04/18/2019
IN THE COURT OF APPEALS OF TENNESSEE
AT NASHVILLE
February 19, 2019 Session
STEVEN WILLIAMS v. GATEWAY MEDICAL CENTER ET AL.
Appeal from the Circuit Court for Montgomery County
No. CC16CV2392 Ross H. Hicks, Judge
___________________________________
No. M2018-00939-COA-R3-CV
___________________________________
THOMAS R. FRIERSON, II, J., concurring in part and dissenting in part.
I concur fully in this Court’s affirmance of the dismissal of Mr. Williams’s claims
based on his failure to substantially comply with the requirements of Tennessee Code
Annotated § 29-26-121(a)(2)(E). I write separately solely to express my opinion that
prior precedent from this Court would mandate dismissal not only for Mr. Williams’s
failure to describe the records to be disclosed on his medical authorization form but for
the omission of an expiration date as well.
As our Supreme Court has recognized and the majority opinion acknowledges, a
HIPAA-complaint medical authorization must contain six “core elements”:
(i) A description of the information to be used or disclosed
that identifies the information in a specific and meaningful
fashion.
(ii) The name or other specific identification of the person(s),
or class of persons, authorized to make the requested use
or disclosure.
(iii) The name or other specific identification of the person(s),
or class of persons, to whom the covered entity may
make the requested use or disclosure.
(iv) A description of each purpose of the requested use or
disclosure . . . .
(v) An expiration date or an expiration event that relates to
the individual or the purpose of the use or disclosure . . . .
(vi) Signature of the individual and date. If the authorization
is signed by a personal representative of the individual, a
description of such representative’s authority to act for
the individual must also be provided.
See Stevens ex rel. Stevens v. Hickman Cmty. Health Care Servs., Inc., 418 S.W.3d 547,
555-56 (Tenn. 2013) (quoting 45 C.F.R. § 164.508(c)(1)) (emphasis added).
In the case at bar, the medical records authorizations provided by Mr. Williams
did not include a “description of information to be used or disclosed” or an expiration
date. See 45 C.F.R. § 164.508(c)(1)(i), (v). In prior cases wherein only one “core”
element was omitted, this Court has determined that substantial compliance with the
statute was not accomplished. See Buckman v. Mountain States Health All., No. E2017-
01766-COA-R3-CV, ____ S.W.3d ____, 2018 WL 3608416, at *6 (Tenn. Ct. App. July
26, 2018), perm. app. denied (Tenn. Nov. 15, 2018) (concluding that the medical
authorization was insufficient to establish substantial compliance because the expiration
date had already passed); Lawson v. Knoxville Dermatology Grp., P.C., 544 S.W.3d 704,
712 (Tenn. Ct. App. 2017), perm. app. denied (Tenn. Nov. 16, 2017) (concluding that the
plaintiffs’ authorization was insufficient to establish substantial compliance because it did
not contain the name(s) of the persons authorized to make the requested disclosure);
Parks v. Walker, No. E2017-01603-COA-R3-CV, 2018 WL 6242461, at *3 (Tenn. Ct.
App. Nov. 28, 2018), perm. app. denied (Tenn. Mar. 27, 2019) (concluding that the
plaintiff’s authorization was insufficient to establish substantial compliance because it did
not contain a “description of each purpose of the requested use or disclosure”).
In prior cases wherein the omissions were more numerous and significant, this
Court has repeatedly determined that the plaintiffs failed to substantially comply with the
respective statute. See J.A.C. by & through Carter v. Methodist Healthcare Memphis
Hosps., 542 S.W.3d 502, 513 (Tenn. Ct. App. 2016) (finding medical authorizations
insufficient when the plaintiffs did not identify the patient whose records were to be
released and did not identify the persons to whom a disclosure could be made); Smith v.
Wellmont Health Sys., No. E2017-00850-COA-R9-CV, 2018 WL 3343591, at *5 (Tenn.
Ct. App. July 9, 2018) (determining that a medical authorization that failed to contain
three of the “core elements mandated by 45 C.F.R. § 164.508(c)” was not sufficient to
constitute substantial compliance); Roberts v. Wellmont Health Sys., No. E2017-00845-
COA-R9-CV, 2018 WL 3302178, at *1 (Tenn. Ct. App. July 5, 2018) (same); Rush v.
Jackson Surgical Assocs. PA, No. W2016-01289-COA-R3-CV, 2017 WL 564887, at *4-
5 (Tenn. Ct. App. Feb. 13, 2017), perm. app. denied (Tenn. June 8, 2017) (determining
that when the plaintiffs failed to describe the purpose of the disclosure on certain forms
and failed to identify the persons authorized to receive the health information on others,
-2-
the plaintiffs had not substantially complied). But see Martin v. Rolling Hills Hosp.,
LLC, No. M2016-02214-COA-R3-CV, 2018 WL 3097231, at *9 (Tenn. Ct. App. June
22, 2018), perm. app. granted (Tenn. Nov. 16, 2018) (determining that although the
plaintiffs had failed to comply with three of the requirements of 45 C.F.R. § 164.508(c),
substantial compliance had been shown because the defendants failed to demonstrate that
they were prejudiced as a result of the deficiencies in the medical authorizations).
Based on this Court’s prior precedent, I believe that each of the omissions in Mr.
Williams’s medical authorizations was significant and prevented substantial compliance
with Tennessee Code Annotated § 29-26-121(a)(2)(E). Without an expiration date or a
description of the information to be used or disclosed, the medical authorizations failed to
comply with two of the “core” requirements of 45 C.F.R. § 164.508(c). As this Court has
previously elucidated:
“Defective authorizations” are defined in 45 C.F.R. § 164.508(b)(2).
An authorization is not valid if, among other things, it “has not been filled
out completely, with respect to an element described by paragraph (c) of
this section.” See 45 C.F.R. § 164.508(b)(2). . . . Therefore, we affirm the
trial court’s holding that the omission of a core element constituted a lack
of substantial compliance with the statutory requirements.
Parks, 2018 WL 6242461, at *3. In addition, “[b]ecause the penalties imposed on
entities that wrongfully disclose or obtain private health information in violation of
HIPAA are severe, the sufficiency of the plaintiffs’ medical authorizations is
imperative.” Woodruff by & through Cockrell v. Walker, 542 S.W.3d 486, 499 (Tenn. Ct.
App. 2017), perm. app. denied (Tenn. Oct. 6, 2017).
Furthermore, I believe that this Court is bound by relevant precedent repeatedly
holding that it is not the burden of medical defendants to “assist” a plaintiff in achieving
compliance with Tennessee Code Annotated § 29-26-121(a)(2)(E) or to “test” a deficient
authorization to ascertain whether records can be obtained. See J.A.C., 542 S.W.3d at
514; Roberts, 2018 WL 3302178, at *5. As our Supreme Court stated in Stevens,
“Plaintiff—not Defendants—was responsible for complying with the requirements of
Tenn. Code Ann. § 29-26-121(a)(2)(E).” 418 S.W.3d at 559.
For these reasons, I would affirm the dismissal of this case based upon the trial
court’s proper determination that the medical authorizations provided by Mr. Williams
were defective pursuant to 45 C.F.R. § 164.508(c)(1)(i), (v) such that Mr. Williams failed
to substantially comply with the requirements of Tennessee Code Annotated § 29-26-
121(a)(2)(E) by omitting two core elements.
-3-
_________________________________
THOMAS R. FRIERSON, II, JUDGE
-4-