Mary Wenzler v. Dr. Xiao Yu

11/20/2018
IN THE COURT OF APPEALS OF TENNESSEE
AT JACKSON
October 9, 2018 Session

MARY WENZLER v. DR. XIAO YU, ET AL.

Appeal from the Circuit Court for Shelby County
No. CT-003652-17 Mary L. Wagner, Judge
___________________________________

No. W2018-00369-COA-R3-CV
___________________________________

This is a health care liability case filed against a dentist and the dental practice that
employed him. Before filing the complaint, the plaintiff gave written notice to the two
potential defendants of her health care liability claims against them. Tennessee Code
Annotated section 29-26-121(a)(2)(E) requires that a plaintiff’s pre-suit notice include a
HIPAA compliant medical authorization permitting the health care provider receiving the
notice to obtain complete medical records from every other provider that is being sent a
notice. After the plaintiff filed suit, the defendants moved to dismiss the complaint based
on noncompliance with the statute, as the defendants alleged that the HIPAA
authorizations provided by the plaintiff did not contain all of the required information and
were therefore invalid. After a hearing, the trial court granted the motion to dismiss,
concluding that the authorizations provided by the plaintiff were not HIPAA compliant
and therefore the plaintiff did not substantially comply with the statute. The plaintiff
appeals. We affirm in part, reverse in part, and remand for further proceedings.

Tenn. R. App. P. 3 Appeal as of Right; Judgment of the Circuit Court Affirmed in
Part, Reversed in Part, and Remanded

BRANDON O. GIBSON, J., delivered the opinion of the court, in which J. STEVEN
STAFFORD, P.J., W.S., and ARNOLD B. GOLDIN, J., joined.

Kathleen L. Caldwell, Memphis, Tennessee, for the appellant, Mary Wenzler.

Laura L. Deakins, Memphis, Tennessee, and Lucas A. Davidson, Nashville, Tennessee,
for the appellees, Xiao Yu, and American Family Dentistry of Memphis, PC.

OPINION

I. FACTS & PROCEDURAL HISTORY
 On June 8, 2017, Plaintiff Mary Wenzler sent pre-suit notice letters to two
potential defendants – Dr. Xiao Yu and American Family Dentistry of Memphis, PC –
notifying them of potential health care liability claims arising out of their care and
treatment of Mrs. Wenzler on June 13, 2016. The pre-suit notice letters stated that
Plaintiff was attaching HIPAA compliant medical authorizations authorizing each
potential defendant to obtain complete medical records relating to her care and treatment
from the other medical provider receiving the notice.1 According to federal regulations, a
HIPAA compliant authorization must, at a minimum, contain six “core elements,”
including,

(iii) The name or other specific identification of the person(s), or class of
persons, to whom the covered entity may make the requested use or
disclosure.

45 C.F.R. § 164.508(c)(1). The HIPAA authorizations sent by Plaintiff mentioned that
the information would be used for litigation but did not identify any particular person or
class of persons to whom the covered entities could make the use or disclosure.

Plaintiff filed her complaint for health care liability on September 1, 2017, and
named as defendants Dr. Xiao Yu and American Family Dentistry of Memphis, PC.2 The
defendants filed a motion to dismiss on October 2, 2017, asserting that Plaintiff failed to
provide HIPAA compliant medical authorizations with her pre-suit notice letters as
required by Tennessee Code Annotated section 29-26-121(a)(2)(E). Specifically, the
defendants noted that the authorization forms failed to identify the person or entity that
was authorized to receive the disclosure pursuant to the release. Based on this defect, the
defendants argued that Plaintiff could not take advantage of the 120-day statutory
extension to the statute of limitations provided by Tennessee Code Annotated section 29-
26-121(c), and as a result, her complaint was time-barred.3

1
“HIPAA is an acronym for the Health Insurance Portability and Accountability Act of
1996, Pub. L. No. 104–191, 110 Stat. 1936 (codified as amended in scattered sections of 18
U.S.C., 26 U.S.C., 29 U.S.C., 42 U.S.C.).” Runions v. Jackson-Madison Cnty. Gen. Hosp. Dist.,
549 S.W.3d 77, 80 n.3 (Tenn. 2018).
2
The complaint also included a loss of consortium claim filed by Plaintiff’s husband.
However, the trial court ultimately dismissed his claim, and Plaintiff’s husband was not listed on
the notice of appeal to this Court. Accordingly, we limit our review on appeal to Plaintiff’s
claim.
3
“When a plaintiff gives pre-suit notice to a health care provider under Tennessee Code
Annotated section 29-26-121, the one-year statute of limitations is extended by 120 days.”
Runions, 549 S.W.3d at 86 (citing Tenn. Code Ann. § 29-26-121(c)). However, the pre-suit
notice must comply with the statute in order for the plaintiff to receive the 120-day extension.
Byrge v. Parkwest Med. Ctr., 442 S.W.3d 245, 249-50 (Tenn. Ct. App. 2014); see, e.g., Dortch v.
Methodist Healthcare Memphis Hosps., No. W2017-01121-COA-R3-CV, 2018 WL 706767, at
*3 (Tenn. Ct. App. Feb. 5, 2018) (“because Ms. Dortch did not comply with the provisions of
-2-
 In response to the motion to dismiss, Plaintiff raised two arguments. First, she
argued that her HIPAA authorization forms met or exceeded the statutory requirements.
But alternatively, Plaintiff argued that even though there were “two named defendant
medical providers: Dr. Yu and American Family Dentistry of Memphis, P.C. (Dr. Yu’s
employer),” there was no “other” medical provider from whom records would be needed,
so the defendants were not prejudiced.

After a hearing, the trial court entered an order granting the defendants’ motion to
dismiss. The trial court found that Plaintiff’s authorizations were not HIPAA compliant,
as they did not identify any person or entity that could receive the protected information.
Because of this omission, the trial court concluded that Plaintiff did not substantially
comply with Tennessee Code Annotated section 29-26-121(a)(2)(E). The trial court
rejected Plaintiff’s argument that a HIPAA authorization was unnecessary in the event
that only one set of medical records existed, stating, “[t]he current case law is clear that
where there are two or more defendants, the plaintiff must provide HIPAA compliant
authorizations to all defendants,” “even when the defendants stand in an employee-
employer relationship.” Because Plaintiff was not entitled to rely on the 120-day
extension of the statute of limitations, the trial court dismissed Plaintiff’s complaint as
time-barred. Plaintiff timely filed a notice of appeal.

II. ISSUES PRESENTED

On appeal, Plaintiff asks this Court to consider “whether Plaintiff[] failed to
provide a HIPAA compliant medical authorization with the[] pre-suit notice as required
by Tennessee Code Annotated § 29-26-121(a)(2)(E).”4 Specifically, Plaintiff argues that
she substantially complied with the statute despite her failure to identify the intended
recipient of the medical records. Alternatively, she contends that a HIPAA authorization
was not needed because “in essence the instant case involves a single health care
provider.” For the following reasons, we affirm the decision of the circuit court in part,

section 121, she did not receive the 120 day extension, which made her [] Complaint time-
barred”); J.A.C. by & through Carter v. Methodist Healthcare Memphis Hosps., 542 S.W.3d 502,
514 (Tenn. Ct. App. 2016) (“Due to the Plaintiffs’ substantial noncompliance, the trial court was
correct in determining that the 120-day extension of the statute of limitations [] provided by
Tennessee Code Annotated section 29-26-121(c) was unavailable.”)
4
We note the defendants’ argument that this Court should dismiss the appeal due to
deficiencies in Plaintiff’s brief. Plaintiff failed to include a section in her brief listing the issues
presented for review and failed to include proper citations to the relevant pages of the record.
Instead, the cover page of Plaintiff’s brief states, “The nature of the proceedings: whether
Plaintiffs failed to provide a HIPAA compliant medical authorization with their pre-suit notice as
required by Tennessee Code Annotated § 29-26-121(02)(E),” and for citations to the record, she
included references such as “Complaint, ¶2” and “see Exhibit B-1 . . . to Complaint.” In light of
the limited issue resolved by the trial court and the small record on appeal, we will proceed to
address the merits of the appeal, and we decline the defendants’ request for attorney’s fees.
-3-
reverse in part, and remand for further proceedings.

III. STANDARD OF REVIEW

According to the Tennessee Supreme Court,

The proper way for a defendant to challenge a complaint’s
compliance with Tennessee Code Annotated section 29-26-121 [] is to file
a Tennessee Rule of Procedure 12.02 motion to dismiss. In the motion, the
defendant should state how the plaintiff has failed to comply with the
statutory requirements by referencing specific omissions in the complaint
and/or by submitting affidavits or other proof. Once the defendant makes a
properly supported motion under this rule, the burden shifts to the plaintiff
to show either that it complied with the statutes or that it had extraordinary
cause for failing to do so. Based on the complaint and any other relevant
evidence submitted by the parties, the trial court must determine whether
the plaintiff has complied with the statutes. If the trial court determines that
the plaintiff has not complied with the statutes, then the trial court may
consider whether the plaintiff has demonstrated extraordinary cause for its
noncompliance. If the defendant prevails and the complaint is dismissed,
the plaintiff is entitled to an appeal of right under Tennessee Rule of
Appellate Procedure 3 using the standards of review in Tennessee Rule of
Appellate Procedure 13.

Myers v. AMISUB (SFH), Inc., 382 S.W.3d 300, 307 (Tenn. 2012). Because the trial
court’s decision on the motion “involves a question of law, our review is de novo with no
presumption of correctness.” Id. (citing Graham v. Caples, 325 S.W.3d 578, 581 (Tenn.
2010)).

IV. DISCUSSION

Under Tennessee law, a claimant must provide written pre-suit notice to a
potential defendant before filing a complaint alleging health care liability:

Any person, or that person’s authorized agent, asserting a potential claim
for health care liability shall give written notice of the potential claim to
each health care provider that will be a named defendant at least sixty (60)
days before the filing of a complaint based upon health care liability in any
court of this state.

-4-
Tenn. Code Ann. § 29-26-121(a)(1). Pursuant to the statute, the pre-suit notice must
include “[a] HIPAA compliant medical authorization permitting the provider receiving
the notice to obtain complete medical records from each other provider being sent a
notice.” Tenn. Code Ann. § 29-26-121(a)(2)(E) (emphasis added).

“Because the penalties imposed on entities that wrongfully disclose or obtain
private health information in violation of HIPAA are severe, the sufficiency of the
plaintiffs’ medical authorizations is imperative.” Woodruff by & through Cockrell v.
Walker, 542 S.W.3d 486, 499 (Tenn. Ct. App. 2017). The specific requirements for a
HIPAA compliant medical authorization are set forth in 45 C.F.R. § 164.508:

(a) Standard: Authorizations for uses and disclosures
(1) Authorization required: General rule. Except as otherwise permitted or
required by this subchapter, a covered entity may not use or disclose
protected health information without an authorization that is valid under
this section. . . .
....
(c) Implementation specifications: Core elements and requirements—
(1) Core elements. A valid authorization under this section must contain at
least the following elements:
(i) A description of the information to be used or disclosed that identifies
the information in a specific and meaningful fashion.
(ii) The name or other specific identification of the person(s), or class of
persons, authorized to make the requested use or disclosure.
(iii) The name or other specific identification of the person(s), or class of
persons, to whom the covered entity may make the requested use or
disclosure.
(iv) A description of each purpose of the requested use or disclosure. . . .
(v) An expiration date or an expiration event that relates to the individual or
the purpose of the use or disclosure. . . .
(vi) Signature of the individual and date. If the authorization is signed by a
personal representative of the individual, a description of such
representative’s authority to act for the individual must also be provided.

(Emphasis added). “Under the plain language of the regulation,” with respect to
subsection (iii), “a name is not required so long as there is specific identification of the
entity, person, or class of persons authorized to receive the protected health records.”

-5-
Rush v. Jackson Surgical Assocs. PA, No. W2016-01289-COA-R3-CV, 2017 WL
564887, at *4 (Tenn. Ct. App. Feb. 13, 2017) perm. app. denied (Tenn. June 8, 2017).
For example, a valid authorization may authorize disclosure to a designated class of
persons, “such as the employees of XYZ division of ABC insurance company,” so long
as the class is specifically identified. Id. On the other hand, an authorization simply
listing the term “bearer” does not satisfy the specificity requirement, and such a form is
not HIPAA compliant. Id. Additionally, the HIPAA regulation expressly provides:

Defective authorizations. An authorization is not valid, if the document
submitted has any of the following defects:
....
(ii) The authorization has not been filled out completely, with respect to an
element described by paragraph (c) of this section, if applicable[.]

45 C.F.R. § 164.508(b)(2). Thus, “HIPAA deems authorizations defective if not filled
out completely.” Smith v. Wellmont Health Sys., No. E2017-00850-COA-R9-CV, 2018
WL 3343591, at *4 (Tenn. Ct. App. July 9, 2018).

As previously noted, the authorizations provided by Plaintiff in this case omitted
information regarding element (iii), failing to identify any person or class of persons to
whom the covered entity could make the requested use or disclosure. We now consider
the effect of such an error under Tennessee law. The Tennessee Supreme Court provided
guidance on that issue in Stevens ex rel. Stevens v. Hickman Community Health Care
Services, Inc., 418 S.W.3d 547 (Tenn. 2013). In that case, the pre-suit notice provided by
the plaintiff included a HIPAA authorization that only permitted the release of medical
records to plaintiff’s counsel and lacked other required information. Id. at 552. The
defendants moved to dismiss the complaint based on noncompliance with Tennessee
Code Annotated section 29-26-121(a)(2)(E). Id. The trial court denied the motion, and
the case eventually made its way to the Tennessee Supreme Court. Id. at 553. The
supreme court recognized that “[h]ealthcare liability defendants have a right to receive
medical records to defend themselves against civil liability,” and section 29-26-
121(a)(2)(E) requires a plaintiff to complete a HIPAA authorization “as a pre-condition
of filing suit.” Id. at 557-58. The supreme court explained that the statute’s HIPAA
authorization requirement serves “an investigatory function, equipping defendants with
the actual means to evaluate the substantive merits of a plaintiff’s claim by enabling . . .
early access to a plaintiff’s medical records.” Id. at 554. According to the court,

Because HIPAA itself prohibits medical providers from using or disclosing
a plaintiff’s medical records without a fully compliant authorization form, it

-6-
 is a threshold requirement of the statute that the plaintiff’s medical
authorization must be sufficient to enable defendants to obtain and review a
plaintiff’s relevant medical records. See 45 C.F.R. § 164.508(a)(1) (“a
covered entity may not use or disclose protected health information without
an authorization that is valid under this section”). Tenn. Code Ann. § 29-
26-121(d)(1) creates a statutory entitlement to the records governed by §
29-26-121(a)(2)(E). See Tenn. Code Ann. § 29-26-121(d)(1) (“All parties
in an action covered by this section shall be entitled to obtain complete
copies of the claimant’s medical records from any other provider receiving
notice ...”) (emphasis added). . . . .
A plaintiff’s less-than-perfect compliance with Tenn. Code Ann. §
29-26-121(a)(2)(E), however, should not derail a healthcare liability claim.
Non-substantive errors and omissions will not always prejudice defendants
by preventing them from obtaining a plaintiff’s relevant medical records.
Thus, we hold that a plaintiff must substantially comply, rather than strictly
comply, with the requirements of Tenn. Code Ann. § 29-26-121(a)(2)(E).

Id. at 555 (emphasis in original).

Next, the court considered the sufficiency of the HIPAA authorization provided in
that case to determine whether it substantially satisfied the requirements of the statute.
Id. After noting the six core elements required by federal regulations, the supreme court
concluded that the authorization at issue was not HIPAA compliant. Id. at 556. “First,
and most importantly,” the court said, “by permitting disclosure only to Plaintiff’s
counsel, Plaintiff’s medical authorization failed to satisfy the express requirement of
Tenn. Code Ann. § 29-26-121(a)(2)(E) that a plaintiff’s medical authorization ‘permit[ ]
the provider receiving the notice to obtain complete medical records from each other
provider being sent a notice.’” Id. Secondly, the court found that the authorization failed
to satisfy at least three of the six compliance requirements mandated by HIPAA. Id. The
court continued,

In determining whether a plaintiff has substantially complied with a
statutory requirement, a reviewing court should consider the extent and
significance of the plaintiff’s errors and omissions and whether the
defendant was prejudiced by the plaintiff’s noncompliance. Not every non-
compliant HIPAA medical authorization will result in prejudice. But in this
case, the medical authorization submitted by Plaintiff was woefully
deficient. The errors and omissions were numerous and significant. Due to
Plaintiff's material non-compliance, Defendants were not authorized to
receive any of the Plaintiff’s records. As a result of multiple errors,

-7-
 Plaintiff failed to substantially comply with the requirements of Tenn. Code
Ann. § 29-26-121(a)(2)(E).

Id. (emphasis added). In a later case, the supreme court summarized Stevens as holding
that “non-substantive errors and omissions and a plaintiff's less-than-perfect compliance
with subsection 29-26-121(a)(2)(E) will not derail a healthcare liability claim so long as
the medical authorization provided is sufficient to enable defendants to obtain and review
a plaintiff’s relevant medical records.” Thurmond v. Mid-Cumberland Infectious Disease
Consultants, PLC, 433 S.W.3d 512, 519-20 (Tenn. 2014) (quotations and bracketing
omitted).

In sum, “there is no bright line rule that determines whether a party has
substantially complied with the requirements of Tenn. Code Ann. § 29-26-
121(a)(2)(E)[.]” Rush, 2017 WL 564887, at *4. However, in order to substantially
comply with the statute, a plaintiff must provide a defendant with a HIPAA compliant
medical authorization form that is sufficient to allow the defendant to obtain the
plaintiff’s medical records from the other providers being sent the notice. Brookins v.
Tabor, No. W2017-00576-COA-R3-CV, 2018 WL 2106652, at *5 (Tenn. Ct. App. May
8, 2018); Travis v. Cookeville Reg’l Med. Ctr., No. M2015-01989-COA-R3-CV, 2016
WL 5266554, at *7 (Tenn. Ct. App. Sept. 21, 2016). In this context, substantial
compliance requires “a degree of compliance that provides the defendant with the ability
to access and use the medical records for the purpose of mounting a defense.” Lawson v.
Knoxville Dermatology Grp., P.C., 544 S.W.3d 704, 711 (Tenn. Ct. App. 2017).

Applying these principles, we consider whether Plaintiff failed to substantially
comply with section 29-26-121(a)(2)(E) by providing each defendant with an incomplete
HIPAA authorization form that failed to identify to whom the covered entity could make
the requested use or disclosure. Considering first “the extent and significance of the
plaintiff’s errors and omissions,” as instructed by Stevens, 418 S.W.3d at 556, we note
that these HIPAA authorizations were “defective” and “not valid” under HIPAA
regulations due to Plaintiff’s omission. 45 C.F.R. § 164.508(b)(2)(ii). Her omission was
both substantive and significant. As a result of Plaintiff’s failure to identify any
authorized recipient of the records, her HIPAA authorizations did not permit the
defendants to receive Plaintiff’s medical records.

In Lawson, 544 S.W.3d at 712, this Court found no substantial compliance where
a similar core element of the plaintiff’s HIPAA authorization, designating who was
authorized to make the requested use or disclosure, was left blank. Id. We explained that
“health care providers presented with a medical authorization missing the identification
of those authorized to release information would have no way of knowing that they were
-8-
the providers for which the authorization was intended or that they were allowed to
release medical records.” Id. As such, we concluded that the single omitted core element
was “a necessary element” to the defendants’ legal authorization to use the medical
records. Id.

In Riley v. Methodist Healthcare Memphis Hospitals, 731 F. App’x 481 (6th Cir.
2018), the Sixth Circuit considered a HIPAA authorization with the same omission as the
one before us in the context of a diversity jurisdiction case alleging health care liability.
Specifically, the plaintiffs in Riley left blank the section where they were supposed to list
the persons to whom each provider could disclose the patient’s records. Id. at 488 (citing
C.F.R. § 145.608(c)(1)(iii)). Applying Tennessee law and federal HIPAA regulations,
the district court deemed the authorization defective, rejecting the plaintiff’s argument
that the forms were HIPAA compliant and would effectively permit each defendant to
share records with anyone it wished. Id. at 489. Instead, the district court concluded,
because of the omission in the form, the defendants were permitted to disclose records to
no one. Id. The Sixth Circuit found no error in this decision. Id. at 490. After reviewing
Tennessee caselaw, the court concluded that “substantial compliance requires that the
noncomplying features of the authorization do not render it insufficient to authorize
access and use of the records,” and the form at issue in Riley “did not permit that access
and use.” Id. at 491-92; see also Rush, 2017 WL 564887, at *4 (concluding that an
authorization that failed to identify with specificity a person or class of persons able to
receive the records but instead listing “bearer” was not HIPAA compliant).

Despite the deficiencies in Plaintiff’s HIPAA authorization, Plaintiff argues that
“in essence the instant case involves a single health care provider,” and therefore, no
HIPAA authorization was necessary in the first place. According to Plaintiff’s complaint,
Dr. Yu was “a health care provider” who was “practicing dentistry at the dental clinic
owned and operated by American Family Dentistry of Memphis, P.C.,” and Dr. Yu either
“worked at, was employed by, or had an ownership interest in” American Family
Dentistry.5 Plaintiff argues that the Tennessee Supreme Court’s holding in Bray v. Khuri,
523 S.W.3d 619 (Tenn. 2017) is “directly on point” and no HIPAA authorization needed
to be provided under these circumstances.

In Bray, the plaintiff filed suit against one physician – a single “health care
provider” within the meaning of HIPAA and the Tennessee Health Care Liability Act.6

5
Because we are reviewing the trial court’s decision on a Rule 12.02(6) motion to
dismiss, for purposes of this appeal, we presume that the allegations of fact in the complaint are
true. Stevens, 418 S.W.3d at 552 n.1.
6
Under HIPAA, a “health care provider” is defined as “a provider of services (as defined
in section 1861(u) of the Act, 42 U.S.C. 1395x(u)), a provider of medical or health services (as
-9-
Id. at 620. The Tennessee Supreme Court examined the text of Tennessee Code
Annotated section 29-26-121(a)(2)(E), which requires a person who asserts a potential
claim for health care liability to provide with pre-suit notice a HIPAA compliant
authorization “permitting the provider receiving the notice to obtain complete medical
records from each other provider being sent a notice.” Tenn. Code Ann. § 29-26-
121(a)(2)(E). Considering the plain language of the statute, the Bray court concluded
that “a prospective plaintiff who provides pre-suit notice to one potential defendant is not
required under Tennessee Code Annotated section 29-26-121(a)(2)(E) to provide the
single potential defendant with a HIPAA-compliant medical authorization.” Id.
(emphasis added). In other words, “a plaintiff need not provide a HIPAA-compliant
authorization when a single healthcare provider is given pre-suit notice of a healthcare
liability claim.” Id. at 622 (emphasis added). According to the court, “The authorization
only allows a potential defendant to obtain the prospective plaintiff’s medical records
from any other healthcare provider also given notice and identified as a potential
defendant in the pre-suit notice.” Id. (emphasis added).

The intermediate appellate court in Bray had concluded that even though the sole
defendant-physician may have physically possessed the patient’s records, he could not
review them with counsel to evaluate the merits of the claim absent a HIPAA compliant
authorization. Id. at 621. Thus, on appeal, the physician maintained that a HIPAA
authorization would be necessary because HIPAA would prohibit him from disclosing
medical records already in his possession to his own counsel. Id. The supreme court
recognized the “general rule” that “HIPAA prohibits a healthcare provider from using or
disclosing protected health information without a valid authorization.” Id. (citing 45
C.F.R. § 164.508(a)(1)).7 However, examining HIPAA regulations, the supreme court
found an applicable “regulatory exception to the general requirement of a HIPAA-
compliant medical authorization.” Id. at 623. The court explained that HIPAA
regulations permit a health care provider to use or disclose protected health information
for its own “health care operations,” with some exceptions. Id. at 622 (citing 45 C.F.R. §

defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or organization
who furnishes, bills, or is paid for health care in the normal course of business.” 45 C.F.R. §
160.103. Tennessee Code Annotated section 29-26-101(a)(2) defines a “health care provider” as
“[a] health care practitioner licensed, authorized, certified, registered, or regulated under any
chapter of title 63 or title 68 . . . .”
7
Specifically, section 164.508(a)(1) provides:

(a) Standard: Authorizations for uses and disclosures
(1) Authorization required: General rule. Except as otherwise permitted or
required by this subchapter, a covered entity may not use or disclose protected
health information without an authorization that is valid under this section.

45 C.F.R. § 164.508(a)(1) (emphasis added).
- 10 -
164.506(a)). “Health care operations” include “[c]onducting or arranging for . . . legal
services,” and the website maintained by the United States Department of Health and
Human Services indicated that a health care provider may use or disclose protected health
information with its lawyer for litigation. Id. at 622-23. As such, the supreme court
concluded that “HIPAA does not require Dr. Khuri to obtain a medical authorization to
use a patient’s medical records in his possession and consult with counsel to evaluate the
merits of a potential claim.” Id. at 623 (emphasis added). Notably, the physician relied
on a previous decision from the Court of Appeals, Roberts v. Prill, E2013-02202-COA-
R3-CV, 2014 WL 2921930, at *6 (Tenn. Ct. App. June 26, 2014), to support his
argument that a HIPAA compliant medical authorization was required to enable him to
“use” medical records in his possession. Id. Without opining on the merits of the
Roberts decision, the supreme court found it “factually distinguishable on a critical point:
Roberts involved two defendants, whereas this case involves a single defendant.” Id.
Accordingly, the supreme court explained, Roberts did not consider the same issue –
“whether section 29-26-121(a)(2)(E) applies when a single healthcare provider is named
as a potential defendant.”8 Id.

In summary, Bray established two points – (1) “a plaintiff need not provide a
HIPAA-compliant authorization when a single healthcare provider is given pre-suit
notice of a healthcare liability claim,” and (2) a health care provider may use or disclose
protected health information for its health care operations and does not need to obtain a
medical authorization in order “to use a patient’s medical records in [its] possession and
consult with counsel to evaluate the merits of a potential claim.” Id. at 622-23. Clearly,
the factual situation before us does not fall within the “single healthcare provider”
exception recognized in Bray that would have excused Plaintiff from providing a HIPAA
authorization in the first place. This Court rejected a similar argument in another case

8
The Roberts case was filed against an oncologist and the health care group that
employed the oncologist. Roberts, 2014 WL 2921930, at *1. The plaintiff claimed that the
defendants already had all of the relevant records in their possession. Id. at *6. The court of
appeals concluded that because the HIPAA authorizations provided by the plaintiff were
defective, the two defendants “were not legally authorized to use the pertinent medical records to
mount a defense, despite the fact that the records may have already been in their possession.” Id.
at *5. The court concluded that the “case did not fall within one of the limited circumstances
anticipated by HIPAA that would allow for the use of the records without authorization.” Id. at
*6. However, the only specific exception the court discussed was provided in 45 C.F.R. §
164.508(a)(2)(i)(C), which addresses the use of psychotherapy notes in a legal action. Id. We
did not mention the exception for health care operations that was later discussed by the supreme
court in Bray. Id.; see also Harmon v. Shore, No. M2014-01339-COA-R3-CV, 2015 WL
1881467, at *5 & n.3 (Tenn. Ct. App. Apr. 23, 2015) (relying on Roberts prior to Bray -- where
the plaintiff argued that a doctor and hospital already possessed the records -- and concluding
that the case did not fall within one of the limited circumstances that would allow for the “use”
of records without an authorization, but only discussing the psychotherapy exception).
- 11 -
involving two defendant medical providers – a physician’s assistant and the dermatology
practice that employed her. Lawson, 544 S.W.3d at 710. Despite the employer-employee
relationship between the defendants, we ultimately concluded that the situation before us
involved multiple defendants, and therefore “the one-defendant exception articulated in
Bray [did] not apply[.]” Id. at 711-12.

The Sixth Circuit also considered and rejected a similar argument in Riley, where
health care liability claims were filed against a physician in addition to the clinic and the
hospital where the physician practiced. 731 Fed. Appx. at 483. Like Plaintiff, the
appellants in Riley argued that this was “essentially a one-provider case” and suggested
that all of the records would be accessible by the physician as the health care provider
who rendered the care. Id. at 495. The Sixth Circuit rejected that argument, first
characterizing Bray as “a statutory interpretation case” that was “inapposite” given that
the case before it involved pre-suit notice sent to three health care providers. Id.
However, to the extent that the plaintiffs were suggesting a lack of prejudice on the part
of the defendants due to an alleged ability to access records without the need for a
HIPAA authorization, the court further held that the plaintiffs failed to adequately raise
and establish a lack of prejudice or that the defendants actually had “another means of
access” to the records. Id. at 494-95.

Likewise, this is not a “single healthcare provider” case within the meaning of
Bray such that HIPAA authorizations were unnecessary. However, to the extent that
Plaintiff is attempting to argue a lack of prejudice in light of the two defendants’
employment relationship, we find it necessary to consider the issue of prejudice
separately with respect to each defendant. Again, Stevens requires us to consider whether
each defendant was prejudiced by Plaintiff’s failure to provide a HIPAA compliant
release. See Stevens, 418 S.W.3d at 556. Notably, at oral argument before this Court,
counsel for the defendants conceded that “[i]n this particular case, Dr. Yu does not
possess the records; American Family Dentistry possesses the records.” Therefore, we
begin by considering the issue of prejudice to American Family Dentistry, which already
had the records in its possession, resulting from its inability to utilize the HIPAA
authorization provided by Plaintiff.9

According to the Tennessee Supreme Court’s decision in Bray, a HIPAA
authorization “only allows a potential defendant to obtain the prospective plaintiff’s
medical records from any other healthcare provider also given notice and identified as a

9
With regard to the issue of prejudice, we note that a defendant is not required to
attempt to use a medical authorization it believes to be defective, and “a defendant’s claim of
prejudice is not waived by failing to attempt to use or otherwise ‘test’ an allegedly defective
authorization.” Smith, 2018 WL 3343591, at *6.
- 12 -
potential defendant in the pre-suit notice,” and HIPAA regulations allow a health care
provider to use or disclose protected health information in its possession for its own
health care operations. 523 S.W.3d at 622. For instance, in Bray, HIPAA did not require
the defendant-doctor to obtain a medical authorization in order to “use” the patient’s
medical records in his possession and consult with counsel to evaluate the merits of the
potential claim. Id. Here, according to the concession of defense counsel, Dr. Yu did not
possess any records. The records were maintained by American Family Dentistry.
Therefore, it was not necessary for American Family Dentistry to utilize the HIPAA
authorization to obtain records from any other health care provider identified as a
potential defendant, and American Family Dentistry was authorized to use the records in
its possession to evaluate the merits of Plaintiff’s claim without a HIPAA authorization.

In this regard, this case is analogous to Hughes v. Henry County Medical Center,
No. W2014-01973-COA-R3-CV, 2015 WL 3562733 (Tenn. Ct. App. June 9, 2015). In
Hughes, the plaintiff filed a health care liability action against a hospital and a physician
(although the physician was not a party to the appeal). Id. at *1. A clerical error in the
medical authorization form provided to the hospital did not permit it to obtain medical
records from the physician. Id. However, counsel for the hospital conceded that the
physician saw the patient only at the hospital and had no records independent of the
hospital’s records. Id. at *2. This Court quoted the following pertinent language from
Stevens,

[I]n determining whether a plaintiff has substantially complied with a
statutory requirement, a reviewing court should consider the extent and
significance of the plaintiff’s errors and omissions and whether the
defendant was prejudiced by the plaintiff’s noncompliance. Not every non-
compliant HIPAA medical authorization will result in prejudice.

Id. (citing 418 S.W.3d at 556). We noted the undisputed fact that the physician had no
medical records, and therefore, the validity of the release for the physician’s records had
no effect on the hospital’s ability to obtain “complete medical records” as contemplated
by the statute. Id. at *3. Rather, the hospital “was able to obtain all of the [patient’s]
relevant medical records, and evaluate the merits of the claim despite Appellants’
technical failure to include [the physician’s] records in its release.”10 Id. at *4. Because
the hospital admittedly suffered no prejudice as a result of the defective HIPAA
authorization and the statutory goal of allowing a defendant to evaluate the merits of a

10
Hughes was a pre-Bray decision. The Court of Appeals concluded that the hospital
was permitted to “use its own records” in light of the particular language of the defective HIPAA
release form, without discussing the exception for health care operations later discussed in Bray.
Id. at *1. However, we believe the result here is the same with respect to the issue of prejudice.
- 13 -
claim with early access to medical records was satisfied, we concluded that Plaintiff
substantially complied with the statute. Id. at *5. See also Martin v. Rolling Hills Hosp.,
LLC, No. M2016-02214-COA-R3-CV, 2018 WL 3097231, at *8 (Tenn. Ct. App. June
22, 2018) (finding no prejudice to the defendants in a case where the plaintiffs argued
that the defendants already had possession of the relevant documents); but see Dolman v.
Donovan, No. W2015-00392-COA-R3-CV, 2015 WL 9315565, at *1 (Tenn. Ct. App.
Dec. 23, 2015) (declining to find no prejudice when eight separate providers were given
pre-suit notice, only one defendant-hospital actually had relevant records, but the
providers did not know this information during the pre-suit notice period and were unable
to use the defective authorizations to request whatever records might have existed).

We recognize that our holding with regard to this issue seems to conflict with the
portion of the Lawson opinion analyzing the issue of prejudice when two defendants are
involved. Again, Lawson involved two defendant medical providers – a physician’s
assistant and the dermatology practice that employed her. Lawson, 544 S.W.3d at 705.
However, the plaintiffs only appealed the dismissal of the claim against the dermatology
practice. Id. On appeal, the plaintiffs argued that the defendant-practice was not
prejudiced by a defective HIPAA release because it “already had access to the medical
record it generated” when the plaintiff was treated and “was already in possession of the
only medical record relevant to the case at bar.” Id. at 710. We found the “one-
defendant exception” from Bray inapplicable and instead relied on the pre-Bray decision
in Roberts (which had only discussed the applicability of the HIPAA exception for
psychotherapy notes). Id. Applying Roberts, we concluded that the fact that the records
were already in the defendant’s possession did not excuse compliance with the HIPAA
authorization requirement because, in the absence of one of HIPAA’s limited exceptions,
HIPAA generally provides that a covered entity may not use protected health information
without a valid authorization. Id. As in Roberts, the only exception we referenced was
the one for psychotherapy notes. Id. We concluded that in light of the defective HIPAA
form, the defendant medical practice would not be allowed to consult with anyone about
the records and “would not be allowed to use Mr. Lawson’s medical records to mount a
defense.” Id. at 713.

Essentially, in Lawson, we concluded that “the one-defendant exception
articulated in Bray [did] not apply” to excuse the plaintiffs from providing HIPAA
authorizations, but we did not discuss whether the “health care operations” exception to
HIPAA that was secondarily discussed in Bray would nevertheless permit the defendant-
practice to use the records in its possession. Id. at 711. Having carefully reviewed
Lawson, Roberts (and cases citing it), and the Tennessee Supreme Court’s decision in
Bray, we simply conclude that our decision is controlled by the Bray decision and its
conclusion regarding the use of records that are already in the possession of a health care
provider. Discerning no prejudice to American Family Dentistry due to Plaintiff’s failure

- 14 -
to provide it with a HIPAA compliant release, we conclude that Plaintiff substantially
complied with Tennessee Code Annotated section 29-26-121(a)(2)(E), she was entitled to
the 120-day extension to the statute of limitations, and her claim against American
Family Dentistry was not time-barred. We reverse the trial court’s dismissal of Plaintiff’s
claim against American Family Dentistry.

We now consider the existence of prejudice to Dr. Yu, who did not already
possess the records, resulting from his inability to utilize the HIPAA authorization
provided by Plaintiff. Before the trial court, counsel for the defendants acknowledged
that American Family Dentistry and Dr. Yu are “in an employer-employee relationship.”
Although Plaintiff does not cite any HIPAA regulations on appeal, she suggests that it is
incomprehensible that Dr. Yu would not have “free access” to obtain medical records
from American Family Dentistry when he continues to work at the clinic.

We disagree. HIPAA distinguishes between uses or disclosures for purposes of
treatment and those for purposes of health care operations.11 The “health care
operations” exception to the general requirement of a HIPAA compliant authorization,
which was discussed in Bray, does not extend to the lengths implicitly urged by Plaintiff.
Keeping in mind that the purpose of American Family Dentistry providing these records
to Dr. Yu would be for Dr. Yu’s own health care operations, we look to the language of
the regulation:

(c) Implementation specifications: Treatment, payment, or health care
operations.
(1) A covered entity may use or disclose protected health information for its
own treatment, payment, or health care operations.
....
(4) A covered entity may disclose protected health information to another
covered entity for health care operations activities of the entity that receives
the information, if each entity either has or had a relationship with the
individual who is the subject of the protected health information being
requested, the protected health information pertains to such relationship,
and the disclosure is:
(i) For a purpose listed in paragraph (1) or (2) of the definition of health
care operations; or

11
“Treatment means the provision, coordination, or management of health care and
related services by one or more health care providers, including the coordination or management
of health care by a health care provider with a third party; consultation between health care
providers relating to a patient; or the referral of a patient for health care from one health care
provider to another.” 45 C.F.R. § 164.501.
- 15 -
 (ii) For the purpose of health care fraud and abuse detection or compliance.

45 C.F.R. § 164.506(c) (emphasis added). The referenced purposes listed in paragraphs
(1) and (2) are for quality-related health care operations and do not include legal services,
which is separately addressed in paragraph (4).12 Accordingly, this exception to the
authorization requirement would not permit American Family Dentistry to disclose
records to Dr. Yu for the purposes of Dr. Yu’s health care operations (i.e., conducting or
arranging for legal services).

“Requiring a HIPAA compliant medical authorization to accompany the pre-suit
notice was a policy decision by the General Assembly that ‘equip[s] defendants with the
actual means to evaluate the substantive merits of a plaintiff’s claim by enabling early
access to a plaintiff’s medical records.’”13 J.A.C. by & through Carter, 542 S.W.3d at

12
See https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-
treatment-payment-health-care-operations/index.html (characterizing paragraphs (1) and (2) as
“quality-related health care operations activity”). The definition of health care operations
provides:

Health care operations means any of the following activities of the covered entity
to the extent that the activities are related to covered functions:

(1) Conducting quality assessment and improvement activities, including
outcomes evaluation and development of clinical guidelines, provided that the
obtaining of generalizable knowledge is not the primary purpose of any studies
resulting from such activities; patient safety activities (as defined in 42 CFR
3.20); population-based activities relating to improving health or reducing health
care costs, protocol development, case management and care coordination,
contacting of health care providers and patients with information about treatment
alternatives; and related functions that do not include treatment;
(2) Reviewing the competence or qualifications of health care professionals,
evaluating practitioner and provider performance, health plan performance,
conducting training programs in which students, trainees, or practitioners in areas
of health care learn under supervision to practice or improve their skills as health
care providers, training of non-health care professionals, accreditation,
certification, licensing, or credentialing activities;
....
(4) Conducting or arranging for medical review, legal services, and auditing
functions, including fraud and abuse detection and compliance programs;

45 C.F.R. § 164.501.
13
We note that HIPAA also permits a covered entity to disclose protected health
information “in the course of any judicial or administrative proceeding” but only “[i]n response
to an order of a court or administrative tribunal” or “a subpoena, discovery request, or other
lawful process” and provided that other conditions are met. 45 C.F.R. § 164.512(e).
- 16 -
521 (quoting Stevens, 418 S.W.3d at 555). In the case before us, the authorization
Plaintiff sent to Dr. Yu was not HIPAA-compliant, and Plaintiff has not demonstrated
that Dr. Yu had another means of access to the records maintained by American Family
Dentistry that would have enabled him to evaluate her claim. See Myers, 382 S.W.3d at
307 (“Once the defendant makes a properly supported motion under this rule, the burden
shifts to the plaintiff to show [] that it complied with the statutes . . . . Based on the
complaint and any other relevant evidence submitted by the parties, the trial court must
determine whether the plaintiff has complied with the statutes.”); Dolman, 2015 WL
9315565, at *4 (concluding that plaintiffs presented only sparse evidence regarding an
alleged affiliation between defendant entities that failed to reveal the extent of the
defendants’ access to records). We therefore conclude that Dr. Yu was prejudiced by the
lack of a HIPAA compliant authorization. “‘Defendants are clearly prejudiced when
unable, due to a form procedural error, to obtain medical records needed for their legal
defense.’” Hamilton v. Abercrombie Radiological Consultants, Inc., 487 S.W.3d 114,
120 (Tenn. Ct. App. 2014). Plaintiff failed to substantially comply with Tennessee Code
Annotated section 29-26-121(a)(2)(E) because her authorization would not allow Dr. Yu
to obtain medical records from the other health care provider receiving pre-suit notice.
Due to Plaintiff’s failure to substantially comply with the statute within the original
statute of limitations, Plaintiff did not receive the 120-day extension of the statute of
limitations, and her complaint against Dr. Yu was not timely filed. See Byrge, 442
S.W.3d at 250. We affirm the trial court’s dismissal of the claim against Dr. Yu.

V. CONCLUSION

For the aforementioned reasons, we affirm the decision of the circuit court in part,
we reverse in part, and we remand this cause for further proceedings consistent with this
opinion. Costs of this appeal are taxed equally to the appellant, Mary Wenzler, and to
appellee American Family Dentistry, for which execution may issue if necessary.

_________________________________
BRANDON O. GIBSON, JUDGE

- 17 -