Healthcare Information Security

HIPAA and Compliance News

HIPAA Regulations Not Applicable in TN Supreme Court Case

The Tennessee Supreme Court ruled that medical authorization is not needed for a pre-suit notice under HIPAA regulations.

Medical authorization is not needed for a pre-suit notice under HIPAA regulations, a Supreme Court ruled.

Source: Thinkstock

By Elizabeth Snell

- Medical authorization compliant with HIPAA regulations is not required when a pre-suit notice is sent to a single healthcare provider, according to a recent Tennessee Supreme Court ruling.

In 2011, Deborah Bray filed a healthcare liability suit against Dr. Radwan Khuri for the alleged wrongful death of her husband, Nigel Bray. Mrs. Bray sent a pre-suit notice to Khuri, which included a medical authorization.

Khuri claimed that the medical authorization was incomplete and not HIPAA compliant as he could not use the medical records to consult with his legal team to review the case’s claims.

“Appellee argued that while Appellant did provide notice as required by the statute, Appellant‟s medical authorization form was deficient because it did not include a description of the information to be used and it failed to identify which health care providers were authorized to make the requested disclosures,” the appeals case stated. “In response, Appellant argued that the statute’s language did not require it to provide an authorization form at all.”

Mrs. Bray maintained that the statute’s line of “permitting the provider receiving the notice to obtain complete medical records from each other provider being sent a notice” exempted her from providing a form. This is because there were no other healthcare providers besides Khuri.

“In addition, Appellant argued that the form she provided was not deficient when read in conjunction with the potential claim letter accompanying it,” the document read. “The circuit court disagreed and entered an order granting Appellee‟s motion to dismiss on January 30, 2015.”

The appeals court had determined that Mrs. Bray was required to provide a HIPAA compliant authorization. Citing the case of Hughes v. Henry Cnty. Med. Ctr., the court explained that “without a HIPAA-compliant authorization form, the full purpose of the statute becomes frustrated.”

“While Appellee may have physically possessed Decedent’s records, he was unable to review them with his attorney in order to evaluate the merits of Appellant’s claim,” the court continued.

Furthermore, Tennessee law states that a pre-suit notice must include “HIPAA compliant medical authorization permitting the provider receiving the notice to obtain complete medical records from each other provider being sent a notice.”

The circuit court had said Mrs. Bray’s pre-suit was found to not HIPAA compliant because it “did not include a description of the information to be used” and “also failed to specifically identify which health care providers were authorized to make the requested disclosures.”

The appeals court affirmed the ruling, stating that Mrs. Bray “failed to provide Appellee with the proper authorization to use Decedent’s medical records to mount a defense.

The state Supreme Court ruled that “Tennessee law does not require a HIPAA-compliant medical authorization when a plaintiff sends a pre‑suit notice of a healthcare liability claim to a single healthcare provider.”

“We hold that, based on the clear and unambiguous language of section 29-26-121(a)(2)(E), a plaintiff need not provide a HIPAA-compliant authorization when a single healthcare provider is given pre-suit notice of a healthcare liability claim,” the supreme court explained in its unanimous opinion. “The authorization only allows a potential defendant to obtain the prospective plaintiff’s medical records from any other healthcare provider also given notice and identified as a potential defendant in the pre-suit notice.”

The Supreme Court disagreed with Khuri’s interpretation of HIPAA regulations, where he stated that HHS indicates that a consultation with an attorney regarding a potential claim prior to the commencement of a lawsuit is not included in “health care operations.”

“Under HIPAA regulations, ‘healthcare operations’ include arranging for legal services,” the court wrote. “HHS has indicated that a healthcare provider may share health information for ‘litigation purposes’ with its lawyer. HIPAA does not limit ‘legal services’ and ‘litigation purposes’ to pending lawsuits.”

Essentially, the pre-suit notice “sufficiently invoked the regulatory exception to the general requirement of a HIPAA-compliant medical authorization.”

Overall, the Tennessee Supreme Court held that a medical authorization under HIPAA regulations was not required as the pre-suit notice was sent to a single provider. 

X

SIGN UP and gain free access to articles, white papers, webcasts and exclusive interviews on

HIPAA Compliance
BYOD
Cybersecurity
Data Breaches
Ransomware

Our privacy policy

no, thanks