A HIPAA authorization form that leaves blanks for which parties may make disclosures and to whom disclosures can be made is most likely insufficient to meet the statutory requirements of the HCLA, even if it complies with the local practice.
In Roberts v. Wellmont Health System, No. 2017-00845-COA-R9-CV (Tenn. Ct. App. July 5, 2018), plaintiff sent defendants a pre-suit notice and then filed an HCLA complaint. When defendants filed motions to dismiss in the first matter, plaintiff voluntarily dismissed the case, then subsequently sent new pre-suit notices and filed a second complaint. Defendants filed motions to dismiss, arguing that the first pre-suit notice was deficient due to an incomplete HIPAA authorization, that plaintiff was thus not entitled to the 120-day extension of the statute of limitations which would mean that the first suit was filed outside the statute of limitations, and that the second suit was therefore time-barred.
When sending the first pre-suit notice, plaintiff included a HIPAA authorization that left blank the spaces for (1) the persons authorized to disclose protected health information and (2) the persons to whom disclosure could be made. The form also failed to state an expiration date.