523 S.W.3d 619
Tenn.
2017

Deborah BRAY v. Radwan R. KHURI, M.D.

Supreme Court of Tennessee, AT JACKSON.

Filed July 5, 2017

February 8, 2017 Session. Heard at Nashville.

523 S.W.3d 619

Dunсan E. Ragsdale, William R. Bruce, and Aaron L. Thomas, Memphis, Tennessee, for the appellant, Deborah Bray.

James T. McColgan, III and Sherry S. Fernandez, Cordova, Tennessee, for the appellee, Radwan R. Khuri, M.D.

W. Bryan Smith, Memphis, Tennessee; John Vail, Washington, D.C.; and Brian G. Brooks, Greenbrier, Arkansas, for аmicus curiae, Tennessee Association for Justice.

OPINION

Sharon G. Lee, J., delivered the opinion of the Court, in which Jeffrey S. Bivins, C.J., Cornelia A. Clark, Holly Kirby, and Roger A. Page, JJ., joined.

Tennessee Code Annotated section 29-26-121(a)(2)(E) requires a person who asserts a potential claim for healthcare liability to include with pre-suit notice a HIPAA-cоmpliant1 medical authorization permitting the healthcare provider who receives the notice to obtain complete medical records “from each other provider being sent the notice.” Tenn. Code Ann. § 29-26-121(a)(2)(E). Here, the plaintiff sent pre-suit notice of her claim to a single healthcare provider and included a medical authorization. After the plaintiff filed suit, the defendant healthcare provider moved to dismiss, asserting the plaintiff had failed to provide a HIPAA-compliant medical authorization. The trial court granted the motion, and the Court of Appeals affirmed. We hold that a prospective plaintiff who provides pre-suit notice to one potential defendant is not required under Tennessee Code Annotated section 29-26-121(a)(2)(E) to provide the single potential defendant with a HIPAA-compliant medical authorization. We reverse the judgments of the trial court and the Court of Appeals and remand this case to the trial court for further proceedings.

I.

Between the evening of March 25 and the morning of March 26, 2003, Nigel Bray committed suicide at Saint Francis Hospital in Memphis. Dr. Radwan Khuri provided psychiatric care to Mr. Bray from the time of his hospital admission on March 20 until his death less than a week later.

In March 2004, Deborah Bray, Mr. Bray‘s surviving spouse, filed a healthcare liability case against Dr. Khuri alleging negligence in the care and treatment of Mr. Bray. In May 2010, after the parties had engaged in pretrial discovery, Mrs. Bray voluntarily dismissed the suit.

In May 2011, Mrs. Bray sent Dr. Khuri pre-suit notice of her healthcare liability claim as required by section 29-26-121(a)(1). The pre-suit notice letter advised Dr. Khuri of a potential claim by Mrs. Bray for the wrongful death of her husband arising out of the medical and psychiatric treatment Dr. Khuri provided to Mr. Bray at Saint Francis Hospital. The notice, which included a medical authorization signed by Mrs. Bray, stated that Dr. Khuri was the only healthcare provider receiving the notice.

In September 2011, Mrs. Bray filed a healthcare liability suit against Dr. Khuri. Dr. Khuri moved to dismiss ‍‌‌‌​​​​​​​​​‌‌‌​‌‌‌​​​‌‌‌‌‌‌​‌‌​​​​​‌‌‌​‌‌‌​‌​​​‍the case, asserting that Mrs. Bray had failed to provide a HIPAA-compliant medical authorization under section 29-26-121(a)(2)(E). Dr. Khuri argued that because the authorization was incomplete and not HIPAA-compliant,2 he could not discuss Mr. Bray‘s medical records with counsel to prepare a defense to the potential claim. Mrs. Bray responded, in part, that no authorization was required under section 29-26-121(a)(2)(E) because Dr. Khuri was the only healthcare provider to whom she sent pre-suit notice.

The trial court granted Dr. Khuri‘s motion and dismissed the complaint, finding that the authorization provided by Mrs. Bray did not comply with HIPAA and did not substantially comply with the requirements of Tennessee Code Annotated section 29-26-121(a)(2)(E). Further, the trial court ruled that Dr. Khuri was prejudiced by Mrs. Bray‘s deficient authorization because he could not use Mr. Bray‘s records to prepare a defense. The trial court concluded that it was not determinative that Dr. Khuri was the only defendant and may have had the records.

The Court of Appeals affirmed, holding that Mrs. Bray was required to furnish a HIPAA-compliant authorization with the prе-suit notice even though Dr. Khuri was the only healthcare provider notified of the claim. . The Court of Appeals reasoned that the goal of section 29-26-121(a)(2)(E) is to allow a defendant to gain early access to a plaintiff‘s medical records to evaluate the substantive merits of the claim. (quoting ). The Court of Appeals concluded that even though Dr. Khuri may have physically possessed the decedent‘s records, he could not review them with counsel to evaluate the merits of the claim absent a HIPAA-compliant authorization. The Court of Appeals further hеld that the authorization failed to substantially comply with HIPAA requirements. .

We granted Mrs. Bray‘s application for permission to appeal.

II.

This case involves an interpretation of Tennessee Code Annotated section 29-26-121(a)(2)(E), which is a question of law we review de novo. See , (citing ). “[O]ur role is to ascertain and effectuate ‍‌‌‌​​​​​​​​​‌‌‌​‌‌‌​​​‌‌‌‌‌‌​‌‌​​​​​‌‌‌​‌‌‌​‌​​​‍the legislature‘s intent.” (citing ). We do not broaden or restrict a statute‘s intended meaning, and we presume that the legislature intended to give each word of the statute its full effect. (citing ; ). When statutory language is clear and unambiguous, we accord the language its plain meaning, understood in its ordinary and accepted usage, without a forced interpretation. (citing ); (citing ).

Tennessee Code Annotated section 29-26-121(a)(1) provides that a person “asserting а potential claim for health care liability shall give written notice of the potential claim to each health care provider that will be a named defendant at least sixty (60) days before the filing of a complaint....” Tenn. Code Ann. § 29-26-121(a)(1). Tennessee Code Annotated section 29-26-121(a)(2)(E) states that the notice shall include ”[a] HIPAA compliant medical authorization permitting the prоvider receiving the notice to obtain complete medical records from each other provider being sent a notice.” Id. § 29-26-121(a)(2)(E) (emphasis added).

We hold that, based on the clear and unambiguous language of section 29-26-121(a)(2)(E), a plaintiff need not provide a HIPAA-compliant authorization when a single healthсare provider is given pre-suit notice of a healthcare liability claim. The authorization only allows a potential defendant to obtain the prospective plaintiff‘s medical records from any other healthcare provider also given notice and identified as a potential defendant in the pre-suit notice. This authorization requirement is consistent with section 29-26-121(d)(1), which specifies that all parties to a healthcare suit “shall be entitled to obtain complete copies of the claimant‘s medical records from any other provider receiving notice” and that the claimant complies with this requirement by providing a HIPAA-compliant medical authorization with pre-suit notice. Id. § 29-26-121(d)(1).

Dr. Khuri argues that HIPAA prohibits the disclosure of a patient‘s medical records to counsel for evaluating the merits of a potential claim absent a valid medical authorization. HIPAA, enacted in 1996, establishes requirements for protecting confidential medical information by healthcare providers. As a general rule, HIPAA prohibits a healthcare provider from using or disclosing protected health information without a valid authorization. 45 C.F.R. § 164.508(a)(1). Howevеr, HIPAA regulations allow a healthcare provider to “use or disclose protected health information for treatment, payment, or health care operations,” with some exceptions for certain uses or disclosure requiring an authorization. 45 C.F.R. § 164.506(a) (emphasis added); see also id. § 164.506(c)(1). “Health care operations” include ”[c]onducting or arranging for mеdical review, legal services, and auditing functions.” Id. § 164.501 (emphasis added). The United States Department of Health and Human Services (“HHS“), in its Frequently Asked Questions (“FAQ“) for Professionals pages of its website, indicates that a healthcare provider may use or disclose protected health informаtion for litigation “whether for judicial or administrative proceedings, or as part of the covered entity‘s health care operations.”3 HHS further recognizes that “[i]n most cases, the covered

entity will share protected health information for litigation purposes with its lawyer, who is either a workforce member or a business associаte.”4 HIPAA regulations define a “business associate” to include a person ‍‌‌‌​​​​​​​​​‌‌‌​‌‌‌​​​‌‌‌‌‌‌​‌‌​​​​​‌‌‌​‌‌‌​‌​​​‍who provides legal services to or for a healthcare provider. 45 C.F.R. § 160.103. HIPAA does not require Dr. Khuri to obtain a medical authorization to use a patient‘s medical records in his possession and consult with cоunsel to evaluate the merits of a potential claim.

Dr. Khuri argues that the HHS website indicates “health care operations” do not include consultation with an attorney regarding a potential claim prior to the commencement of a lawsuit. He emphasizes that the websitе refers to a “plaintiff or defendant in a legal proceeding,” a “defendant in a malpractice action,” and “the course of any judicial or administrative proceeding.” According to Dr. Khuri, this language applies only to proceedings following the filing of a complaint.

We disagree with Dr. Khuri‘s narrow interpretation. Under HIPAA regulations, “healthcare operations” include arranging for legal services. HHS has indicated that a healthcare provider may share health information for “litigation purposes” with its lawyer.5 HIPAA does not limit “legal services” and “litigation purрoses” to pending lawsuits. Although providing pre-suit notice does not commence a lawsuit, see , pre-suit notice is a prerequisite to the commencement of a healthcare liability claim and is provided to each healthcare provider who “will be a named defendаnt” in the lawsuit.6 Mrs. Bray‘s pre-suit notice was a predicate to filing suit against Dr. Khuri. Mrs. Bray‘s pre-suit notice to Dr. Khuri, as the sole healthcare provider who would “be a named defendant,” sufficiently invoked the regulatory exception to the general requirement of a HIPAA-compliant medical authorization.

Dr. Khuri relies on , no perm. app. filed, an unreported decision, to support his argument that a HIPAA-compliant medical authorization was required to enable him to use Mr. Bray‘s medical records in his possession. Roberts, however, is distinguishable. In Roberts, the plaintiff filed a healthcare liability suit against the decedent‘s treating oncologist and the specialty healthcare group that employed the oncologist. . The trial court granted the defendants’ motions to dismiss based on its finding that the plaintiff failed to provide a HIPAA-compliant authorization and failed to attach a copy of the pre-suit notices to her complaint. The Court of Appeals affirmed. While Roberts and the case at bar are both healthcare liability suits concerning incomplete medical authorizations, they are factually distinguishable on a critical point: Roberts involved two defendants, whereas this case involves a single defendant. Neither the trial court nor the Court of Appeals in Roberts considered whether section 29-26-121(a)(2)(E) applies when a single healthcare provider ‍‌‌‌​​​​​​​​​‌‌‌​‌‌‌​​​‌‌‌‌‌‌​‌‌​​​​​‌‌‌​‌‌‌​‌​​​‍is named as a potential defendant.

Last, Dr. Khuri argues that the Patient‘s Privacy Protection Act, Tenn. Code Ann. §§ 68-11-1501 to -1505, is more restrictive than HIPAA and bars the disclosure of protected health information without proper authorization or a court order. Dr. Khuri also argues that the protections afforded by Tennessee privacy laws are not preempted by HIPAA or other federal laws. These arguments are without merit.

The Patient‘s Privacy Protection Aсt provides that “[e]very patient entering and receiving care at a healthcare facility licensed by the board for licensing healthcare facilities has the expectation of and right to privacy for care received at such facility.” Tenn. Code Ann. § 68-11-1502. This statute applies only tо healthcare facilities, not physicians. More importantly, it authorizes a patient to recover damages for invasion of privacy against a healthcare provider who publicly divulges the patient‘s identifying information. Id. § 68-11-1504. The healthcare liability act does not require a рatient to provide an authorization under this statute, and Mrs. Bray has not sued Dr. Khuri under this statute. The Patient Privacy Protection Act does not support Dr. Khuri‘s argument or provide any basis for upholding the dismissal of Mrs. Bray‘s claim.

Because we conclude that Tennessee Code Annotated section 29-26-121(a)(2)(E) does not apply here, where only a single healthcare provider received pre-suit notice as a potential defendant, the issue of whether Mrs. Bray substantially complied with section 29-26-121(a)(2)(E) is pretermitted. The Patient‘s Privacy Protection Act is also inapplicable; therefore, we need not determine whether Tennessee‘s privacy law conflicts with or is preеmpted by HIPAA.

III.

After careful review, we hold that a HIPAA-compliant medical authorization was not required under section 29-26-121(a)(2)(E) because Mrs. Bray‘s pre-suit notice was sent to a single provider. The judgments of the trial court and the Court of Appeals are reversed, and this case is remanded to the trial cоurt for further proceedings. The costs of this appeal are taxed to Radwan R. Khuri, M.D., for which execution may issue if necessary.

Notes

1
“HIPAA” is the acronym for the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of 18, 26, 29, and 42 U.S.C.). Among other things, HIPAA requirеs healthcare providers to protect the confidentiality of patients’ health information. In general, a healthcare provider may not disclose protected health information without a patient‘s express written authorization, with certain exceptions. 45 C.F.R. § 164.508(a)(1).
2
HIPAA regulations require a medical authorization to include the following: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person(s), or class of persons, authorizеd to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. (iv) A description of each purpose of the requested use or disclosure.... (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure.... (vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative‘s authority to act for the individual must also be provided. 45 C.F.R. § 164.508(c)(1).
3
HIPAA for Professionals FAQ 704, HHS (Jan. 7, 2005), https://www.hhs.gov/hipaa/for-professionals/faq/704/may-a-covered-entity-use-protected-health-information-for-litigation/index.html (citations omitted); HIPAA for Professionals FAQ 705, HHS (Jan. 7, 2005), https://www.hhs.gov/hipaa/for-professionals/faq/705/may-a-covered-entity-in-a-legalproceeding-use-protected-health-information/index.html.
4
HIPAA for Professionals FAQ 705, supra note 3.
5
See HIPAA for Professionals FAQ 705, supra note 3.
6
See Tenn. Code Ann. § 29-26-121(a) (“Any person ... asserting a potential claim for health care liability shall give written notice of the potential claim to each health care provider ‍‌‌‌​​​​​​​​​‌‌‌​‌‌‌​​​‌‌‌‌‌‌​‌‌​​​​​‌‌‌​‌‌‌​‌​​​‍that will be a named defendant at least sixty (60) days before the filing of a complaint based upon health care liability....“) (emphasis added).
Read the detailed case summary