Summary
determining that when the plaintiffs failed to describe the purpose of the disclosure on certain forms and failed to identify the persons authorized to receive the health information on others, the plaintiffs had not substantially complied
Summary of this case from Williams v. Gateway Med. Ctr.Opinion
No. W2016-01289-COA-R3-CV
02-13-2017
GERALD RUSH, ET AL. v. JACKSON SURGICAL ASSOCIATES PA, ET AL.
Matthew E. Wright, Franklin, Tennessee, for the appellants, Gerald Rush, and Betty Rush. Jerry D. Kizer, Brandon J. Stout, Jackson, Tennessee, for the appellees, Jackson Surgical Associates, PA, and David Villarreal.
Appeal from the Circuit Court for Madison County
No. C-15-319
Kyle Atkins, Judge This is a healthcare liability action. After sustaining injuries as a result of alleged surgical error, Appellant filed this action against the surgeon and his medical group. Appellees moved to dismiss the action for failure to comply with the notice requirement of Tennessee Code Annotated Section 29-26-121(a)(2)(E). The trial court granted the motion to dismiss, and Appellant appeals. Discerning no error, we affirm and remand.
Tenn. R. App. P. 3 Appeal as of Right; Judgment of the Circuit Court is Affirmed and Remanded.
KENNY ARMSTRONG, J., delivered the opinion of the Court, in which J. STEVEN STAFFORD, P.J., W.S., and BRANDON O. GIBSON, J., joined. Matthew E. Wright, Franklin, Tennessee, for the appellants, Gerald Rush, and Betty Rush. Jerry D. Kizer, Brandon J. Stout, Jackson, Tennessee, for the appellees, Jackson Surgical Associates, PA, and David Villarreal.
OPINION
I. Background
On November 6, 2015, Gerald and Betty Rush (together "Appellants") filed a healthcare liability complaint in Madison County Circuit Court against Jackson Surgical Associates ("JSA") and Dr. David Villarreal (together with JSA, "Appellees"). The complaint alleged that, on July 18, 2014, while performing gallbladder surgery on Mr. Rush, Dr. Villarreal negligently cut the wrong duct, clipped the hepatic artery, and cut the small intestine causing Mr. Rush serious injuries including organ failure.
On December 9, 2015, Appellees filed a motion seeking dismissal of the lawsuit pursuant to Tennessee Rule of Civil Procedure 12.02 for failure to comply with the pre-suit notice requirements of Tennessee Code Annotated Section 29-26-121, which provides:
(a)(1) Any person, or that person's authorized agent, asserting a potential claim for health care liability shall give written notice of the potential claim to each health care provider that will be a named defendant . . . .Appellees asserted that the complaint failed to conform with the statute because Appellants did not include a medical authorization compliant with the Health Insurance Portability and Accountability Act ("HIPAA"). Specifically, Appellees argued that the HIPAA authorization did not permit each health care provider the opportunity to obtain the complete medical records of each of the providers being sent notice. Additionally, Appellees argued that the medical authorizations were deficient because they failed to comply with several core elements required by federal regulations. Appellees argued that Appellants' failure to comply with the requirements outlined in Tennessee Code Annotated Section 29-26-121(a), precluded the 120-day extension provided in Tennessee Code Annotated Section 29-26-121(c), and, thus, the complaint is time-barred.
(2) The notice shall include:
***
(E) A HIPAA compliant medical authorization permitting the provider receiving the notice to obtain complete medical records from each other provider being sent a notice.
Following a hearing, the trial court issued an order dismissing the complaint. The trial court found that Appellant's medical authorizations did not substantially comply with Tennessee Code Annotated Section 29-26-121 and that Appellees were prejudiced by the noncompliance. Specifically, the trial court found that: (1) the medical authorizations provided to JSA for the release of records held by Dr. Villarreal and JSA were not HIPAA compliant because the authorizations inadequately described the agency or individual authorized to receive information as "bearer" and also failed to state the purpose for the release of health information; and (2) the medical authorization provided to JSA, for the release of records held by Jackson-Madison County General Hospital District (JMCGHD), as well as the medical authorizations provided to Dr. Villarreal, for the release of records held by JSA and JMCGHD, were not HIPAA compliant because they, likewise, failed to state the purpose for the release. Due to these omissions, the trial court found that the authorizations were not HIPAA compliant and that neither JSA nor Dr. Villarreal was authorized to use their own records to investigate Appellants' claim during the pre-suit period. The trial court further found that Appellants violated the statute by failing to provide a medical authorization allowing Appellees to request records from Bolivar General Hospital, Inc. despite the fact that Bolivar General Hospital, Inc. was listed as a medical provider receiving pre-suit notice. Appellants appeal.
II. Issues
Appellants raise the following issue as stated in their brief:
Whether the trial court erred in ordering the dismissal with prejudice of all claims by holding that Plaintiffs did not substantially comply with the Tennessee Code Annotated Section 29-26-121(a), and that Defendants suffered prejudice as a result, thereby negating all tolling provisions for the statute of limitations?
III. Standard of Review
The Appellees properly filed a motion to dismiss pursuant to Tennessee Rule of Civil Procedure 12.02. Myers v. AMISUB (SFH) , Inc., 382 S.W.3d 300, 307 (Tenn. 2012) ("The proper way for a defendant to challenge a complaint's compliance with Tennessee Code Annotated Section 29-26-121 is to file a Tennessee Rule of [Civil] Procedure 12.02 motion to dismiss."). The issue before us is a question of law. Accordingly, the trial court's grant of the motion to dismiss is subject to a de novo review with no presumption of correctness because we are reviewing the trial court's legal conclusion. Blackburn v. Blackburn , 270 S.W.3d 42, 47 (Tenn. 2008); Union Carbide Corp. v. Huddleston , 854 S.W.2d 87, 91 (Tenn. 1993).
To the extent that Appellants' issue involves interpretation of any statutory provision, we review questions of statutory construction de novo with no presumption of correctness. In re Estate of Tanner , 295 S.W.3d 610, 613 (Tenn. 2009). This court's primary objective is to carry out legislative intent without broadening or restricting the Act beyond its intended scope. Houghton v. Aramark Educ. Res., Inc., 90 S.W.3d 676, 678 (Tenn. 2002). In construing legislative enactments, we presume that every word in a statute has meaning and purpose and should be given full effect if the obvious intention of the legislature is not violated by so doing. In re C.K.G., 173 S.W.3d 714, 722 (Tenn. 2005). When a statute is clear, we should apply the plain meaning without complicating the task. Eastman Chem. Co. v. Johnson , 151 S.W.3d 503, 507 (Tenn. 2004).
IV. Analysis
A. HIPAA Compliant Medical Authorizations
Tennessee Code Annotated Section 29-26-121(a)(2)(E) provides that a plaintiff "shall" include, in the pre-suit notice, a "HIPAA compliant medical authorization permitting the provider receiving the notice to obtain complete medical records from each other provider being sent a notice." Federal regulations state that a HIPAA-compliant authorization must include the following six elements:
(i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.Stevens ex rel. Stevens v. Hickman Community Health Care Services , Inc., 418 S.W. 3d 547, 555-56 (Tenn. 2013)(quoting 45 C.F.R. §164.508(c)(1)).
(ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.
(iii) The name or other specific identification of the person(s) or class of persons, to whom the covered entity may make the requested use or disclosure.
(iv) A description of each purpose of the requested use or disclosure. The statement "at the request of the individual" is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.
(v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. . . .
(vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided.
Appellees assert that the Appellants' pre-suit notice did not include a HIPAA compliant medical authorization that permitted each health care provider the opportunity "to obtain the complete medical records from each other provider being sent notice." Tenn. Code Ann. § 29-26-121(a)(2)(E). Specifically, Appellees argue that Appellants failed to provide a medical authorization allowing Appellees to request records from Bolivar General Hospital, Inc. even though Bolivar General Hospital, Inc. was listed as a medical provider receiving pre-suit notice. Appellants assert that they mistakenly believed Bolivar General Hospital, Inc. was a registered agent for JMCGHD and that Bolivar General Hospital, Inc. was only listed "out of an abundance of caution" as an agent for JMCGHD. Appellants contend that Mr. Rush was never treated at Bolivar General Hospital, Inc., and, as such, there were no relevant medical records to be obtained from Bolivar General Hospital, Inc. However, in the pre-suit notice letters sent to both JSA and Dr. Villarreal, Bolivar General Hospital, Inc. was listed as one of the healthcare providers for Mr. Rush; it was not listed as an agent for JMCGHD. Furthermore, Appellants did not reveal to Appellees that Bolivar General Hospital, Inc. was listed as a purported agent for JMCGHD until they filed their response to Appellees' motion to dismiss. Therefore, Appellees did not know, during the pre-suit notice phase, that Bolivar General did not have relevant medical records. Accordingly, Appellees argue that they were prejudiced in that they could not properly evaluate the merits of Appellants' claim during the pre-suit notice phase. The trial court, in its ruling, specifically found that the Appellants
listed Bolivar General Hospital, Inc. as a provider being sent pre-suit notice but no medical authorization was provided to [Appellees] allowing them to request records from Bolivar General Hospital, Inc. during the pre-suit period; consequently, [Appellees] were prejudiced because they were not given the opportunity to investigate and evaluate the claim by requesting records from Bolivar General Hospital, Inc.
Tennessee Code Annotated Section 29-26-121(d) clearly states that "[a]ll parties ... shall be entitled to obtain complete copies of the claimant's medical records from any other provider receiving notice." Tenn. Code Ann. § 29-26-121(d). It is undisputed that Appellants did not provide a HIPAA-compliant medical authorization to either of the Appellees so as to allow them to request records from Bolivar General Hospital, Inc. The very purpose of Tennessee Code Annotated Section 29-26-121(a)(2)(E) is "to equip defendants with the actual means to evaluate the substantive merits of a plaintiff's claim by enabling early access to a plaintiff's medical records." Stevens , 418 S.W. 3d at 555. However, the Tennessee Supreme Court has held that a "plaintiff must substantially comply, rather than strictly comply, with the requirements of Tenn. Code Ann. § 29-26-121(a)(2)(E)." Id . Therefore, a party's "less-than-perfect compliance with Tenn. Code Ann. § 29-26-121(a)(2)(E) . . . should not derail a healthcare liability claim. Non-substantive errors and omissions will not always prejudice defendants by preventing them from obtaining a plaintiff's relevant medical records." Id.
Even if we assume, arguendo, that Appellants' failure to provide a medical authorization for Bolivar General Hospital, Inc. is not fatal to the pre-suit notice requirements, this is not Appellants' only error concerning the medical authorizations. As argued by Appellees, there were other deficiencies with the medical authorizations provided by the Appellants. The trial court found that "[t]he two medical authorizations provided to JSA for the release of records by Dr. Villarreal and JSA were not HIPAA-compliant because . . . these authorizations inadequately described the agency or individuals authorized to receive health information as 'bearer.'" The Code of Federal Regulations requires "[t]he name or other specific identification of the person(s) or class of persons, to whom the covered entity may make the requested use or disclosure." 45 C.F.R. § 164.508(c)(1)(iii). Appellants contend that the term "bearer" used in the medical authorizations provided named the class of persons authorized to obtain records, thus satisfying the federal regulations. Appellants further assert that they intentionally used the term "bearer" as a courtesy and as an accommodation so that Appellees could provide the authorization to their agent, lawyer, or representative in order to obtain the records. Appellees argue that the person or entity whom the patient is authorizing to receive records must be specifically apparent, from the face of the authorization. In support of this argument, Appellees rely on an Indiana Court of Appeals case, E.J. ex rel. Jeffrey v. Okolocha , 972 N.E. 2d 941 (Ind. Ct. App. 2012). In the Indiana case, the court considered the use of "TO WHOM IT MAY CONCERN" to describe the person authorized to disclose information on a medical authorization. Id. at 947. The Indiana court ultimately held that the identification did not satisfy HIPAA requirements because the authorization failed to include "specific identification of the person . . . authorized to make the . . . disclosure." 45 C.F.R. § 164.508(c)(1)(ii). Id. The court concluded that the "specific identification of the person" is a core element, which is critical and that "[i]t must be apparent from the face of the authorization that the signing patient knows specifically whom she is authorizing to make disclosure of her protected health records." Id. Although the instant case differs from E.J. ex rel. Jeffrey in that, here, we are addressing the question of the specific identification of the person or class of persons authorized to receive the protected health records rather than the person or entity providing the protected health records, the Indiana court's reasoning is still applicable. Under the plain language of the regulation, a name is not required so long as there is specific identification of the entity, person, or class of persons authorized to receive the protected health records. The U.S. Department of Health and Human Services (HHS) explains that a valid authorization may authorize disclosures to a "class of persons, such as the employees of XYZ division of ABC insurance company." U.S. Dep't of Health and Human Servs., FAQ, Health Information Privacy (Sept. 24, 2003), http://www.hhs.gov/hipaa/for-professionals/faq/473/may-a-valid-authorization-list-categories-of-persons-who-may-use-protected-information/index.html. Accordingly, HHS confirms that even where an authorization provides for a "class of persons," the class must, nonetheless, be specifically identified. The term "bearer" does not satisfy the specificity requirement and, therefore, is not HIPAA-compliant.
Appellees further argue that several of the medical authorizations provided by Appellants fail to state the purpose for the release of the health information. A review of the record shows that the section for the purpose of the release was left blank for the medical authorizations provided to JSA, for the release of records by JMCGHD, Dr. Villarreal, and JSA. The medical authorization provided to Dr. Villarreal, for the release of records by JSA, also fails to state the purpose for the release of the protected health information. As set out above, the purpose for the release of protected health information is one of the six essential "core elements" for HIPAA-compliance. Regarding the purpose of the requested use or disclosure, the Code of Federal Regulations states that a compliant HIPAA authorization requires:
A description of each purpose of the requested use or disclosure. The statement "at the request of the individual" is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.45 C.F.R §164.508(c)(1)(iv). The regulation does not require specificity, but it does require some effort. The regulations state that "[w]hen a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization." 45 C.F.R. § 164.508(a)(1). Therefore, the form cannot simply be left blank. The trial court found that based on Appellant's use of the term "bearer" and the failure to state the purpose for the release of medical records, neither Appellee "was authorized to use their own records to investigate the claim during the pre-suit period, which would have been essential in pre-suit evaluation of the case, resulting in prejudice to the [Appellees]."
Although there is no bright line rule that determines whether a party has substantially complied with the requirements of Tenn. Code Ann. § 29-26-121(a)(2)(E), the Stevens court provides guidance. "In determining whether a plaintiff has substantially complied with a statutory requirement, a reviewing court should consider the extent and significance of the plaintiff's errors and omissions and whether the defendant was prejudiced by the plaintiff's noncompliance. Not every non-compliant HIPAA medical authorization will result in prejudice." Stevens , 418 S.W. 3d at 556.
Despite the Tennessee Supreme Court's guidance, a review of recent case law indicates that Tennessee law is less than settled concerning the question of substantial compliance. In J.A.C. v. Methodist Healthcare Memphis Hosps., No. W2016-00024-COA-R3-CV, 2016 WL 6493229, at *2 (Tenn. Ct. App. Nov. 2, 2016), perm. app. pending, this Court upheld the trial court's dismissal of a health liability action when the authorizations did not list the person or class of persons authorized to disclose protected health information and did not list the person or class of persons to whom a disclosure of information could be made. Additionally, the medical authorizations did not designate that mother was signing the forms on behalf of her young daughter as required by federal regulations. Id. at *7-8; see also Harmon v . Shore , No. M2014-01339-COA-R3-CV, 2015 WL 1881467, *2 (Tenn. Ct. App. April 23, 2015) ("Although Appellants mailed a HIPAA medical authorization to the Appellees, the authorization only released [the patient's] medical records to her own lawyer."); Johnson v. Parkwest Medical Center , No. E2013-01228-COA-R3-CV, 2014 WL 3765702, *7 (Tenn. Ct. App. July 31, 2014), perm. app. denied (Tenn. Dec. 17, 2014) ("Without an appropriate HIPAA-compliant medical authorization, Parkwest could not appropriately utilize those records to mount a defense, even if the records were already in Parkwest's possession."); Roberts v. Prill , No. E2013-02202-COA-R3-CV, 2014 WL 2921930, *5 (Tenn. Ct. App. June 26, 2014) ("[T]he form only permitted the use or disclosure of the medical records by plaintiff's counsel."); and Hawkins v. Martin , No. W2013-02102-COA-R3-CV, 2014 WL 2854256, *1 (Tenn. Ct. App. June 23, 2014)(finding that the pre-lawsuit notice did "not include medical authorization forms that complied with HIPAA, so as to permit the defendants to obtain relevant medical records."). The Tennessee Supreme Court has recently granted certiorari in the case of Bray v. Khuri , No. W2015-00397-COA-R3-CV, 2015 WL 7775316, (Tenn. Ct. App. Dec. 3, 2015), perm. app. granted (Tenn. June 23, 2015). In Bray , this Court affirmed the trial court's dismissal of the healthcare liability action. Specifically, we held that "Appellant's form left blank a core element and therefore failed to provide Appellee with the proper authorization to use Decedent's medical records to mount a defense." Id. at *4. The Bray Appellant left blank the portion of the authorization form describing the type and amount of information to be used. Id.
However, there is another line of cases in which noncompliance did not result in the dismissal of the healthcare liability action. In Hughes v. Henry Cty. Med. Ctr., No. W2014-01973-COA-R3-CV, 2015 WL 3562733, at *4 (Tenn. Ct. App. June 9, 2015), this Court reversed the trial court's dismissal of a healthcare liability claim. In that case, an error in the medical authorization form, which was provided to Henry County Medical Center ("HCMC"), did not permit HCMC to obtain medical records from Dr. Gold. However, Dr. Gold saw the patient only at HCMC, and he had no records other than the hospital's records. HCMC was able to obtain all of the Appellants' relevant medical records and to evaluate the merits of the claim despite Appellants' technical failure to include Dr. Gold's records in its release. Id. at *1; see also Hunt v . Nair , E2014-01261-COA-R9-CV, 2015 WL 5657083, (Tenn. Ct. App. Sept. 25, 2015) perm. app. denied (Tenn. Jan. 21, 2016) (holding that Appellant's authorization was substantially compliant despite "plaintiff's failure to employ certain language from §164.508(c)(ii)-(iii)" because the omission did not prejudice the defendants.). Id at *6. In the case of Hamilton v. Abercrombie Radiological Consultants , Inc., E2014-003433-COA-R3-CV, 2014 WL 7117802 (Tenn. Ct. App. Dec. 15, 2014), perm. app. denied (May 15, 2015), the date line on the medical release was intentionally left blank for the medical provider to fill in so that the release form would not "become stale." Id. at *1. There was no evidence to support a finding that the defendants were prejudiced and unable to obtain the necessary medical records. Id. at *5. Consequently, this Court held that the relatively minor shortcoming in the HIPAA release was not fatal to the appellant's cause of action. Id. at *7; see also, Chambers ex rel. Chambers v. County , No. E2013-01064-COA-R10-CV, 2014 WL 1266101 (Tenn. Ct. App. Mar. 28, 2014) (affirming the trial court's denial of the motion to dismiss where the sole issue on appeal was whether dismissal was warranted because the plaintiff failed to file, with the complaint, an affidavit of the party mailing the pre-suit notice.).
In this case, the Appellants' failure is cumulative in that they did not comply with three separate provisions of the Code of Federal Regulations. First, they failed to provide a release for Bolivar General Hospital, Inc. even though it was listed as a provider receiving notice. On the authorizations provided to JSA, Appellants failed to identify, with any specificity, the person or class of persons able to receive Mr. Rush's private health information. Finally, on four of the medical authorizations provided by Appellants, the Appellants failed to describe the purpose of the requested disclosure. As noted by our Supreme Court, "[p]laintiff—not [d]efendants—[is] responsible for complying with the requirements of section 29-26-121(a)(2)(E)." Stevens , 418 S.W.3d at 559. In reviewing the totality of the Appellants' errors and omissions, we conclude that Appellants did not substantially comply with federal regulations and that Appellees were prejudiced by the fact that the authorizations submitted by Appellants did not allow it to review the necessary records during the pre-suit notice phase.
In this case, we are not called upon to determine whether any one of these deficiencies warrant dismissal. As such, we express no opinion whether one of these deficiencies, in isolation, is enough to warrant dismissal. --------
B. Statute of Limitations
Here, the trial court found that the Appellants were "not entitled to the 120-day extension of the statute of limitations that would otherwise have been afforded by the statute." The applicable statutes of limitations and repose in a health care liability action "shall be extended for a period of one hundred twenty (120) days" when proper pre-suit notice is provided. Tenn. Code Ann. § 29-26-121(c). In this case, the alleged negligence occurred on July 18, 2014, but the complaint was not filed until November 6, 2015. Having concluded that proper pre-suit notice was not provided pursuant to Tennessee Code Annotated Section 29-26-121(a)(2)(E), we also conclude that the trial court correctly held that Appellants were not entitled to the 120-day extension of the statute of limitations under Tennessee Code Annotated Section 29-26-121(c). The case, therefore, is time-barred.
V. Conclusion
For the foregoing reasons, we affirm the order of the trial court. We remand the case for such further proceedings as may be necessary and are consistent with this opinion. Costs of the appeal are assessed against Appellants, Gerald and Betty Rush, and their surety, for all of which execution may issue if necessary.
/s/_________
KENNY ARMSTRONG, JUDGE