The HIPAA release required by the Health Care Liability Act and the standards for HIPAA compliance continue to be a litigated issues in this evolving area of Tennessee law.
In Bray v. Khuri, No. W2015-00397-COA-R3-CV (Tenn. Ct. App. Dec. 3, 2015), plaintiff was the surviving spouse of a patient who committed suicide while admitted to a hospital under defendant doctor’s care. Before filing suit, plaintiff sent a notice letter and a medical authorization form to defendant. Once plaintiff filed her complaint, defendant filed a motion to dismiss, arguing that plaintiff failed to provide a HIPAA-compliant medical authorization as required by Tenn. Code Ann. § 29-26-121(a)(2)(E) because the authorization provided “did not include a description of the information to be used and it failed to identify which health care providers were authorized to make the requested disclosure.” Plaintiff opposed the motion to dismiss, asserting that she did not have to provide a HIPAA-compliant authorization since the only health care provider at issue was defendant, and that “the form she provided was not deficient when read in conjunction with the potential claim letter accompanying it.” The trial court agreed with defendant, dismissing plaintiff’s claim, and the Court of Appeals affirmed.
The first issue on appeal was whether plaintiff was required to provide defendant with a HIPAA-compliant authorization when defendant “was the only medical provider being sent the notice of potential claim.” In support of her argument that no medical authorization was required here, plaintiff pointed to the language of the statute, which states that a plaintiff’s written notice “shall include…[a] HIPAA compliant medical authorization permitting the provider receiving the notice to obtain complete medical records from each other provider being sent a notice.” Tenn. Code Ann. § 29-26-121(a)(2)(E). Plaintiff asserted that “the inclusion of the phrase ‘from each other provider’ signals that it is unnecessary to include an authorization when only one provider is receiving the notice because that provider already has all the relevant records in its possession.”