### IN THE COURT OF APPEALS OF TENNESSEE AT JACKSON October 9, 2018 Session **MARY WENZLER v. DR. XIAO YU, ET AL**  

### . **Appeal from the Circuit Court for Shelby County No. CT**  **- 003652**  **- 17**  **Mary L. Wagner, Judge**

**___________________________________ No.**  **W2018 -**  **00369 -**  **COA -** **R3 -**  **CV**

**___________________________________** This is a health care liability case filed against a dentist and the dental practice that employed him . B efore filing the complaint, the plaintiff gave written notice to the two potential defendants of her health care liability claims against them. T ennessee Code Annotated section 29 - 26 - 121(a)(2)(E) requires that a plaintiff’s pre - suit notice include a HIPAA compliant medical authorization permitting the health care provider receiving the notice to obtain complete me dical records from every other provider that is being sent a notice. After the plaintiff filed suit, the defendants moved to dismiss the complaint based on noncompliance with the statute, as the defendants alleged that the HIPAA authorizations provided by the plaintiff did not contain all of the required information and were therefore invalid. After a hearing, the trial court granted the motion to dismiss, concluding that the authorizations provided by the plaintiff were not HIPAA comp liant and therefore the plaintiff did not substantially comply with the statute. The plaintiff appeals. We affirm in part, reverse in part, and remand for further proceedings. **Tenn. R. App. P. 3 Appeal as of Right ; Judgment of the**  **Circuit Court Affir me**  **d in** 

**Part, Reversed in Part, and Remanded** B RANDON O. GIBSON , J., delivered the opinion of the court, in which J. S TEVEN S TAFFORD , P.J., W.S., and ARNOLD B. GOLDIN, J., joined. Kathleen L. Caldwell, Memphis, Tennessee, for the appellant, Mary Wenzler. Laura L. Deakins, Memphis, Tennessee, and Lucas A. Davidson, Nashville, Tennessee, for the appellees, Xiao Yu, and American Family Dentistry of Memphis, PC. **OPINION I.**  **F ACTS**  **& P** **ROCEDURAL H** **ISTORY**- 2 -

On June 8, 2017, Plaintiff Mary Wenzler sent pre - suit notice letters to two potential defendants

– Dr. Xiao Yu and American Family Dentistry of Memphis, PC

– notifying them of potential health care liability claims arising out of their care and treatment of Mrs. Wenzler on June 13, 2016. The pre - suit notice letters stated that Plaintiff was attaching HIPAA compliant medical authorizations authorizing each potential defendant to obtain complete me dical records relating to her care and treatment from the other medical provider receiving the notice . 1 According to federal regulations, a HIPAA compliant authorization must, at a minimum, contain six “core elements,” including, (iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure. 45 C.F.R. § 164.508(c)(1). The HIPAA authorizations sent by Plaintiff mentioned that the information would be used for litigation but did not identify any particular person or class of persons to whom the covered entities could make the use or disclosure. Plaintiff filed her complaint for health care liability on September 1, 2017, and named as defendants Dr. Xiao Yu and American Family Dentistry of Memphis, PC. 2 The defendants filed a motion to dismiss on October 2, 2017 , asserting that Plaintiff failed to provide HIPAA compliant medical authorizations with her pre - suit notice letters as required by Tennessee Code Annotated section 29 - 26 - 121(a)(2)(E). Specifically, the defendants noted that the authorization forms failed to identify the person or entity that was authorized to receive the disclosure pursuant to the release. Based on this defect, the defendants argued that Plaintiff could not take advantage of the 120 - day statutory extension to the statute of limitations pro vided by Tennessee Code Annotated section 29 - 26 - 121(c), and as a result, her complaint was time -barred. 3

1 “HIPAA is an acronym fo r the Heal th I nsurance Portability and Accountability Act of 1996, Pub. L. No. 104

– 191, 110 Stat. 1936 (codified as amended in scattered sections of 18 U.S.C., 26 U.S.C., 29 U.S.C., 42 U.S.C.).” Runions v. Jackson

-Madison Cnty. Gen . Hosp. Dist., 549 S.W.3d 77, 80 n.3 (Tenn. 2018).

2 The com

plaint also included a lo ss of c onsorti um c laim filed by Plaint iff’s husband. However, the trial court ul timately dismissed his claim, and Plaint iff’s husband was not listed on the notice of

a ppeal to this Court . Accordingly, we limito ur review o n appeal to Plaint iff’s claim. 3 “When a plaint iff gives pre - sui t notice to a heal

th c are provider under Tennessee Code Annotated section 29 - 26 - 121, the one - year statute of limitat io ns is extended by 120 days.” Runions , 549 S.W.3d at 86 (ci ting Tenn. Code Ann. § 29 - 26 - 121(c)). However, the pre - sui t notice must com

ply wi th the statute in order fo r the plaint iff to receive the 120 - day e xt ensio n. Byrge v. Parkwest Med. Ctr., 442 S.W.3d 245, 2 49 - 50 (Tenn. Ct. App. 2014); see, e.g. , Dortch v. Methodist Health care Memphis Hosps. , No. W2017 - 01121 - COA- R3 - CV, 2018 WL 706767, at *3 (Tenn. Ct. App. Feb. 5, 2018) (“because Ms. Dortch did not com ply wi th the provisions of- 3 -

In response to the motion to dismiss, Plaintiff raised two arguments. F irst, she argued that her HIPAA authorization forms met or exceeded the statutory requirements. But alternatively, Plaintiff argued that even though there were “two named defendant me dical providers: Dr. Yu and American Family Dentistry of Memphis, P.C. (Dr. Yu’s employer),” there was no “other” medical provider from whom records would be needed, so the defendants were not prejudiced. After a hearing, the trial court entered an order granting the defendants’ motion to dismiss. The trial court found that Plaintiff’s authorizations were not HIPAA compliant, as they did not identify any person or entity that could receive the protected information. Because of this omission, the trial c ourt concluded that Plaintiff did not substantially comply with Tennessee Code Annotated section 29 - 26 - 121(a)(2)(E). The trial court rejected Plaintiff’s argument that a HIPAA authorization was unnecessary in the event that only one set of medical records existed, stating, “[t]he current case law is clear that where there are two or more defendants, the plaintiff must provide HIPAA compliant authorizations to all defendants,” “even when the defendants stand in an employee employer relationship.” Because Pl aintiff was not entitled to rely on the 120 - day extension of the statute of limitations, the trial court dismissed Plaintiff’s com plaint as time -barred. Plaintiff timely filed a notice of appeal. **I I**  **. I**  **SSUES P**  **RESENTED** On appeal, Plaintiff asks this Court to consider “whether Plaintiff[] failed to provide a HIPAA compliant medical authorization with the[] pre - suit notice as required by Tennessee Code Annotated § 29 - 26 - 121(a)(2)(E).” 4 Specifically, Plaintiff argues that she substantially complied with the statute despite her failure to identify the intended recipient of the medical records. Alternatively, she contends that a HIPAA authorization was not needed because “in essence the instant case involves a single health care provider.” For the following reasons, we affirm the decision of the circuit court in part, sect io n 121, she did not receive the 120 day e xtension, which made her [] Co mp laint time barred”) ; J.A.C. by &

through Carter v. Methodist Healthcare Memphis Hosps ., 542 S.W.3d 502, 514 (Tenn. Ct. App. 2016) (“Due to the Plaintiffs’ substantial nonco mp liance, the trial court was correct in determining that the 120 - day extension o f the statute of

limit at io ns [] provided by Tennessee Code Annotated section 29 - 26 - 121(c) was unavailable.”)

4 We note the defendants’ argument that this Court should dismiss the appeal due to deficiencies in Plaint iff’s brie f. Plaint iff failed to include a section in her brie f list ing the issues presented fo r review and failed to include proper ci tations to the relevant pages of the record. Instead, the cover page of P laint iff’s brief states, “The nature of the proceedings: whether Plaint iffs failed to provide a HIPAA compliantmedical authorizat io n wi th their pre - sui

t notice as requi red by Tennessee Code Annotated § 29 - 26 - 121(02)(E),” and fo r cit ations to the record, she included references such as “Co mp laint, ¶2” and “ see Exhibi t B - 1 . . . to Com

plaint. ” In light of the limi ted issue reso lved by the trial court and the small record on appeal, we will proceed to address the merits of the appeal, and we decline the defendants’ request for attorney ’s f ees.- 4 -

reverse in part, and remand for further proceedings. **I II**  **. S**  **TANDARD OF R** **EVIEW** According to the Tennessee Supreme Court, The proper way for a def endant to challenge a complaint’ s compliance with Tennessee Code Annotated section 29 - 26 - 121 [] is to file a Tennessee Rule of Procedure 12.02 motion to dismiss. In the motion, the defendant should state how the plaintiff has failed to comply with the statutory requirements by referencing specific omissions in the complaint and/or by submitting affidavits or other proof. Once the defendant makes a properly supported motion under this rule, the burden shifts to the plaintiff to show either that it complied with the statutes or that it had extraordinary cause for failing to do so. Based on the complaint and any other relevant evidence submitted by the parties, the trial court must determine whether the plaintiff has complied with the statutes. If the trial court determines that the plainti ff has not complied with the statutes, then the trial court may consider whether the plaintiff has demonstrated extraordinary cause for its noncompliance. If the defendant prevails and the complaint is dismissed, the plaintiff is entitled to an appeal of right under Tennessee Rule of Appellate Procedure 3 using the standards of review in Tennessee Rule of Appellate Procedure 13. Myers v. AMISUB (SFH), Inc. , 382 S.W.3d 300, 307 (Tenn. 2012) . B ecause the trial court’ s decision on the motion “involves a question of l aw, our review is de novo with no presumption of correctness. ” Id. ( citing Graham v. Caples , 325 S.W.3d 578, 581 (Tenn. 2010)). **I V** **. D**  **ISCUSSION** Under Tennessee law, a claimant must provide written pre - suit notice to a potential defendant before filing a complaint alleging health care liability: Any person, or that person’s authorized agent, asserting a potential claim for health care liability shall give written notice of the potential claim to each health care provider that will be a named defendant at least sixty (60) days before the filing of a complaint based upon health care liability in any court of this state.- 5 -

Tenn. Code Ann. § 29 - 26 - 121(a)(1). Pursuant to the statute, the pre - suit notice must include “[ a] HIPAA compliant medical authorization permitting the provider receiving the notice to obtain complete medical records from each other provider being sent a notice. ” Tenn . Code Ann . § 29 - 26 - 121(a)(2) (E) (emphasis added).

“Because the penalties imposed on entities that wrongfully disclose or obtain private health information in violation of HIPAA are severe, the sufficiency of the plaintiffs’ medical authorizations is imperative. ” Woodruff by & through Cockrell v. Walker, 542 S.W.3d 486, 499 (Tenn. Ct. App. 2017). The specific requirements for a HIPAA compliant medical authorization are set forth in 45 C.F.R. § 164.508 : (a) Standard: Authorizations for uses and disclosures (1) Authorization required: General rule. Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. . . .

. . . . (c) Implementation specifications: Core elements and requirements

— (1) Core elements. A

valid authorization under this section must contain at least the following elements: (i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion. (ii) The name or other specific identification of the person( s), or class of persons, authorized to make the requested use or disclosure. (iii) The name or other specific identification of the person(s), or class of persons, to wh om the covered entity may make the requested use or disclosure. (iv) A description of e ach purpose of the requested use or disclosure. . . . (v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. . . . (vi) Si gnature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual must also be provided. (Emphasis added). “Under the plain language of the regulation,” with respect to subsection (iii), “a name is not required so long as there is specific identification of the entity, person, or class of persons authorized to receive the protected health records.”- 6 -

Rush v. Jackson Surgical Assocs. PA , No. W2016 - 01289 - COA- R3 - CV, 2017 WL 564887, at *4 (Tenn. Ct. App. F eb. 13, 2017) perm. app. denied (Tenn. June 8, 2017). For example, a valid authorization may authorize disclosure to a designated class of persons, “such as the employees of XYZ division of ABC insurance company,” so long as the class is specifically identified. Id. On the other hand, an authorization simply listing the term “bearer” does not satisfy the specificity requirement, and such a form is not HIPAA compliant. Id. Additionally, the HIPAA regulation expressly provides: Defective authorizations. An authorization is not valid, if the document submitted has any of the following defects:

. . . . (ii) The authorization has not been filled out completely, with respect to an element described by paragraph (c) of this section, if applicable[.] 45 C.F. R. § 164.508(b)(2). Thus, “HIPAA deems authorizations defective if not filled out completely.” Smith v. Wellmont Health Sys ., No. E2017 - 00850 - COA- R9 - CV, 2018 WL 3343591, at *4 (Tenn. Ct. App. July 9, 2018). As previously noted, the authorizations provided by Plaintiff in this case omitted information regarding element (iii), failing to identify any person or class of persons to whom the covered entity could make the requested use or disclosure. We now consider the effect of such an error under Tennessee law. The Tennessee Supreme Court provided guidance on that issue in Stevens ex rel. Stevens v. Hickman C ommunit y Health Care Services, Inc. , 418 S.W.3d 547 (Tenn. 2013) . In that case, the pre - suit notice provided by the plaintiff included a HIPAA authorization that only permitted the release of me dical records to plaintiff’s counsel and lacked other required information. Id. at 552. The defendants mo ved to dismiss the complaint based on noncompliance with Tennessee Code Annotated section 29 - 26 - 121(a)(2 )(E). Id. The trial court denied the motion, and the case eventually made its way to the Tennessee Supreme Court. Id. at 553. The supreme court recognized that “[h] ealthcare liability defendants have a right to receive medical records to defend themselves against civil liability,” and section 29 - 26 - 121(a)(2)(E) requires a plaintiff to complete a HIPAA authorization “as a pre - condition of filing suit.” Id. at 557 - 58. The supreme court explained that the statute’s HIPAA authorization requirement serves “an investigatory function, equipping defendants with the actual means to evaluate the substantive merits of a plaintiff’ s claim by enabling . . . early access to a plaintiff’ s medical records. ” Id. at 554. According to the court, Because HIPAA itself prohibits medical providers from using or disclosing a plaintiff’ s medical records without a fully compliant authorization form, it- 7 -

is a threshold requirement of the statute that the plaintiff’s medical authorization must be sufficient to enable defendants to obtain and review a plaintiff’s relevant medical records. See 45 C.F.R. § 164.508(a)(1) (“a covered entity may not use or disclose protected health information without an authorization that is valid under this section”) . Tenn. Code Ann. § 29 - 26 - 121(d)(1) creates a statutory entitlement to the records governed by § 29 - 26 - 121(a)(2)(E). See Tenn. Code Ann. § 29 - 26 - 121(d)(1) (“All parties in an action covered by this section shall be entitled to obtain complete copies of the claimant’

s medical records from any other provider receiving notice ...”) (emphasis added). . . . . A plaintiff’s less -than-perfect compliance with Tenn. Code Ann. § 29 - 26 - 121(a)(2)(E), however, should not derail a healthcare liability claim. Non- substantive errors and omissions will not always prejudice defendants by preventing them from obtaining a plaintiff’s relevant medical records. Thus, we hold that a plaintiff must substantially comply, rather than strictly comply, with the requirements of Tenn. Code Ann. § 29 - 26 - 121(a)(2)(E). Id. at 555 (emphasis in original). Next, the court considered the sufficiency of the HIPAA authorization provided in that case to determine whether it substantially satisfied the requirements of the statute. Id. After noting the s ix core elements required by federal regulations, the supreme court concluded that the authorization at issue was not HIPAA com pliant. Id. at 556. “First, and most importantly, ” the court said, “by permitting disclosure only to Plaintiff’s counsel, Plaintiff’ s medical authorization failed to satisfy the express requirement of Tenn. Code Ann. § 29 - 26 - 121(a)(2)(E) that a plaintiff’ s medical authorization ‘ permit[ ] the provider receiving the notice to obtain complete medical records from each other provider being sent a notice .’” Id. Secondly, the court found that the authorization failed to satisfy at least three of the six compliance requirements mandated by HIPAA. Id. The court continued, In determining whether a plaintiff has substantially complied with a statutory requirement, a reviewing court should consider the extent and significance of the plaintiff ’ s errors and omissions and whether the defendant was prejudiced by the plaintiff ’ s noncompliance. Not every noncompliant HIPAA medical authorization will result in prejudice. But in this case, the me dical authorization submitted by Plaintiff was woefully deficient. The errors and omissions were numerous and significant. Due to Plaintiff's material non- compliance, Defendants were not authorized to receive any of the Plaintiff’ s records. As a result of multiple errors,- 8 -

Plaintiff failed to substantially comply with the requirements of Tenn. Code Ann. § 29 - 26 - 121(a)(2)(E). Id. (emphasis added). In a later case, the supreme court summarized Stevens as holding that “non- substantive errors and omissions and a plaintiff 's less -than-perfect com

pliance with subsection 29 - 26 - 121(a)(2)(E) will not derail a healthcare liability claim so long as the medical authorization provided is sufficient to enab le defendants to obtain and review a plaintiff’ s relevant medical records. ” Thurmond v. Mid

- Cumberland Infectious Disease Consultants, PLC, 433 S.W.3d 512, 519 - 20 (Tenn. 2014) (quotations and bracketing omitted). In sum, “there is no bright line rule that determines whether a party has substantially complied with the requirements of Tenn. Code Ann. § 29 - 26 - 121(a)(2)(E) [.]” Rush , 2017 WL 564887, at *4. However, in order to substantially comply with the statute, a plaintiff must provide a defendant with a HIPAA compliant medical authorization form that is sufficient to allow the de fendant to obtain the plaintiff’ s medical records from the other providers being sent the notice. Brookins v. Tabor, No. W2017 - 00576 - COA- R3 - CV, 2018 WL 2106652, at *5 (Tenn. Ct. App. May 8, 2018); Travis v. Cookeville Reg’l Med. Ctr., No. M2015 - 01989 - COA- R3 - CV, 2016 WL 5266554, at * 7 (Tenn. Ct. App. Sept. 21, 2016) . In this context, substantial compliance requires “a degree of compliance that provides the defendant with the ability to access and use the medical records for the purpose of mounting a defense. ” Lawson v. Knoxville Dermatology Grp., P.C. , 544 S.W.3d 704, 711 (Tenn. Ct. App. 2017) . Applying these principles, we consider whether Plaintiff failed to substantially comply with section 29 - 26 - 121(a)(2)(E) by providing each defendant with an incomplete HIPAA authorization form that failed to identify to whom the covered entity could make the requested use or disclosure. Considering first “the extent and significance of the plaintiff’s errors and omissions,” as instructed by Stevens , 418 S.W.3d at 556, we note that the se HIPAA authorizations were “defective” and “not valid” under HIPAA regul ations due to Plaintiff’s omission. 45 C.F.R. § 164.508(b)(2)(ii). Her omission was both substantive and significant. A s a result of Plaintiff’s failure to identify any authorized recipient of the records, her HIPAA authorizations did not permit the def endants to receive Plaintiff’s medical records. In Lawson , 544 S.W.3d at 712, this Court found no substantial compliance where a similar core element of the plaintiff’s HIPAA authorization, designating who was authorized to make the requested use or dis closure, was left blank. Id. We explained that “health care providers presented with a medical authorization missing the identification of those authorized to release information would have no way of knowing that they were- 9 -

the providers for which the authorization was intended or that they were allowed to release medical records.” Id. As such, we concluded that the single omitted core element was “a necessary element” to the defendants’ legal authorization to use the medical records. Id. In Riley v. M

ethodist Healthcare Memphis Hospitals , 731 F. App’x 481 (6th Cir. 2018), the Sixth Circuit considered a HIPAA authorization with the same omission as the one before us in the context of a diversity jurisdiction case alleging health care liability. Specifi cally, the plaintiffs in Riley left blank the section where they were supposed to list the persons to whom each provider could disclose the patient’s records. Id. at 488 (citing C.F.R. § 145.608(c)(1)(iii)). A pplying Tennessee law and federal HIPAA regulations, the district court deemed the authorization defective, rejecting the plaintiff’s argument that the forms were HIPAA compliant and would effectively permit each defendant to share records with anyone it wished. Id. at 489. Instead, the district court concluded, because of the omission in the form, the defendants were permitted to disclose records to no one. Id. The Sixth Circuit found no error in this decision. Id. at 490. After reviewin g Tennessee caselaw, the court concluded that “substantial compliance requires that the noncomplying features of the authorization do not render it insufficient to authorize access and use of the records,” and the form at issue in Riley “did not permit that access and use.” Id. at 491 - 92; see also Rush , 2017 WL 5 64887, at * 4 (concluding that an authorization that failed to identify with specificity a person or class of persons able to receive the records but instead listing “bearer” was not HIPAA compliant). Despite the deficiencies in Plaintiff’s HIPAA authorization, Plaintiff argues that “in essence the instant case involves a single health care provider,” and therefore, no HIPAA authorization was necessary in the first place. According to Plaintiff’s complaint, Dr. Yu was “a health care provider” who was “practicing dentistry at the dental clinic owned and operated by American Family Dentistry of Memphis, P.C.,” and Dr. Yu either “worked at, was employed by, or had an ownership interest in” American Family Dentistry. 5 Plaintiff argues that the Tennessee Supreme Court’s holding in Bray v. Khuri , 523 S.W.3d 619 (Tenn. 2017) is “directly on point” and no HIPAA authorization needed to be provided under these circumstances. In Bray , the plaintiff filed suit against one physician

– a single “health care provider” within the meaning of HIPAA and the Tennessee Health Care Liability Act. 6

5 Because we are reviewing the trial court’s decision on a Rule 12.02(6) mo tion to dismiss, fo r purposes of

thi s appeal, we presume that the allegat io ns of f act in the co mp laint are true. Stevens , 418 S.W.3d at 552 n.1.

6 Under HIPAA, a “heal

th care provider” is defined as “a provider of services (as defined in sect io n 1861(u) of

the Act, 42 U.S.C. 1395x(u)), a provider of medical o r health services (as- 10 -

Id. at 620. The Tennessee Supreme Court examined the text of Tennessee Code Annotated section 29 - 26 - 121(a)(2)(E), which requires a person who asserts a potential claim for health care liability to provide with pre - suit notice a HIPAA compliant authorization “permitting the provider receiving the notice to obtain complete medical records from each other provider being sent a notice.” Tenn. Code Ann. § 29 - 26 - 121(a)(2)(E). C onsidering the plain language of the statute, the Bray court concluded that “a prospective plaintiff who provides pre - suit notice to one potential defendant is not required under Tennessee Code Annotated section 29 - 26 - 121(a)(2)(E) to provide the single potential defendant with a HIPAA- compliant medical authorization.” Id. (emphasis added). In other words, “a plaintiff need not provide a HIPAA- compliant authorization when a single healthcare provider is given pre - suit notice of a healthcare liability claim.” Id. at 622 (emphasis added). According to the court, “The authorization only allows a potential defendant to obtain the prospective plaintiff’s medical records from any other healthcare provider also given notice and identified as a potential defendant in the pre - suit notice.” Id. (emphasis added). The intermediate appellate court in Bray had concluded that even though the sole defendant-physician may have physically possessed the patient’s records, he could not review them with counsel to evaluate the merits of the claim absent a HIPAA compliant authorization. Id. at 621. Thus, on appeal, the physician maintained that a HIPAA authorization would be necessary because HIPAA would prohibit him from disclosing medical rec ords already in his possession to his own counsel. Id. The supreme court recognized the “general rule” that “HIPAA prohibits a healthcare provider from using or disclosing protected health information without a valid authorization.” Id. (citing 45 C.F.R . § 164.508(a)(1) ) . 7 However, examining HIPAA regulations, the supreme court found an applicable “regulatory exception to the general requirement of a HIPAAcompliant medical authorization.” Id. at 623. The court explained that HIPAA regulations permit a health care provider to use or disclose protected health information for its own “health care operations,” with some exceptions. Id. at 622 (citing 45 C.F.R. § defined in sect io n 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or organizat io n who furnishes, bills, or is paid fo r heal th c are in the normal course of busines s.” 4 5 C.F.R. § 160.103. Tennessee Code Annotated section 29 - 26 - 101(a)(2) defines a “health care provider” as “[a] health care pract it io ner licensed, authorized, certified, registered, or regulated under any chapter of title 63 or title 68 . . . .”

7 Spe cifically, sect io n 164.508(a)(1) provides: (a) Standard: Authorizat io ns fo r uses and disclo sures (1) Authorization requi

red: General rule. Except as otherwise permitted or required by this subchapter, a covered ent ity may not use or disclo se protected health informat io n wi

thout an authorizat io n that is valid under this sect io n. 45 C.F.R. § 164.508(a)(1) (emphasis added).- 11 -

164.506(a) ). “Health care operations” include “[c]onducting or arranging for . . . legal services ,” and the website maintained by the United States Department of Health and Human Services indicated that a health care provider may use or disclose protected health information with its lawyer for litigation. Id. at 622 - 23. As such, the supreme court concluded that “HIPAA does not require Dr. Khuri to obtain a medical authorization to use a patient’s medical records in his possession and consult with counsel to evaluate the merits of a potential claim.” Id. at 623 (emphasis added). Notably, the physician relied on a previous decision from the Court of Appeals, Roberts v. Prill, E2013 - 02202 - COAR3 - CV, 2014 WL 2921930, at *6 (Tenn. Ct. App. June 26, 2014), to support his argument that a HIPAA compliant medical authorization was required to enable him to “use” medical records in his possession. Id. Without opining on the merits of the Roberts decision, the supreme court found it “factually distinguishable on a critical point: Roberts involved two defendants, whereas this case involves a single defendant.” Id. Accordingly, the supreme court explained, Roberts did not consider the same issue

– “whether section 29 - 26 - 121(a)(2)(E) applies when a single healthcare provider is named as a potential defendant.” 8 Id. In summary, Bray established two points

– (1) “a plaintiff need not provide a HIPAA- compliant authorization when a single healthcare provider is given pre - suit notice of a healthcare liability claim, ” and (2) a health care provider may use or disclose protected health information for its health care operations and does not need to obtain a medical authorization in order “to use a patient’s medical records in [its] possession and consult with counsel to evaluate the merits of a potential claim.” Id. at 622 - 23. C learly, the factual situation before us does not fall within the “single healthcare provider” exception recognized in Bray that would have excused Plaintiff from providing a HIPAA authorization in the first place. This Court rejected a similar argument in another case

8 The Roberts case was filed against an onco lo gist and the heal th care group that em ployed the onco lo gist. Roberts , 2014 WL 2921930, at *1. The plaint iff claimed that the def endants al

ready had all of

the relevant records in thei r possession. Id. at* 6. The court of a ppeals concluded that because the HIPAA authorizat io ns provided by the plaint iff were def ect ive, the two defendants “were not legally authorized to use the pertinent medical records to mount a defense, despite the fact that the records may have already been in their possession.” Id. at *5. The court co ncluded that the “case did not fall wi thin one of

the limited circumstances ant ic ipated by HIPAA that would allow fo r the use of the records wi

thout authorization.” Id. at *6. However, the only specific except io n the court discussed was provided in 45 C.F.R. § 164.508(a) (2)(i)(C), which addresses the use of p sychotherapy

notes in a legal act io n. Id. We did not ment io n the except io n fo r heal th care operations that was later discussed by the supreme court in Bray. I

d. ; see also Harmon v. Shore , No. M2014 - 01339 - COA- R3 - CV, 2015 WL 1881467, at* 5 & n.3 (Tenn. Ct. App. Apr. 23, 2015) (relying on Roberts prior to Bray -- where the plaint iff argued that a doctor and hospi tal already possessed the records -- and concluding that the case did not fall wi thin one of

the limited ci

rcumstances that wo uld allow fo r the “use ” of records wi

thout an authorization, but only discussing the psychotherapy except io n).- 12 -

involving two defendant medical providers

– a physician’s assistant and the dermatology practice that employed her. Law son , 544 S.W.3d at 710. Despite the employer- em ployee relationship between the defendants, we ultimately concluded that the situation before us involved multiple defendants, and therefore “the one - defendant exception articulated in Bray [did] not apply[.]” Id. at 711 - 12. The Sixth Circuit also considered and rejected a similar argument in Riley , where health care liability claims were filed against a physician in addition to the clinic and the hospital where the physician practiced. 7 31 Fed. Appx. at 483. Like Plaintiff, the appellants in Riley argued that this was “essentially a one -provider case” and suggested that all of the records would be accessible by the physician as the health care provider who rendered the care. Id. at 495. The Sixth Circuit rejected that argument, first characterizing Bray as “a statutory interpretation case” that was “inapposite” given that the case before it involved pre - suit notice sent to three health care providers. Id. However, to the extent that the plaintiffs were suggesting a lack of prejudice on the part of the defendants due to an alleged ability to access records without the need for a HIPAA authorization, the court further held that the plaintiffs failed to adequately raise and establish a lack of prejudice or that the defendants actually had “another means of access” to the records. Id. at 494 - 95. Likewise, this is not a “single healthcare provider” case within the meaning of Bray such that HIPAA authorizations were unnecessary. However, to the extent that Plaintiff is attempting to argue a lack of prejudice in light of the two defendants’ employment relationship, we find it necessary to consider the issue of prejudice separately with respect to each defendant. Again, Stevens requires us to consider whether each defendant was prejudiced by Plaintiff’s failure to provide a HIPAA compliant release. See Stevens , 418 S.W.3d at 556 . N otably, at oral argument before this Court, counsel for the defendants conceded that “[i]n this particular case, Dr. Yu does not possess the records; American Family Dentistry possesses the records.” Therefore, we begin by considering the issue of prejudice to American Family Dentistry, which already had the records in its possession, resulting from its inability to utilize the HIPAA authorization provided by Plaintiff. 9 According to the T ennessee Supreme Court’s decision in Bray , a HIPAA authorization “only allows a potential defendant to obtain the prospective plaintiff’s medical records from any other healthcare provider also given notice and identified as a

9 With regard to the issue of prejudice, we note that a defendant is not required to attem pt to use a medical authorizat io n itb elieves to be defect ive, and “a defendant’s claim of prejudice is not waived by failing to attempt to use or otherwise ‘test’ an allegedly defect ive authorizat io n.” Smith , 2018 WL 3343591, at *6 .- 13 -

potential defendant in the pre - suit notice,” and HIPAA regulations allow a health care provider to use or disclose protected health information in its possession for its own health care operations. 523 S.W.3d at 622
. For instance, in Bray , HIPAA did not require the defendant- doctor to obtain a medical authorization in order to “use” the patient’s medical records in his possession and consult with counsel to evaluate the merits of the potential claim. Id. Here, according to the concession of defense counsel, Dr. Yu did not possess any records. The records were maintained by American Family Dentistry. Therefore, it was not necessary for American Family Dentistry to utilize the HIPAA authorization to obtain records from any other health care provider identified as a potential defendant, and American Family Dentistry was authorized to use the records in its possession to evaluate the merits of Plaintiff’s claim without a HIPAA authorization. In this regard, this case is analogous to Hughes v. Henry C oun ty Medical C

en ter, No. W2014 - 01973 - COA- R3 - CV, 2015 WL3 562733 (Tenn. Ct. App. June 9, 2015) . In Hughes , the plaintiff filed a health care liability action against a hospital and a physician (although the physician was not a party to the appeal). Id. at *1. A c leric al error in the medical authorization form provided to the hospital did not permit it to obtain medical records from the physician. Id. However, counsel for the hospital conceded that the physician saw the patient only at the hospital and had no records independent of the hospital’s records. Id. at *2. This Court quoted the following pertinent language from Stevens , [I]n determining whether a plaintiff has substantially complied with a statutory requirement, a reviewing court should consider the extent and significance of the plaintiff’s errors and omissions **and** whether the defendant was prejudiced by the plaintiff’s noncompliance. Not every noncompliant HIPAA medical authorization will result in prejudice. Id. (citing 418 S.W.3d at 556). We noted the undisputed fact that the physician had no medical records, and therefore, the validity of the release for the physician’s records had no effect on the hospital’s ability to obtain “complete medical records” as contemplated by the statute. Id. at *3. Rather, the hospital “was able to obtain all of the [patient’s] relevant medical records, and evaluate the merits of the claim despite Appellants’ technical failure to include [the physician’s] records in its release. ” 10 Id. at *4. B ecause the hospital admittedly suffered no prejudice as a result of the defective HIPAA authorization and the statutory goal of allowing a defendant to evaluate the merits of a

10 Hughes was a pre -Bray decision. T he Court of Appeals concluded that the hospi tal was permitted to “use its own records” in light of the part icular language of the defect ive HIPAA release fo rm, wi

thout discussing the exception fo r heal th care operations later discussed in Bray . Id. at *1. However, we believe the result here is the same wi th respect to the issue of prejudice
.- 14 -

claim with early access to medical records was satisfied, we c oncluded that Plaintiff substantially complied with the statute. Id. at *5. See also Martin v. Rolling Hills Hosp., LLC, No. M2016 - 02214 - COA- R3 - CV, 2018 WL 3097231, at *8 (Tenn. Ct. App. June 22, 2018) (finding no prejudice to the defendants in a case where the plaintiffs argued that the defendants already had possession of the relevant documents ); but see Dolman v. Donovan , No. W2015 - 00392 - COA- R3 - CV, 2015 WL9 315565, at *1 (Tenn. Ct. App. Dec. 23, 2015) (declining to find no prejudice when eight separate providers were given pre - suit notice, only one defendant-hospital actually had relevant records, but the providers did not know this information during the pre - suit notice period and were unable to use the defective authorizations to request whatever records might have existed). We recognize that our holding with regard to this issue seems to conflict with the portion of the Law

son opinion analyzing the issue of prejudice when two defendants are involved . Again, Lawson involved two defendant me dical providers

– a physician’s assistant and the dermatology practice that em ployed her. Lawson , 544 S.W.3d at 705. However, the plaintiffs only appealed the dismissal of the claim against the dermatology practi ce. Id. On appeal, the plaintiffs argued that the defendant-practice was not prejudiced by a defective HIPAA release because it “already had access to the medical record it generated” when the plaintiff was treated and “was already in possession of the only me dical record relevant to the case at bar.” Id. at 710. We found the “one defendant exception” from Bray inapplicable and instead relied on the pre -Bray decision in Roberts (which had only discussed the applicability of the HIPAA exception for psychotherapy notes). Id. Applying Roberts , we concluded that the fact that the records were already in the defendant’s possession did not excuse compliance with the HIPAA authorization requirement because, in the absence of one of HIPAA’s limited exceptions, HIPAA generally provides that a covered entity may not use protected health information without a valid authorization. Id. As in Roberts , the only exception we referenced was the one for psychotherapy notes. Id. We concluded that in light of the defective HIPAA form, the defendant medical practice would not be allowed to consult with anyone about the records and “would not be allowed to use Mr. Lawson’s me dical records to mount a defense.” Id. at 713. Essentially, in Lawson , we concluded that “the one - defendant exception articulated in Bray [did] not apply” to excuse the plaintiffs from providing HIPAA authorizations, but we did not discuss whether the “health care operations” exception to HIPAA that was secondarily discussed in Bray would neverthel ess permit the defendantpractice to use the records in its possession. Id. at 711. H aving carefully reviewed Law son , Roberts (and cases citing it), and the Tennessee Supreme Court’s decision in Bray , we simply conclude that our decision is controlled by the Bray decision and its conclusion regarding the use of records that are already in the possession of a health care provider. Discerning no prejudice to American Family Dentistry due to Plaintiff’s failure- 15 -

to provide it with a HIPAA compliant release, we conclude that Plaintiff substantially complied with Tennessee Code Annotated section 29 - 26 - 121(a)(2)(E), she was entitled to the 120 - day extension to the statute of limitations, and her claim against American Family Dentistry was not time -barred. We reverse the trial court’s dismissal of Plaintiff’s claim against American Family Dentistry. We now consider the existence of prejudice to Dr. Yu, who did not already possess the records, resulting from his inability to utilize the HIPAA authorization provided by Plaintiff. B efore the trial court, counsel for the defendants acknowledged that American Family Dentistry and Dr. Yu are “in an em ployer- em

ployee relationship.” Although Plaintiff does not cite any HIPAA regulations on appeal, she suggests that it is incomprehensible that Dr. Yu would not have “free access” to obtain medical records from American Family Dentistry when he continues to work at the clinic. We disagree. H IPAA distinguishes between uses or disclosures for purposes of treatment and those for purposes of health care operations. 11 The “health care operations” exception to the general requirement of a HIPAA compliant authorization, which was discussed in Bray , does not extend to the lengths implicitly urged by Plaintiff. Keeping in mind that the purpose of American Family Dentistry providing these records to Dr. Yu would be for Dr. Yu’s own health care operations, we look to the language of the regulation: (c) Implementation specifications: Treatment, payment, or health care operations. (1) A covered entity may use or disclose protected health information for its ow n treatment, payment, or health care operations.

. . . . (4) A covered entity may disclose protected health information to another covered entity for health care operations activities of the entity that receives the information , if each entity either has or had a relationship with the individual who is the subject of the protected health information being requested, the protected health information pertains to such relationship , and the disclosure is: (i) For a purpose listed in paragraph (1) or (2) of the definition of health care operations; or

11 “Treatment me ans the provision, coordinat io n, o r management of heal th c are and related services by one or more heal th care providers, including the coordinat io n or management of health care by a health care provider wi th athird party; consultat io n between health care providers relat ing to a patient; or the ref erral of a patient fo r health care fro m one health care provider to another.” 45 C.F.R. § 164.501.- 16 -

(ii) For the purpose of health care fraud and abuse detection or compliance. 45 C.F.R. § 164.506 (c) (emphasis added). The referenced purposes listed in paragraphs (1) and (2) are for quality-related health care operations and do not include legal services, which is separately addressed in paragraph (4). 12 Accordingly, this exception to the authorization requirement would not permit American Family Dentistry to disclose records to Dr. Yu for the purposes of Dr. Yu’s health care operations (i.e., conducting or arranging for legal services). “Requiring a HIPAA compliant medical authorization to accompany the pre - suit notice was a policy decision by the General Assembly that ‘equip[s] defendants with the actual means to evaluate the substantive merits of a plaintiff’s claim by enabling early access to a plaintiff’s me dical records.’” 13 J.A.C. by & through Carter, 542 S.W.3d at

12 See https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclo sures treatment -payment -health- care - operations/index .h tml (characterizing paragraphs (1) and (2) as “quality-related health care operations act ivity”). The definit io n of heal th c are operations provides: Heal th care operations means any of the fo llowing activi ties of the covered enti

ty to the extent that the activit ies are related to covered funct io ns: (1) Co nducting quali

ty a ssessment and improvement activit ies, including outcomes evaluat io n and development of c linical guidelines, provided that the obtaining of

generalizable knowledge is not the primary purpose of any studies resul ting fro m such act ivit ies; pat ients afety activi ties (as defined in 42 CFR 3.20); populat io n- based act ivit ies relat ing to improving health or reducing health care costs, protocol development, case management and care coordinat io n, contacting of health care providers and pat ient s wi th inf ormat io n about treatment al ternat ives; and related funct io ns that do not include treatment; (2) Reviewing the co mp etence or qualificat io ns of health care prof essionals, evaluat ing pract it io ner and provider perf ormance, health plan perf ormance, conducting training programs in which students, trainees, or practi tioners in areas of heal th c are le arn under supervisio n to practice or improve thei r skills as health care providers, training of non- health care prof essionals, accreditat io n, certification, licensing, or credentialing act ivit ies;

. . . . (4) Conducting or arranging fo r medical review, legal services, and audi ting funct io ns, including fraud and abuse detection and compliance programs; 45 C.F.R. § 164.501 .

13 We note that HIPAA also permits a covered ent ity to disclose protected health informat io n “in the course of any judicial or administrative proceeding” but only “[ i] n response to an order of

ac ourt or administrative tribunal” or “a subp oena, discovery request, or other lawful process” and provided that other condit io ns are met. 45 C.F.R. § 164.512(e).- 17 -

521 (quoting Stevens , 418 S.W.3d at 555). In the case before us, the authorization Plaintiff sent to Dr. Yu was not HIPAA- compliant, and Plaintiff has not demonstrated that Dr. Yu had another me ans of access to the records maintained by American Family Dentistry that would have enabled him to evaluate her claim. See Myers , 382 S.W.3d at 307 (“Once the defendant makes a properly supported motion under this rule, the burden shifts to the plaintiff to show [] that it complied with the statutes . . . . Based on the comp laint and any other relevant evidence submitted by the parties, the trial court must determine whether the plaintiff has complied with the statutes. ”); Dolman , 2015 WL 9315565, at *4 (concluding that plaintiffs presented only sparse evidence regarding an alleged affiliation between defendant entities that failed to reveal the extent of the defendants’ access to records). We therefore conclude that Dr. Yu was prejudiced by the lack of a HIPAA compliant authorization. “ ‘ Defendants are clearly prejudiced when unable, due to a form procedural error, to obtain medical records needed for their legal defense. ’ ” Hamilton v. Abercrombie Radiological Consultants, Inc ., 487 S.W.3d 114, 120 (Tenn. Ct. App. 2014). Plaintiff failed to substantially comply with Tenness ee Code Annotated section 29 - 26 - 121(a)(2)(E) because her authorization would not allow Dr. Yu to obtain medical records from the other health care provider receiving pre - suit notice. Due to Plaintiff’s failure to substantially comply with the statute within the original statute of limitations, Plaintiff did not receive the 120 - day extension of the statute of limitations, and her complaint against Dr. Yu was not timely filed. See Byrge , 442 S.W.3d at 250. We affirm the trial court’s dismissal of the claim against Dr. Yu. **V .**  **C ONCLUSION**  For the aforementioned reasons, we affirm the decision of the circuit court in part, we reverse in part, and we remand this cause for further proceedings consistent with this opinion. C osts of this appeal are taxed equally to the appellant, Mary Wenzler, and to appellee American Family Dentistry, for which execution may issue if necessary.

_________________________________ BRANDON O. GIBSON, JUDGE