Day on Torts
Because the HIPAA authorizations included with a health care liability plaintiff’s pre-suit notice included limiting language, the authorizations did not comply with the HCLA and thus plaintiff’s medical malpractice claims were dismissed.
In Curtis v. Sharp, No. E2023-01583-COA-R3-CV (Tenn. Ct. App. Jan. 29, 2025), the plaintiff sent pre-suit notice of a her HCLA suit to five health care providers. This notice included HIPAA authorizations. The HIPAA authorizations sent by the plaintiff including the following limiting language: “Any conferences, formal or informal, of any type or oral communication with [the provider receiving the authorization], or any of [his/her/its] representatives is absolutely forbidden.”
The plaintiff filed her HCLA complaint against three of the providers. Although the plaintiff attached the pre-suit notice materials to her complaint, she failed to attach the HIPAA authorization sent to one of the defendants. That HIPAA authorization was subsequently filed as a Late Filed Authorization. The plaintiff eventually voluntarily dismissed this original suit and refiled pursuant to the savings statute. The second set of HIPAA authorizations contained the same limiting language as the first. The defendants filed a motion to dismiss, arguing that the plaintiff failed to comply with the HCLA by sending faulty HIPAA authorizations and failing to attach one HIPAA authorization to the original complaint. The defendants argued that because of these errors, the plaintiff was not entitled to the 120-day statute of limitations exception granted by the HCLA, making the original suit untimely. The trial court agreed with both of the defendants’ arguments and found that because the original suit was time-barred, this second complaint should be dismissed. On appeal, this ruling was affirmed in part and reversed in part.
To determine whether the first suit was timely, the Court of Appeals analyzed “whether [the plaintiff] complied with the pre-suit notice requirements of Section [29-26-121].” The statute requires that a copy of the pre-suit notice be attached to the complaint, including a copy of the HIPPA authorization. “The requirement to provide a copy of the medical authorization with the complaint serves to confirm the content of the document that was given to the potential defendants.” (internal citation omitted). This portion of the statute “can be achieved through substantial compliance.” (internal citation omitted).
When filing her complaint, the plaintiff failed to attach the HIPAA authorization sent to one of the three defendants. She submitted it as a Late Filed Authorization, but the trial court ruled that this did not substantially comply with the statute. The Court of Appeals disagreed. The Court wrote that the defendants were “unable to show how they were prejudiced by this late filing.” “When a plaintiff timely provides HIPAA-compliant medical authorizations with her pre-suit notice, when the pre-suit notice is served in accordance with Section 121, and when the late-filed exhibits are true and correct copies of the authorizations, the defendant suffers no prejudice from the filing delay.” (internal citation omitted). The Court of Appeals therefore reversed the ruling that the plaintiff failed to comply with the HCLA by late-filing the HIPAA authorization.
The Court of Appeals agreed with the trial court, however, that the limiting language included in the HIPAA authorizations meant that the authorizations failed to substantially comply with the HCLA. The Court wrote:
Section 121 enables noticed health care providers to investigate the merits of the claim and pursue settlement negotiations before the start of the litigation. This benefits the parties by promoting early resolution of claims, which also serves the interest of judicial economy.
Each HIPAA authorization sent by Plaintiff states that it “is a limited medical authorization” and includes the Limiting Language “absolutely” forbidding “[a]ny conferences, formal or informal, [of] any type or oral communication with” the noticed providers “or any of [their] representatives[.]” Plaintiff argues that the Limiting Language is “narrowly tailored . . . [to] preserv[e] only [Plaintiff’s] rights under Tennessee law.” We do not agree. If Plaintiff’s only intent was to preserve her already existing rights under Section 121(f), she could have referenced that statutory section in the HIPAA authorization. She did not. Instead, the Limiting Language leaves a reasonable person unable to determine what is permitted by the HIPAA authorization. Both AAT and Ms. Sharp received authorizations containing the Limiting Language, which could also be interpreted as prohibiting AAT from orally communicating with its employee, Ms. Sharp, about Plaintiff’s claim. As the Tennessee Supreme Court has emphasized, and as the trial court in this case recognized, the penalties imposed upon covered entities that wrongfully disclose or obtain private health information in violation of HIPAA are . . . extremely severe, with such entities facing punishment of up to $50,000 per offense and/or imprisonment of up to one year for non-compliance. For this reason, although defendants must explain how they were prejudiced by noncompliance, defendants need not ‘test’ incomplete and facially noncompliant medical authorizations.
Because of the limiting language, and because defendants are not required to “test” noncompliant HIPAA authorizations, the Court of Appeals agreed that the HIPAA authorizations provided here did not comply with the HCLA. Dismissal of the refiled suit was therefore affirmed.
HIPAA authorizations are one of the most litigated topics related to HCLA pre-suit notice. Here, inclusion of limiting language made the HIPAA authorizations noncompliant with the HCLA requirements.
This opinion was released 2.5 months after oral arguments.