Is an insurer considered a "covered entity" subject to HIPAA regulations regarding protected health information?
Case SummaryThese consolidated automobile negligence cases arose out of automobile collisions that occurred in 2016 and 2017. State Farm sought an interlocutory appeal after the trial court granted plaintiffs' motions for qualified protective orders pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended in sections of Titles 18, 26, 29, and 42 of the United States Code)) ("HIPAA qualified protective orders").
The proposed qualified protective orders would: (1) require any person or entity in possession of protected health information (PHI) received pursuant to the protective order, including an insurance company, to return or destroy any and all PHI pertaining to the plaintiffs within 60 days after the conclusion of the litigation in compliance with 45 C.F.R. § 164.512(e)(1)(v)(B); and (2) prohibit the parties, their attorneys, and their insurers from using or disclosing PHI for any purpose other than the litigation at issue in compliance with 45 C.F.R. § 164.512(e)(1)(v)(A). State Farm objected to the qualified protective orders, arguing that they would impose "significant restrictions and obligations" upon it, and requested the court to use the form template protective order used by Cook County Circuit Court.
On appeal, the Haage court first confirmed that State Farm was not a "covered entity" under HIPAA because it was not a "health care clearing house" or a "health care provider" as those terms are defined under HIPAA at 45 C.F.R. § 160.103. The appellate court confirmed, in a de novo review of HIPAA regulations, that State Farm's status as a "non-covered entity" did...
