Claimants, Beware! The Northern District of Illinois finds that once insurance companies receive your health information, they can use it as they see fit.

The protection of protected health information (“PHI”) for Illinois residents faced a setback last week when the Northern District of Illinois dismissed the complaint in Brown v. State Farm Mutual Automobile Insurance Co.  The lawsuit claimed that State Farm improperly shared individuals’ PHI with third parties without obtaining proper consent.  Specifically, the plaintiffs argued that State Farm and the Insurance Services Office, Inc. (“ISO”) inappropriately kept claimants’ PHI submitted for claims after their resolution for underwriting and rate-setting purposes.

The Northern District of Illinois found that an immunity provision of the Illinois Insurance Code allowed for the disclosure of PHI when necessary for an insurance institution, agent, or insurance-support organization to perform their functions related to an insurance transaction and insulated State Farm and ISO from liability.  However, the court’s interpretation overlooks the circumstances under which the insurance institution, agent, or insurance-support organization acquired the relevant PHI.

According to the Northern District’s interpretation of the immunity provision, whenever a claimant provides health records to substantiate the extent of their injuries for a claim, they must accept that their health records can be utilized in any other manner the insurance company deems appropriate as long as it relates to their insurance provision.  This interpretation arguably contradicts state and national public policy designed to protect against the unauthorized disclosure of health information.

The Northern District’s decision underscores the challenges consumers encounter when pursuing legal action against companies for the unauthorized sharing of consumers’ PHI and highlights the need for improved data privacy laws that effectively address the public policy issues related to the protection of citizens’ PHI.

The case is Brown et al. v. State Farm Mutual Automobile Insurance Co. et al., case number 1:23-cv-06065, in the U.S. District Court for the Northern District of Illinois.