¶
Daniel Wall appeals orders
dismissing his claims against Marion Pahl, Jacquelyn Schimke, and Gundersen Lutheran Health System, Inc. Wall contends Pahl and Schimke violated Wis. Stat. § 146.82,
BACKGROUND
¶ 2. Because this case is before us on review of the circuit court's decision on a motion to dismiss, the following facts are taken from Wall's complaint and are accepted as true for purposes of this appeal. See Walberg v. St. Francis Home, Inc.,
1 3. Gundersen is a Wisconsin corporation in the business of providing health care services. In the past, Wall has been a patient of Gundersen. At some point, Gundersen provided Wall with an "audit trail of people who [had] accessed his health care records." After reviewing the audit trail, Wall learned that Gundersen employees Pahl and Schimke had "accessed and observed" his health care records.
¶ 4. Wall submitted a written request to Gundersen for the "reason why [Pahl and Schimke] accessed his confidential medical records." Gundersen responded it had "completed its investigation into whether [Pahl and Schimke] had legal authorization to access [Wall's] health care records and why[.]" However, it concealed the results of that investigation from Wall.
¶ 5. Wall's complaint asserted claims against Pahl and Schimke for "invasion of privacy of medical records." In addition, it alleged Gundersen had violated Wis. Stat. § 146.83(4)(b) by "blocking] and hinder [ing] [Wall] from investigating the reason why and authority upon which [Pahl and Schimke] accessed [Wall's] health care records." The complaint also alleged Gundersen had violated the federal regulations promulgated under the Health Insurance Portability and Accountability Act (HIPAA) by failing to answer Wall's inquiry into why Pahl and Schimke accessed his medical records. Wall sought punitive damages from all three defendants.
¶ 6. Pahl and Schimke moved to dismiss Wall's claims, and Gundersen filed a separate motion to dismiss. In support of their motion, Pahl and Schimke noted that, aside from a generic reference to Wis. Stat. ch. 146, Wall's complaint did not identify the legal basis for his "invasion of privacy of medical records" claims. Regardless, Pahl and Schimke argued Wall's claims failed, as a matter of law, because the complaint did not state a claim for invasion of privacy under Wis. Stat. § 995.50, for a violation of HIPAA, or for a violation of Wis. Stat. §§ 146.82 or 146.83. In response, Wall clarified that his claims against Pahl and Schimke were based solely on ch. 146, in that Pahl and Schimke "did not have the 'informed consent' required by Chapter 146 to see [his] recоrds," and none of the exceptions to the informed consent requirement in ch. 146 applied. In other words, Wall contended Pahl and Schimke had violated § 146.82. Wall also clarified, in response to Gundersen's motion, that his sole claim against Gundersen was for an alleged violation of § 146.83(4)(b)
¶ 7. The circuit court granted all three defendants' motions to dismiss. The court reasoned that, in order to state a claim for relief under Wis. Stat. ch. 146 against Pahl, Schimke, or Gundersen, Wall's complaint needed to allege that Pahl and Schimke "disclosed" Wall's medical records "to other people." The court concluded Wall's complaint failed to do so, in that it merely alleged Pahl and Schimke "briefly accessed" Wall's medical records without his knowledge, but it failed to allege they "released, published or disclosed his medical record in any way." Wall now appeals from the orders dismissing his claims.
DISCUSSION
¶ 8. Whether a complaint states a claim upon which relief can be granted is a question of law that we review independently. Data Key Partners v. Permira Advisers LLC,
¶ 9. In this case, whether Wall's complaint states a claim for relief hinges on the interpretation of several statutes. Statutory interpretation presents a question of law that we review independently. Domino v. Walworth Cty.,
I. Wall's claims against Pahl and Schimke
¶ 10. Wall contends Pahl and Schimke violated Wis. Stat. § 146.82, entitled "Confidentiality of patient health care records." Subsection (1) of that statute, entitled "Confidentiality," provides, in relevant part, "All patient health care records!
¶ 11. Wall's complaint alleges Pahl and Schimke accessed his patient health care records without informed consent and without "legitimate cause" to do so. Accepting these allegations as true fоr purposes of this appeal, Pahl and Schimke nevertheless argue Wall's Wis. Stat. § 146.82 claim fails because Wall has not alleged they "released" any of his patient health care records. Pahl and Schimke contend the statutory term "release" requires disclosure of patient health care records or the information contained therein to someone outside the organization holding the records. In contrast, Wall contends that, whenever an employee of a health care organization accesses a patient's records, the organization has "released" the records to the employee for purposes of § 146.82.
¶ 12. The term "release" is not defined in Wrs. Stat. ch. 146. When a statutory term is undefined, its ordinary and accepted meaning can be established by reference to a recognized dictionary. Door Cty. Highway Dep't v. DILHR,
¶ 13. Although dictionary definitions do not clarify the meaning of the term "release" as it is used in Wis. Stat. § 146.82, a statutоry term is not ambiguous if its meaning can be discerned when read in context with surrounding or closely related statutes. See Kalal,
¶ 14. Wisconsin Stat. § 146.816 is entitled "Uses and disclosures of protected health information." Enacted in 2013, § 146.816 was intended to "change[] state confidentiality laws on patient health care records ... to more closely track. . . [HIPAA]."
¶ 15. Wisconsin Stat. § 146.816 expressly distinguishes between "use" and "disclosure" of protected health information and defines those terms by reference to 45 C.F.R. § 160.103. As used in § 146.816, "disclosure" means "the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information," 45 C.F.R. § 160.103, and includes "redisclosures and rereleases of information," § 146.816(l)(c). "Use," in turn, means "with respect to individually identifiable health information, [
¶ 16. Notably, the term "disclosure" in Wis. Stat. § 146.816(l)(c) incorporates the
¶ 17. There are, however, potential weaknesses in this analysis. First, the definition of "disclosure" in 45 C.F.R. § 160.103 can be read in two ways. Again, under that regulation, "disclosure" means "the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information." Id. In this definition, the modifier "outside the entity holding the information" could be read as applying to each of the preceding terms describing what is being done with the information, that is "release," "transfer," "provision of access to," and "divulging in any manner." If that reading were correct, it could suggest that the term "release," by itself, is not limited to the dissemination of information to persons outside the entity holding the information — if the unmodified term "release" included only the provision of information to persons outside the entity, the modifier "outside the entity holding the information" arguably would be unnecessary.
¶ 18. Conversely, one could also read the phrase "outside the entity holding the information" as modifying only the term describing what is being done with the information that immediately precedes it — that is, "divulging in any manner." Under this reading, the term "disclosure," as defined in 45 C.F.R. § 160.103, would simply include "release," without specifying whether the release of information was to someone inside or outside the organization holding the information. We have already concluded the term "release," on its own, can reasonably be read as encompassing both the dissemination of information within an organizatiоn and to persons outside the organization. Thus, without the modifier "outside the entity holding the information," the term "release" in 45 C.F.R. § 160.103 is arguably just as ambiguous as the term "release" in Wis. Stat. § 146.82.
¶ 19. There is an additional and even more compelling problem with using the definitions of "disclosure" and "use" that are set forth in 45 C.F.R. § 160.103 and incorporated into Wis. Stat. § 146.816 to inform our understanding of the term "release" in Wis. Stat. § 146.82. Section 146.816(2) provides that § 146.82 "do[es] not apply to a use, disclosure, or request for disclosure of protected health information by a covered еntity" if the use, disclosure, or request for disclosure complies with the relevant federal regulations and is for the purposes of treatment, payment, or health care operations.
¶ 20. As the preceding discussion shows, the interplay between Wis. Stat. § 146.816 and Wis. Stat. § 146.82 is not clear cut, and interpreting the statutes in context with one another yields more questions than answers. Thus, even after considering the definitions of "use" and "disclosure" in § 146.816, the meaning of the term "release" in § 146.82 remains unclear.
¶ 21. Nevertheless, we observe that statutes must be interpreted reasonably, in order to avoid absurd or unreasonable results. See Kalal,
¶ 22. Employees of health care organizations routinely access numerous patient health care records each day. If Wall were correct that Wis. Stat. § 146.82 applies each time an employee accеsses a patient's health care records, giving rise to a private right of action against the employee, see Wis. Stat. § 146.84(1), health care employees would be liable not only for intentionally accessing patient health care records without informed consent or a valid purpose, but also for merely accidentally accessing a patient's records. Furthermore, when sued by a patient, possibly years after the fact, an employee would be faced with the difficult, potentially impossible, task of proving why he or she accessed a particular patient record in order to show that the access fell within one of the permissible circumstances set forth in § 146.82(2). For these reasons, we agree with Pahl and Schimke that interpreting § 146.82 to apply to internal use of patient health care records would run the risk of entering into a field with "no sensible or just stopping point." See Hoida, Inc. v. M&I Midstate Bank,
¶ 23. Moreover, as a practical matter, if Wall's interpretation were correct, health care organizations would be forced tо put in place systems that either verified an employee's access was permissible each time he or she tried to access a patient record or required the employee to document his or her reasons for accessing a record each time he or she did so. Simply put, Wall's interpretation would "place too
¶ 24. Wall complains that interpreting the term "release" in Wis. Stat. § 146.82 to include only the dissemination of information outside the entity holding patient health care records means that "employees can have unlimited access" to patient health care records, and a "violation only occurs when they tell someone else." Although we recognize Wall's concern about health care organizations' employees accessing patient records for illegitimate reasons, contrary to Wall's assertion, our opinion in this case does not give those employees carte blanche to access patient records for nefarious purposes without consequence. We merely hold that an employee's internal access to patient records is not the type of conduct governed by § 146.82. Internal use of protected health information is, however, extensively regulated by HIPAA, which sets forth civil and criminal penalties for violations. See 42 U.S.C. § 1320d-5.
¶ 25. Admittedly, HIPAA does not create a private right of action for improper use of protected health information. See Seaton v. Mayberg,
f 26. For the reasons discussed above, we conclude Wis. Stat. § 146.82 does not apply when a health care organization's employee merely accesses a patient health care record, without disclosing any information from the record to anyone outside the organization. Because § 146.82 does not apply to the conduct at issue in this case, the circuit court properly dismissed Wall's clаims against Pahl and Schimke.
II. Wall's claim against Gundersen
I 27. The circuit court also properly dismissed Wall's claim against Gundersen.
¶ 28. Wall's claim against Gundersen fails because Wis. Stat. § 146.83(4)(b) clearly and unambiguously applies only to the concealment or withholding of "patient health care recordfs]." As relevant here, the term "patient health care records" means "all records relatеd to the health of a patient prepared by or under the supervision of a health care provider [.]" Wis. Stat. § 146.81(4). This definition has three salient facets, for purposes of this case. First, a patient health care record must be a "record." The statutory definition does not encompass mere information that is not reduced to a record. See State v. Straehler,
¶ 29. Wall's complaint does not allege that Gundersen concealed or withheld any patient health care records, as that term is defined in Wis. Stat. § 146.81(4). The complaint merely alleges Gundersen "concealed the results of the investigation into why [its employees] had accessed [Wall's] health care records and authority for the access." In other words, Wall alleges Gundersen concealed and withheld the information it obtained when it conducted an internal investigation into its employees' actions. He does not allege Gundersen withheld any record. In addition, any records Gundersen might have kept regarding its internal investigation would not have related to Wall's health or any treatment or services Wall received. Accordingly, such information, even if reduced to a record, would not have constituted a patient health care record as that term is defined by statute. Wall's complaint thereforе fails to state a claim that Gundersen violated Wis. Stat. § 146.83(4)(b) by concealing or withholding patient health care records.
By the Court. — Orders affirmed.
Notes
All references to the Wisconsin Statutes are to the 2013-14 version unless otherwise noted.
The complaint also alleged a third employee had accessed Wall's health care records. However, that employee was not named as a defendant.
Wisconsin Stat. § 146.84(1) imposes civil liability for violations of Wis. Stat. §§ 146.82 and 146.83.
At our request, the Wisconsin Hospital Association and Disability Rights Wisconsin submitted amicus briefs in this appeal. We thank both entities for their participation in this matter.
The term "patient health care records" is defined as:
all records related to the health of a patient prepared by or under the supervision of a health care provider; and all records made by an ambulance service provider, as defined in s. 256.01(3), an emergency medical technician, as defined in s. 256.01(5), or a first responder, as defined in s. 256.01(9), in administering emergency care procedures to and handling and transporting sick, disabled, or injured individuals. "Patient health care records" includes billing statements and invoices for treatment or services provided by a health care provider and includes health summary forms prepared under s. 302.388(2). "Patient health care records" does not include those records subject to s. 51.30, reports collected under s. 69.186, records of tests administered under s. 252.15(5g) or (5j), 343.305, 938.296(4) or (5) or 968.38(4) or (5), records related to sales of pseudoephedrine products, as defined in s. 961.01(20c), that are maintained by pharmacies under s. 961.235, fetal monitor tracings, as defined under s. 146.817(1), or a pupil's physical health reсords maintained by a school under s. 118.125.
Wis. Stat. § 146.81(4).
WISCONSIN Stat. § 146.82 was enacted in 1979. See 1979 Wis. Laws, ch. 221, § 649t. Those portions of the statutory language that are relevant to this case have not changed since that time.
WISCONSIN Stat. § 146.816(l)(b) specifies that "covered entity" has the meaning given in 45 C.F.R. § 160.103, which defines the term as:
(1) A health plan.
(2) A health care clearinghouse.
(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
"Protected health information" is defined in Wis. Stat. § 146.816(l)(f) by reference to 45 C.F.R. § 160.103, which provides:
Protected health information means individually identifiаble health information:
(1) Except as provided in paragraph (2) of this definition, that is:
(1) Transmitted by electronic media;
(ii) Maintained in electronic media; or
(iii) Transmitted or maintained in any other form or medium.
(2) Protected health information excludes individually identifiable health information:
(i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g;
(ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv);
(iii) In employment records held by a covered entity in its role as employer; and
(iv) Regarding a person who has been deceased for more than 50 years.
"Individually identifiable health information" means:
information that is a subset of health information, including demographic information collected from an individual, and:
(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
(i) That identifies the individual; or
(ii) With respect to which there is a reasonable basis to believe the information сan be used to identify the individual.
45 C.F.R. § 160.103.
"Health information," in turn, means:
any information, including genetic information, whether oral or recorded in any form or medium, that:
(1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision оf health care to an individual.
Id.
Wisconsin Stat. § 146.816(2) reads in full:
Sections 51.30(4)(a) and (e) and 146.82 and rules promulgated under s. 61.30(12) do not apply to a use, disclosure, or request for disclosure of protected health information by a covered entity or its business associate that meets all the following criteria:
(a) The covered entity or its business associate makes the use, disclosure, or request for disclosure in compliance with 45 CFR 164.500 to 164.534.
(b) The covered entity or its business associate makes the use, disclosure, or request for disclosure in any of the follоwing circumstances:
1. For purposes of treatment.
2. For purposes of payment.
3. For purposes of health care operations.
Wisconsin Stat. § 51.30(4)(a) and (e) and the rules promulgated under § 51.30(12) pertain to the confidentiality of records created in the course of providing services to individuals for mental illness, developmental disabilities, alcoholism, or drug dependence. See § 51.30(l)(am), (b). Like Wis. Stat. § 146.82, § 51.30(4)(a) and (e) and the rules promulgated under § 51.30(12) refer to the "release" of these records.
Although we affirm the order dismissing Wall’s claim against Gundersen, we do so for different reasons from those relied on by the circuit court. See State v. Gribble, 2001 WI App 227, ¶ 27 n.10,
In attempt to bolster his claim that Gundersen violated Wis. Stat. § 146.83(4)(b), Wall cites a letter he sent to Gundersen requesting "a copy of the authorization by which and the reason" why each employee accessed his records. He also cites a letter he received in response from Gundersen's associate general counsel. However, these letters are neither attached to the complaint nor referenced in it. As such, we may not consider them. See Data Key Partners v. Permira Advisers LLC,