Where an Tennessee HCLA plaintiff’s HIPAA authorization had an error in the “purpose” section, but the potential defendants only included two physicians who were employed by the third potential defendant health system and plaintiff asserted that the defendant health system was the only potential defendant who possessed any relevant medical records, the Court of Appeals vacated dismissal based on the noncompliant HIPAA authorization and held that plaintiff should have been allowed “to conduct limited discovery to determine whether [defendant health system] had been prejudiced by Plaintiff’s failure to provide a HIPAA-compliant medical authorization[.]”
In Hayward v. Chattanooga-Hamilton County Hospital Authority d/b/a Erlanger Health System, No. E2022-00488-COA-R3-CV (Tenn. Ct. App. April 27, 2023), plaintiff filed an HCLA claim against defendants related to a bladder surgery and related complications. Before filing suit, plaintiff sent pre-suit notice to three potential defendants, including two physicians and one health system (“Erlanger”). A HIPAA authorization was included with the pre-suit notice pursuant to Tenn. Code Ann. § 29-26-121(a)(2)(E).
After suit was filed, Erlanger filed a motion to dismiss based on the HIPAA authorization being noncompliant. Specifically, Erlanger pointed out that the purpose section of the HIPAA authorization, which is one of the six core elements required on a HIPAA authorization, only permitted disclosure of records to plaintiff’s attorney. Erlanger argued that this prevented the potential defendants from obtaining records from each other and that dismissal was thus appropriate.
