Where a HIPAA authorization only allowed the healthcare professionals to release records, not to obtain them, the Plaintiff had failed to substantially comply with the HCLA and dismissal was affirmed.
In Moxley v. AMISUB SHF Inc. d/b/a Saint Francis Hospital, No. W2025-00443-COA-R3-CV (Tenn. Ct. App. Mar. 13, 2026) (memorandum opinion), the plaintiff filed a health care liability suit against the defendants based on alleged medical negligence during her cancer treatment. The plaintiff had sent pre-suit notice to twelve possible defendants, but the HIPAA authorizations included with those pre-suit notices only stated that the receiving entity could release records to certain other entities. The HIPAA authorizations did not contain any language “stating that [the defendants] could ‘obtain’ any medical records.”
The defendants filed a motion to dismiss, asserting that the plaintiff failed to comply with the HCLA requirements found in Tenn. Code Ann. § 29-26-121. On this third appeal in this case, the Court of Appeals affirmed dismissal based on the insufficient HIPAA authorizations.


