Haage v. Zavala

Plaintiffs filed negligence suits for auto collisions, and moved for entry of qualified protective orders pursuant to HIPAA. Liability insurer for a named defendant in each case intervened and filed objections to the HIPAA qualified protective orders, and requested that the court instead enter protective orders similar to the one used in the Law Division of Cook County Circuit Court, which would permit insurers to disclose, maintain, use, and dispose of protected health information (PHI) to comply with statutes and regulations for certain designated purposes and exempt insurers from any "return or destroy" provisions. Court properly ruled that, to the extent that HIPAA and its regulations conflict with state law, they preempt state law; and that any person or entity receiving PHI in response to a HIPAA qualified protective order is bound to follow terms of that order.  Cook County protective order directly conflicts with HIPAA requirements in that it does not require insurer to return or destroy PHI at conclusion of litigation and would permit insurer to use and retain PHI outside of litigation. (BIRKETT and ZENOFF, concurring.)