Day on Torts - New Post: Failure to list purpose on HIPAA authorization leads to dismissal of HCLA case.

Where plaintiff’s medical authorizations lacked required elements and plaintiff failed to show that defendants already had all relevant records, dismissal of plaintiff’s HCLA case was affirmed.

In Woods v. Arthur, No. W2019-01936-COA-R3-CV (Tenn. Ct. App. Mar. 23, 2021), plaintiff filed an HCLA claim related to two spinal surgeries, the first performed by Dr. Arthur and Dr. Lingo, who were employees of the same clinic, and the second performed by Dr. Sorenson. According to plaintiff, the wrong size screw was used in the first surgery, which caused injuries, and he was further injured by the second corrective surgery.

Before filing suit, plaintiff sent pre-suit notice to Dr. Arthur, Dr. Sorenson, and Methodist Hospital, which is where the first surgery was performed. Notice was also sent to Dr. Lingo, but he did not make an appearance in the case and was not a party to this appeal. After receiving the notices, defendant doctors “replied…and informed Plaintiff they were investigating the matter.” During a phone call, counsel for the doctors “stated that he had the Operative Reports for both” surgeries. Despite communication between the parties, no settlement was reached, and plaintiff filed his complaint. Defendant doctors and defendant hospital filed motions to dismiss, alleging that the medical authorizations sent with plaintiff’s pre-suit notice were not HIPAA compliant, and that plaintiff was therefore not entitled to the 120-day extension of the statute of limitations under Tenn. Code Ann. § 29-26-121(c), making his suit untimely. The trial court agreed, granting the motions to dismiss, and the Court of Appeals affirmed.

The HCLA requires plaintiffs to send a HIPAA compliant medical authorization with their pre-suit notice allowing defendants to “obtain and review a plaintiff’s relevant medical records.” (internal citation omitted). Federal regulations require that this authorization contain six core elements. While the HIPAA compliant medical authorization requirement may be satisfied through substantial compliance, HIPAA is a “strict statute,” and “plaintiffs who sent imperfect medical authorizations have been found substantially compliant in very few instances.” (internal citation omitted). Further, Tennessee courts “have generally declined to look beyond the language of the medical authorization form when determining whether the authorization complied with HIPAA,” instead concluding that “when a pre-suit medical authorization is facially invalid, the recipient is per se prejudiced.” (internal citation omitted).

Defendants here pointed out two problems with plaintiff’s authorizations. First, plaintiff failed to authorize the disclosure of medical records from Dr. Lingo. Plaintiff asserted that this failure was “immaterial because Dr. Lingo was a resident physician under the supervision of Drs. Arthur and Sorenson,” and thus had no records of his own. The Court rejected this argument, noting that the statute requires that the medical authorization allow defendants “to obtain complete medical records from each other provider being sent a notice.” (Tenn. Code Ann. § 29-26-121(a)(2)(e)). Dr. Lingo was sent a notice but was not included on the authorizations, which meant plaintiff failed to comply with the HCLA.

Plaintiff also argued that his failure to include Dr. Lingo was irrelevant because defendants already had the relevant records, as their counsel had admitted that he had both operative reports. Plaintiff asserted that the two operative reports were the only records needed in this case. The Court ruled, though, that plaintiff failed to carry his burden on this argument, noting that he “did not establish by affidavits or another means provided in Tennessee Rule 56 that the Operative Reports were the only relevant documents.” The Court stated that it had “no way of knowing…how the medical records before us…would be evaluated by an expert witness or consultant.” Because plaintiff named Dr. Lingo as a provider being sent notice yet failed to provide authorizations that allowed defendants to obtain records from him, the Court affirmed the trial court’s ruling that plaintiff failed to substantially comply with the HCLA pre-suit notice requirements.

Second, plaintiff failed to include the “purpose for obtaining and using his medical records” on his authorizations, which made them invalid. A description of the purpose for the requested use or disclosure is one of the six core elements required on a HIPAA compliant medical authorization. Plaintiff argued that “the purpose of the disclosure and use was manifest because there is language by plaintiff authorizing the release of the medical records that make it clear what its purpose is,” but the Court noted that plaintiff cited “no valid authority for the proposition that the purpose element may be inferred.” In fact, in a previously published opinion, the Court had held that “failing to fill out the purpose section of a release form rendered it invalid.” (internal citation omitted). The Court thus agreed with the trial court that the lack of purpose on the authorization meant plaintiff failed to substantially comply with the HCLA requirements.

Because plaintiff did not provide HIPAA compliant authorizations with his pre-suit notice, dismissal was affirmed.

This case is yet another example of an HCLA plaintiff who never had the merits of his case heard due to a faulty HIPAA medical authorization. These medical authorizations continue to cause problems for Tennessee plaintiffs and must be carefully prepared.

NOTE: This opinion was released four months after oral arguments in this case.