delivered the opinion of the court:
The plaintiffs in this consolidated appeal filed complaints alleging, inter alia, medical malpractice and drug product liability. The plaintiffs alleged that they had suffered injuries from injections of disease, the trade name used by defendant Baxter Laboratories, Inc., for chymopapain, a Federal Drug Administration investigational drug. During discovery, the plaintiffs sought the production of the medical records of patients, other than the plaintiffs, who also had been treated with disease at the defendant hospital, Central DuPage Hospital (the hospital). The hospital’s objections were overruled, and the trial court subsequently ordered the hospital to produce the admission and discharge summaries (the records) of some 800 patients. The court stated that the hospital could strike the names and identifying numbers of the patients from the records. The hospital failed to comply with the court’s orders and was held in contempt of court. The hospital appeals.
The issues presented in this appeal are: (1) whether a hospital can assert the physician-patient privilege; (2) whether the physician-patient privilege protects the hospital’s records; (3) whether the physician-patient privilege has been waived by the hospital or the patients; (4) whether the hospital records are relevant to the plaintiffs’ actions; and (5) whether the records are protected by the patients’ constitutional and Federal statutory rights of privacy and due process.1
Although communications between a doctor and patient were not protected at common law (The Physician-Patient Privilege, 56 Nw. U.L. Rev. 263 (1961)), the State of Illinois has created a statutory protection for certain information obtained by a physician in his professional relationship with a patient. (People v. Bickham (1980), 90 Ill. App. 3d 897, 414 N.E.2d 37, aff'd (1982), 89 Ill. 2d 1, 431 N.E.2d 365.) The Illinois statute, which is similar in substance to those of other States (Geisberger v. Willuhn (1979), 72 Ill. App. 3d 435, 390 N.E.2d 945), provides in pertinent part:
“No physician or surgeon shall be permitted to disclose any information he may have acquired in attending any patient in a professional character, necessary to enable him professionally to serve such patient, except only * * * (2) in actions, civil or criminal, against the physician for malpractice, (3) with the expressed consent of the patient, ° e (4) in all civil suits brought by or against the patient, * * * wherein the patient’s physical or mental condition is an issue, * * * (6) in any criminal action where the *853charge is either murder by abortion, attempted abortion or abortion • * Ill. Rev. Stat. 1979, ch. 51, par. 5.1.
The plaintiffs in the instant case argue that the statute only permits the physician or surgeon to assert the privilege on behalf of the patient. Thus, they contend that the hospital does not have standing to claim the physician-patient privilege.
We believe that in certain instances a hospital can assert the physician-patient privilege to protect the records of its patients. While no Illinois court has ruled on this issue, we believe that such a conclusion can be drawn inferentially from the case of Cannell v. Medical & Surgical Clinic, S.C. (1974), 21 Ill. App. 3d 383, 315 N.E.2d 278. Cannell held that the defendant medical clinic had a duty to disclose a patient’s medical history, upon the patient’s request, to third parties. In reaching this conclusion the court quoted the following passage from Emmett v. Eastern Dispensary & Casualty Hospital (D.C. Cir. 1967), 396 F.2d 931, 935:
“ ‘The responsibilities of physicians and hospitals to protect their patients’ medical facts from extrajudicial exposure spring from the confidential nature of the relationship. We find in the fiducial qualities of that relationship the physician’s duty to reveal to the patient that which in his best interests it is important that he should know.’” (Emphasis added.) 21 Ill. App. 3d 383, 385, 315 N.E.2d 278, 280.
This issue specifically was decided by the Arizona courts in Tucson Medical Center Inc. v. Rowles (1974), 21 Ariz. App. 424, 520 P.2d 518. The Arizona statute construed in that case provided that in a civil action physicians and surgeons could not, without the consent of their patients, be examined as to certain physician-patient communications. (Ariz. Rev. Stat. Annot. §12 — 2235 (1982).) In holding that the hospital could assert the privilege on behalf of the patient, the court stated:
“We have neither discovered nor have we been cited to authority holding directly that a hospital cannot assert the privilege as to records containing confidential material when both the physician and the patient are absent from the proceedings. * * * [OJur decision above that hospital records are covered by the physician-patient privilege mandates that the hospital assert this privilege when neither the patient nor his physician are parties to the proceeding. To hold otherwise would deprive a patient of the confidentiality granted him by A.R.S. §12 — 2235 * 21 Ariz. App. 424, 429, 520 P.2d 518, 523.
Central DuPage Hospital was the only defendant from whom the plaintiffs sought the records of patients who were treated with disease. Therefore, we hold that the hospital was mandated to assert the physi*854cian-patient privilege to insure that the patients’ records would be protected in accordance with the intentions of our statute.2
The next issue raised in this appeal is whether the Illinois physician-patient privilege is applicable in the case at bar. The plaintiffs contend that the records were discoverable because they met the second of seven statutory exceptions to the privilege — “in actions, civil or criminal, against the physician for malpractice” (Ill. Rev. Stat. 1979, ch. 51, par. 5.1). It is the plaintiffs’ position that this exception is not limited to the records of the patient who brings an action for malpractice. They argue that the exception should apply to the records of all patients of the physician who is being sued for malpractice.
As we stated in People v. Bickham, the purpose of the physician-patient privilege is to encourage free disclosure between the physician and patient and to protect the patient from the embarrassment and invasion of privacy which disclosure would entail. (See also The Physician-Patient Privilege, 56 Nw. U.L. Rev. 263, 266-69 (1961).) The physician-patient privilege, as with other statutory privileges, is a legislative balancing between relationships that society feels should be fostered through the shield of confidentiality and the interests served by disclosure of the information in a court of law. (See In re Westland (1976), 48 Ill. App. 3d 172, 362 N.E.2d 1153; Note, Physician-Patient Privilege, 46 Chi.Kent L. Rev. 37 (1969).) Except for the purposes specified in the statute, the legislature has decided in favor of the former.
Recognizing a similar legislative policy determination, New Jersey courts have held that their statutory physician-patient privilege prohibits a physician from revealing to a plaintiff in a civil malpractice action the identities, ailments and treatments of his patients who are not parties to the litigation. In Osterman v. Ehrenworth (1969), 106 N.J. Super 515, 256 A.2d 123, the court refused to allow the disclosure of such information without the consent of the nonparty patients and held that the revelation of such information “would amount to judicial disregard of the legislatively expressed public policy; it would disclose that which the legislature has specifically acted to protect.” (106 N.J. Super. 515, 525, 256 A.2d 123, 129.) The disclosure of nonparty patients’ information has been forbidden in several other States as well. Tucson Medical Center, Inc. v. Rowles; Costa v. Regents of University of California (1953), 116 Cal. App. 2d 445, 254 P.2d 85; Argonaut Insurance Co. v. Peralta (Fla. App. 1978), 358 So. 2d 232; Shepherd v. McGinnis (1964), 257 Iowa 35, 131 N.W.2d 475.
*855 The information in the patients’ records in the case at bar deserves the protection of confidentiality that the legislature envisioned and in accordance with the public policy expressed above. Although the Illinois statute on the physician-patient privilege exempts civil malpractice actions, we believe that that exception should be limited to only allow the disclosure of the records of the patient who is bringing the malpractice action. A broadening of that exception to allow the disclosure of communications involving patients who are not parties to the litigation would neither serve a public interest nor the private interests of those nonparty patients.
We also reject the plaintiffs’ argument that the physician-patient privilege would not have been violated because the trial court ordered that the names and identifying numbers of the patients be excluded from the records. A similar trial court order was held violative of the privilege in Argonaut Insurance Co. v. Peralta. (Contra, Community Hospital Association v. District Court (1977), 194 Col. 98, 570 P.2d 243.) As in Argonaut Insurance Co., the plaintiffs in the instant case seek specific medical information about nonparty patients. The hospital’s admit and discharge summaries of the other patients who had been injected with disease contain information acquired in attending the patients, which information the Illinois physician-patient privilege protects. Cf. Gourdine v. Phelps Memorial Hospital (1972), 40 App. Div. 2d 694, 336 N.Y.S.2d 316 (the physician-patient privilege does not apply to ordinary incidents and facts which are not necessary for a physician to treat his patient).
Whether the patients’ identities would remain confidential by the exclusion of their names and identifying numbers is questionable at best. The patients’ admit and discharge summaries arguably contain histories of the patients’ prior and present medical conditions, information that in the cumulative can make the possibility of recognition very high. (See Doe v. Roe (1977), 93 Misc. 2d 201, 214 n.9, 400 N.Y.S.2d 668, 677 n.9.) As the patients disclosed this information with an expectation of privacy, their rights to confidentiality should be protected.3
The third issue raised in this appeal is whether the physician-patient privilege was waived. The plaintiffs argue that the hospital has waived the privilege by responding to a supplementary interrogatory that to the hospital’s knowledge no patients, except the plaintiffs, had suffered adverse reactions to the drug disease. A similar argument was rejected in Tucson Medical Center, Inc. v. Rowles wherein the court stated that the *856privilege only could be waived by the holder of the privilege, the patient. We agree and hold that the hospital in the case at bar could not waive the patients’ rights to confidentiality. We further find that the patients did not waive the physician-patient privilege when they signed authorizations allowing the hospital to release their medical information to “such agencies as might be concerned with third party payment of charges for services.” We do not believe that the execution of this limited waiver evidences an intent by the patients to allow the release of their medical information to unknown individuals or agencies or to the public at large. Cf. People v. Mileris (1981), 103 Ill. App. 3d 589 (no expectation of confidentiality where patients’ medical records are subject to disclosure under Workmen’s Compensation Act).
Since we find that the physician-patient privilege bars the discovery of the hospital records sought by the plaintiffs, a discussion of the other issues raised in the instant case is unnecessary.
For the foregoing reasons, the judgment of the circuit court of Cook County is reversed and the cause is remanded for further proceedings in accordance with the views expressed herein.
Reversed and remanded.
WHITE, P. J., and RIZZI, J., concur.