A HIPAA authorization form that leaves blanks for which parties may make disclosures and to whom disclosures can be made is most likely insufficient to meet the statutory requirements of the HCLA, even if it complies with the local practice.
In Roberts v. Wellmont Health System, No. 2017-00845-COA-R9-CV (Tenn. Ct. App. July 5, 2018), plaintiff sent defendants a pre-suit notice and then filed an HCLA complaint. When defendants filed motions to dismiss in the first matter, plaintiff voluntarily dismissed the case, then subsequently sent new pre-suit notices and filed a second complaint. Defendants filed motions to dismiss, arguing that the first pre-suit notice was deficient due to an incomplete HIPAA authorization, that plaintiff was thus not entitled to the 120-day extension of the statute of limitations which would mean that the first suit was filed outside the statute of limitations, and that the second suit was therefore time-barred.
When sending the first pre-suit notice, plaintiff included a HIPAA authorization that left blank the spaces for (1) the persons authorized to disclose protected health information and (2) the persons to whom disclosure could be made. The form also failed to state an expiration date.
The trial court denied defendants’ motions to dismiss based on the HIPAA authorization, holding that these blank forms “could be over compliance with the requirement…because it allows not only medical records on this particular incident but it allows a medical records history which could be relevant.” Further, the trial court took judicial notice that it was “the practice and custom in the 2nd Judicial District…to provide blank authorizations so that the person requesting information can get information from anyone they want to, not just the provider of the incident but also the provider of prior medical care or history.” This interlocutory appeal followed, and the Court of Appeals reversed the trial court and ruled that the case should be dismissed with prejudice.
First, the Court of Appeals ruled that a HIPAA form with blanks where the persons who can make disclosures and to whom disclosures can be made should be listed, and which failed to contain an expiration date, was not compliant with the statutory requirements. The Court noted that this form “failed to contain three of the core elements for HIPAA-compliant authorizations.” While a plaintiff must only substantially comply with the HIPAA form requirements, “forms that are markedly inadequate do not actually authorize or facilitate any disclosure.” (internal citation omitted).
Next, the Court noted that failure to comply with the HIPAA form requirement can be excused for “extraordinary cause.” Here, the Court found that the trial court did not find extraordinary cause, but instead seemed to replace that analysis “by taking judicial notice of a local practice in the second judicial district of using ‘blank’ authorizations.” The Court reasoned:
The problem lies not in the taking of judicial notice, but in the apparent contention that the judicially-noticed custom rises to the level of extraordinary cause to excuse compliance. Contrary to the purported local practice, our Legislature requires a HIPAA-compliant medical authorization to accompany pre-suit notice. Local counsel’s practice of leaving medical authorization forms incomplete does not override the pertinent statutory scheme. …To allow a local practice alone to excuse otherwise noncompliance would damage uniformity in application of pre-suit notice requirements between judicial districts across the State. Accordingly, we find that judicial notice of a local custom alone, does not rise to the level of extraordinary cause.
(internal citations omitted).
Finally, the Court addressed whether defendants were “permitted to alter or modify a medical authorization after it has been executed by a patient or patient’s authorized representative.” The Court noted that “a defendant is not responsible for filling in blanks on medical authorizations provided as part of pre-suit notice,” and that “it was incumbent upon the Plaintiffs to achieve substantial compliance with [the HCLA].” (internal citation and quotations omitted). Ultimately, the Court ruled that “a person receiving an authorization with blanks is not authorized to fill in the blanks.” Further, the Court stated that “defendants are not required to attempt to use a medical authorization to gather patient medical records” in order to claim prejudice.
Based on these findings, the Court of Appeals ruled that the HIPAA authorization was not compliant, and that the case should have thus been dismissed with prejudice.
This case presented a unique argument, local practice, in response to a defendant’s assertion that pre-suit notice was incomplete. Based on this case, and based on the wording of the HCLA, such an argument will not excuse a plaintiff who failed to comply with the statute’s notice requirements. Note that once again there is no suggestion defendants suffered any prejudice because of the defective notice.