Sun-Times v. Cook Cnty. Health & Hosps. Sys.

2022 IL 127519

215 N.E.3d 963

465 Ill.Dec. 758

Chicago SUN-TIMES, Appellee

v.COOK COUNTY HEALTH AND HOSPITALS SYSTEM, Appellant.

Docket No. 127519

Supreme Court of Illinois.

Filed November 30, 2022

Kimberly M. Foxx, State's Attorney, of Chicago (Cathy McNeil Stein, Jessica M. Scheller, Prathima Yeddanapudi, and Jonathon D. Byrer, Assistant State's Attorneys, of counsel), for appellant.

Matthew Topic, Josh Loevy, Merrick Wayne, and Shelley Geiszler, of Loevy & Loevy, of Chicago, for appellee.

JUSTICE MICHAEL J. BURKE delivered the judgment of the court, with opinion.

¶ 1 Plaintiff, the Chicago Sun-Times, sent defendant, the Cook County Health and Hospitals System, a request under the Freedom of Information Act (FOIA) ( 5 ILCS 140/1 et seq. (West 2018)) for information about gunshot wound patients who arrive at defendant's emergency rooms unaccompanied by law enforcement. Plaintiff was investigating whether defendant was meeting a requirement to notify local law enforcement when so-called "walk-in" gunshot wound patients are treated. 20 ILCS 2630/3.2 (West 2018). Plaintiff asked for the "time/date" of each relevant hospital admission and the corresponding "time/date" of law enforcement notification.

¶ 2 Defendant asserted two FOIA exemptions and withheld the records, claiming they contained (1) personal health information prohibited from disclosure by the Health Insurance Portability and Accountability Act (HIPAA) ( Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended in scattered sections of Titles 18, 26, 29, and 42 of the United States Code); 5 ILCS 140/7(1)(a) (West 2018)) and (2) private information barred from disclosure under FOIA ( 5 ILCS 140/7(1)(b) (West 2018)).

¶ 3 Plaintiff initiated a FOIA enforcement action, arguing that the year listed on each record was discoverable, even if the time of day, day of month, and month were not. Id. § 11(a). The Cook County circuit court ruled for defendant on the parties’ cross-motions for summary judgment. The appellate court reversed, holding that HIPAA and FOIA permitted the release of the year elements of the records as long as the individual identifying information was redacted, or "de-identified" to maintain patient confidentiality. 2021 IL App (1st) 192551, 451 Ill.Dec. 719, 184 N.E.3d 306.

¶ 4 The issue presented is whether the year of each walk-in gunshot wound patient admission and the year of the corresponding law enforcement notification of each admission are exempt from disclosure under section 7(1)(a), which incorporates privacy laws such as HIPAA, or section 7(1)(b), which prohibits the disclosure of private information, including medical records. In light of the narrow scope of plaintiff's request, we hold that the responsive information is not exempt from disclosure under the two exemptions addressed in the parties’ cross-motions for summary judgment. We affirm the appellate court's judgment, reverse the circuit court's judgment, and remand the cause for further proceedings.

¶ 5 I. BACKGROUND

¶ 6 On September 10, 2018, plaintiff requested the following information at issue:

"Without providing identifying patient information, we seek the time/date of admission of patients seeking treatment for gunshot wounds through [defendant] between Jan. 1, 2015 through the present day who were not been [sic ] accompanied by a law enforcement officer at the time of their admission as well as the corresponding time/date that law enforcement officials were notified of the patients’ admission as required by state statue [sic ] ( 20 ILCS 2630/3.2 )."

¶ 7 On October 26, 2018, Deborah Fortier, defendant's FOIA officer, answered the request in relevant part as follows:

"According to Trauma administration, there is a trauma registry that logs arrival information of all trauma patients not just walk in gunshot patients, however that log is identifiable private patient health/medical information that is protected from release by medical privacy laws and regulations, including but not limited to HIPAA. Further, there is no independent written record of patient information that simply tracks times/dates of walk in gunshot patients and reporting; so, there is no existing document that is responsive to your request. Respectfully, [defendant] is not required under the FOIA to create a document that is not kept in the regular course of business in order to respond to your request. Further, it would be improper and a violation of state and federal medical privacy laws, including but not limited to HIPAA, for [defendant] to release the specific arrival times and dates and reporting dates of individual walk in gunshot patients, as this could allow for patient identification. This patient information, which is individual protected patient health/medical information, is therefore exempt from public release under Sections 2(c-5) and 7(1)(a) of the FOIA. This would also include where arrival times and dates and date of any reporting would be entered into individual patient medical records; medical records are not public records and are private records per se under Section 2(c-5) of the FOIA. In fact, it would be a violation of medical privacy laws, for [defendant's] staff to review or even access patient medical information to respond to a FOIA request, as responding to a public records request is not a lawful purpose to access patient medical information."

¶ 8 On November 21, 2018, plaintiff filed a complaint alleging defendant improperly withheld the information. Plaintiff sought, inter alia , an order requiring defendant to produce the requested records and enjoining defendant from withholding public records that are not exempt under FOIA.

¶ 9 The parties filed cross-motions for summary judgment on the issue of whether the information concerning the timing of walk-in patient admission and police notification was exempt from disclosure under section 7 of FOIA. Defendant attached to its motion the affidavit of Fortier, who averred that John H. Stroger Jr. Hospital of Cook County (Stroger Hospital) was the only entity that possessed records that were potentially responsive to plaintiff's request.

¶ 10 Defendant also attached the affidavit of Justin Mis, Stroger Hospital's trauma coordinator. Mis averred that the electronic trauma registry at Stroger Hospital contains entries for each patient arriving at the hospital. Each entry includes the patient's name, date and time of arrival, medical record number, and the patient's chief complaint. Mis conceded that he could generate a report listing only the mechanism of injury, such as gunshot wound, and the patient's time of arrival in the emergency department. However, the report would not state whether the patient was accompanied by a law enforcement officer or when law enforcement was notified, if at all. To determine which patients were unaccompanied, Mis would need to cross-reference the report with the "patient access log." The log shows the time and date a law enforcement officer requested access to a patient, but it would not indicate whether the request was prompted by hospital notification. Ultimately, Mis would need to access the medical record of each gunshot wound patient to determine whether he or she arrived at Stroger Hospital with law enforcement or if law enforcement was notified of the admission.

¶ 11 Fortier averred that the trauma registry and the patient access log contained protected health information as defined by HIPAA. Fortier claimed defendant could not remove enough identifying information from the trauma registry and the patient access log to fulfill the FOIA request and still comply with HIPAA. Further, Fortier averred that the responsive records constituted medical records that are protected from disclosure under Illinois law.

¶ 12 Plaintiff argued in its summary judgment motion that FOIA permitted disclosure of the requested information in a de-identified report. Specifically, plaintiff argued HIPAA permits the disclosure of the year of treatment and year of law enforcement notification. Plaintiff conceded that HIPAA bars disclosure of other elements of a date field, such as time of day, day of month, or month.

¶ 13 On November 15, 2019, the circuit court entered summary judgment for defendant. The court stated that, because the year identifier was part of a medical record, it was exempt from disclosure under section 7(1)(b) of FOIA. The court explained that, without case law expressly permitting the redaction of medical records for FOIA purposes, the responsive information was not improperly withheld.

¶ 14 The appellate court reversed the summary judgment and remanded for further proceedings. 2021 IL App (1st) 192551, ¶ 29, 451 Ill.Dec. 719, 184 N.E.3d 306. The court determined that plaintiff had not forfeited review by revising its request at the summary judgment stage. Id. ¶ 15. Plaintiff initially requested "time/date" information, but plaintiff's summary judgment motion conceded that just the year element was releasable. The court observed that "narrowing of the request reflects an implicit concession by [plaintiff] that it was not entitled to the more specific date and time information." Id.

¶ 15 The appellate court held section 7(1)(a) of FOIA did not exempt the year of patient admission and police notification in gunshot-wound cases because the year element, alone, does not convey identifying information. Id. ¶ 19 (citing 45 C.F.R. § 164.514(b)(2)(i)(A)-(C), (G), (H) (2018) ). The court held that removing individual identifiers would de-identify the information in compliance with HIPAA. Id.

¶ 16 Considering the sheer number of gunshot-wound patients treated at Stroger Hospital during the relevant time period, the court also rejected defendant's claim that it had " ‘actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.’ " Id. ¶ 20 (quoting 45 C.F.R. § 164.514(b)(2)(ii) (2018) ).

¶ 17 The appellate court...