*1 This matter is before the Court on a motion for entry of a HIPAA Qualified Protective Order filed by Plaintiffs. (Doc. 35). For the following reasons, the motion is granted.

Plaintiffs Lennisha Reed and Lenn Reed Jr., Co-Administrators of the Estate of Lenn Reed Sr., commenced this action on October 28, 2020, claiming constitutional violations pursuant to 42 U.S.C. § 1983 and violations of Illinois state laws. (Doc. 1). Plaintiffs allege that while Lenn Reed Sr. (“Reed”) was incarcerated with the Illinois Department of Corrections, medical staff continued to mistreat his complaints of digestive problems and ignore signs of cancer. Once tests were performed and Reed was diagnosed with cancer, medical staff proceeded treating and caring for Reed in an unhurried manner. As a result, it became too late for Reed to receive effective treatment, and he died of cancer in January 2019.

On May 24, 2021, Defendant Ahmed filed a motion for the entry of a HIPAA Qualified Protective Order. (Doc. 32). No motions in opposition to Defendant Ahmed's motion were filed, and as such motions in civil cases involving the medical care of an inmate are routine, the Court granted the motion on June 4, 2021, three days prior to the response deadline. (Doc. 33). The Clerk of Court was directed to enter the standard qualified protective order pursuant to HIPAA, which applies only to the disclosure of Reed's protected health information. (Doc. 34).

Unbeknownst to the Court, after Defendant Ahmed had filed his motion, Plaintiffs communicated via email with Defense Counsel for Defendants Wexford, Shah, and Ritz and Defense Counsel for Defendant Ahmed that they opposed the proposed protective order submitted by Defendant Ahmed because it only covered the protected health information for Reed, and Plaintiffs intended to seek the medical information of third parties in discovery. Plaintiffs sent Defendants an alternative protective order that would protect not only Reed's medical information but the medical information of other inmates as well. (Doc. 35-1, p. 5). Defendant Ahmed's position regarding the alternative protective order is unknown at this time, but Defendants Wexford, Shah, and Ritz responded to the email that they did not agree to Plaintiffs’ proposed protective order.

On June 17, 2021, and on August 13, 2021, Defendants Wexford, Shah, and Ritz served their responses to Plaintiffs’ requests for production. They objected to a number of requests, but more specifically, Defendants objected to requests #25, #27, #29, #31, #46 - #50, in part because disclosing the medical information of third party inmates would violate HIPAA. On August 13, 2021, in an attempt to resolve the HIPAA objections, Plaintiff again email Defendants Wexford, Shah, and Ritz asking for agreement upon a broader protective order. Defendants refused. On September 11, 2021, Plaintiffs filed the motion currently before the Court. (Doc. 35).

The motion before the Court is a motion for a HIPAA qualified protective order, not a motion to compel. Although it is apparent that the parties disagree over the production of several documents, the only issue Plaintiffs are currently seeking to resolve is whether HIPAA can be used to prohibit discovery in this case.

*2 There seems to be confusion over the standard used for determining whether a protective order should be entered and the role of HIPAA in the discovery process. The Federal Rules of Civil Procedure allow for liberal discovery. See Seattle Times Co. v. Rhinehart, 467 U.S. 34 (1984). “The Rules do not distinguish between public and private information. Nor do they apply only to parties to the litigation, as relevant information in the hands of third parties may be subject to discovery.” Id. at 35. “Because of the liberality of pretrial discovery permitted by Rule 26(b)(1), it is necessary for the trial court to have the authority to issue protective orders conferred by Rule 26(c).” Prior to entering a protective order, the Court must first make a finding of good cause. FED. R. CIV. P. (c)(1). See also U.S. ex rel. Camillo v. Ancillay Sys, Inc., 233 F. R.D. 520, 523 (S.D. Ill. Nov. 7, 2005) (“the determination of good cause cannot be left to the parties, that is the Court's prerogative”). Likewise, a party must show good cause in order to change or modify an existing protective order. See Paine v. City of Chi., No. 06 C 3173, 2006 WL 3065515, at *3 (N.D. Ill. Oct. 26, 2006); Murata Mfg. Co., Ltd. v. Bel Fuse, Inc., 234 F.R.D. 175, 180 (N.D. Ill. 2006).

Generally, the Health Insurance Portability and Accountability Act (“HIPAA”) “prevents the disclosure of health-related information without the consent of the persons whose health information is at issue.” Ligas v. Maram, No. 05 C 4331, 2007 WL 2316940, at *5 (N.D. Ill. Aug. 10, 2007) (citing 45 C.F.R. §§ 164.508, 164.512). However, HIPAA permits protected health information to be revealed in response to a discovery request if:

Nw. Mem'l Hosp. v. Ashcroft, 362 F.3d 923, 925–926 (7th Cir. 2004) (citing 45 C.F.R. § 164.512(e)(1)(v)). The HIPAA provisions do not create a privilege against production or admission of evidence; they merely create a procedure for obtaining protected medical records in litigation. Id.; United States v. Bek, 493 F.3d 790, 802 (7th Cir. 2007).

Here, Plaintiffs have demonstrated good cause warranting a new protective order in this case. Since the Court granted Defendant Ahmed's motion and entered its standard qualified protective order as a matter of course, circumstances have changed. Plaintiffs have received discovery responses which raise objections to the disclosure of third party medical information based on potential HIPAA violations. Because Plaintiffs have asserted a Monell claim against Wexford for widespread practices of providing inadequate care, discovery in this case will not be limited to only the protected health information of Reed. As this Court has observed,

Green v. Meeks, No. 20-cv-00463-SPM, Doc. 122 (S.D. Ill. Jan. 15, 2021) (citations omitted). To succeed on a claim against Wexford, a plaintiff is “required to show ‘systemic and gross deficiencies’ that have impacted others in IDOC custody,” not just the plaintiff. Green v. Meeks, No. 20-cv-00463-SPM, 2021 WL 3631264, at *4 (S.D. Ill. July 14, 2021) (citing Hildreth v. Butler, 960 F. 3d 420 (7th Cir. 2020)). Thus, generally speaking, third party medical information is discoverable, and Plaintiffs have shown good cause for the entry of a new protective order governing the use of any third party protected health information produced.

*3 Not only does the Court find good cause for the entry of a protective order, but the proposed HIPAA protective order submitted by Plaintiffs meets the procedural requirements for disclosure under HIPAA. It contains provisions prohibiting the disclosure of protected health information for any other purpose other than the litigation and prescribes that all protected health information shall be returned or disposed of at the end of the litigation. See 45 C.F.R. § 164.512(e)(1)(v); Nw. Mem'l Hosp., 362 F. 3d at 925. The proposed protective order even goes further than the HIPAA requirements and requires that all protected health information disclosed through discovery be designated and labeled as for “Attorneys’ Eyes Only” and permits only counsel of record, paralegals, investigators, and retained expert witnesses for the parties to view such documents. Additionally, the proposed protective order allows a party to redact information that it “believes it has a right to redact.” Defendants have not presented any arguments that the language does not meet the requirements of HIPAA or does not sufficiently protect the medical information produced in discovery from unauthorized disclosure. There is also no indication that the parties will not abide by the terms of the proposed protective order. Thus, the Court will adopt the proposed protective order submitted by Plaintiffs.

Defendants opposed the protective order arguing that the production requests (1) would produce evidence that is not admissible at trial; (2) present serious privacy concerns which outweigh any arguments of relevance; and (3) are overly broad. These arguments conflate the entry of a HIPAA qualified protective order with a Court order directing Defendants to produce any and all third party protected medical information requested by Plaintiffs.

As discussed, HIPAA does not create some kind of medical records privilege. See U.S. v. Bek, 493 F. 3d. at 802. It establishes a procedure for obtaining protected health information during discovery by way of a protective order. A HIPAA qualified protective order is further limited in function in that it does not “cure any objections that a party might interpose as to the relevance or breadth of particular requests, nor will it resolve questions of privilege.” Ousterhout v. Zukowski, No. 11 cv 9136, 2014 WL 804079, at *2 (N.D. Ill. Feb. 28, 2014). Upon the “entry of a HIPAA qualified protective order, the parties are not immediately divested of their rights or their other objections unrelated to HIPAA, nor are the parties required to immediately produce documents.” Id. at * 3. Thus, Defendants are still free to object to Plaintiffs’ discovery requests on other grounds, including relevance, privilege, overly broad, and undue burden or expense. See In re Sulfuric Acid Antitrust Litigation, 231 F. R. D. 331, at *337 (N.D. Ill. 2005) (the “served party has the option of providing appropriate written objections and leaving it to the party seeking discovery to file a motion to compel”) (citations omitted). The HIPAA qualified protective order only limits the disclosure of the protected medical information once it is produced in accordance within the bounds of the Federal Rules of Civil Procedure.

Defendants also try to frame Plaintiffs’ motion for a new protective order as untimely and an inappropriate objection to Defendant Ahmed's initial motion for a protective order. These arguments are not well taken. First, parties routinely seek to modify or vacate protective orders as litigation progresses. The Court entered the standard HIPAA qualified protective order prior to the response deadline and Plaintiffs’ receipt of Defendants’ responses to their first discovery requests. Additionally, Defendant Ahmed did not express agreement on the part of Plaintiffs when seeking a protective order. Therefore, Plaintiffs’ motion is not improper.

Second, the motion is not untimely. There is no deadline for filing a motion for a protective order, and discovery in this case does not close until June 23, 2022. Furthermore, Defendants Wexford, Shah, and Ritz have not demonstrated actual prejudiced by the timing of Plaintiffs’ motion. If anything, Defendants have prejudiced themselves by refusing to work with Plaintiffs to file a new joint proposed HIPAA qualified protective order, especially in light of the fact that courts in this circuit, including this one, have repeatedly found that cases involving Monell type claims require broad discovery. See Green, No. 20-cv-00463-SPM at Doc. 122; Michael Outley v. The City of Chi., No. 17 C 08633, 2021 WL 4789026, at *4-5 (N.D. Ill. Jan 5, 2021); Lymon v. Chamberlain, 17 CV 50093, 2020 WL 6940985, at *3 (N.D. Ill. Nov. 24, 2020); Cooper v. Rezutko, No. 17-CV-834-PPS-MGG, 2019 WL 927095, at *9 (N.D. Ind. Feb. 26, 2019); Andrews v. Sangamon Cty. Ill., No. 18-cv-110, 2018 WL 6523186, at *1 (C.D. Ill. Dec. 11, 2018); Awalt v. Marketti, No. 11 C 6142, 2012 WL 6568242, at *3 (N.D. Ill. Dec. 17, 2012). See also Daniel v. Cook Cty., 833 F. 3d 728, 734 (7th Cir. 2016) (an inmate meets the burden of showing an unlawful official policy by offering evidence showing “a general pattern of repeated behavior”). Defendants argue that “agreeing to Plaintiffs’ protective order violates the policy of HIPAA.” (Doc. 37, p. 15). But it is not clear to the Court how agreeing to the entry of a protective order that meets the requirements of HIPAA, 45 C.F.R. 164.512(e), could also violate the “spirit HIPAA,” as they contend.

*4 Regardless, none of the arguments presented by Defendants refute a finding of good cause. The Court will grant Plaintiffs’ motion and adopt the proposed qualified HIPAA protective order.

For the reasons stated above, the Motion for Entry of a HIPAA Qualified Protective Order (Doc. 35) is GRANTED. The previous HIPAA Qualified Protective Order (Doc. 34) is VACATED, and the Court ADOPTS the proposed protective order submitted by Plaintiffs.

IT IS SO ORDERED.