Deficient HIPAA Authorization Not Grounds for Dismissal


Where an HCLA plaintiff sent defendants a HIPAA authorization that “failed to include the mother’s authority to sign the document, the expiration date of the document, and the names of all healthcare providers authorized to use or disclose the requested information,” plaintiff was still deemed to have substantially complied with the statutory requirements, and dismissal of the complaint was reversed.

In Martin v. Rolling Hills Hospital, LLC, No. M2016-02241-COA-R3-CV (Tenn. Ct. App. June 22, 2018), plaintiffs were the parents and children of a patient who was admitted to defendant hospital for suicidal ideation and detoxification, and was found unresponsive two days after her admission, dying later that day.

The death occurred on June 28, 2013, and the first complaint was filed on October 17, 2014, which was outside the one-year limitations period but within the 120-day extension period. That complaint was nonsuited, and a second complaint was filed naming the same defendants within a year of the nonsuit. Defendants filed a motion to dismiss, arguing that plaintiffs did not comply with the pre-suit notice requirements, which meant they were not entitled to the 120-day extension of the statute of limitations. Accordingly, defendants argued that the first suit was time-barred, making the second suit also time-barred. The trial court granted to motion to dismiss based on plaintiffs’ incomplete HIPAA authorization, but the Court of Appeals reversed.

On appeal, defendants first argued that plaintiffs were not entitled to the 120-day extension because they “failed to send the notice to Rolling Hills’ and Universal’s registered agent, as required by Tennessee Code Annotated section 29-26-121(a)(3)(B)(ii).” While this section does state that “pre-suit notice must be sent to the healthcare provider at both the address for the agent for service of process and the provider’s current business address, if different from that of the agent,” the Court of Appeals focused on the common law holding that this section can be satisfied through substantial compliance. The Court noted that the purpose of the pre-suit notice is to give healthcare defendants “timely notice of a forthcoming lawsuit,” and that when the manner of service is in question, a court should consider “the extent and significance of the plaintiff’s deviation form the statute and whether the defendant was prejudiced by the plaintiff’s noncompliance.” (internal citations omitted). Here, because defendants did not assert that they failed to receive timely notice and return receipts showed that both Rolling Hills and Universal received the notice, there was no prejudice and the plaintiffs’ failure to strictly comply with the statute “was not cause to dismiss the action.”

Next, defendants argued that the pre-suit notice did not include defendant Dr. Karl’s name “as a provider receiving notice and that the notice Rolling Hills received did not include Universal.” Regarding Dr. Karl, the Court pointed to plaintiffs’ response to the motion to dismiss, wherein they explained that Dr. Karl was identified by defendants’ counsel during settlement negotiations after the first suit was filed. The settlement negotiations took place after April 2014, and Dr. Karl was served with pre-suit notice on June 26, 2014. The other two defendants, however, were served with pre-suit notice on October 13, 2013, before plaintiffs knew about the possible fault of Dr. Karl. Due to this timeline, the Court held that “Rolling Hills and Universal could not have been provided the identity of Dr. Karl in the pre-suit notice because Plaintiffs had not determined that Dr. Karl should be a party to the suit at the time notice was sent to Defendants.”

With regards to Universal being left off the Rolling Hills notice, the Court stated that defendants had acknowledged that “Universal is merely a corporate entity (not Provider/Health Plan) and obviously had no treatment records regarding [the decedent].” Because the statute only requires plaintiffs to list other providers receiving notice, the Court ruled that Universal did not have to be listed, and dismissal was not warranted on this ground.

Finally, defendants asserted that the HIPAA authorization supplied by plaintiffs was incomplete, and that plaintiffs were thus not entitled to the 120-day time extension. The trial court agreed with this argument, but the Court of Appeals reversed. The Court began by noting that “[a] plaintiff’s less than perfect compliance [with this section of the HCLA]…should not derail a healthcare liability claim. Non-substantive errors and omissions will not always prejudice defendants by preventing them from obtaining a plaintiff’s relevant medical records.” (internal citation omitted). The standard for the HIPAA form is therefore substantial compliance, not strict compliance.

The HIPAA authorization at issue here did not include the mother’s authority to sign the form, did not have an expiration date, and did not list the names of all healthcare providers authorized to use or disclose the information. Plaintiffs conceded that the “authorizations were deficient,” but also argued that defendants were not prejudiced. The Court of Appeals agreed with plaintiffs. The Court stated that none of the defendants had explained how they were prejudiced by the deficiencies. Moreover, the Court pointed out that Dr. Karl treated decedent at defendant Rolling Hills Hospital and was “an employee and/or ostensible agent of Defendant Rolling Hills.” Further, the Court noted that because Universal was not a health care provider, it would have no records that other defendants would need to obtain. Accordingly, the Court ruled that “defendants [had] failed to demonstrate that they were prejudiced as a result of the deficiencies in the HIPAA authorizations,” and dismissal was reversed. Although the Court did not explicitly say so, it was essentially using the same reasoning used in single provider cases where incomplete HIPAA forms have been held to not be grounds for dismissal.

The Court of Appeals did a good job here of analyzing the alleged statutory errors and weighing them against the lack of prejudice to the defendants. While plaintiffs should try to strictly comply with the HCLA requirements, a plaintiff facing a motion to dismiss due to an inadequate pre-suit notice should read this case.

Contact Information