REBECCA A. WIESE and TYLER D. WIESE, individually and as the natural parents and natural guardians of RDW, a minor, Appellants (Plaintiffs), v. RIVERTON MEMORIAL HOSPITAL, LLC, a Delaware business entity, Appellee (Defendant).
S-21-0215
IN THE SUPREME COURT, STATE OF WYOMING
November 29, 2022
2022 WY 150
OCTOBER TERM, A.D. 2022
Appeal from the District Court of Fremont County
The Honorable Jason M. Conder, Judge
Representing Appellants:
Robert P. Schuster, Bradley L. Booke, Adelaide P. Myers of Robert P. Schuster, P.C., Jackson, Wyoming. Argument by Mr. Booke.
Representing Appellee:
Patrick Murphy of Williams, Porter, Day & Neville, PC, Casper, Wyoming; LaMar F. Jost, Clarissa M. Collier of Wheeler Trigg O’Donnell LLP, Denver, Colorado. Argument by Ms. Collier.
Representing Amicus Curiae, Wyoming Trial Lawyers Association:
Grant Lawson, Casper, Wyoming.
Before FOX, C.J., and KAUTZ, BOOMGAARDEN, GRAY, and FENN, JJ.
NOTICE: This opinion is subject to formal revision before publication in Pacific Reporter Third. Readers are requested to notify the Clerk of the Supreme Court, Supreme Court Building, Cheyenne, Wyoming 82002, of typographical or other formal errors so correction may be made before final publication in the permanent vоlume.
KAUTZ, Justice
[¶1]
ISSUES
[¶2] The Wieses raise four issues, which we restate as three:
- Did audit trails constitute “health care information” under the Wyoming Hospital Records and Information Act?
- Did the district court err by concluding no genuine issues of material fact existed regarding whether the Hospital complied
with the Act with respect to Ms. Wiese’s Centricity electronic record and audit trail? - Did the district court err by failing to consider the Wieses’ outstanding motions before ruling on the parties’ summary judgment motions?
FACTS
RDW’s Birth and Centricity
[¶3] On the evening of September 24, 2012, Ms. Wiese was admitted to the Hospital’s labor and delivery unit for a planned induction of labor. She gave birth to RDW at 9:50 a.m. the next day. He had no respirations, tone, reflexes, or color. RDW was intubated and life-flighted to a hospitаl in Denver, Colorado, where he was diagnosed with cerebral palsy as a result of “severe hypoxic ischemic encephalopathy“—brain damage caused by lack of oxygen to critical brain structures. Ms. Wiese was discharged from the Hospital on September 26, 2012.
[¶4] At the time of RDW’s birth, the Hospital’s primary electronic patient medical record software system was Hospital Management System (HMS). The Hospital also collected patient medical data from its labor and delivery unit via Centricity, a proprietary software system developed and owned by General Electric Healthcare and/or General Electric Medical Systems (GE Healthcare). Centricity temporarily stored/saved patient medical data on a primary and a back-up server, both located on-site at the Hospital.
[¶5] Due to data storage limitations on the servers, data on both the primary and back-up servers was constantly being overwritten as new data entered the servers. To preserve the data before it was overwritten, Centricity automatically archived the data on each server to a compact disc (CD). When a CD reached its data storage limit and needed to be replaced, Centricity would send an electronic message (a “pop up” box) to the nurses in the labor and delivery unit, informing them the CD needed to be replaced with a new CD. When the nurse removed the CD from the server, he or she would handwrite on the faсe of the CD the date it was removed and a unique Centricity identification number (Centricity ID), which he or she obtained from GE Healthcare. The Centricity ID identified the day of the year and the year the CD was removed. Before placing a new CD into the server, the nurse would handwrite on its face the date the CD was placed into the server. As a result, each Centricity CD contained, handwritten on its face, the date the CD had been placed into the server, the date it was removed, and the Centricity ID. Each CD was also electronically embedded with the Centricity ID. The Hospital stored these CDs in a locked cabinet in its labor and delivery unit until 2015, when it closed that unit. The CDs are now locked in the Hospital’s Information Systems Department.
[¶6] After a patient’s labor and delivery, the Hospital would print the patient’s Centricity electronic record and scan it into the patient’s HMS electronic record. In this case, a nurse printed Ms. Wiese’s Centricity electronic record on September 25, a few hours after RDW’s birth, and the Hospital’s Health Information Management Department scanned the printed Centricity electronic record into her HMS electronic record.
The Wieses’ Requests for Records
[¶7] In October 2015, about three years after RDW’s birth, the Wieses sent medical releases to the Hospital and requested all medical and billing records relating to Ms. Wiese’s stay at the Hospital from September 24-26, 2012. In November and December 2016, the Hospital responded by producing a hard copy of Ms. Wiese’s HMS electrоnic record, which included a hard copy of Ms. Wiese’s scanned-in Centricity electronic record.
[¶8] The hard copy records revealed that most of the nursing entries (entries made by nurses from their observations rather than entries made automatically by monitoring sensors) in Centricity were not created contemporaneously with the events but rather hours later. For example, the nursing entries appearing on the printed fetal monitoring strip for the period from 8:15 a.m. to 8:20 a.m. on September 25, 2012, were actually created by the nurses between 4:06 p.m. and 4:08 p.m. on September 25, 2012, over five
[¶9] In February 2018, the Wieses wrote the Hospital claiming it had withheld “[s]ignificant records.” They again requested the Hospital send them all medical records relating to Ms. Wiese’s stay at the Hospital in September 2012, including the Centricity audit trail. Unlike a paper record, which only reveals the last information entered into the record, an audit trail records and stores infоrmation identifying all occasions on which an electronic medical record was accessed, who accessed it, from where, what part of the electronic medical record was viewed, and the content of all entries made in the electronic record, including whether any information was deleted or altered and what information was deleted or altered. Consequently, the information in an audit trail may show if and when the records were supplemented, edited, or deleted.
[¶10] In April 2018, the Hospital responded to the Wieses’ letter, alleging it had provided them copies of all the medical records to which they were legally entitled. With respect to the Wieses’ request for audit trails, the Hospital statеd it was not legally obligated to produce them to patients but nevertheless agreed to produce the audit trail associated with Ms. Wieses’ HMS electronic record.2 It informed the Wieses that the HMS audit trail was the only audit trail relating to Ms. Wiese in its possession, custody, and control. It claimed it was unable to produce the audit trail associated with Ms. Wiese’s Centricity electronic
record (or any of the Centricity record in an electronic format). It explained it had “expended considerable resources and hired forensic computer experts in order to produce this irrelevant and duplicative data[] but was unable to access this information. However, since all of the Centricity records are time stamped with the date of every entry and the user, audit-like data is available from the face of the [hard-copy] records.”
The Wieses’ Complaint and Discovery
[¶11] In June 2018, the Wieses filed a complaint against the Hospital alleging it violated the Wyoming Hospital Records and Information Act by failing to provide them all “health care information” concerning Ms. Wiese’s labor and delivery, including Ms. Wiese’s Centricity audit trail. To the extent the Hospital claimed the electronic information had been deleted or was not accessible, the Wieses asked for a court order allowing them, through their experts, to have access to the Hospital’s Centricity servers and other storage devices to attempt to retrieve the requested data. The Hospital answеred the complaint, again alleging it had no legal obligation to produce the Centricity audit trail. It also maintained for the first time that it had located the Centricity CD that was supposed to contain Ms. Wiese’s Centricity electronic record, but the record was not on the CD. It reiterated it had retained a forensic expert to search for Ms. Wiese’s Centricity electronic record on the Hospital’s Centricity servers and a CD and claimed the expert had determined the electronic record “was not deleted” but rather “it [was] simply never saved.”
[¶12] Extensive discovery (and discovery disputes) ensued, during which the Wieses learned of the Hospital’s attempts to locate Ms. Wiese’s Centricity electronic record, which was nеeded to “run” or generate the Centricity audit trail. Linda Tice, the Hospital’s Director of Information Services, testified that in 2017 she searched for Ms. Wiese’s Centricity electronic record. She explained she began by searching the Centricity
[¶13] Ms. Tice then logged into Centricity and found Ms. Wiese’s name. The system informed her Ms. Wiese’s electronic record had been archived to a CD with thе Centricity ID of “QS333201201.” Under the Centricity coding system, the code “QS333201201” indicated the CD containing Ms. Wiese’s Centricity electronic record was removed from the server on the 333rd day of 2012 or November 28, 2012. She located the CD with the relevant date range (August 16, 2012, to November 28, 2012) and “QS333201201” written on its face. She placed the CD into the Centricity server and discovered other patients’ records, but not Ms. Wiese’s. She also discovered the CD was electronically embedded with “QS229201201,” a different Centricity ID than that handwritten on the face of the CD. This ID meant the CD had been removed from the server on the 229th day of 2012 or August 16, 2012, a month before Ms. Wiese’s admission to the hospital. Ms. Tice then
reviewed every Centricity CD in the Hospital’s possession (approximately 25-50 CDs), and none had “QS333201201” electrоnically embedded on it.
[¶14] Ms. Tice testified she called GE Healthcare’s “800 support line” and informed GE Healthcare she was looking for a record and could not find it. She asked if GE Healthcare could help her find the record; it informed her it would “take a look.” GE Healthcare emailed her back, stating it “didn’t find anything either.”
[¶15] The Hospital retained Forensic Pursuit to perform a forensic analysis of the Centricity primary and back-up servers, one Centricity CD, and a thumb drive. Andrew Jacobs performed the analysis for Forensic Pursuit in late Summer 2017. He discovered three items on the thumb drive. The contents of the items consisted of directions on how to install a physical power supply. Mr. Jacobs observed 239 “.gz folders,” which Mr. Jacobs described as “archive” folders, saved under a “PTFiles” folder on the CD. He knew these items were patient files, but he could not open any of them or view their contents. He found 3,211 databases on the primary server ranging in date from 2004 to 2015 (the year the Hospital closed its labor and delivery unit). He did not analyze the back-up server or even attempt to power it on. Many of the databases on the primary server were proprietary and could not be viewed without running the appropriate software. Of the few items he could preview on the server, none of them were patient records or audit trails. Mr. Jacobs attempted to run the Centricity software on the server to open the databases, but he was unsuccessful because the softwarе had been disabled. He claimed, “[s]oftware support would be required for further steps,” but he did not contact GE Healthcare for assistance because such task was “outside the scope” of his assignment. Mr. Jacobs testified either Ms. Tice or the Hospital’s attorney provided him terms to search for on the primary server, but he did not recall them or record them. In conclusion, he stated he had “exhausted all traditional means of observing or acquiring the specific records. Forensic standards were used to image and parse the data, but due to the nature of the records and proprietary database formats, no readable data could be obtained.”
[¶16] On November 22, 2019, approximately four months after Ms. Ticе’s deposition and one month after Mr. Jacob’s deposition, the Hospital provided the Wieses pictures of two Centricity CDs which the Hospital gathered and transported to its counsel’s office, one of which was analyzed by Mr. Jacobs. The photographs showed that the original date range (August 16, 2012, to November 28, 2012) and Centricity ID (“QS333201201“) handwritten on the face of the CDs had been crossed out and replaced with a new date range (January 4, 2012, to August 16, 2012) and a new Centricity ID (“QS229201201“). The Hospital later admitted it was Ms. Tice who made the cross-outs. Because these photographs showed the CD analyzed by Mr. Jacobs could not have contained Ms. Wiese’s Centricity electronic record, the Wieses
The Parties’ Motions and the District Court’s Orders
[¶17] On December 10, 2019, eight days after the Wieses served their additional discovery requests, the Hospital filed a motion for summary judgment. It again claimed audit trails are not medical records under the Act. It also argued the Act required it to produce for a patient only those records in its possession or inform the patient the records do not exist or cannot be found. It maintained the Act did not require it to affirmatively prove medical records cannot be located. According to the Hospital, the Wieses produced no evidence showing it was in possession of additional medical records that had not alreаdy been produced or that existed. Relevant here, as to the Centricity audit trail, the Hospital claimed that because it could not locate Ms. Wiese’s Centricity electronic record, it could not generate the Centricity audit trail.
[¶18] The Wieses also filed a motion for summary judgment.3 Relevant here, they claimed audit trails fell within the purview of the Act and must be produced. They claimed the evidence was undisputed that Ms. Wiese’s Centricity electronic record was saved and burned to a CD on November 28, 2012, yet the Hospital had not produced the electronic record or audit trail as required by the Act. They argued they were entitled to summary judgment due to the Hospital’s violation of the Act and an order permitting them, at their expense, with the assistance of GE Healthcаre and in the presence of the Hospital, its counsel, and the parties’ experts, to inspect the Hospital’s Centricity servers and all Centricity CDs (joint inspection). On the same day, they also filed a
[¶19] The district court denied the Wieses’
motion because they had responded to the motion and, in fact, filed their own competing motion for summary judgment. The court denied the Wieses’ motion for summary judgment and granted summary judgment to the Hospital. The court determined the Hospital complied with the Act by producing Ms. Wiese’s and RDW’s medical records and by informing the Wieses that the Centricity electronic record and audit trail did not exist and/or could not be found. It denied as moot the Wieses’ motion to compel and motion to conduct a joint inspection. The Wieses timely appealed.4
[¶20] The Wieses argue the district court erred by granting summary judgment to the Hospital because audit trails were “health care information” under the Act and a genuine issue of material fact exists as to whether the Hospital complied with the Act with respect to Ms. Wiese’s Centricity audit trail. They also claim the court erred by granting summary judgment to the Hospital in spite of their pending discovery motions. The Hospital argues we need not decide whether audit trails were “health care information” under the Act because the district court did not decide the issue. Rather, it contends the court correctly granted summary judgment to it because it complied with the Act by informing the Wieses that the Centricity audit trail did not exist and/or could not be found. Because the Hospital believes the district court’s summary judgment order was correct, it also maintains the court correctly denied the Wieses’ outstanding motions as moot.
[¶21] The district court did not explicitly decide whether or not audit trails were “health care information” under the Act. However, by concluding the Hospital complied with the Act by producing Ms. Wiese’s and RDW’s medical records despite not producing the Centricity audit trail, the court implicitly decided audit trails were not “health care information” under the Act. Moreover, if audit trails did not constitute “health care information” under the Act, then we need not decide whether the сourt erred in granting summary judgment to the Hospital based on its determination the Hospital complied with the Act by informing the Wieses that Ms. Wiese’s Centricity electronic record and audit trail did not exist and/or could not be found. As a result, we first address whether audit trails constituted “health care information” under the Act.
Audit Trails
[¶22] The Wieses devote much of their opening brief to arguing federal law establishes that audit trails are medical records to which a patient has access. However, they brought suit under the Wyoming Hospital Records and Information Act, not any federal statute or regulation. The narrow issue before us is whether patients had a right to the audit trails associated with their electronic records under the now-repealed Act.
[¶23] At the time the Wieses filed this lawsuit,
(a) Upon receipt of a written request from a patient to examine or copy all or part of the patient’s recorded health care information, a hospital, as promptly as required under the circumstances, but no later than ten (10) days after receiving the request shall:
(i) Make the information available for examination during regular business hours and provide a copy, if requested, to the patient;
(ii) Inform the patient if the information does not exist or cannot be found;
(iii) If the hospital does not maintain a record of the information, inform the patient and provide the name and address, if known, of the health care provider or health care facility that maintains the record;
(iv) If the information is in use or unusual circumstances of delay occur in hаndling the request, inform the patient and specify in writing the reasons for the delay and the earliest date, which shall not be later than twenty-one (21) days after receiving the request, when the information will be available for examination or copying or when the request will be otherwise answered; or
(v) Deny the request, in whole or in part, underW.S. 35-2-612 and inform the patient.
(Emphasis added).
[¶24] The Act defined “[h]ealth care information” as ”any information, whether oral or recorded in any form or medium, that
[¶25] The Wieses argue audit trails qualify as “health care information” to which they have access under the Act. The Hospital maintains we should not create a blanket rule that audit trails are always part of a patient’s medical record, but rather should leave this decision to the sound discretion of the trial court to decide on a case-by-case basis. It also maintains, as it did throughout the district court proceedings, that audit trails were not “health care information” under the Act because they do not document patient treatment/care or assist in making treatment decisions, but rather contain administrative information about when users access and enter information.
[¶26] Whether audit trails werе “health care information” under the Act is a question of statutory interpretation, a legal question, not one to be made on a case-by-case basis as the Hospital maintains. Guy v. Lampert, 2016 WY 77, ¶ 13, 376 P.3d 499, 502 (Wyo. 2016) (citing Powder River Basin Res. Council v. Wyo. Oil & Gas Conservation Comm’n, 2014 WY 37, ¶ 19, 320 P.3d 222, 228 (Wyo. 2014)). “‘When interpreting a statute . . . , we first look at the plain language used by the legislature. If the [statutory language] is sufficiently clear and unambiguous, the Court simply applies the words according to their ordinary and obvious meaning.’” Ailport v. Ailport, 2022 WY 43, ¶ 22, 507 P.3d 427, 437 (Wyo. 2022) (quoting DB v. State (In re CRA), 2016 WY 24, ¶ 16, 368 P.3d 294, 298 (Wyo. 2016), and citing MR v. State (In re CDR), 2015 WY 79, ¶ 19, 351 P.3d 264, 269 (Wyo. 2015)).
[¶27]
[¶28] Audit trails satisfy the broad definition of “health care information” provided by the Act. Audit trails capture the content of every entry (including deletions and alterations) made into a patient’s electronic medical chart, by whom, and from where. These entries are made by hospital personnel while the patient is being diagnosed or treated in the hospital and the information entered pertains to the care, services, and procedures provided by the hospital to the patient to diagnose, treat, or maintain his physical and mental health or bodily structures and functions. Audit trails also record who accessed the patient’s electronic record and from where. In other words, audit trails are “any information” which identifies the patient or is associated with the patient’s identity and “is related to” or
connected with the health care the patient receives at the hospital and include any disclosures of the information.
[¶29] Audit trails qualify as “health care information” under the Act.
Summary Judgment
[¶30]
“The party requesting a summary judgment bears the initial burden of establishing a prima facie case for summary judgment.” Gowdy v. Cook, 2020 WY 3, ¶ 22, 455 P.3d 1201, 1207 (Wyo. 2020) (quoting Hatton v. Energy Elec. Co., 2006 WY 151, ¶ 9, 148 P.3d 8, 12 (Wyo. 2006)). “Once the movant establishes a prima facie case for summary judgment, the burden shifts to the opposing party to present materials demonstrating a genuine dispute as to a material fact for trial.” Id., ¶ 23, 455 P.3d at 1207 (citing Hatton, ¶ 9, 148 P.3d at 12-13). “‘The opposing party must affirmatively set forth material, specific facts in opposition to a motion for summary judgment[.]’” Id. (quoting Jones v. Schabron, 2005 WY 65, ¶ 10, 113 P.3d 34, 37 (Wyo. 2005)) (other quotation marks and citation omitted).
Kappes, ¶ 15, 512 P.3d at 35. “When the parties file cross-motions for summary judgment and the district court issues a decision completely resolving the case by granting summary judgment to one party and denying the othеr’s motion, we review both aspects of the district court’s order.” Gowdy, ¶ 23, 455 P.3d at 1207 (citing Dowell v. Dowell (In re Mark E. Dowell Irrevocable Trust), 2012 WY 154, ¶ 16, 290 P.3d 357, 360 (Wyo. 2012)).
[¶31] The Wieses argue the district court erred by granting summary judgment to the Hospital because there is a genuine issue of material fact as to whether the Hospital
complied with the Act with respect to Ms. Wiese’s Centricity audit trail. Specifically, they argue there is a genuine issue of material fact as to whether the Hospital made a good faith effort to locate Ms. Wiese’s Centricity electronic record (which was necessary to generate the Centricity audit trail) before informing them that the Centricity audit trail did not exist or could not be found. The Hospital maintains the court correctly granted summary judgment in its favor because the undisputed facts show it complied with the Act.
[¶32] As we stated above, the Act allowed a hospital, in response to a patient’s written request for health care information, to “[i]nform the patient if the information does not exist or cannot be found[.]”
[¶33] Viewing the facts in the light most favorable to the Wieses, we conclude there is a genuine issue of material fact as to
[¶34] Ms. Tice testified she searched the Centricity servers and all of the Hospital’s Centricity CDs for Ms. Wiese’s Centricity electronic record and did not find it. However, she stated she searched the CDs only for the embedded Centricity ID, not for Ms. Wiese’s Centricity electronic record. Ms. Tice also testified she called GE Healthcare for assistance in finding the record. GE Healthcare emailed her back, stating it “didn’t find anything either.” Although the record reveals GE Healthcare could remotely аccess the Hospital’s Centricity servers, the record does not indicate whether GE Healthcare searched the servers, checked for records of CDs being made, or reviewed any CDs. The record is silent as to the nature and extent of GE Healthcare’s search.
[¶35] Mr. Jacobs searched one Centricity CD and observed files, but he could not open any of them. He determined no files had been deleted from that particular CD. However,
that CD could not possibly have contained Ms. Wiese’s Centricity electronic record because the CD had been removed from the server on August 16, 2012, over a month before Ms. Wiese’s admission to the hospital. He did not search any other CD.5 Mr. Jacobs searched the primary Centricity server and discovered over 3,000 databases ranging in date from 2004-2015, but he could not open or preview any of them because he could not run the Centricity software on the server. He did not contact GE Healthcare for assistance, nor was he asked to do so, even though he admitted such assistance would be necessary to access the files. Mr. Jacobs did not search or even power up the back-up server. In sum, Mr. Jacob’s analysis could not and did not determine whether or not Ms. Wiese’s Centricity electronic record was on either the primary or back-up server or whether it had been archived to a CD. Indeed, he stated he was not tasked with accessing medical records or audit trails and, if he had been, he would need experts familiar with Centricity to assist.
[¶36] Because a genuine issue of material fact exists as to whether the Hospital complied with the Act by making a good faith effort to locate Ms. Wiese’s Centricity electronic record for purposes of creating the corresponding audit trail, the district court erred in granting summary judgment to the Hospital.6
Outstanding Motions
[¶37] The Wieses maintain the district court erred by granting the Hospital’s summary judgment motion while their various discovery motions were pending. The Wieses appear to include their
[¶38] The Wieses request we order a joint inspection of the Hospital’s Centricity storage devices be conducted on remand. We decline to do so. The district court should decide, in the first instance, whether such joint inspection, or other discovery, is warranted. Cf. Roemmich v. Roemmich, 2010 WY 115, ¶ 22, 238 P.3d 89, 95 (Wyo. 2010) (“A ‘district court must generally be afforded broad discretion, both in the mechanisms adopted to control discovery and in its selection of appropriatе sanctions for violations of . . . discovery. . . .’” (quoting Ruwart v. Wagner, 880 P.2d 586, 592 (Wyo. 1994))).
CONCLUSION
[¶39] Audit trails were “health care information” under the (now-repealed) Act. Because a genuine issue of material fact exists as to whether the Hospital complied with the Act with respect to Ms. Wiese’s Centricity electronic record and audit trail, the district court erred in granting summary judgment to the Hospital.
[¶40] We REVERSE and REMAND for further proceedings consistent with this opinion.