02/13/2017
IN THE COURT OF APPEALS OF TENNESSEE
AT JACKSON
January 19, 2017 Session
GERALD RUSH, ET AL. v. JACKSON SURGICAL ASSOCIATES PA, ET
AL.
Appeal from the Circuit Court for Madison County
No. C-15-319 Kyle Atkins, Judge
___________________________________
No. W2016-01289-COA-R3-CV
___________________________________
This is a healthcare liability action. After sustaining injuries as a result of alleged
surgical error, Appellant filed this action against the surgeon and his medical group.
Appellees moved to dismiss the action for failure to comply with the notice requirement
of Tennessee Code Annotated Section 29-26-121(a)(2)(E). The trial court granted the
motion to dismiss, and Appellant appeals. Discerning no error, we affirm and remand.
Tenn. R. App. P. 3 Appeal as of Right; Judgment of the Circuit Court is Affirmed
and Remanded.
KENNY ARMSTRONG, J., delivered the opinion of the Court, in which J. STEVEN
STAFFORD, P.J., W.S., and BRANDON O. GIBSON, J., joined.
Matthew E. Wright, Franklin, Tennessee, for the appellants, Gerald Rush, and Betty
Rush.
Jerry D. Kizer, Brandon J. Stout, Jackson, Tennessee, for the appellees, Jackson Surgical
Associates, PA, and David Villarreal.
OPINION
I. Background
On November 6, 2015, Gerald and Betty Rush (together “Appellants”) filed a
healthcare liability complaint in Madison County Circuit Court against Jackson Surgical
Associates (“JSA”) and Dr. David Villarreal (together with JSA, “Appellees”). The
complaint alleged that, on July 18, 2014, while performing gallbladder surgery on Mr.
Rush, Dr. Villarreal negligently cut the wrong duct, clipped the hepatic artery, and cut the
small intestine causing Mr. Rush serious injuries including organ failure.
On December 9, 2015, Appellees filed a motion seeking dismissal of the lawsuit
pursuant to Tennessee Rule of Civil Procedure 12.02 for failure to comply with the pre-
suit notice requirements of Tennessee Code Annotated Section 29-26-121, which
provides:
(a)(1) Any person, or that person's authorized agent, asserting a potential
claim for health care liability shall give written notice of the potential claim
to each health care provider that will be a named defendant . . . .
(2) The notice shall include:
***
(E) A HIPAA compliant medical authorization permitting the provider
receiving the notice to obtain complete medical records from each other
provider being sent a notice.
Appellees asserted that the complaint failed to conform with the statute because
Appellants did not include a medical authorization compliant with the Health Insurance
Portability and Accountability Act (“HIPAA”). Specifically, Appellees argued that the
HIPAA authorization did not permit each health care provider the opportunity to obtain
the complete medical records of each of the providers being sent notice. Additionally,
Appellees argued that the medical authorizations were deficient because they failed to
comply with several core elements required by federal regulations. Appellees argued that
Appellants’ failure to comply with the requirements outlined in Tennessee Code
Annotated Section 29-26-121(a), precluded the 120-day extension provided in Tennessee
Code Annotated Section 29-26-121(c), and, thus, the complaint is time-barred.
Following a hearing, the trial court issued an order dismissing the complaint. The
trial court found that Appellant’s medical authorizations did not substantially comply
with Tennessee Code Annotated Section 29-26-121 and that Appellees were prejudiced
by the noncompliance. Specifically, the trial court found that: (1) the medical
authorizations provided to JSA for the release of records held by Dr. Villarreal and JSA
were not HIPAA compliant because the authorizations inadequately described the agency
or individual authorized to receive information as “bearer” and also failed to state the
purpose for the release of health information; and (2) the medical authorization provided
to JSA, for the release of records held by Jackson-Madison County General Hospital
District (JMCGHD), as well as the medical authorizations provided to Dr. Villarreal, for
the release of records held by JSA and JMCGHD, were not HIPAA compliant because
they, likewise, failed to state the purpose for the release. Due to these omissions, the trial
-2-
court found that the authorizations were not HIPAA compliant and that neither JSA nor
Dr. Villarreal was authorized to use their own records to investigate Appellants’ claim
during the pre-suit period. The trial court further found that Appellants violated the
statute by failing to provide a medical authorization allowing Appellees to request
records from Bolivar General Hospital, Inc. despite the fact that Bolivar General
Hospital, Inc. was listed as a medical provider receiving pre-suit notice. Appellants
appeal.
II. Issues
Appellants raise the following issue as stated in their brief:
Whether the trial court erred in ordering the dismissal with prejudice of all
claims by holding that Plaintiffs did not substantially comply with the
Tennessee Code Annotated Section 29-26-121(a), and that Defendants
suffered prejudice as a result, thereby negating all tolling provisions for the
statute of limitations?
III. Standard of Review
The Appellees properly filed a motion to dismiss pursuant to Tennessee Rule of
Civil Procedure 12.02. Myers v. AMISUB (SFH), Inc., 382 S.W.3d 300, 307 (Tenn.
2012) (“The proper way for a defendant to challenge a complaint’s compliance with
Tennessee Code Annotated Section 29-26-121 is to file a Tennessee Rule of [Civil]
Procedure 12.02 motion to dismiss.”). The issue before us is a question of law.
Accordingly, the trial court’s grant of the motion to dismiss is subject to a de novo review
with no presumption of correctness because we are reviewing the trial court’s legal
conclusion. Blackburn v. Blackburn, 270 S.W.3d 42, 47 (Tenn. 2008); Union Carbide
Corp. v. Huddleston, 854 S.W.2d 87, 91 (Tenn. 1993).
To the extent that Appellants’ issue involves interpretation of any statutory
provision, we review questions of statutory construction de novo with no presumption of
correctness. In re Estate of Tanner, 295 S.W.3d 610, 613 (Tenn. 2009). This court’s
primary objective is to carry out legislative intent without broadening or restricting the
Act beyond its intended scope. Houghton v. Aramark Educ. Res., Inc., 90 S.W.3d 676,
678 (Tenn. 2002). In construing legislative enactments, we presume that every word in a
statute has meaning and purpose and should be given full effect if the obvious intention
of the legislature is not violated by so doing. In re C.K.G., 173 S.W.3d 714, 722 (Tenn.
2005). When a statute is clear, we should apply the plain meaning without complicating
the task. Eastman Chem. Co. v. Johnson, 151 S.W.3d 503, 507 (Tenn. 2004).
IV. Analysis
-3-
A. HIPAA Compliant Medical Authorizations
Tennessee Code Annotated Section 29-26-121(a)(2)(E) provides that a plaintiff
“shall” include, in the pre-suit notice, a “HIPAA compliant medical authorization
permitting the provider receiving the notice to obtain complete medical records from each
other provider being sent a notice.” Federal regulations state that a HIPAA-compliant
authorization must include the following six elements:
(i) A description of the information to be used or disclosed that
identifies the information in a specific and meaningful fashion.
(ii) The name or other specific identification of the person(s), or class of
persons, authorized to make the requested use or disclosure.
(iii) The name or other specific identification of the person(s) or class of
persons, to whom the covered entity may make the requested use or
disclosure.
(iv) A description of each purpose of the requested use or disclosure. The
statement “at the request of the individual” is a sufficient description
of the purpose when an individual initiates the authorization and
does not, or elects not to, provide a statement of the purpose.
(v) An expiration date or an expiration event that relates to the
individual or the purpose of the use or disclosure. . . .
(vi) Signature of the individual and date. If the authorization is signed by
a personal representative of the individual, a description of such
representative's authority to act for the individual must also be
provided.
Stevens ex rel. Stevens v. Hickman Community Health Care Services, Inc., 418 S.W. 3d
547, 555-56 (Tenn. 2013)(quoting 45 C.F.R. §164.508(c)(1)).
Appellees assert that the Appellants’ pre-suit notice did not include a HIPAA
compliant medical authorization that permitted each health care provider the opportunity
“to obtain the complete medical records from each other provider being sent notice.”
Tenn. Code Ann. § 29-26-121(a)(2)(E). Specifically, Appellees argue that Appellants
failed to provide a medical authorization allowing Appellees to request records from
Bolivar General Hospital, Inc. even though Bolivar General Hospital, Inc. was listed as a
medical provider receiving pre-suit notice. Appellants assert that they mistakenly
believed Bolivar General Hospital, Inc. was a registered agent for JMCGHD and that
Bolivar General Hospital, Inc. was only listed “out of an abundance of caution” as an
-4-
agent for JMCGHD. Appellants contend that Mr. Rush was never treated at Bolivar
General Hospital, Inc., and, as such, there were no relevant medical records to be
obtained from Bolivar General Hospital, Inc. However, in the pre-suit notice letters sent
to both JSA and Dr. Villarreal, Bolivar General Hospital, Inc. was listed as one of the
healthcare providers for Mr. Rush; it was not listed as an agent for JMCGHD.
Furthermore, Appellants did not reveal to Appellees that Bolivar General Hospital, Inc.
was listed as a purported agent for JMCGHD until they filed their response to Appellees’
motion to dismiss. Therefore, Appellees did not know, during the pre-suit notice phase,
that Bolivar General did not have relevant medical records. Accordingly, Appellees
argue that they were prejudiced in that they could not properly evaluate the merits of
Appellants’ claim during the pre-suit notice phase. The trial court, in its ruling,
specifically found that the Appellants
listed Bolivar General Hospital, Inc. as a provider being sent pre-suit notice
but no medical authorization was provided to [Appellees] allowing them to
request records from Bolivar General Hospital, Inc. during the pre-suit
period; consequently, [Appellees] were prejudiced because they were not
given the opportunity to investigate and evaluate the claim by requesting
records from Bolivar General Hospital, Inc.
Tennessee Code Annotated Section 29-26-121(d) clearly states that “[a]ll parties
... shall be entitled to obtain complete copies of the claimant’s medical records from any
other provider receiving notice.” Tenn. Code Ann. § 29-26-121(d). It is undisputed that
Appellants did not provide a HIPAA-compliant medical authorization to either of the
Appellees so as to allow them to request records from Bolivar General Hospital, Inc. The
very purpose of Tennessee Code Annotated Section 29-26-121(a)(2)(E) is “to equip
defendants with the actual means to evaluate the substantive merits of a plaintiff's claim
by enabling early access to a plaintiff's medical records.” Stevens, 418 S.W. 3d at 555.
However, the Tennessee Supreme Court has held that a “plaintiff must substantially
comply, rather than strictly comply, with the requirements of Tenn. Code Ann. § 29-26-
121(a)(2)(E).” Id. Therefore, a party’s “less-than-perfect compliance with Tenn. Code
Ann. § 29-26-121(a)(2)(E) . . . should not derail a healthcare liability claim. Non-
substantive errors and omissions will not always prejudice defendants by preventing them
from obtaining a plaintiff’s relevant medical records.” Id.
Even if we assume, arguendo, that Appellants’ failure to provide a medical
authorization for Bolivar General Hospital, Inc. is not fatal to the pre-suit notice
requirements, this is not Appellants’ only error concerning the medical authorizations.
As argued by Appellees, there were other deficiencies with the medical authorizations
provided by the Appellants. The trial court found that “[t]he two medical authorizations
provided to JSA for the release of records by Dr. Villarreal and JSA were not HIPAA-
compliant because . . . these authorizations inadequately described the agency or
individuals authorized to receive health information as ‘bearer.’” The Code of Federal
-5-
Regulations requires “[t]he name or other specific identification of the person(s) or class
of persons, to whom the covered entity may make the requested use or disclosure.” 45
C.F.R. § 164.508(c)(1)(iii). Appellants contend that the term “bearer” used in the
medical authorizations provided named the class of persons authorized to obtain records,
thus satisfying the federal regulations. Appellants further assert that they intentionally
used the term “bearer” as a courtesy and as an accommodation so that Appellees could
provide the authorization to their agent, lawyer, or representative in order to obtain the
records. Appellees argue that the person or entity whom the patient is authorizing to
receive records must be specifically apparent, from the face of the authorization. In
support of this argument, Appellees rely on an Indiana Court of Appeals case, E.J. ex rel.
Jeffrey v. Okolocha, 972 N.E. 2d 941 (Ind. Ct. App. 2012). In the Indiana case, the court
considered the use of “TO WHOM IT MAY CONCERN” to describe the person
authorized to disclose information on a medical authorization. Id. at 947. The Indiana
court ultimately held that the identification did not satisfy HIPAA requirements because
the authorization failed to include “specific identification of the person . . . authorized to
make the . . . disclosure.” 45 C.F.R. § 164.508(c)(1)(ii). Id. The court concluded that the
“specific identification of the person” is a core element, which is critical and that “[i]t
must be apparent from the face of the authorization that the signing patient knows
specifically whom she is authorizing to make disclosure of her protected health records.”
Id. Although the instant case differs from E.J. ex rel. Jeffrey in that, here, we are
addressing the question of the specific identification of the person or class of persons
authorized to receive the protected health records rather than the person or entity
providing the protected health records, the Indiana court’s reasoning is still applicable.
Under the plain language of the regulation, a name is not required so long as there is
specific identification of the entity, person, or class of persons authorized to receive the
protected health records. The U.S. Department of Health and Human Services (HHS)
explains that a valid authorization may authorize disclosures to a “class of persons, such
as the employees of XYZ division of ABC insurance company.” U.S. Dep’t of Health
and Human Servs., FAQ, Health Information Privacy (Sept. 24, 2003),
http://www.hhs.gov/hipaa/for-professionals/faq/473/may-a-valid-authorization-list-
categories-of-persons-who-may-use-protected-information/index.html. Accordingly,
HHS confirms that even where an authorization provides for a “class of persons,” the
class must, nonetheless, be specifically identified. The term “bearer” does not satisfy the
specificity requirement and, therefore, is not HIPAA-compliant.
Appellees further argue that several of the medical authorizations provided by
Appellants fail to state the purpose for the release of the health information. A review of
the record shows that the section for the purpose of the release was left blank for the
medical authorizations provided to JSA, for the release of records by JMCGHD, Dr.
Villarreal, and JSA. The medical authorization provided to Dr. Villarreal, for the release
of records by JSA, also fails to state the purpose for the release of the protected health
information. As set out above, the purpose for the release of protected health information
is one of the six essential “core elements” for HIPAA-compliance. Regarding the
-6-
purpose of the requested use or disclosure, the Code of Federal Regulations states that a
compliant HIPAA authorization requires:
A description of each purpose of the requested use or disclosure. The
statement “at the request of the individual” is a sufficient description
of the purpose when an individual initiates the authorization and
does not, or elects not to, provide a statement of the purpose.
45 C.F.R §164.508(c)(1)(iv). The regulation does not require specificity, but it does
require some effort. The regulations state that “[w]hen a covered entity obtains or
receives a valid authorization for its use or disclosure of protected health information,
such use or disclosure must be consistent with such authorization.” 45 C.F.R. §
164.508(a)(1). Therefore, the form cannot simply be left blank. The trial court found
that based on Appellant’s use of the term “bearer” and the failure to state the purpose for
the release of medical records, neither Appellee “was authorized to use their own records
to investigate the claim during the pre-suit period, which would have been essential in
pre-suit evaluation of the case, resulting in prejudice to the [Appellees].”
Although there is no bright line rule that determines whether a party has
substantially complied with the requirements of Tenn. Code Ann. § 29-26-121(a)(2)(E),
the Stevens court provides guidance. “In determining whether a plaintiff has
substantially complied with a statutory requirement, a reviewing court should consider
the extent and significance of the plaintiff’s errors and omissions and whether the
defendant was prejudiced by the plaintiff’s noncompliance. Not every non-compliant
HIPAA medical authorization will result in prejudice.” Stevens, 418 S.W. 3d at 556.
Despite the Tennessee Supreme Court’s guidance, a review of recent case law
indicates that Tennessee law is less than settled concerning the question of substantial
compliance. In J.A.C. v. Methodist Healthcare Memphis Hosps., No. W2016-00024-
COA-R3-CV, 2016 WL 6493229, at *2 (Tenn. Ct. App. Nov. 2, 2016), perm. app.
pending, this Court upheld the trial court’s dismissal of a health liability action when the
authorizations did not list the person or class of persons authorized to disclose protected
health information and did not list the person or class of persons to whom a disclosure of
information could be made. Additionally, the medical authorizations did not designate
that mother was signing the forms on behalf of her young daughter as required by federal
regulations. Id. at *7-8; see also Harmon v. Shore, No. M2014-01339-COA-R3-CV,
2015 WL 1881467, *2 (Tenn. Ct. App. April 23, 2015) (“Although Appellants mailed a
HIPAA medical authorization to the Appellees, the authorization only released [the
patient’s] medical records to her own lawyer.”); Johnson v. Parkwest Medical Center,
No. E2013-01228-COA-R3-CV, 2014 WL 3765702, *7 (Tenn. Ct. App. July 31, 2014),
perm. app. denied (Tenn. Dec. 17, 2014) (“Without an appropriate HIPAA-compliant
medical authorization, Parkwest could not appropriately utilize those records to mount a
defense, even if the records were already in Parkwest's possession.”); Roberts v. Prill,
-7-
No. E2013-02202-COA-R3-CV, 2014 WL 2921930, *5 (Tenn. Ct. App. June 26, 2014)
(“[T]he form only permitted the use or disclosure of the medical records by plaintiff’s
counsel.”); and Hawkins v. Martin, No. W2013-02102-COA-R3-CV, 2014 WL
2854256, *1 (Tenn. Ct. App. June 23, 2014)(finding that the pre-lawsuit notice did “not
include medical authorization forms that complied with HIPAA, so as to permit the
defendants to obtain relevant medical records.”). The Tennessee Supreme Court has
recently granted certiorari in the case of Bray v. Khuri, No. W2015-00397-COA-R3-CV,
2015 WL 7775316, (Tenn. Ct. App. Dec. 3, 2015), perm. app. granted (Tenn. June 23,
2015). In Bray, this Court affirmed the trial court’s dismissal of the healthcare liability
action. Specifically, we held that “Appellant’s form left blank a core element and
therefore failed to provide Appellee with the proper authorization to use Decedent’s
medical records to mount a defense.” Id. at *4. The Bray Appellant left blank the portion
of the authorization form describing the type and amount of information to be used. Id.
However, there is another line of cases in which noncompliance did not result in
the dismissal of the healthcare liability action. In Hughes v. Henry Cty. Med. Ctr., No.
W2014-01973-COA-R3-CV, 2015 WL 3562733, at *4 (Tenn. Ct. App. June 9, 2015),
this Court reversed the trial court’s dismissal of a healthcare liability claim. In that case,
an error in the medical authorization form, which was provided to Henry County Medical
Center (“HCMC”), did not permit HCMC to obtain medical records from Dr. Gold.
However, Dr. Gold saw the patient only at HCMC, and he had no records other than the
hospital’s records. HCMC was able to obtain all of the Appellants’ relevant medical
records and to evaluate the merits of the claim despite Appellants’ technical failure to
include Dr. Gold’s records in its release. Id. at *1; see also Hunt v. Nair, E2014-01261-
COA-R9-CV, 2015 WL 5657083, (Tenn. Ct. App. Sept. 25, 2015) perm. app. denied
(Tenn. Jan. 21, 2016) (holding that Appellant’s authorization was substantially compliant
despite “plaintiff’s failure to employ certain language from §164.508(c)(ii)-(iii)” because
the omission did not prejudice the defendants.). Id at *6. In the case of Hamilton v.
Abercrombie Radiological Consultants, Inc., E2014-003433-COA-R3-CV, 2014 WL
7117802 (Tenn. Ct. App. Dec. 15, 2014), perm. app. denied (May 15, 2015), the date line
on the medical release was intentionally left blank for the medical provider to fill in so
that the release form would not “become stale.” Id. at *1. There was no evidence to
support a finding that the defendants were prejudiced and unable to obtain the necessary
medical records. Id. at *5. Consequently, this Court held that the relatively minor
shortcoming in the HIPAA release was not fatal to the appellant’s cause of action. Id. at
*7; see also, Chambers ex rel. Chambers v. County, No. E2013-01064-COA-R10-CV,
2014 WL 1266101 (Tenn. Ct. App. Mar. 28, 2014) (affirming the trial court’s denial of
the motion to dismiss where the sole issue on appeal was whether dismissal was
warranted because the plaintiff failed to file, with the complaint, an affidavit of the party
mailing the pre-suit notice.).
In this case, the Appellants’ failure is cumulative in that they did not comply with
-8-
three separate provisions of the Code of Federal Regulations.1 First, they failed to
provide a release for Bolivar General Hospital, Inc. even though it was listed as a
provider receiving notice. On the authorizations provided to JSA, Appellants failed to
identify, with any specificity, the person or class of persons able to receive Mr. Rush’s
private health information. Finally, on four of the medical authorizations provided by
Appellants, the Appellants failed to describe the purpose of the requested disclosure. As
noted by our Supreme Court, “[p]laintiff—not [d]efendants—[is] responsible for
complying with the requirements of section 29-26-121(a)(2)(E).” Stevens, 418 S.W.3d at
559. In reviewing the totality of the Appellants’ errors and omissions, we conclude that
Appellants did not substantially comply with federal regulations and that Appellees were
prejudiced by the fact that the authorizations submitted by Appellants did not allow it to
review the necessary records during the pre-suit notice phase.
B. Statute of Limitations
Here, the trial court found that the Appellants were “not entitled to the 120-day
extension of the statute of limitations that would otherwise have been afforded by the
statute.” The applicable statutes of limitations and repose in a health care liability action
“shall be extended for a period of one hundred twenty (120) days” when proper pre-suit
notice is provided. Tenn. Code Ann. § 29-26-121(c). In this case, the alleged negligence
occurred on July 18, 2014, but the complaint was not filed until November 6, 2015.
Having concluded that proper pre-suit notice was not provided pursuant to Tennessee
Code Annotated Section 29-26-121(a)(2)(E), we also conclude that the trial court
correctly held that Appellants were not entitled to the 120-day extension of the statute of
limitations under Tennessee Code Annotated Section 29-26-121(c). The case, therefore,
is time-barred.
V. Conclusion
For the foregoing reasons, we affirm the order of the trial court. We remand the
case for such further proceedings as may be necessary and are consistent with this
opinion. Costs of the appeal are assessed against Appellants, Gerald and Betty Rush, and
their surety, for all of which execution may issue if necessary.
_________________________________
KENNY ARMSTRONG, JUDGE
1
In this case, we are not called upon to determine whether any one of these deficiencies warrant
dismissal. As such, we express no opinion whether one of these deficiencies, in isolation, is enough to
warrant dismissal.
-9-