Summary
holding that a medical authorization lacking core elements required by federal law for HIPAA compliance was not substantially compliant with Section 121(E)
Summary of this case from Martin v. Rolling Hills Hosp., LLCOpinion
No. E2017-01603-COA-R3-CV
11-28-2018
Jennifer PARKS v. Rebecca A. WALKER, M.D. et al.
This is a health care liability action. Plaintiff gave written pre-suit notice of her claim to potential defendants. See Tenn. Code Ann. § 29-26-121(c) (2018). She then filed her complaint. Defendants filed motions to dismiss. After a hearing, the trial court held that plaintiff failed to substantially comply with the requirements of the notice statute by failing to provide a HIPAA-compliant medical authorization, pursuant to Tenn. Code Ann. § 29-26-121(a)(2)(E). It entered an order granting defendants' motions to dismiss. Plaintiff appeals. We affirm.
I.
On February 19, 2015, plaintiff had a robotic-assisted hysterectomy. She subsequently suffered complications causing her pain and injury. On February 19, 2016, plaintiff provided pre-suit notice of her potential claim to defendants. See Tenn. Code Ann. § 29-26-121. On June 17, 2016, plaintiff filed her complaint. On July 15, 2016, defendants Parkwest Medical Center and Covenant Health filed their joint motion to dismiss. On July 20, 2016, defendants Rebecca A. Walker, M.D. and Parkwest Women's Specialists, PLLC filed their own joint motion to dismiss. Defendants advance similar arguments in their respective motions.
45 C.F.R. § 164.508(b)(2)(ii) states that an authorization is invalid if it "has not been filled out completely, with respect to an element described in paragraph (c) of this section;" paragraph (c) refers to the core elements required for a valid authorization enumerated in 45 C.F.R. § 164.508(c)(1). Defendants argue that the medical authorizations provided by plaintiff are invalid, because they fail to include a core element. Defendants specifically point to plaintiff's failure to meet 45 C.F.R. § 164.508(c)(1)(iv), which requires that the authorization include:
A description of each purpose of the requested use or disclosure. The statement ‘at the request of the individual’ is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.
45 C.F.R. § 164.508(c)(1)(iv). The authorization plaintiff provided to defendants included the following section:
Actual image of blank section on plaintiff's pre-suit notice HIPAA authorization.
--------
?
As shown above, the portion labeled "for the purpose of" was left blank when provided to defendants. Defendants contend that, by leaving this section blank, plaintiff provided defendants with an authorization that was not filled out completely with respect to a core element, thus rendering the authorization non-HIPAA compliant. See 45 C.F.R. § 164.508(c)(1)(iv).
Defendants also argue that the medical authorizations attached to the first pre-suit notice did not comply with Tenn. Code Ann. § 29-26-121, because they were not HIPAA-compliant medical authorizations "permitting the provider receiving the notice to obtain complete medical records from each other." See Tenn. Code Ann. § 29-26-121(a)(2)(E) (emphasis added). The authorizations provided to defendants only authorizes them "to release, use or disclose" plaintiff's health records to the other providers listed in the authorization. Defendants argue that plaintiff has therefore failed to provide them with authorizations permitting defendants to "obtain" plaintiff's medical records. See Tenn. Code Ann. § 29-26-121(a)(2)(E).
On September 23, 2016, a hearing was held on defendants' motions to dismiss. On July 13, 2017, the trial court entered an order granting the motions to dismiss. The trial court held that
[t]he failure to set forth the purpose of the authorization, combined with the authorization's failure to allow a provider to obtain records from another provider, demonstrates a lack of substantial compliance with the statutory requirements and that the defendants have been prejudiced as a result.
Plaintiff appeals arguing that the trial court erred in granting defendants' motions to dismiss.
II.
The defendants have properly employed a Tenn. R. Civ. P. 12.02 motion challenging the plaintiff's compliance with Tenn. Code Ann. § 29-26-121. Myers v. AMISUB (SFH), Inc. 382 S.W.3d 300, 307 (Tenn. 2012). As Myers noted,
[t]he proper way for a defendant to challenge a complaint's compliance with Tennessee Code Annotated section 29-26-121 and Tennessee Code Annotated section 29-26-122 is to file a Tennessee Rule of Procedure 12.02 motion to dismiss. In the motion, the defendant should state how the plaintiff has failed to comply with the statutory requirements by referencing specific omissions in the complaint and/or by submitting affidavits or other proof. Once the defendant makes a properly supported motion under this rule, the burden shifts to the plaintiff to show either that it complied with the statutes or that it had extraordinary cause for failing to do so. Based on the complaint and any other relevant evidence submitted by the parties, the trial court must determine whether the plaintiff has complied with the statutes. If the trial court determines that the plaintiff has not complied with the statutes, then the trial court may consider whether the plaintiff has demonstrated extraordinary cause for its noncompliance ...
Myers v. AMISUB (SFH), Inc. , 382 S.W.3d 300, 307 (Tenn. 2012).
The issues before us pertain to matters of law. A health care liability plaintiff's pre-suit notice shall include "[a] HIPAA compliant medical authorization permitting the provider receiving the notice to obtain complete medical records from each other provider being sent a notice." Tenn. Code Ann. § 29–26–121(a)(2)(E). The specific purpose of subsection (a)(2)(E) is not to provide defendants with notice of a potential claim; rather, as the Supreme Court noted in Stevens ex rel. Stevens v. Hickman Community Health Care Services, Inc. , 418 S.W.3d 547 (Tenn. 2013), the subsection "serves to equip defendants with the actual means to evaluate the substantive merits of a plaintiff's claim by enabling early access to a plaintiff's medical records." Stevens , 418 S.W.3d at 555. "Because HIPAA itself prohibits medical providers from using or disclosing a plaintiff's medical records without a fully compliant authorization form, it is a threshold requirement of the statute that the plaintiff's medical authorization must be sufficient to enable defendants to obtain and review a plaintiff's relevant medical records." Id. (citing 45 C.F.R. § 164.508(a)(1) ).
III.
Plaintiff argues, in her response to defendants' motions to dismiss, that the deficiencies in her authorizations are "merely ... hyper technicali[ties]" advanced by defendants in order "to avoid civil responsibility for [p]laintiff's injuries based on a purely procedural issue." While the Supreme Court has held that "[a] plaintiff's less-than-perfect compliance with Tenn. Code Ann. § 29–26–121(a)(2)(E) ... should not derail a healthcare liability claim," it concluded that a plaintiff must still substantially comply with the requirements of Tenn. Code Ann. § 29–26–121(a)(2)(E). Stevens , 418 S.W.3d at 555. In determining whether a plaintiff has substantially complied with the statute, "a reviewing court should consider the extent and significance of the plaintiff's errors and omissions and whether the defendant was prejudiced by the plaintiff's noncompliance." Id. at 556.
"Defective authorizations" are defined in 45 C.F.R. § 164.508(b)(2). An authorization is not valid if, among other things, it "has not been filled out completely, with respect to an element described by paragraph (c) of this section." See 45 C.F.R. § 164.508(b)(2). A "description of each purpose of the requested use or disclosure" is a core element. See 45 C.F.R. § 164.508(c)(iv). As noted above in this opinion, plaintiff's authorization was not complete, and it did not include a description of the purpose of the requested use or disclosure, as required. Therefore, we affirm the trial court's holding that the omission of a core element constituted a lack of substantial compliance with the statutory requirements.
Next, as noted above, the authorization sent to each defendant authorizes them to "release, use or disclose" the health records of plaintiff to the other named providers. The authorization then lists the providers to whom the entity is authorized to release the records. Plaintiff alleges that this language is sufficient to allow any one of the named parties to request plaintiff's medical records from any of the other listed parties and to obtain the medical records. The trial court disagreed holding that "the plain language of the form does not allow this." The trial court stated that
[i]t only allows [doctor] to release, use, or disclose medical records. Thus, if Dr. Walker sends this form to another provider and asks that provider to send the plaintiff's medical records, the form simply does not provide authorization for them to do so. The plaintiff's response is that each provider can look at the list of providers and should know that each of them also received their own authorization form allowing them to release, use or disclose the material information. However, this is not what the law requires. In order to be effective, the authorization form must allow a medical provider to obtain records from the other providers.
We affirm the trial court's holding that plaintiff's authorization is not sufficient to enable defendants to obtain plaintiff's medical records.
Lastly, plaintiff argues that defendants were obligated to inform plaintiff of any omissions or to at least attempt to utilize the flawed authorization before alleging they were prejudiced by the deficiencies. We disagree. As noted above, the proper means to challenge plaintiff's compliance with Tenn. Code Ann. § 29-26-121 is through a Tenn. R. Civ. P. 12.02 motion. This Court has previously rejected the argument that the onus should be placed on defendants to test the sufficiency of the authorization, or even to complete an inadequate authorization. See, e.g. , Roberts v. Prill , 2014 WL 2921930, at *6. Furthermore, our Court noted in J.A.C. :
Several Tennessee decisions have rejected the proposition that a health care liability defendant has a duty to assist a plaintiff achieve compliance or to test whether an obviously deficient HIPAA form would allow the release of records. See, e.g. , Stevens , 418 S.W.3d at 559
("Plaintiff—not Defendants—was responsible for complying with the requirements of Tenn. Code Ann. § 29–26–121(a)(2)(E)."); Dolman v. Donovan , No. W2015-00392-COA-R3-CV, 2015 WL 9315565, at *5 (Tenn. Ct. App. Dec. 23, 2015) (rejecting the plaintiffs' argument that the medical providers could not have been prejudiced because they never attempted to obtain medical records with the deficient medical authorization provided), perm. app. denied (Tenn. May 6, 2016). Similarly, our courts have rejected the notion that a health care liability defendant needs to inform a plaintiff that the provided authorization form is deficient before filing a motion to dismiss. Stevens , 418 S.W.3d at 559 ; Vaughn v. Mountain States Health Alliance , No. E2012-01042-COA-R3-CV, 2013 WL 817032, at *4 (Tenn. Ct. App. Mar. 5, 2013) (rejecting the argument that the defendants should have contacted plaintiff's counsel prior to an action being filed against them in order to inform plaintiff's counsel that the requirements of Tennessee Code Annotated section 29–26–121 had not been met), overruled on other grounds by Davis v. Ibach , 465 S.W.3d 570 (Tenn. 2015).
J.A.C. , 542 S.W.3d at 514–15. As this Court has recently reiterated
[d]efendants are not required to attempt to use a medical authorization to gather patient medical records, if the defendant believes the authorizations to be defective. It therefore follows that a defendant's claim of prejudice is not waived by failing to attempt to use or otherwise ‘test’ an allegedly defective authorization.
Roberts v. Wellmont Health Sys. , No. E201700845COAR9CV, 2018 WL 3302178, at *6 (Tenn. Ct. App. July 5, 2018). Accordingly, we follow our precedent in holding that plaintiff's argument that defendants cannot claim prejudice, because they did not attempt to obtain the records with the provided authorizations and receive a corresponding denial, fails.
In sum, forms that are markedly inadequate do not actually authorize or facilitate any disclosure. See, e.g. , J.A.C. by & through Carter v. Methodist Healthcare Memphis Hosps. , 542 S.W.3d 502, 513 (Tenn. Ct. App. 2016), appeal denied (Mar. 9, 2017); Roberts v. Prill , No. E2013-02202-COA-R3CV, 2014 WL 2921930, at *5 (Tenn. Ct. App. June 26, 2014). We hold that the medical authorizations in this case do not substantially comply with the provisions of Tenn. Code Ann. § 29–26–121. Accordingly, we affirm.
IV.
We affirm the judgment of the trial court granting defendants' motions to dismiss. This case is remanded to the trial court for collection of costs assessed below. Costs on appeal are taxed to the appellant, Jennifer Parks.
D. Michael Swiney, C.J., filed a dissenting opinion.
D. Michael Swiney, C.J., dissenting.
I respectfully dissent from the majority's decision in this case. I disagree with the majority's holding "that the medical authorizations in this case do not substantially comply with the provisions of Tenn. Code Ann. § 29-26-121." I would reverse the Trial Court as I believe the medical authorizations do substantially comply.
The majority correctly notes "the authorization sent to each defendant authorizes them to ‘release, use or disclose’ the health records of plaintiff to the other named providers. The authorization then lists the providers to whom the entity is authorized to release the records." Every medical provider defendant is named in this list. The majority, however, then affirms the Trial Court's holding "that plaintiff's authorization is not sufficient to enable defendants to obtain plaintiff's medical records."
If that were the entirety of the situation, I would agree with the majority. However, that is not the entirety of the situation here. Attached to the complaint as exhibit B is an affidavit from plaintiff's attorney. Attached to this affidavit are copies of the February 19, 2016 notice letter sent to each of the medical providers. Accompanying this letter was a "LIST OF NAME AND ADDRESS OF ALL HEALTH CARE PROVIDERS TO WHOM THIS NOTICE IS SENT PURSUANT TO TENN. CODE ANN. § 29-26-121(A) OF A POTENTIAL CLAIM FOR MEDICAL MALPRACTICE." This list contained the names of each medical provider defendant to this lawsuit. The last sentence on that page states "Each provider above is being sent a HIPAA-compliant medical authorization permitting each to obtain complete medical records from each other."
Then also attached to each letter was a copy of the medical authorization release form sent to that medical provider authorizing that medical provider defendant to "release, use or disclose" to all of the listed medical providers the plaintiff's medical records. For purposes of clarity, and as an example of what was sent to each medical provider defendant, attached to this dissent as attachment 1 is a copy of the letter and the medical authorization forms sent to one of the medical provider defendants, Rebecca A. Walker, M.D. As alleged in the complaint, each medical provider defendant was furnished the same authorization with the only difference being the name of that medical provider defendant inserted where it stated: "I hereby authorize ________ to release, use or disclose from the health records of: ...." Each authorization contained a list of the medical provider defendants to whom the medical provider defendant was authorized "to release, use or disclose ..." plaintiff's health records.
According to the complaint, each medical provider defendant was furnished a notice and a medical authorization form allowing them to disclose the plaintiff's medical records to all the other medical provider defendants as listed on that form. Further, each medical provider defendant was told in this notice that each medical provider defendant had been sent such a HIPAA-compliant medical authorization form "permitting each to obtain complete medical records from each other." In short, each medical provider defendant was told that every other medical provider defendant had been furnished a "HIPAA-compliant medical authorization" that authorized each and every one of the medical provider defendants to release plaintiff's records to each and every other medical provider defendant.
If all that plaintiff had furnished had been the medical authorization form without the list of names and addresses of all health care providers, which specifically stated that each medical provider defendant was being sent such a HIPAA-compliant medical authorization permitting each one to obtain complete medical records from the others, the releases may well have been deficient. According to the complaint, however, the medical provider defendants were provided with this information at the time they received the medical authorization forms.
Respectfully, the Trial Court and the majority focus only on the two page authorization forms and ignore the February 19, 2016 notice letters including the "LIST OF NAME AND ADDRESS OF ALL HEALTH CARE PROVIDERS TO WHOM THIS NOTICE IS SENT PURSUANT TO TENN. CODE ANN. § 29-26-122(A) OF A POTENTIAL CLAIM FOR MEDICAL MALPRACTICE," all of which were attached to the complaint as part of exhibit B.
As the Trial Court correctly notes, this dismissal was a result of a motion to dismiss. I believe it was error for the Trial Court and the majority to consider only part of exhibit B attached to the complaint while ignoring the remainder of exhibit B. From the complaint, each and every medical provider defendant was clearly told that "Each provider above is being sent a HIPAA-compliant authorization permitting each to obtain complete medical records from each other." Each provider was told this at the same time each received the authorization "to release, use or disclose ..." the plaintiff's heath records to every other medical provider defendant.
I believe this is substantial compliance with the statute because, as stated in the notice letter to the defendants, each and every one of them could get all of plaintiff's medical records from the other medical provider defendants, and they knew it. To hold otherwise requires that we assume that the health care providers and their attorneys were all illiterate and unable to read the medical authorization form in conjunction with the notice letter sent to them.
As to plaintiff's failure to fill in the blank after: "For the purpose of:" in the authorization, I believe it is a technical violation that does not, by itself, prevent there being substantial compliance with the statute. The majority is correct that plaintiff did not fill in this blank. However, the phrase "at the request of the individual" would have been sufficient to satisfy this HIPAA requirement. At the risk of stating the obvious, "at the request of the individual" is obvious from the fact that "the individual" signed the request and stated no other purpose. In any event, I believe the failure to fill in this blank did not prevent substantial compliance with the statute as the effect and significance of that error or omission is minimal at most.
I believe the record shows that there was substantial compliance by plaintiff with the statute. Each and every medical provider defendant was authorized by the medical authorizations to both release the medical records to and obtain the medical records from each and every other medical provider defendant. To hold otherwise in deciding this motion to dismiss is to ignore part of the complaint, including parts of exhibit B to the complaint, showing what actually was furnished to each of the medical provider defendants. This results in requiring perfection rather than substantial compliance. As the majority correctly notes in quoting our Supreme Court, the statute in question "serves to equip defendants with the actual means to evaluate the substantive merits of a plaintiff's claim by enabling early access to a plaintiff's medical records." Stevens, ex rel. Stevens v. Hickman Community Health Care Servs., Inc., 418 S.W.3d 547, 555 (Tenn. 2013). Here, the medical provider defendants were so equipped but chose not to "evaluate the substantive merits of" the plaintiff's claim early or otherwise. Id.
At this motion to dismiss stage, applying the standards relevant to a motion to dismiss, it cannot be disputed that each and every medical provider defendant, by means of all the authorizations furnished by plaintiff to all the medical provider defendants, was equipped with the means to obtain the medical records from each and every medical provider defendant so each could evaluate the merits of plaintiff's claim. Again, unless the health care providers and their attorneys were illiterate and were unable to read and understand not only the medical authorization form sent to that health care provider, but the notice letter and all attachments to that notice letter as well, it was clear that each medical provider had been authorized both to furnish to and to obtain and receive from every other medical provider the plaintiff's medical records, and they knew it. This is, I believe, at least substantial compliance.
Since the enactment of the sections of the Health Care Liability Act governing pre-suit notice were adopted by the General Assembly in 2008, this Court has seen case after case brought by Tennessee plaintiffs dismissed without any determination whether the case has any merit. In all of these cases, this Court has yet to be pointed even once to anything supporting the proposition that the purpose, or even a secondary purpose, of HIPAA was to enable medical providers to weaponize the HIPAA provisions concerning medical release authorization forms to the detriment of their patients. Despite that, this is exactly how HIPAA is being used in these lawsuits. Under the Trial Court's opinion and the majorities' opinion, this Tennessee plaintiff is just the latest victim in the "game of ‘gotcha’ ... played by the lawyers." Buckman v. Mountain States Health Alliance , 570 S.W.3d 229, 240-42 (Tenn. Ct. App. 2018), no appl. perm. appeal filed (Swiney, C.J., concurring separately).
I, respectfully, dissent from majority's opinion. I would reverse the decision of the Trial Court.
ATTACHMENT 1 ????