the Federal Rules of Civil Procedure. e) The parties may seek the PHI for non-parties from any covered entity or entities identified in any disclosure or discovery response, medical record, inmate file,
or testified to at any deposition, or identified by any other discovery tool. Nothing in this Order authorizes the parties’ attorneys to obtain medical records or information through means other than formal discovery requests, subpoenas, depositions, patient authorizations, or other lawful process. Further, nothing in this Order constitutes a ruling on the admissibility of non-party PHI.4
4In their Joint Response, Defendants seek additions to paragraph 4(e). Defendants ask the Court to add:
“This Order is not intended, nor should it be understood, to order certain disclosures that would be considered ‘required by law,’ for which the ‘Minimum Necessary’ standard would not apply under 45 C.F.R. § 164.502(b)(2). Nor is this order an ‘express authorization[]’ that designates any specific type or category of protected health information for disclosure under 45 C.F.R. § 164.512(e)(1)(i).”
Plaintiff disagrees such additions are necessary, arguing they “would render the proposed order a nullity (i.e., as modified, the order would essentially say that it is not really a HIPAA-qualified protective order at all).” The Court has considered Defendants’ requested additions and concludes, under the authorities cited herein, they are unwarranted. The minimum necessary requirement does not apply to disclosures that are required by law, as described in § 164.512(a). See 45 C.F.R. § 164.502(b)(2)(v). As alluded to above, the requirements of § 164.512(a) are satisfied in this case. Further, regarding Defendants’ concerns under § 164.512(e)(1)(i), it suffices to reiterate that “PHI” is defined in this Order and nothing provides for or presently requires the immediate disclosure of any specific third-party PHI from any covered entity. 5. The parties shall, at the termination of this proceeding, return all “Attorneys’ Eyes Only” matter obtained during the course of this proceeding to the
attorney representing the person whose “Attorneys’ Eyes Only” matter was released during the course of this proceeding, and/or dispose of any “Attorneys’ Eyes Only” matter retained thereafter pursuant to the Privacy Standards. 6. The individual pages of each document designated, produced pursuant to this Order, or otherwise covered by such Order shall bear the following designation: ATTORNEYS’ EYES ONLY: CONFIDENTIAL DOCUMENT PRODUCED
PURSUANT TO PROTECTIVE ORDER ENTERED IN 20-cv-00900-DWD. or ATTORNEYS’ EYES ONLY No document containing the above designation shall be copied in whole or in part without such designation appearing on the copy. No document containing the above
designation shall be read by any person other than the parties’ counsel of record for the instant litigation, their paralegals and investigators, and retained expert witnesses. However, the parties themselves shall not be barred from viewing such information, as necessary in consultation with their attorneys and for purposes of this litigation. Likewise, the Court and its staff shall not be barred from viewing such information, if
and when such viewing is necessary for purposes of this litigation. 7. To the extent that a party believes it has a right to redact information, it may redact such information, provided that, if a party redacts information from any “Attorneys’ Eyes Only” matter and the face of the document itself does not make clear and obvious the nature of the information redacted, the party shall provide in writing a specific category of information redacted (for example, social security number). 8. Nothing in this Protective Order shall be deemed a waiver of the right of
any party to object to a request for discovery on the basis of relevance, materiality, privilege, overbreadth, undue burden or expense, or any other recognized objection to discovery. 9. This Protective Order may be modified by further written stipulation signed by the parties and/or by further order of this Court upon application to the Court with notice. Nothing in this Order shall bind the Court to its terms, and the Court may, in its discretion, modify or amend the Order. 10. restricted or sealed document is to be filed with the Clerk of the Court unless, prior to filing and upon a motion, a showing of good cause for why the specific document(s) should be filed under seal is established, and leave of the Court to file the particular document(s) is specifically obtained. SO ORDERED. Dated: August 24, 2022.
DAVID W.DUGAN United States District Judge