2025 IL App (1st) 240485 Fourth Division Filed December 18, 2025 No. 1-24-0485

IN THE APPELLATE COURT OF ILLINOIS FIRST DISTRICT ) MARVA BURNETTE, ) Plaintiff-Appellee, ) ) Appeal from the v. Circuit Court of Cook County. ) RUSSELL P. NOCKELS, M.D.; IGNACIO ) No. 23 L 000973 JUSUE-TORRES, M.D.; and LOYOLA ) UNIVERSITY MEDICAL CENTER, ) The Honorable Scott D. McKenna, Defendants ) Judge, presiding. ) (Loyola University Medical Center, Defendant- ) Appellant). )

JUSTICE OCASIO delivered the judgment of the court, with opinion.

Presiding Justice Navarro and Justice Lyle concurred in the judgment and opinion.

OPINION ¶1 In this interlocutory appeal, we must decide whether the trial court properly exercised its discretion when it allowed the plaintiff’s request for a live inspection at which her technical consultant would oversee an unfiltered extraction of audit-trail data from the defendant hospital’s electronic medical record system. We hold that the trial court correctly based its decision on the discovery rules, not federal regulations, and that it otherwise exercised its discretion reasonably.

¶2 I. BACKGROUND ¶3 According to the complaint and its attachments, in May 2021, the plaintiff, Marva Burnette, went to defendant Loyola University Medical Center (Loyola) for a lumbar spinal decompression No. 1-24-0485

and fusion. Instead, doctors performed the decompression and fusion procedure on vertebrae in her upper back. In 2023, she sued Loyola and two physicians for malpractice.

¶4 In discovery, Burnette asked Loyola to produce her medical records and their associated audit trails. Loyola produced the medical records. It also produced an audit trail for the period between March 25, 2021, the day Burnette presented at Loyola with the complaints that led to the surgery, and January 4, 2022, the day she notified Loyola that she was transferring her care to another hospital. The data was produced both as five printable PDF files and five Microsoft Excel spreadsheet files.

¶5 Burnette then moved to compel Loyola to produce a complete, unfiltered audit trail and to permit an “inspection” that would amount to Burnette’s technical expert overseeing and directing the retrieval of the audit-trail data from Loyola’s computer systems. She argued that the production was incomplete because it did not contain any audit data showing changes that may have been made to her medical record before March 25, 2021, or after January 4, 2022. She also contended that the audit trails appeared to have not included several data fields that they should have and that, because the audit trail was split across five files, there were four gaps in time between the last entry in a spreadsheet and the first entry in the next one. Burnette asserted that she had a right to a complete, unfiltered audit trail for her medical records under both Illinois statutory law and federal regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of Titles 18, 26, 29, and 42 of the United States Code)).

¶6 The motion to compel was supported by two affidavits sworn to by Lee Neubecker, who identified himself as a “computer forensics, data analytics, cyber security and technology consultant” who had significant experience reviewing and analyzing electronic medical records and audit trails. According to Neubecker, there were several problems with the audit trail produced by Loyola. First, he noted that Loyola’s production had split the audit trail across five different spreadsheets, which was unnecessary from a technical perspective but created a risk that some data had been omitted by mistake. Second, he explained that a complete audit trail that went all the way

-2- No. 1-24-0485

to the date of production was necessary to identify whether any records had been modified before being produced. Third, he opined that Loyola had filtered the audit trail data before producing it.

He noted that the spreadsheets did not include at least four “standard fields.” He also stated that the entries in the “Event Type” field “appear[ed] to be limited to a handful” of the event types that “commonly” appeared in Epic-generated audit trails, suggesting that the production was not complete. To ensure that Loyola produced a complete, unfiltered audit trail, Neubecker recommended that the court consider ordering a “supervised inspection” where Loyola personnel would extract the audit data from its live system while he monitored and directed the process as necessary. He opined that the supervised inspection would require no more than three hours, excluding any follow-ups needed for specific documents, and that it was the most efficient way to ensure that Burnette would receive a complete and accurate audit trail.

¶7 Loyola’s response contended that Burnette had a right to her medical records under applicable law but not a right to be furnished copies of the audit trails for those records. Nevertheless, it asserted that it had, in fact, produced a “complete” audit trail. Although conceding that the data it produced covered a limited time period, it argued that Burnette had not shown that data generated outside that period would be relevant and that, in any event, producing that data would be disproportionately burdensome relative to its possible utility. Loyola disputed Burnette’s claim that there were any gaps in the audit trail. It observed that three of the four “gaps” were only a matter of minutes long and that the fourth “gap” was a 19-hour period in between two outpatient appointments, reflecting nothing more than the fact that nobody accessed her record during those time periods. Loyola also argued that its production of the audit trail split across five files, rather than one file, was necessitated by the sheer volume of data involved. Emphasizing that each of the five spreadsheets contained “approximately 1 megabyte of data,” Loyola contended that Burnette could not “credibly argue that Defendant is required to maintain a system that can allow for the

-3- No. 1-24-0485

transfer of 6 megabytes of data in a single file.” 1 Loyola characterized Neubecker’s opinion that it had produced a filtered version of the audit trail as being “simply untrue,” arguing that Neubecker’s assertions that the production did not include certain fields or event types he would typically see were unsupported and conclusory. Alternatively, Loyola argued that the proposed inspection protocol, which called for Neubecker to supervise remotely, would violate HIPAA because Zoom did not satisfy the security requirements for transmitting protected health information, and it asked the court to be given a chance to depose Neubecker before being required to submit to an inspection.

¶8 The court granted Burnette’s motion to compel, explaining as follows: “Plaintiff is entitled to inspect the audit trail. We have been through this on numerous other cases. They have an affidavit from someone saying that it’s not being fully produced. I don’t see a competing affidavit from the defense end saying, You know what? My IT guy—or here’s the IT guy who says this information either is not locatable or downloadable, or something of that nature. And there’s argument being made, but I don’t see anything of evidentiary value[ ] indicating that the information could not potentially be there in the system.

*** *** [T]he bottom line is according to the law, the CFR, everything— I mean, this is the plaintiff’s records. And until the legislature takes this up—and I would encourage you to talk to the [Illinois Trial Lawyers Association] to have them do that—there needs to be set guidelines for what needs to be stored, produced, and all that, but we don’t have that.

For context, the common law record in this appeal contains approximately 61 megabytes of data. A typical CD-ROM has a capacity of at least 650 megabytes.

-4- No. 1-24-0485

So the plaintiff is entitled to look at what is potentially in that [EMR], so that will be the order today.”

After counsel for Loyola protested that an inspection under Neubecker’s proposed protocol would violate HIPAA, the court agreed that Loyola was “entitled to a protocol.” It indicated that, if the parties were unable to work one out by agreement, the court would set the terms of the inspection.

¶9 In a motion to reconsider, Loyola argued that the court had erred by finding that federal law required it to disclose the audit trails to Burnette. It also contended that Neubecker’s “unsubstantiated” affidavit did not make a prima facie case for an inspection. In denying the motion, the court clarified that, in its understanding, Burnette had a right to access her full records, but the manner of that access was left to the court’s discretion: “[Y]ou’re asserting that I wrongfully relied on some mandatory federal regulations that require an inspection. I don’t know—I don’t think I framed it that it was—that federal law necessarily requires an audit trail production to be in any certain [form] or any certain way.

But, I believe that what the federal regulations do require is that the patient has access to its own—their own record. And how that’s done is completely within the Court’s discretion.

*** I will submit to you that, you know, perhaps there’s not a federal—and there’s—I don’t think the CFR lays out exactly how—how audit trails are supposed to be developed. *** *** [B]ut in the absence of that, it’s certainly within my discretion to say that I have reason to believe or I—there’s at least a reasonable potentiality here that the plaintiff has not been provided all of *** her records. And at a minimum, I believe that an inspection is appropriate to make that determination because they’re the ones—it’s their record, it’s their case.

-5- No. 1-24-0485

They’re the ones that underwent the medical care. They should have a right to confirm or deny that they have all the records. *** I’ll concede that, I mean, there’s not any one factor that makes anything mandatory.

But I believe—so I don’t think I misapplied the law in that sense. If I said that, I may have been [in] error.

But, that doesn’t affect the overall tenor of this, which is that if there’s reason to believe that not everything has been produced in a patient’s chart, or there’s reason to believe that they should at—or—or at least at a minimum, they have a right to confirm that everything has been produced that’s in their chart. To that extent, the motion to reconsider will be denied.”

At that point, counsel for Loyola clarified that, as far as he understood it, the dispute was over the audit trails, not the medical records. Burnette’s attorney responded that ascertaining whether the entire medical record had, in fact, been produced was “the entire reason for the audit trail,” and the court agreed: “Yeah. I think—I think a plaintiff has—there’s a reason and there’s a good reason why they should know whether the entirety of their char[t] has been produced. And simply relying on defense representations, I mean, that’s all well and good, but, I mean, if all we’re doing here is confirming that—that the entirety has been produced, then the—the inspection should confirm that on your side.”

¶ 10 At Loyola’s request, the court set a compliance date to allow it to decide whether to comply or to seek to be held in friendly contempt. Loyola chose the latter course, and the court duly entered a finding of civil contempt and imposed a sanction of $50, facilitating this appeal. See Ill. S. Ct. R. 304(b)(5) (eff. Mar. 8, 2016).

-6- No. 1-24-0485

¶ 11 II. ANALYSIS ¶ 12 On appeal, Loyola challenges the trial court’s order compelling an inspection. Although that order was nonfinal, and therefore not itself appealable, we have jurisdiction to review it because Loyola’s noncompliance with the inspection order was the basis for the trial court’s later contempt order. Norskog v. Pfiel, 197 Ill. 2d 60, 69 (2001). We generally review discovery orders for an abuse of discretion (id. at 70), but the appropriate standard of review ultimately depends on the nature of the specific question the trial court answered. People v. Cole, 2017 IL 120997, ¶ 19.

¶ 13 Loyola’s primary argument on appeal is that the trial court erred as a matter of law by finding that Burnette was entitled to disclosure of the audit trail for her medical records under federal health-information regulations. The parties both argue that, in granting Burnette’s motion to compel, the trial court found that federal law required Loyola to produce the audit trial upon demand. They dispute whether that proposition was legally sound: Loyola contends that federal law grants patients only the right to access their medical records, not the associated audit trails, while Burnette argues that her right of access includes both her records and the audit trails. See 45 C.F.R. § 164.524(a) (2014) (establishing right of access); 45 C.F.R. § 164.502(a)(2)(i) (2013) (mandating disclosure upon request). If the court’s inspection order was premised on a misunderstanding of law, as Loyola contends, then appellate review is necessary to ensure that its exercise of discretion was not “frustrated by an erroneous rule of law.” People v. Williams, 188 Ill. 2d 365, 369 (1999). Because the question is one of law, our review is de novo. Id. ¶ 14 The parties’ framing of the issue assumes that the discoverability of the audit trails turned on whether that data was encompassed within the HIPAA right of access. We do not agree.

¶ 15 Discovery is governed by the Illinois Supreme Court rules, not by federal regulations. See Ill. S. Ct. R. 201(a) (eff. Mar. 17, 2023) (“Information is obtainable as provided in these rules ***.”).

Generally, the rules require “full disclosure regarding any matter relevant to the subject matter involved in the pending action.” Ill. S. Ct. R. 201(b)(1) (eff. Mar. 17, 2023). This is a very broad criterion that reaches not only material that would be relevant at trial but also material that can lead to admissible evidence. Findlay v. Chicago Title Insurance Co., 2022 IL App (1st) 210889,

-7- No. 1-24-0485

¶ 115; accord Krupp v. Chicago Transit Authority, 8 Ill. 2d 37, 41 (1956). This “general duty to disclose” (Dameron v. Mercy Hospital & Medical Center, 2020 IL 125219, ¶ 18) is then tempered by other rules, such as provisions exempting privileged materials and giving the court discretion to regulate discovery to prevent requests that are abusive, unreasonably burdensome, and so forth.

See Ill. S. Ct. R. 201(b)(2), (c) (eff. Mar. 17, 2023). The purpose of these rules is to ferret out the truth, help attorneys prepare for trial, and eliminate surprise, thereby “promot[ing] an expeditious and final determination of controversies in accordance with the substantive rights of the parties.”

D.C. v. S.A., 178 Ill. 2d 551, 561 (1997).

¶ 16 The HIPAA right of access serves purposes having nothing to do with resolving litigation. Its goal is to make sure that patients have “easy access to their health information,” which “empowers them to be more in control of decisions regarding their health and well-being.” U.S. Dep’t of Health & Hum. Serv., Individuals’ Right Under HIPAA to Access Their Health Information 45 C.F.R. § 164.524, https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html (last visited Dec. 5, 2025) [https://perma.cc/RRM9-QDK6]. The relevant regulation anticipates that patients will obtain their health information directly from their providers, who will put in place procedures to receive and act on access requests, communicate with requesters, internally review certain kinds of denials, and ultimately decide how to facilitate access. See 45 C.F.R. § 164.524 (2014). The regulation does not anticipate that the right of access will be enforced through court- mediated discovery procedures. To the contrary, the regulations treat discovery as a distinct process that takes place outside of the right-to-access framework by exempting discovery responses from the general rule of nondisclosure. See 45 C.F.R. § 164.512(e)(1) (2016); see Northwestern Memorial Hospital v. Ashcroft, 362 F.3d 923, 925-26 (7th Cir. 2004) (explaining that section 164.512(e) creates “a procedure for obtaining authority” to use protected health records during litigation).

¶ 17 In short, the discovery rules are “procedural tools to effectuate the prompt and just disposition of litigation, by educating the parties in advance of trial as to the real value of their claims and defenses.” People ex rel. Terry v. Fisher, 12 Ill. 2d 231, 236 (1957). The HIPAA right of access is

-8- No. 1-24-0485

not animated by the same goals. Whether the right of access encompasses a particular data set has no bearing on whether it is within the general scope of discovery. See Ill. S. Ct. R. 201(b)(1) (eff.

Mar. 17, 2023). At most, the existence of a right of access might inform the court’s assessment of the burden a particular discovery request would impose on a party. Otherwise, the right of access generally has no impact on discovery, and discovery disputes involving medical records and audit data should be resolved by reference to the ordinary rules governing pretrial discovery, not the HIPAA right of access.

¶ 18 From our review of the record, it appears that the trial court’s ruling on the motion to compel was consistent with this analysis. Although the court referred to the HIPAA right of access at points, it did so only in the context of Burnette’s right to access her medical records—something neither party disputes are subject to disclosure—not the associated audit trails. At no point did it find that the HIPAA right of access encompassed a right to access audit trails. Instead, the court emphasized that the audit trails were subject to discovery because Burnette had shown an adequate basis for believing that Loyola might not have disclosed the entirety of the underlying medical records. In other words, it reasonably determined that the audit trails were a “matter relevant to the subject matter involved in the pending action.” Id. Accordingly, the trial court’s exercise of discretion was not frustrated by an erroneous rule of law.

¶ 19 Loyola also advances several other arguments that the trial court erred in granting the motion to compel. We have reviewed those arguments, and we find no abuses of discretion. First, the trial court reasonably relied on the unrebutted affidavits of Burnette’s technical consultant to find that there was a genuine concern that Loyola had not produced an unfiltered audit trail and that an inspection might reveal previously undisclosed records or audit data. Second, because the medical records produced in discovery could have been accessed or modified at any point before the date of the production, to the extent the trial court found that audit data generated after January 4, 2022, was relevant and discoverable, it acted reasonably and did not abuse its discretion. Third, based on the limited information before it, which indicated that an inspection would take no more than three hours and require only one Loyola employee with sufficient knowledge of and access to the

-9- No. 1-24-0485

appropriate systems, the trial court reasonably determined that the burden of an inspection would not outweigh its potential utility. Finally, as the trial court has not yet set a protocol for the inspection, Loyola’s argument that the inspection would carry unacceptable security risks and violate HIPAA is premature.

¶ 20 In summary, the trial court correctly resolved the motion to compel, based on the applicable discovery rules. It neither premised its ruling on the HIPAA right of access, nor otherwise erred when it granted the motion to compel. We therefore affirm the order allowing the motion to compel.

Consistent with our usual practice, we also vacate the order finding Loyola in friendly contempt.

See John Doe Corp. 1 v. Huizenga Managers Fund, LLC, 2021 IL App (2d) 200513, ¶ 94.

¶ 21 III. CONCLUSION ¶ 22 For the foregoing reasons, we affirm the trial court’s order granting the motion to compel and vacate the order finding Loyola in friendly contempt.

¶ 23 Affirmed in part and vacated in part.

- 10 - No. 1-24-0485

Burnette v. Nockels, 2025 IL App (1st) 240485

Decision Under Review: Appeal from the Circuit Court of Cook County, No. 23-L- 000973; the Hon. Scott D. McKenna, Judge, presiding.

Attorneys Jennifer M. Suttle, Jason Gluskin, and Joseph E. Comer, of for Barker, Castro & Steinback, LLC, of Chicago, for appellant.

Appellant:

Attorneys Leslie J. Rosen, of Leslie J. Rosen Attorney at Law, P.C., and for Jason Williams, of Smith Lacien, LLP, both of Chicago, and Appellee: Robert J. Rooth, of The Rooth Law Firm, of Evanston, for appellee.

- 11 -