Court Opinion

ID: 9297341
Source: CourtListenerOpinion
Date Created: 2022-11-30 15:02:21.671485+00
Date Added: 2024-06-11T17:13:25.296350
License: Public Domain

2022 IL 127519

                                       IN THE
                               SUPREME COURT
                                           OF
                         THE STATE OF ILLINOIS

                                   (Docket No. 127519)

            CHICAGO SUN-TIMES, Appellee v. COOK COUNTY HEALTH
                     AND HOSPITALS SYSTEM, Appellant.

                            Opinion filed November 30, 2022.

        JUSTICE MICHAEL J. BURKE delivered the judgment of the court, with
     opinion.

        Justices Anne M. Burke, Neville, Overstreet, Carter, and Holder White
     concurred in the judgment and opinion.

        Chief Justice Theis dissented, with opinion.

                                        OPINION

¶1      Plaintiff, the Chicago Sun-Times, sent defendant, Cook County Health and
     Hospitals System, a request under the Freedom of Information Act (FOIA) (5 ILCS
     140/1 et seq. (West 2018)) for information about gunshot wound patients who
     arrive at defendant’s emergency rooms unaccompanied by law enforcement.
     Plaintiff was investigating whether defendant was meeting a requirement to notify
     local law enforcement when so-called “walk-in” gunshot wound patients are
     treated. 20 ILCS 2630/3.2 (West 2018). Plaintiff asked for the “time/date” of each
     relevant hospital admission and the corresponding “time/date” of law enforcement
     notification.

¶2       Defendant asserted two FOIA exemptions and withheld the records, claiming
     they contained (1) personal health information prohibited from disclosure by the
     Health Insurance Portability and Accountability Act (HIPAA) (Pub. L. No. 104-
     191, 110 Stat. 1936 (1996) (codified as amended in scattered sections of Titles 18,
     26, 29, and 42 of the United States Code); 5 ILCS 140/7(1)(a) (West 2018)) and
     (2) private information barred from disclosure under FOIA (5 ILCS 140/7(1)(b)
     (West 2018)).

¶3       Plaintiff initiated a FOIA enforcement action, arguing that the year listed on
     each record was discoverable, even if the time of day, day of month, and month
     were not. Id. § 11(a). The Cook County circuit court ruled for defendant on the
     parties’ cross-motions for summary judgment. The appellate court reversed,
     holding that HIPAA and FOIA permitted the release of the year elements of the
     records as long as the individual identifying information was redacted, or “de-
     identified” to maintain patient confidentiality. 2021 IL App (1st) 192551.

¶4       The issue presented is whether the year of each walk-in gunshot wound patient
     admission and the year of the corresponding law enforcement notification of each
     admission are exempt from disclosure under section 7(1)(a), which incorporates
     privacy laws such as HIPAA, or section 7(1)(b), which prohibits the disclosure of
     private information, including medical records. In light of the narrow scope of
     plaintiff’s request, we hold that the responsive information is not exempt from
     disclosure under the two exemptions addressed in the parties’ cross-motions for
     summary judgment. We affirm the appellate court’s judgment, reverse the circuit
     court’s judgment, and remand the cause for further proceedings.

¶5                                  I. BACKGROUND

¶6      On September 10, 2018, plaintiff requested the following information at issue:

                                            -2-
            “Without providing identifying patient information, we seek the time/date
        of admission of patients seeking treatment for gunshot wounds through
        [defendant] between Jan. 1, 2015 through the present day who were not been
        [sic] accompanied by a law enforcement officer at the time of their admission
        as well as the corresponding time/date that law enforcement officials were
        notified of the patients’ admission as required by state statue [sic] (20 ILCS
        2630/3.2).”

¶7      On October 26, 2018, Deborah Fortier, defendant’s FOIA officer, answered the
     request in relevant part as follows:

            “According to Trauma administration, there is a trauma registry that logs
        arrival information of all trauma patients not just walk in gunshot patients,
        however that log is identifiable private patient health/medical information that
        is protected from release by medical privacy laws and regulations, including
        but not limited to HIPAA. Further, there is no independent written record of
        patient information that simply tracks times/dates of walk in gunshot patients
        and reporting; so, there is no existing document that is responsive to your
        request. Respectfully, [defendant] is not required under the FOIA to create a
        document that is not kept in the regular course of business in order to respond
        to your request. Further, it would be improper and a violation of state and
        federal medical privacy laws, including but not limited to HIPAA, for
        [defendant] to release the specific arrival times and dates and reporting dates of
        individual walk in gunshot patients, as this could allow for patient
        identification. This patient information, which is individual protected patient
        health/medical information, is therefore exempt from public release under
        Sections 2(c-5) and 7(1)(a) of the FOIA. This would also include where arrival
        times and dates and date of any reporting would be entered into individual
        patient medical records; medical records are not public records and are private
        records per se under Section 2(c-5) of the FOIA. In fact, it would be a violation
        of medical privacy laws, for [defendant’s] staff to review or even access patient
        medical information to respond to a FOIA request, as responding to a public
        records request is not a lawful purpose to access patient medical information.”

¶8      On November 21, 2018, plaintiff filed a complaint alleging defendant
     improperly withheld the information. Plaintiff sought, inter alia, an order requiring

                                             -3-
       defendant to produce the requested records and enjoining defendant from
       withholding public records that are not exempt under FOIA.

¶9         The parties filed cross-motions for summary judgment on the issue of whether
       the information concerning the timing of walk-in patient admission and police
       notification was exempt from disclosure under section 7 of FOIA. Defendant
       attached to its motion the affidavit of Fortier, who averred that John H. Stroger Jr.
       Hospital of Cook County (Stroger Hospital) was the only entity that possessed
       records that were potentially responsive to plaintiff’s request.

¶ 10       Defendant also attached the affidavit of Justin Mis, Stroger Hospital’s trauma
       coordinator. Mis averred that the electronic trauma registry at Stroger Hospital
       contains entries for each patient arriving at the hospital. Each entry includes the
       patient’s name, date and time of arrival, medical record number, and the patient’s
       chief complaint. Mis conceded that he could generate a report listing only the
       mechanism of injury, such as gunshot wound, and the patient’s time of arrival in
       the emergency department. However, the report would not state whether the patient
       was accompanied by a law enforcement officer or when law enforcement was
       notified, if at all. To determine which patients were unaccompanied, Mis would
       need to cross-reference the report with the “patient access log.” The log shows the
       time and date a law enforcement officer requested access to a patient, but it would
       not indicate whether the request was prompted by hospital notification. Ultimately,
       Mis would need to access the medical record of each gunshot wound patient to
       determine whether he or she arrived at Stroger Hospital with law enforcement or if
       law enforcement was notified of the admission.

¶ 11       Fortier averred that the trauma registry and the patient access log contained
       protected health information as defined by HIPAA. Fortier claimed defendant could
       not remove enough identifying information from the trauma registry and the patient
       access log to fulfill the FOIA request and still comply with HIPAA. Further, Fortier
       averred that the responsive records constituted medical records that are protected
       from disclosure under Illinois law.

¶ 12       Plaintiff argued in its summary judgment motion that FOIA permitted
       disclosure of the requested information in a de-identified report. Specifically,
       plaintiff argued HIPAA permits the disclosure of the year of treatment and year of

                                               -4-
       law enforcement notification. Plaintiff conceded that HIPAA bars disclosure of
       other elements of a date field, such as time of day, day of month, or month.

¶ 13       On November 15, 2019, the circuit court entered summary judgment for
       defendant. The court stated that, because the year identifier was part of a medical
       record, it was exempt from disclosure under section 7(1)(b) of FOIA. The court
       explained that, without case law expressly permitting the redaction of medical
       records for FOIA purposes, the responsive information was not improperly
       withheld.

¶ 14       The appellate court reversed the summary judgment and remanded for further
       proceedings. 2021 IL App (1st) 192551, ¶ 29. The court determined that plaintiff
       had not forfeited review by revising its request at the summary judgment stage. Id.
       ¶ 15. Plaintiff initially requested “time/date” information, but plaintiff’s summary
       judgment motion conceded that just the year element was releasable. The court
       observed that “narrowing of the request reflects an implicit concession by [plaintiff]
       that it was not entitled to the more specific date and time information.” Id.

¶ 15       The appellate court held section 7(1)(a) of FOIA did not exempt the year of
       patient admission and police notification in gunshot-wound cases because the year
       element, alone, does not convey identifying information. Id. ¶ 19 (citing 45 C.F.R.
       § 164.514(b)(2)(i)(A)-(C), (G), (H) (2018)). The court held that removing
       individual identifiers would de-identify the information in compliance with
       HIPAA. Id.

¶ 16       Considering the sheer number of gunshot-wound patients treated at Stroger
       Hospital during the relevant time period, the court also rejected defendant’s claim
       that it had “ ‘actual knowledge that the information could be used alone or in
       combination with other information to identify an individual who is a subject of the
       information.’ ” Id. ¶ 20 (quoting 45 C.F.R. § 164.514(b)(2)(ii) (2018)).

¶ 17       The appellate court separately held that the year information was not exempt
       under section 7(1)(b) of FOIA, which prohibits the disclosure of “private
       information,” including “medical records.” Id. ¶ 25 (citing 5 ILCS 140/2(c-5) (West
       2018)). Noting that FOIA does not define “medical records,” the court declined to
       adopt the definition set forth in the Illinois Administrative Code, instead relying on
       the plain and ordinary meaning of the words. Id. (citing 77 Ill. Adm. Code

                                               -5-
       250.1510(b)(2)(A) (2019)). The dictionary definition of “medical record” is
       “ ‘documents that compose a medical patient’s healthcare history.’ ” Id. (quoting
       Black’s Law Dictionary (11th ed. 2019)). The court concluded that, “[w]hile the
       year of a patient’s hospital admission may be found in a patient’s medical record,
       it, standing alone, is not a medical record under this definition.” (Emphasis in
       original.) Id.

¶ 18        Defendant filed a petition for leave to appeal, which we allowed pursuant to
       Illinois Supreme Court Rule 315 (eff. Oct. 1, 2020).

¶ 19                                            II. ANALYSIS

¶ 20       On appeal, defendant renews its arguments that (1) HIPAA prohibits covered
       entities from using and disclosing their patients’ private health information to
       comply with a FOIA request and (2) the responsive records, even with the unique
       identifiers redacted, constitute “medical records” that FOIA categorically exempts
       from disclosure.

¶ 21       Defendant alternatively argues that complying with the FOIA request would be
       unduly burdensome. Fortier’s response alluded to the impracticality of processing
       the records, but the parties did not raise the issue in their cross-motions for summary
       judgment, and the issue was not addressed by the lower courts.

¶ 22       Plaintiff contends that the appellate court’s judgment should be affirmed
       because plaintiff seeks only the year element of the date field from the records. 1
       For the following reasons, we agree with plaintiff that defendant can de-identify the
       records and comply with the request without violating HIPAA’s privacy rule or
       FOIA’s prohibition against disclosing medical records. We do not reach the
       question of whether the request was unduly burdensome.

           1
            Although defendant criticizes plaintiff’s FOIA request as “reformulated after the fact and
       during the pendency of litigation,” the parties have adopted plaintiff’s interpretation of “time/date”
       to mean “year.” We consider the issues, as presented by the parties, in terms of whether the year
       element is releasable.

                                                       -6-
¶ 23                                  A. Summary Judgment

¶ 24      This appeal arises from the parties’ cross-motions for summary judgment.

          “[S]ummary judgment should be granted only where the pleadings, depositions,
          admissions and affidavits on file, when viewed in the light most favorable to
          the nonmoving party, show that there is no genuine issue as to any material fact
          and that the moving party is clearly entitled to judgment as a matter of law.”
          Pielet v. Pielet, 2012 IL 112064, ¶ 29.

       See 735 ILCS 5/2-1005 (West 2018). “When parties file cross-motions for
       summary judgment, they mutually agree that there are no genuine issues of material
       fact and that only a question of law is involved.” Jones v. Municipal Employees’
       Annuity & Benefit Fund, 2016 IL 119618, ¶ 26. We review summary judgment
       de novo. Pielet, 2012 IL 112064, ¶ 30. De novo review also applies to our
       interpretation of FOIA and HIPAA. In re Appointment of Special Prosecutor, 2019
       IL 122949, ¶ 22 (issues of statutory construction present questions of law that we
       review de novo).

¶ 25                                B. Statutory Interpretation

¶ 26       The objective of statutory interpretation is to ascertain and give effect to the
       legislature’s intent, and the most reliable indicator of that intent is the language of
       the statute, given its plain and ordinary meaning. Id. ¶ 23. The General Assembly
       has declared FOIA’s underlying public policy to be that “all persons are entitled to
       full and complete information regarding the affairs of government and the official
       acts and policies of those who represent them as public officials and public
       employees consistent with the terms of this Act.” 5 ILCS 140/1 (West 2018). “It is
       a fundamental obligation of government to operate openly and provide public
       records as expediently and efficiently as possible in compliance with this Act.” Id.

¶ 27       This clear expression of legislative intent means that public records are
       presumed to be open and accessible. Special Prosecutor, 2019 IL 122949, ¶ 25.
       FOIA should be construed liberally to achieve the goal of providing the public with
       easy access to government information. Id.

                                                -7-
¶ 28       FOIA prescribes rules to ensure governmental compliance, including requiring
       a prompt response to a request for inspection or a copy of documents: “[e]ach public
       body shall, promptly, either comply with or deny a request for public records within
       5 business days after its receipt of the request, unless the time for response is
       properly extended.” 5 ILCS 140/3(d) (West 2018). When a person has been denied
       access to a public record, he “may file suit for injunctive or declaratory relief” and
       may seek attorney fees and civil penalties from the public body. Id. § 11(a), (i), (j).
       The circuit court is vested with “jurisdiction to enjoin the public body from
       withholding public records and to order the production of any public records
       improperly withheld from the person seeking access.” Id. § 11(d); Special
       Prosecutor, 2019 IL 122949, ¶ 57.

¶ 29       However, a public body may withhold information that is exempt from
       disclosure. 5 ILCS 140/7 (West 2018). A public body claiming an exemption bears
       the burden of proving by clear and convincing evidence that the requested
       information is exempt. Id. § 1.2. When a request is made to inspect or copy a public
       record that contains information that is exempt from disclosure under section 7 but
       also contains information that is not exempt, the public body may elect to redact
       the information that is exempt. Id. § 7(1). In that case, the public body shall make
       the remaining information available for inspection and copying. Id.

¶ 30       Defendant asserted two exemptions, claiming (1) HIPAA prohibits the use and
       disclosure of the information and (2) the information is “private information” under
       FOIA. Id. § 7(1)(a), (b). Plaintiff responds that defendant can comply with HIPAA
       and FOIA by redacting the exempt information from the medical records while
       making the requested information available.

¶ 31                                     1. Section 7(1)(a)

¶ 32      The first exemption cited by defendant exposes tension between two strong
       public policies: FOIA’s promotion of the open disclosure of government records
       and HIPAA’s protection of private health information. Defendant claims that
       “answering a public records request *** is not a permitted use under HIPAA.” But
       when statutes potentially conflict, they must be construed in harmony with one
       another if reasonably possible. Knolls Condominium Ass’n v. Harms, 202 Ill. 2d

                                                -8-
       450, 458-59 (2002). The two statutory schemes can be reconciled in this case to
       facilitate the disclosure of government records while protecting patient privacy.

¶ 33       FOIA exempts “[i]nformation specifically prohibited from disclosure by federal
       or State law or rules and regulations implementing federal or State law.” 5 ILCS
       140/7(1)(a) (West 2018). Defendant asserts that HIPAA, a federal law, specifically
       prohibits the disclosure of the year of admission of each walk-in gunshot wound
       patient and the year of each corresponding law enforcement notification.

¶ 34       HIPAA’s privacy rule prohibits the “use or disclosure” of an individual’s
       personal health information by a covered entity, like defendant, unless the
       individual has consented in writing or unless the use or disclosure is otherwise
       specifically permitted or required by the privacy rule. 45 C.F.R. §§ 164.502,
       164.506, 164.508, 164.510, 164.512 (2018). HIPAA defines “protected health
       information,” as all “individually identifiable health information” kept by a covered
       entity that is transmitted or maintained in any form or medium, including electronic
       media. Id. § 160.103. “Individually identifiable health information” includes
       demographic information collected from an individual that

              “(1) Is created or received by a health care provider, health plan, employer,
          or health care clearinghouse; and

              (2) Relates to the past, present, or future physical or mental health or
          condition of an individual; the provision of health care to an individual; or the
          past, present, or future payment for the provision of health care to an individual;
          and

                  (i) That identifies the individual; or

                  (ii) With respect to which there is a reasonable basis to believe the
              information can be used to identify the individual.” Id.

¶ 35       The parties correctly agree the responsive records contain protected health
       information, but defendant argues, “[r]eviewing medical records in response to a
       FOIA request is not a permitted use of protected health information.” To determine
       whether a public body can comply with the FOIA request without violating HIPAA,
       we must consider how the public body would use the protected health information
       to process the request. Here, Fortier, defendant’s FOIA officer, and Mis, Stroger

                                               -9-
       Hospital’s trauma administrator, described defendant’s record keeping. The records
       containing the requested information could be sorted in two databases: the trauma
       registry, which records each patient’s arrival at Stroger Hospital, and the patient
       access log, which shows the time and date a law enforcement officer requested
       access to a patient. From these databases, defendant could generate a report
       showing the arrival times of gunshot wound patients and the corresponding times
       that law enforcement asked to see the patient. But defendant would need to examine
       the medical record of each patient on the list to ascertain whether law enforcement’s
       request for access to a patient was prompted by the hospital’s notification.

¶ 36       The data processing described by Fortier and Mis qualifies as “use” of
       individually identifiable health information under HIPAA. Id. (“Use means, with
       respect to individually identifiable health information, the sharing, employment,
       application, utilization, examination, or analysis of such information within an
       entity that maintains such information.”). However, HIPAA expressly states that a
       covered entity may use protected health information to create de-identified
       information for use by a person other than the covered entity: “[a] covered entity
       may use protected health information to create information that is not individually
       identifiable health information or disclose protected health information only to a
       business associate for such purpose, whether or not the de-identified information is
       to be used by the covered entity.” Id. § 164.502(d)(1).

¶ 37       Health information, once de-identified, no longer meets the standard of
       individually identifiable health information subject to HIPAA’s protection. Id.
       § 164.514(a) (“Health information that does not identify an individual and with
       respect to which there is no reasonable basis to believe that the information can be
       used to identify an individual is not individually identifiable health information.”).
       And HIPAA contains an implementation specification to facilitate de-
       identification. A covered entity may determine that health information is not
       individually identifiable health information if (1) the covered entity does not have
       actual knowledge that the information could be used alone or in combination with
       other information to identify an individual who is a subject of the information (id.
       § 164.514(b)(2)(ii)) and (2) the following identifiers are removed:

              “(A) Names;

                                               - 10 -
    (B) All geographic subdivisions smaller than a State, including street
address, city, county, precinct, zip code, and their equivalent geocodes, except
for the initial three digits of a zip code if, according to the current publicly
available data from the Bureau of the Census:

      (1) The geographic unit formed by combining all zip codes with the
   same three initial digits contains more than 20,000 people; and

      (2) The initial three digits of a zip code for all such geographic units
   containing 20,000 or fewer people is changed to 000.

    (C) All elements of dates (except year) for dates directly related to an
individual, including birth date, admission date, discharge date, date of death;
and all ages over 89 and all elements of dates (including year) indicative of such
age, except that such ages and elements may be aggregated into a single
category of age 90 or older;

   (D) Telephone numbers;

   (E) Fax numbers;

   (F) Electronic mail addresses;

   (G) Social security numbers;

   (H) Medical record numbers;

   (I) Health plan beneficiary numbers;

   (J) Account numbers;

   (K) Certificate/license numbers;

   (L) Vehicle identifiers and serial numbers, including license plate numbers;

   (M) Device identifiers and serial numbers;

   (N) Web Universal Resource Locators (URLs);

   (O) Internet Protocol (IP) address numbers;

                                    - 11 -
              (P) Biometric identifiers, including finger and voice prints;

              (Q) Full face photographic images and any comparable images; and

              (R) Any other unique identifying number, characteristic, or code, except as
          permitted by paragraph (c) of this section[.]” (Emphasis added.) Id.
          § 164.514(b)(2)(i).

¶ 38       Section 164.514(b)(2)(i) specifically excludes the year element from the date
       identifiers that must be removed for de-identification. Accordingly, plaintiff
       confined its request to the year elements directly related to the walk-in gunshot
       wound patients involved. Plaintiff specifically asked defendant to withhold
       “identifying patient information” and did not seek any other identifiers that could
       be used to identify an individual.

¶ 39       Moreover, there was no evidence that defendant has “actual knowledge that the
       information could be used alone or in combination with other information to
       identify an individual who is a subject of the information.” Id. § 164.514(b)(2)(ii).
       Defendant estimated that Stroger Hospital treated as many as 2000 gunshot wound
       victims during the relevant time period, which diminishes the risk of identifying
       any one individual. The appellate court astutely observed, “[i]t strains credulity to
       imagine that any specific patient could be identified merely by the year they were
       admitted and the year law enforcement was notified of their admission.” 2021 IL
       App (1st) 192551, ¶ 20.

¶ 40       The de-identification process is a permitted use of protected health information
       under HIPAA (45 C.F.R. § 164.502(d)(1)) (2018)), and the removal of all the
       enumerated individual identifiers except the year element would meet HIPAA’s de-
       identification requirements for disclosure (id. § 164.514(b)(2)(i)). Under the
       circumstances, we hold that defendant’s use of the patients’ protected health
       information to process plaintiff’s FOIA request would not run afoul of HIPAA’s
       privacy rule because the year element related to each patient admission and police
       notification is not individually identifiable health information. That said, we
       expressly limit our holding to the facts presented, as the exemption could apply to
       a future request involving fewer patients where the year element of a record could
       be used for identification. See id. § 164.514(b)(2)(ii).

                                              - 12 -
¶ 41       Defendant contends King v. Cook County Health & Hospital System, 2020 IL
       App (1st) 190925, compels a different result. In King, the FOIA requester asked for
       the zip codes used to create a map of the locations of individuals who had
       previously received mental health services while detained in the Cook County jail.
       Id. ¶ 1. The public body, which coincidentally happens to be defendant in this case,
       asserted section 7(1)(a) as an exemption on the ground that disclosure would violate
       the Mental Health and Developmental Disabilities Confidentiality Act
       (Confidentiality Act) (740 ILCS 110/1 et seq. (West 2016)), which incorporates
       HIPAA regulations by reference. King, 2020 IL App (1st) 190925, ¶ 28 (citing 45
       C.F.R. § 164.514 (2016) and 740 ILCS 110/2 (West 2016)).

¶ 42       To determine whether the zip codes were confidential information under the
       Confidentiality Act, the Appellate Court, First District, examined HIPAA and its
       pertinent regulations. Id. ¶ 27. The court held that the individuals’ zip code
       information was protected health information but could be released after de-
       identification. Id. ¶ 28.

¶ 43       Defendant contends that HIPAA permitted the release of the redacted zip codes
       in King “[b]ecause the information had been collected for an authorized use, and
       the use was for a legitimate transaction of public business.” Defendant contrasts
       King with this case, where defendant claims the necessary redactions would be a
       misuse of protected health information under HIPAA. Defendant is mistaken.

¶ 44        In King, the redacted zip codes were releasable because they had been de-
       identified according to the implementation specifications set forth in section
       164.514(b)(2)(i)(B) of HIPAA (45 C.F.R. § 164.514(b)(2)(i)(B) (2018)). King,
       2020 IL App (1st) 190925, ¶ 31 (“HIPAA regulations provide that a covered entity
       may determine that private health information is not individually identifiable only
       if the last three digits of a zip code are removed, where the geographic unit formed
       by combining all the zip codes with the same three initial digits contains more than
       20,000 people”). Like the redacted zip codes in King, the year elements in this case
       are not individually identifiable health information if properly de-identified,
       regardless of how the public body previously used the information. 45 C.F.R.
       § 164.502(d)(1) (2018) (“A covered entity may use protected health information to
       create information that is not individually identifiable health information or
       disclose protected health information only to a business associate for such purpose,

                                              - 13 -
       whether or not the de-identified information is to be used by the covered entity.”).

¶ 45                                     2. Section 7(1)(b)

¶ 46       Defendant also asserts the responsive records are exempt because they contain
       “[p]rivate information,” where disclosure is not required by another provision of
       FOIA, a state or federal law, or a court order. 5 ILCS 140/7(1)(b) (West 2018).

          “ ‘Private information’ means unique identifiers, including a person’s social
          security number, driver’s license number, employee identification number,
          biometric identifiers, personal financial information, passwords or other access
          codes, medical records, home or personal telephone numbers, and personal
          email addresses. Private information also includes home address and personal
          license plates, except as otherwise provided by law or when compiled without
          possibility of attribution to any person.” (Emphasis added.) Id. § 2(c-5).

¶ 47       Defendant argues, without citation of authority, “the entirety of a ‘medical
       record’—not merely certain discrete information found in such a record—is exempt
       from disclosure.” We disagree. The year element is not “private information” under
       FOIA and so is not exempt under section 7(1)(b).

¶ 48        Defendant cites provisions in the Medical Rights Act (410 ILCS 50/3(d) (West
       2018)), the Managed Care Reform and Patient Rights Act (215 ILCS 134/5(a)(4)
       (West 2018)), and the Hospital Licensing Act (210 ILCS 85/6.17(d) (West 2018))
       for the proposition that “individuals have a right to an expectation of privacy related
       to their medical information.” These statutory schemes define “medical records,”
       but FOIA, which is the operative statute in this case, does not. So, we adopt the
       approach taken by the appellate court, which is to resort to the plain and ordinary
       meaning of the term. Special Prosecutor, 2019 IL 122949, ¶ 23.

¶ 49       Defendant concedes that the plain and ordinary meaning of “medical records”
       is “[t]he documents that compose a medical patient’s healthcare history.” Black’s
       Law Dictionary 1177 (11th ed. 2019). Although the year element requested by
       plaintiff is found in medical records, the year element by itself, stripped of context,
       is not a document of a patient’s healthcare history.

                                               - 14 -
¶ 50       Defendant argues that, even if maintaining patient anonymity permits
       disclosure of the year element, the process of matching the year of patient
       admission to the year of police notification would require “some form of personally
       identifiable information such as the medical record number.” Processing the FOIA
       request might involve accessing medical records, including their reference
       numbers, to match the year of patient admission to the year of law enforcement
       notification. But section 7(1)(b) of FOIA prohibits the disclosure, not the use, of
       medical records. Theoretically, defendant can use the medical record numbers to
       match the year elements of patient admission and law enforcement notification and
       then renumber the matched records before turning them over to plaintiff.

¶ 51       Defendant concludes that the exemption for medical records would be rendered
       superfluous if a public body could simply redact personally identifying information
       and release the rest of the record. However, the exemption for private information
       under section 7(1)(b) plainly covers “unique identifiers,” which confirms that the
       removal of uniquely identifying information from a patient’s healthcare history
       renders the remainder of the document releasable. Adopting defendant’s broad
       interpretation that “medical records” are exempt in their entirety would potentially
       shield from disclosure all information concerning patient care undertaken by a
       public body.

¶ 52                                 3. Unduly Burdensome

¶ 53       Defendant alternatively argues that, even if the year element of the responsive
       records is not exempt from disclosure, the information was not withheld
       improperly. Defendant asserts the steps for processing the request, including the
       de-identification of the records, would be unduly burdensome under section 3(g) of
       FOIA. 5 ILCS 140/3(g) (West 2018). Defendant adds that plaintiff’s
       “reformulation” of the request at the summary judgment stage would make
       compliance even more burdensome.

¶ 54      Section 3(g) provides,

          “[r]equests calling for all records falling within a category shall be complied
          with unless compliance with the request would be unduly burdensome for the

                                              - 15 -
          complying public body and there is no way to narrow the request and the burden
          on the public body outweighs the public interest in the information.” Id.

       Plaintiff’s request for information about walk-in gunshot wound patients concerns
       a distinct category of records, so section 3(g) potentially applies.

¶ 55        Plaintiff responds that defendant has failed to preserve the issue for review. See,
       e.g., Lazenby v. Mark’s Construction, Inc., 236 Ill. 2d 83, 92 (2010) (the failure to
       raise an issue in the circuit court or appellate court results in forfeiture). Plaintiff
       claims defendant was required to invoke section 3(g) as an affirmative defense and
       in its motion for summary judgment, or risk forfeiture. Plaintiff does not develop
       its forfeiture argument besides asserting “this court need not address the merits of
       [defendant’s] burden claim because it failed to properly raise the issue below.” We
       decline to advocate for plaintiff on the potentially complex issue of what measures
       a public body must take to preserve the unduly burdensome defense under FOIA.
       People ex rel. Illinois Department of Labor v. E.R.H. Enterprises, Inc., 2013 IL
       115106, ¶ 56 (“a reviewing court is not simply a depository into which a party may
       dump the burden of argument and research”).

¶ 56       Setting forfeiture aside, this action’s procedural posture illustrates why
       weighing the evidence on the burdens associated with processing the request would
       be premature at this point. Cross-motions for summary judgment, like those filed
       in this case, ordinarily signify the parties’ mutual agreement that there are no
       genuine issues of material fact and that only a question of law remains. Jones, 2016
       IL 119618, ¶ 26. However, defendant did not invoke section 3(g) in its motion for
       summary judgment, which was perhaps a tacit acknowledgment that a question of
       fact exists about whether processing the request would be unduly burdensome. The
       record contains some evidence, but the lower courts did not reach the issue because
       the parties have focused on the two exemptions concerning HIPAA and medical
       records.

¶ 57       Because the litigation did not progress beyond the summary judgment stage, we
       confine our review to the summary judgment entered for defendant and decline to
       delve into the factual question of the burdens associated with processing the
       request. That said, the circuit court is free to address the procedural and substantive
       issues surrounding the unduly burdensome nature of the request if defendant asserts

                                                - 16 -
       section 3(g) on remand. We emphasize that we express no opinion on the matter.

¶ 58                                   III. CONCLUSION

¶ 59       The parties disputed in their cross-motions for summary judgment whether two
       exemptions authorized defendant to withhold the year of admission for walk-in
       gunshot wound patients and the corresponding year of police notification from
       January 1, 2015, through September 10, 2018. Defendant claims (1) the
       information is prohibited from disclosure under HIPAA and (2) the information is
       “private information” under FOIA. 5 ILCS 140/7(1)(a), (b) (West 2018). We hold
       that the HIPAA regulations and FOIA exemptions cited by defendant do not bar
       the release of the year elements of the responsive records as long as the remaining
       individual identifying information is removed to maintain patient confidentiality.
       We affirm the appellate court judgment, reverse the circuit court judgment, and
       remand the cause to the circuit court for further proceedings consistent with this
       opinion.

¶ 60      Appellate court judgment affirmed.

¶ 61      Circuit court judgment reversed.

¶ 62      Cause remanded.

¶ 63      CHIEF JUSTICE THEIS, dissenting:

¶ 64       Contrary to how the majority frames it, the issue in this case is not whether the
       year that each walk-in gunshot wound patient was admitted to the hospital and the
       year that law enforcement was notified of the admission are exempt from disclosure
       under the Freedom of Information Act (FOIA) (5 ILCS 140/1 et seq. (West 2018)).
       Rather, the issue is whether FOIA requires a public body to review its records to
       piece together information to create a new document in response to a FOIA request.
       FOIA imposes no such requirements on the public body. Therefore, I respectfully
       dissent.

                                              - 17 -
¶ 65       The majority correctly observes that FOIA’s underlying public policy is that
       “all persons are entitled to full and complete information regarding the affairs of
       government and the official acts and policies of those who represent them as public
       officials and public employees consistent with the terms of this Act.” 5 ILCS 140/1
       (West 2018). At the same time, FOIA is not intended to “disrupt the duly-
       undertaken work of any public body independent of the fulfillment of any of the
       fore-mentioned rights of the people to access to information.” Id. Further, FOIA

           “is not intended to create an obligation on the part of any public body to
           maintain or prepare any public record which was not maintained or prepared by
           such public body at the time when this Act becomes effective, except as
           otherwise required by applicable local, State or federal law.” Id.

¶ 66       As an initial matter, I question whether the request at issue sought public
       records that were subject to production under FOIA. As courts have ruled, a
       “request to inspect or copy must reasonably identify a public record and not general
       data, information, or statistics.” Chicago Tribune Co. v. Department of Financial
       & Professional Regulation, 2014 IL App (4th) 130427, ¶ 33; see also Kenyon v.
       Garrels, 184 Ill. App. 3d 28, 32 (1989) (observing that FOIA “does not compel the
       agency to provide answers to questions posed by the inquirer”). Here, as modified
       on appeal, plaintiff’s FOIA request sought the year of

           “admission of patients seeking treatment for gunshot wounds through
           [defendant] between Jan. 1, 2015, through the present day who were not ***
           accompanied by a law enforcement officer at the time of their admission as well
           as the corresponding [year] that law enforcement officials were notified of the
           patients’ admission as required by state statue [sic].”

       This appears to be a request for general information, rather than a request for public
       records under FOIA. 2

           2
            By contrast, plaintiff’s other request (which is not at issue in this appeal) asked the hospital for
       “[w]ritten policy and/or related policy documents, and/or internal memos or communications setting
       policy or providing guidelines, instructions and/or directives to staff in the reporting of patients who
       have suffered gunshot wounds to law enforcement agencies as required by state statute.” The
       hospital provided plaintiff with those policies.

                                                        - 18 -
¶ 67       Setting that question aside, the majority notes that the Cook County Health and
       Hospitals System is required to notify local law enforcement when a person who is
       not accompanied by a law enforcement officer arrives for treatment for a gunshot
       wound. 20 ILCS 2630/3.2 (West 2018). The hospital is not, however, required to
       keep a written log of when it notifies law enforcement. See id. In response to
       plaintiff’s FOIA request and again in its summary judgment filings, the hospital
       explained that there is no written record that tracks the year a gunshot wound patient
       arrived at the hospital unaccompanied by law enforcement and the year that law
       enforcement was notified. In other words, there is no public record that contains the
       information that plaintiff seeks.

¶ 68       Neither plaintiff nor the majority appear to dispute that the hospital does not
       possess the information that plaintiff has requested. See In re Wade, 969 F.2d 241,
       246 (7th Cir. 1992) (“Without evidence of bad faith, the veracity of the
       government’s submissions regarding reasons for withholding the documents should
       not be questioned.”). Nonetheless, the majority would require the hospital to comb
       through the medical records of each gunshot wound patient to see whether the
       hospital’s staff included a notation about whether the patient arrived with law
       enforcement or if law enforcement was notified of the admission. According to the
       majority, the hospital can then “use the medical record numbers to match the year
       elements of patient admission and law enforcement notification and then renumber
       the matched records before turning them over to plaintiff.” Supra ¶ 50. This
       presumably would require the hospital to create a chart that includes a reference
       number for the patient and the years of patient admission and law enforcement
       notification.

¶ 69       The majority would impose these requirements even though FOIA “is not
       designed to compel the compilation of data the governmental body does not
       ordinarily keep.” Kenyon, 184 Ill. App. 3d at 32. FOIA also does not require a
       public body to generate new records in response to FOIA requests. Martinez v.
       Cook County State’s Attorney’s Office, 2018 IL App (1st) 163153, ¶ 30; see also
       Hites v. Waubonsee Community College, 2016 IL App (2d) 150836, ¶ 74
       (distinguishing between performing a search for data on a database that contains
       public records, which is permissible under FOIA, and creating a new record or
       performing research, which is not). And to the extent that the majority would
       require the hospital to produce redacted medical records (see supra ¶ 51), it is not

                                               - 19 -
       clear to me that a gunshot wound patient’s medical records pertain to the transaction
       of public business. See 5 ILCS 140/2(c) (West 2018) (defining “public records,” in
       part, as all “documentary materials pertaining to the transaction of public business,
       *** having been prepared by or for, or having been or being used by, received by,
       in the possession of, or under the control of any public body”).

¶ 70       FOIA does not require a public body to compile information that it does not
       otherwise keep, nor does it require a public body to create a new record in response
       to a FOIA request. Accordingly, I would affirm the trial court’s grant of summary
       judgment in the hospital’s favor. For these reasons, I respectfully dissent.

                                              - 20 -