IN THE COURT OF APPEALS OF TENNESSEE

AT JACKSON

October 9, 2018 Session

MARY WENZLER v. DR. XIAO YU, ET AL.

Appeal from the Circuit Court for Shelby County

No. CT-003652-17 Mary L. Wagner, Judge

___________________________________

No. W2018-00369-COA-R3-CV

___________________________________

This is a health care liability case filed against a dentist and the dental practice that 

employed him. Before filing the complaint, the plaintiff gave written notice to the two 

potential defendants of her health care liability claims against them. Tennessee Code 

Annotated section 29-26-121(a)(2)(E) requires that a plaintiff’s pre-suit notice include a 

HIPAA compliant medical authorization permitting the health care provider receiving the 

notice to obtain complete medical records from every other provider that is being sent a 

notice. After the plaintiff filed suit, the defendants moved to dismiss the complaint based 

on noncompliance with the statute, as the defendants alleged that the HIPAA 

authorizations provided by the plaintiff did not contain all of the required information and 

were therefore invalid. After a hearing, the trial court granted the motion to dismiss, 

concluding that the authorizations provided by the plaintiff were not HIPAA compliant 

and therefore the plaintiff did not substantially comply with the statute. The plaintiff 

appeals. We affirm in part, reverse in part, and remand for further proceedings.

Tenn. R. App. P. 3 Appeal as of Right; Judgment of the Circuit Court Affirmed in 

Part, Reversed in Part, and Remanded

BRANDON O. GIBSON, J., delivered the opinion of the court, in which J. STEVEN 

STAFFORD, P.J., W.S., and ARNOLD B. GOLDIN, J., joined.

Kathleen L. Caldwell, Memphis, Tennessee, for the appellant, Mary Wenzler.

Laura L. Deakins, Memphis, Tennessee, and Lucas A. Davidson, Nashville, Tennessee, 

for the appellees, Xiao Yu, and American Family Dentistry of Memphis, PC.

OPINION

I. FACTS & PROCEDURAL HISTORY

11/20/2018
- 2 -

On June 8, 2017, Plaintiff Mary Wenzler sent pre-suit notice letters to two 

potential defendants – Dr. Xiao Yu and American Family Dentistry of Memphis, PC –

notifying them of potential health care liability claims arising out of their care and 

treatment of Mrs. Wenzler on June 13, 2016. The pre-suit notice letters stated that 

Plaintiff was attaching HIPAA compliant medical authorizations authorizing each 

potential defendant to obtain complete medical records relating to her care and treatment 

from the other medical provider receiving the notice.

1 According to federal regulations, a 

HIPAA compliant authorization must, at a minimum, contain six “core elements,” 

including,

(iii) The name or other specific identification of the person(s), or class of 

persons, to whom the covered entity may make the requested use or 

disclosure.

45 C.F.R. § 164.508(c)(1). The HIPAA authorizations sent by Plaintiff mentioned that 

the information would be used for litigation but did not identify any particular person or 

class of persons to whom the covered entities could make the use or disclosure. 

Plaintiff filed her complaint for health care liability on September 1, 2017, and 

named as defendants Dr. Xiao Yu and American Family Dentistry of Memphis, PC.2The 

defendants filed a motion to dismiss on October 2, 2017, asserting that Plaintiff failed to 

provide HIPAA compliant medical authorizations with her pre-suit notice letters as 

required by Tennessee Code Annotated section 29-26-121(a)(2)(E). Specifically, the 

defendants noted that the authorization forms failed to identify the person or entity that 

was authorized to receive the disclosure pursuant to the release. Based on this defect, the 

defendants argued that Plaintiff could not take advantage of the 120-day statutory 

extension to the statute of limitations provided by Tennessee Code Annotated section 29-

26-121(c), and as a result, her complaint was time-barred.3

 

1

“HIPAA is an acronym for the Health Insurance Portability and Accountability Act of

1996, Pub. L. No. 104–191, 110 Stat. 1936 (codified as amended in scattered sections of 18 

U.S.C., 26 U.S.C., 29 U.S.C., 42 U.S.C.).” Runions v. Jackson-Madison Cnty. Gen. Hosp. Dist., 

549 S.W.3d 77, 80 n.3 (Tenn. 2018).

2

The complaint also included a loss of consortium claim filed by Plaintiff’s husband. 

However, the trial court ultimately dismissed his claim, and Plaintiff’s husband was not listed on 

the notice of appeal to this Court. Accordingly, we limit our review on appeal to Plaintiff’s 

claim.

3

“When a plaintiff gives pre-suit notice to a health care provider under Tennessee Code 

Annotated section 29-26-121, the one-year statute of limitations is extended by 120 days.” 

Runions, 549 S.W.3d at 86 (citing Tenn. Code Ann. § 29-26-121(c)). However, the pre-suit 

notice must comply with the statute in order for the plaintiff to receive the 120-day extension. 

Byrge v. Parkwest Med. Ctr., 442 S.W.3d 245, 249-50 (Tenn. Ct. App. 2014); see, e.g., Dortch v. 

Methodist Healthcare Memphis Hosps., No. W2017-01121-COA-R3-CV, 2018 WL 706767, at 

*3 (Tenn. Ct. App. Feb. 5, 2018) (“because Ms. Dortch did not comply with the provisions of
- 3 -

In response to the motion to dismiss, Plaintiff raised two arguments. First, she 

argued that her HIPAA authorization forms met or exceeded the statutory requirements. 

But alternatively, Plaintiff argued that even though there were “two named defendant 

medical providers: Dr. Yu and American Family Dentistry of Memphis, P.C. (Dr. Yu’s 

employer),” there was no “other” medical provider from whom records would be needed, 

so the defendants were not prejudiced. 

After a hearing, the trial court entered an order granting the defendants’ motion to 

dismiss. The trial court found that Plaintiff’s authorizations were not HIPAA compliant, 

as they did not identify any person or entity that could receive the protected information. 

Because of this omission, the trial court concluded that Plaintiff did not substantially 

comply with Tennessee Code Annotated section 29-26-121(a)(2)(E). The trial court 

rejected Plaintiff’s argument that a HIPAA authorization was unnecessary in the event 

that only one set of medical records existed, stating, “[t]he current case law is clear that 

where there are two or more defendants, the plaintiff must provide HIPAA compliant 

authorizations to all defendants,” “even when the defendants stand in an employeeemployer relationship.” Because Plaintiff was not entitled to rely on the 120-day 

extension of the statute of limitations, the trial court dismissed Plaintiff’s complaint as 

time-barred. Plaintiff timely filed a notice of appeal.

II. ISSUES PRESENTED

On appeal, Plaintiff asks this Court to consider “whether Plaintiff[] failed to 

provide a HIPAA compliant medical authorization with the[] pre-suit notice as required 

by Tennessee Code Annotated § 29-26-121(a)(2)(E).”4Specifically, Plaintiff argues that 

she substantially complied with the statute despite her failure to identify the intended 

recipient of the medical records. Alternatively, she contends that a HIPAA authorization 

was not needed because “in essence the instant case involves a single health care 

provider.” For the following reasons, we affirm the decision of the circuit court in part, 

 

section 121, she did not receive the 120 day extension, which made her [] Complaint timebarred”); J.A.C. by & through Carter v. Methodist Healthcare Memphis Hosps., 542 S.W.3d 502, 

514 (Tenn. Ct. App. 2016) (“Due to the Plaintiffs’ substantial noncompliance, the trial court was 

correct in determining that the 120-day extension of the statute of limitations [] provided by 

Tennessee Code Annotated section 29-26-121(c) was unavailable.”)

4 We note the defendants’ argument that this Court should dismiss the appeal due to 

deficiencies in Plaintiff’s brief. Plaintiff failed to include a section in her brief listing the issues 

presented for review and failed to include proper citations to the relevant pages of the record. 

Instead, the cover page of Plaintiff’s brief states, “The nature of the proceedings: whether 

Plaintiffs failed to provide a HIPAA compliant medical authorization with their pre-suit notice as 

required by Tennessee Code Annotated § 29-26-121(02)(E),” and for citations to the record, she 

included references such as “Complaint, ¶2” and “see Exhibit B-1 . . . to Complaint.” In light of 

the limited issue resolved by the trial court and the small record on appeal, we will proceed to 

address the merits of the appeal, and we decline the defendants’ request for attorney’s fees.
- 4 -

reverse in part, and remand for further proceedings.

III. STANDARD OF REVIEW

According to the Tennessee Supreme Court, 

The proper way for a defendant to challenge a complaint’s 

compliance with Tennessee Code Annotated section 29-26-121 [] is to file 

a Tennessee Rule of Procedure 12.02 motion to dismiss. In the motion, the 

defendant should state how the plaintiff has failed to comply with the 

statutory requirements by referencing specific omissions in the complaint 

and/or by submitting affidavits or other proof. Once the defendant makes a 

properly supported motion under this rule, the burden shifts to the plaintiff 

to show either that it complied with the statutes or that it had extraordinary 

cause for failing to do so. Based on the complaint and any other relevant 

evidence submitted by the parties, the trial court must determine whether 

the plaintiff has complied with the statutes. If the trial court determines that 

the plaintiff has not complied with the statutes, then the trial court may 

consider whether the plaintiff has demonstrated extraordinary cause for its 

noncompliance. If the defendant prevails and the complaint is dismissed, 

the plaintiff is entitled to an appeal of right under Tennessee Rule of 

Appellate Procedure 3 using the standards of review in Tennessee Rule of 

Appellate Procedure 13. 

Myers v. AMISUB (SFH), Inc., 382 S.W.3d 300, 307 (Tenn. 2012). Because the trial 

court’s decision on the motion “involves a question of law, our review is de novo with no 

presumption of correctness.” Id. (citing Graham v. Caples, 325 S.W.3d 578, 581 (Tenn. 

2010)).

IV. DISCUSSION

Under Tennessee law, a claimant must provide written pre-suit notice to a 

potential defendant before filing a complaint alleging health care liability:

Any person, or that person’s authorized agent, asserting a potential claim 

for health care liability shall give written notice of the potential claim to 

each health care provider that will be a named defendant at least sixty (60) 

days before the filing of a complaint based upon health care liability in any 

court of this state.
- 5 -

Tenn. Code Ann. § 29-26-121(a)(1). Pursuant to the statute, the pre-suit notice must 

include “[a] HIPAA compliant medical authorization permitting the provider receiving 

the notice to obtain complete medical records from each other provider being sent a

notice.” Tenn. Code Ann. § 29-26-121(a)(2)(E) (emphasis added).

“Because the penalties imposed on entities that wrongfully disclose or obtain 

private health information in violation of HIPAA are severe, the sufficiency of the 

plaintiffs’ medical authorizations is imperative.” Woodruff by & through Cockrell v. 

Walker, 542 S.W.3d 486, 499 (Tenn. Ct. App. 2017). The specific requirements for a 

HIPAA compliant medical authorization are set forth in 45 C.F.R. § 164.508: 

(a) Standard: Authorizations for uses and disclosures

(1) Authorization required: General rule. Except as otherwise permitted or 

required by this subchapter, a covered entity may not use or disclose 

protected health information without an authorization that is valid under 

this section. . . . 

. . . .

(c) Implementation specifications: Core elements and requirements—

(1) Core elements. A valid authorization under this section must contain at 

least the following elements:

(i) A description of the information to be used or disclosed that identifies 

the information in a specific and meaningful fashion.

(ii) The name or other specific identification of the person(s), or class of 

persons, authorized to make the requested use or disclosure.

(iii) The name or other specific identification of the person(s), or class of 

persons, to whom the covered entity may make the requested use or 

disclosure.

(iv) A description of each purpose of the requested use or disclosure. . . .

(v) An expiration date or an expiration event that relates to the individual or 

the purpose of the use or disclosure. . . . 

(vi) Signature of the individual and date. If the authorization is signed by a 

personal representative of the individual, a description of such 

representative’s authority to act for the individual must also be provided.

(Emphasis added). “Under the plain language of the regulation,” with respect to 

subsection (iii), “a name is not required so long as there is specific identification of the 

entity, person, or class of persons authorized to receive the protected health records.” 
- 6 -

Rush v. Jackson Surgical Assocs. PA, No. W2016-01289-COA-R3-CV, 2017 WL

564887, at *4 (Tenn. Ct. App. Feb. 13, 2017) perm. app. denied (Tenn. June 8, 2017). 

For example, a valid authorization may authorize disclosure to a designated class of 

persons, “such as the employees of XYZ division of ABC insurance company,” so long 

as the class is specifically identified. Id. On the other hand, an authorization simply 

listing the term “bearer” does not satisfy the specificity requirement, and such a form is 

not HIPAA compliant. Id. Additionally, the HIPAA regulation expressly provides:

Defective authorizations. An authorization is not valid, if the document 

submitted has any of the following defects:

. . . . 

(ii) The authorization has not been filled out completely, with respect to an 

element described by paragraph (c) of this section, if applicable[.]

45 C.F.R. § 164.508(b)(2). Thus, “HIPAA deems authorizations defective if not filled 

out completely.” Smith v. Wellmont Health Sys., No. E2017-00850-COA-R9-CV, 2018 

WL 3343591, at *4 (Tenn. Ct. App. July 9, 2018).

As previously noted, the authorizations provided by Plaintiff in this case omitted 

information regarding element (iii), failing to identify any person or class of persons to 

whom the covered entity could make the requested use or disclosure. We now consider 

the effect of such an error under Tennessee law. The Tennessee Supreme Court provided 

guidance on that issue in Stevens ex rel. Stevens v. Hickman Community Health Care 

Services, Inc., 418 S.W.3d 547 (Tenn. 2013). In that case, the pre-suit notice provided by 

the plaintiff included a HIPAA authorization that only permitted the release of medical 

records to plaintiff’s counsel and lacked other required information. Id. at 552. The 

defendants moved to dismiss the complaint based on noncompliance with Tennessee 

Code Annotated section 29-26-121(a)(2)(E). Id. The trial court denied the motion, and 

the case eventually made its way to the Tennessee Supreme Court. Id. at 553. The 

supreme court recognized that “[h]ealthcare liability defendants have a right to receive 

medical records to defend themselves against civil liability,” and section 29-26-

121(a)(2)(E) requires a plaintiff to complete a HIPAA authorization “as a pre-condition 

of filing suit.” Id. at 557-58. The supreme court explained that the statute’s HIPAA 

authorization requirement serves “an investigatory function, equipping defendants with 

the actual means to evaluate the substantive merits of a plaintiff’s claim by enabling . . . 

early access to a plaintiff’s medical records.” Id. at 554. According to the court, 

Because HIPAA itself prohibits medical providers from using or disclosing 

a plaintiff’s medical records without a fully compliant authorization form, it 
- 7 -

is a threshold requirement of the statute that the plaintiff’s medical 

authorization must be sufficient to enable defendants to obtain and review a 

plaintiff’s relevant medical records. See 45 C.F.R. § 164.508(a)(1) (“a 

covered entity may not use or disclose protected health information without 

an authorization that is valid under this section”). Tenn. Code Ann. § 29-

26-121(d)(1) creates a statutory entitlement to the records governed by § 

29-26-121(a)(2)(E). See Tenn. Code Ann. § 29-26-121(d)(1) (“All parties 

in an action covered by this section shall be entitled to obtain complete 

copies of the claimant’s medical records from any other provider receiving 

notice ...”) (emphasis added). . . . .

A plaintiff’s less-than-perfect compliance with Tenn. Code Ann. § 

29-26-121(a)(2)(E), however, should not derail a healthcare liability claim. 

Non-substantive errors and omissions will not always prejudice defendants 

by preventing them from obtaining a plaintiff’s relevant medical records. 

Thus, we hold that a plaintiff must substantially comply, rather than strictly 

comply, with the requirements of Tenn. Code Ann. § 29-26-121(a)(2)(E).

Id. at 555 (emphasis in original). 

Next, the court considered the sufficiency of the HIPAA authorization provided in 

that case to determine whether it substantially satisfied the requirements of the statute. 

Id. After noting the six core elements required by federal regulations, the supreme court 

concluded that the authorization at issue was not HIPAA compliant. Id. at 556. “First, 

and most importantly,” the court said, “by permitting disclosure only to Plaintiff’s 

counsel, Plaintiff’s medical authorization failed to satisfy the express requirement of 

Tenn. Code Ann. § 29-26-121(a)(2)(E) that a plaintiff’s medical authorization ‘permit[ ] 

the provider receiving the notice to obtain complete medical records from each other 

provider being sent a notice.’” Id. Secondly, the court found that the authorization failed 

to satisfy at least three of the six compliance requirements mandated by HIPAA. Id. The 

court continued,

In determining whether a plaintiff has substantially complied with a 

statutory requirement, a reviewing court should consider the extent and 

significance of the plaintiff’s errors and omissions and whether the 

defendant was prejudiced by the plaintiff’s noncompliance. Not every noncompliant HIPAA medical authorization will result in prejudice. But in this 

case, the medical authorization submitted by Plaintiff was woefully 

deficient. The errors and omissions were numerous and significant. Due to 

Plaintiff's material non-compliance, Defendants were not authorized to 

receive any of the Plaintiff’s records. As a result of multiple errors, 
- 8 -

Plaintiff failed to substantially comply with the requirements of Tenn. Code 

Ann. § 29-26-121(a)(2)(E).

Id. (emphasis added). In a later case, the supreme court summarized Stevens as holding 

that “non-substantive errors and omissions and a plaintiff's less-than-perfect compliance 

with subsection 29-26-121(a)(2)(E) will not derail a healthcare liability claim so long as 

the medical authorization provided is sufficient to enable defendants to obtain and review 

a plaintiff’s relevant medical records.” Thurmond v. Mid-Cumberland Infectious Disease 

Consultants, PLC, 433 S.W.3d 512, 519-20 (Tenn. 2014) (quotations and bracketing 

omitted).

In sum, “there is no bright line rule that determines whether a party has 

substantially complied with the requirements of Tenn. Code Ann. § 29-26-

121(a)(2)(E)[.]” Rush, 2017 WL 564887, at *4. However, in order to substantially 

comply with the statute, a plaintiff must provide a defendant with a HIPAA compliant 

medical authorization form that is sufficient to allow the defendant to obtain the 

plaintiff’s medical records from the other providers being sent the notice. Brookins v. 

Tabor, No. W2017-00576-COA-R3-CV, 2018 WL 2106652, at *5 (Tenn. Ct. App. May 

8, 2018); Travis v. Cookeville Reg’l Med. Ctr., No. M2015-01989-COA-R3-CV, 2016 

WL 5266554, at *7 (Tenn. Ct. App. Sept. 21, 2016). In this context, substantial 

compliance requires “a degree of compliance that provides the defendant with the ability 

to access and use the medical records for the purpose of mounting a defense.” Lawson v. 

Knoxville Dermatology Grp., P.C., 544 S.W.3d 704, 711 (Tenn. Ct. App. 2017). 

Applying these principles, we consider whether Plaintiff failed to substantially 

comply with section 29-26-121(a)(2)(E) by providing each defendant with an incomplete 

HIPAA authorization form that failed to identify to whom the covered entity could make

the requested use or disclosure. Considering first “the extent and significance of the 

plaintiff’s errors and omissions,” as instructed by Stevens, 418 S.W.3d at 556, we note

that these HIPAA authorizations were “defective” and “not valid” under HIPAA 

regulations due to Plaintiff’s omission. 45 C.F.R. § 164.508(b)(2)(ii). Her omission was 

both substantive and significant. As a result of Plaintiff’s failure to identify any 

authorized recipient of the records, her HIPAA authorizations did not permit the 

defendants to receive Plaintiff’s medical records. 

In Lawson, 544 S.W.3d at 712, this Court found no substantial compliance where 

a similar core element of the plaintiff’s HIPAA authorization, designating who was 

authorized to make the requested use or disclosure, was left blank. Id. We explained that 

“health care providers presented with a medical authorization missing the identification 

of those authorized to release information would have no way of knowing that they were 
- 9 -

the providers for which the authorization was intended or that they were allowed to 

release medical records.” Id. As such, we concluded that the single omitted core element 

was “a necessary element” to the defendants’ legal authorization to use the medical 

records. Id.

In Riley v. Methodist Healthcare Memphis Hospitals, 731 F. App’x 481 (6th Cir. 

2018), the Sixth Circuit considered a HIPAA authorization with the same omission as the 

one before us in the context of a diversity jurisdiction case alleging health care liability. 

Specifically, the plaintiffs in Riley left blank the section where they were supposed to list 

the persons to whom each provider could disclose the patient’s records. Id. at 488 (citing 

C.F.R. § 145.608(c)(1)(iii)). Applying Tennessee law and federal HIPAA regulations, 

the district court deemed the authorization defective, rejecting the plaintiff’s argument 

that the forms were HIPAA compliant and would effectively permit each defendant to 

share records with anyone it wished. Id. at 489. Instead, the district court concluded, 

because of the omission in the form, the defendants were permitted to disclose records to 

no one. Id. The Sixth Circuit found no error in this decision. Id. at 490. After reviewing 

Tennessee caselaw, the court concluded that “substantial compliance requires that the 

noncomplying features of the authorization do not render it insufficient to authorize 

access and use of the records,” and the form at issue in Riley “did not permit that access 

and use.” Id. at 491-92; see also Rush, 2017 WL 564887, at *4 (concluding that an 

authorization that failed to identify with specificity a person or class of persons able to 

receive the records but instead listing “bearer” was not HIPAA compliant). 

Despite the deficiencies in Plaintiff’s HIPAA authorization, Plaintiff argues that 

“in essence the instant case involves a single health care provider,” and therefore, no 

HIPAA authorization was necessary in the first place. According to Plaintiff’s complaint, 

Dr. Yu was “a health care provider” who was “practicing dentistry at the dental clinic 

owned and operated by American Family Dentistry of Memphis, P.C.,” and Dr. Yu either 

“worked at, was employed by, or had an ownership interest in” American Family 

Dentistry.5Plaintiff argues that the Tennessee Supreme Court’s holding in Bray v. Khuri, 

523 S.W.3d 619 (Tenn. 2017) is “directly on point” and no HIPAA authorization needed 

to be provided under these circumstances. 

In Bray, the plaintiff filed suit against one physician – a single “health care 

provider” within the meaning of HIPAA and the Tennessee Health Care Liability Act.6 

 

5 Because we are reviewing the trial court’s decision on a Rule 12.02(6) motion to 

dismiss, for purposes of this appeal, we presume that the allegations of fact in the complaint are 

true. Stevens, 418 S.W.3d at 552 n.1.

6 Under HIPAA, a “health care provider” is defined as “a provider of services (as defined 

in section 1861(u) of the Act, 42 U.S.C. 1395x(u)), a provider of medical or health services (as 
- 10 -

Id. at 620. The Tennessee Supreme Court examined the text of Tennessee Code 

Annotated section 29-26-121(a)(2)(E), which requires a person who asserts a potential 

claim for health care liability to provide with pre-suit notice a HIPAA compliant 

authorization “permitting the provider receiving the notice to obtain complete medical 

records from each other provider being sent a notice.” Tenn. Code Ann. § 29-26-

121(a)(2)(E). Considering the plain language of the statute, the Bray court concluded 

that “a prospective plaintiff who provides pre-suit notice to one potential defendant is not 

required under Tennessee Code Annotated section 29-26-121(a)(2)(E) to provide the 

single potential defendant with a HIPAA-compliant medical authorization.” Id.

(emphasis added). In other words, “a plaintiff need not provide a HIPAA-compliant 

authorization when a single healthcare provider is given pre-suit notice of a healthcare 

liability claim.” Id. at 622 (emphasis added). According to the court, “The authorization 

only allows a potential defendant to obtain the prospective plaintiff’s medical records 

from any other healthcare provider also given notice and identified as a potential 

defendant in the pre-suit notice.” Id. (emphasis added).

The intermediate appellate court in Bray had concluded that even though the sole 

defendant-physician may have physically possessed the patient’s records, he could not 

review them with counsel to evaluate the merits of the claim absent a HIPAA compliant 

authorization. Id. at 621. Thus, on appeal, the physician maintained that a HIPAA 

authorization would be necessary because HIPAA would prohibit him from disclosing 

medical records already in his possession to his own counsel. Id. The supreme court 

recognized the “general rule” that “HIPAA prohibits a healthcare provider from using or 

disclosing protected health information without a valid authorization.” Id. (citing 45 

C.F.R. § 164.508(a)(1)).

7

 However, examining HIPAA regulations, the supreme court 

found an applicable “regulatory exception to the general requirement of a HIPAAcompliant medical authorization.” Id. at 623. The court explained that HIPAA 

regulations permit a health care provider to use or disclose protected health information 

for its own “health care operations,” with some exceptions. Id. at 622 (citing 45 C.F.R. § 

 

defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or organization 

who furnishes, bills, or is paid for health care in the normal course of business.” 45 C.F.R. § 

160.103. Tennessee Code Annotated section 29-26-101(a)(2) defines a “health care provider” as 

“[a] health care practitioner licensed, authorized, certified, registered, or regulated under any 

chapter of title 63 or title 68 . . . .”

7

Specifically, section 164.508(a)(1) provides:

(a) Standard: Authorizations for uses and disclosures

(1) Authorization required: General rule. Except as otherwise permitted or 

required by this subchapter, a covered entity may not use or disclose protected 

health information without an authorization that is valid under this section.

45 C.F.R. § 164.508(a)(1) (emphasis added).
- 11 -

164.506(a)). “Health care operations” include “[c]onducting or arranging for . . . legal 

services,” and the website maintained by the United States Department of Health and 

Human Services indicated that a health care provider may use or disclose protected health 

information with its lawyer for litigation. Id. at 622-23. As such, the supreme court 

concluded that “HIPAA does not require Dr. Khuri to obtain a medical authorization to 

use a patient’s medical records in his possession and consult with counsel to evaluate the 

merits of a potential claim.” Id. at 623 (emphasis added). Notably, the physician relied 

on a previous decision from the Court of Appeals, Roberts v. Prill, E2013-02202-COAR3-CV, 2014 WL 2921930, at *6 (Tenn. Ct. App. June 26, 2014), to support his 

argument that a HIPAA compliant medical authorization was required to enable him to 

“use” medical records in his possession. Id. Without opining on the merits of the 

Roberts decision, the supreme court found it “factually distinguishable on a critical point: 

Roberts involved two defendants, whereas this case involves a single defendant.” Id. 

Accordingly, the supreme court explained, Roberts did not consider the same issue –

“whether section 29-26-121(a)(2)(E) applies when a single healthcare provider is named 

as a potential defendant.”8 Id.

In summary, Bray established two points – (1) “a plaintiff need not provide a 

HIPAA-compliant authorization when a single healthcare provider is given pre-suit 

notice of a healthcare liability claim,” and (2) a health care provider may use or disclose 

protected health information for its health care operations and does not need to obtain a 

medical authorization in order “to use a patient’s medical records in [its] possession and 

consult with counsel to evaluate the merits of a potential claim.” Id. at 622-23. Clearly, 

the factual situation before us does not fall within the “single healthcare provider” 

exception recognized in Bray that would have excused Plaintiff from providing a HIPAA 

authorization in the first place. This Court rejected a similar argument in another case 

 

8

The Roberts case was filed against an oncologist and the health care group that 

employed the oncologist. Roberts, 2014 WL 2921930, at *1. The plaintiff claimed that the 

defendants already had all of the relevant records in their possession. Id. at *6. The court of 

appeals concluded that because the HIPAA authorizations provided by the plaintiff were 

defective, the two defendants “were not legally authorized to use the pertinent medical records to 

mount a defense, despite the fact that the records may have already been in their possession.” Id.

at *5. The court concluded that the “case did not fall within one of the limited circumstances 

anticipated by HIPAA that would allow for the use of the records without authorization.” Id. at 

*6. However, the only specific exception the court discussed was provided in 45 C.F.R. § 

164.508(a)(2)(i)(C), which addresses the use of psychotherapy notes in a legal action. Id. We 

did not mention the exception for health care operations that was later discussed by the supreme 

court in Bray. Id.; see also Harmon v. Shore, No. M2014-01339-COA-R3-CV, 2015 WL 

1881467, at *5 & n.3 (Tenn. Ct. App. Apr. 23, 2015) (relying on Roberts prior to Bray -- where 

the plaintiff argued that a doctor and hospital already possessed the records -- and concluding 

that the case did not fall within one of the limited circumstances that would allow for the “use”

of records without an authorization, but only discussing the psychotherapy exception). 
- 12 -

involving two defendant medical providers – a physician’s assistant and the dermatology 

practice that employed her. Lawson, 544 S.W.3d at 710. Despite the employer-employee 

relationship between the defendants, we ultimately concluded that the situation before us 

involved multiple defendants, and therefore “the one-defendant exception articulated in 

Bray [did] not apply[.]” Id. at 711-12. 

The Sixth Circuit also considered and rejected a similar argument in Riley, where 

health care liability claims were filed against a physician in addition to the clinic and the 

hospital where the physician practiced. 731 Fed. Appx. at 483. Like Plaintiff, the 

appellants in Riley argued that this was “essentially a one-provider case” and suggested 

that all of the records would be accessible by the physician as the health care provider 

who rendered the care. Id. at 495. The Sixth Circuit rejected that argument, first 

characterizing Bray as “a statutory interpretation case” that was “inapposite” given that 

the case before it involved pre-suit notice sent to three health care providers. Id. 

However, to the extent that the plaintiffs were suggesting a lack of prejudice on the part 

of the defendants due to an alleged ability to access records without the need for a 

HIPAA authorization, the court further held that the plaintiffs failed to adequately raise 

and establish a lack of prejudice or that the defendants actually had “another means of 

access” to the records. Id. at 494-95.

Likewise, this is not a “single healthcare provider” case within the meaning of 

Bray such that HIPAA authorizations were unnecessary. However, to the extent that 

Plaintiff is attempting to argue a lack of prejudice in light of the two defendants’ 

employment relationship, we find it necessary to consider the issue of prejudice 

separately with respect to each defendant. Again, Stevens requires us to consider whether 

each defendant was prejudiced by Plaintiff’s failure to provide a HIPAA compliant 

release. See Stevens, 418 S.W.3d at 556. Notably, at oral argument before this Court, 

counsel for the defendants conceded that “[i]n this particular case, Dr. Yu does not 

possess the records; American Family Dentistry possesses the records.” Therefore, we 

begin by considering the issue of prejudice to American Family Dentistry, which already 

had the records in its possession, resulting from its inability to utilize the HIPAA 

authorization provided by Plaintiff.9

According to the Tennessee Supreme Court’s decision in Bray, a HIPAA 

authorization “only allows a potential defendant to obtain the prospective plaintiff’s 

medical records from any other healthcare provider also given notice and identified as a 

 

9

 With regard to the issue of prejudice, we note that a defendant is not required to 

attempt to use a medical authorization it believes to be defective, and “a defendant’s claim of

prejudice is not waived by failing to attempt to use or otherwise ‘test’ an allegedly defective 

authorization.” Smith, 2018 WL 3343591, at *6.
- 13 -

potential defendant in the pre-suit notice,” and HIPAA regulations allow a health care 

provider to use or disclose protected health information in its possession for its own 

health care operations. 523 S.W.3d at 622. For instance, in Bray, HIPAA did not require 

the defendant-doctor to obtain a medical authorization in order to “use” the patient’s 

medical records in his possession and consult with counsel to evaluate the merits of the 

potential claim. Id. Here, according to the concession of defense counsel, Dr. Yu did not 

possess any records. The records were maintained by American Family Dentistry. 

Therefore, it was not necessary for American Family Dentistry to utilize the HIPAA 

authorization to obtain records from any other health care provider identified as a 

potential defendant, and American Family Dentistry was authorized to use the records in 

its possession to evaluate the merits of Plaintiff’s claim without a HIPAA authorization.

In this regard, this case is analogous to Hughes v. Henry County Medical Center, 

No. W2014-01973-COA-R3-CV, 2015 WL 3562733 (Tenn. Ct. App. June 9, 2015). In 

Hughes, the plaintiff filed a health care liability action against a hospital and a physician 

(although the physician was not a party to the appeal). Id. at *1. A clerical error in the 

medical authorization form provided to the hospital did not permit it to obtain medical 

records from the physician. Id. However, counsel for the hospital conceded that the 

physician saw the patient only at the hospital and had no records independent of the 

hospital’s records. Id. at *2. This Court quoted the following pertinent language from 

Stevens, 

[I]n determining whether a plaintiff has substantially complied with a 

statutory requirement, a reviewing court should consider the extent and 

significance of the plaintiff’s errors and omissions and whether the 

defendant was prejudiced by the plaintiff’s noncompliance. Not every noncompliant HIPAA medical authorization will result in prejudice.

Id. (citing 418 S.W.3d at 556). We noted the undisputed fact that the physician had no 

medical records, and therefore, the validity of the release for the physician’s records had 

no effect on the hospital’s ability to obtain “complete medical records” as contemplated 

by the statute. Id. at *3. Rather, the hospital “was able to obtain all of the [patient’s] 

relevant medical records, and evaluate the merits of the claim despite Appellants’ 

technical failure to include [the physician’s] records in its release.”

10

 Id. at *4. Because 

the hospital admittedly suffered no prejudice as a result of the defective HIPAA 

authorization and the statutory goal of allowing a defendant to evaluate the merits of a 

 

10

 Hughes was a pre-Bray decision. The Court of Appeals concluded that the hospital 

was permitted to “use its own records” in light of the particular language of the defective HIPAA 

release form, without discussing the exception for health care operations later discussed in Bray. 

Id. at *1. However, we believe the result here is the same with respect to the issue of prejudice.
- 14 -

claim with early access to medical records was satisfied, we concluded that Plaintiff 

substantially complied with the statute. Id. at *5. See also Martin v. Rolling Hills Hosp., 

LLC, No. M2016-02214-COA-R3-CV, 2018 WL 3097231, at *8 (Tenn. Ct. App. June 

22, 2018) (finding no prejudice to the defendants in a case where the plaintiffs argued 

that the defendants already had possession of the relevant documents); but see Dolman v. 

Donovan, No. W2015-00392-COA-R3-CV, 2015 WL 9315565, at *1 (Tenn. Ct. App. 

Dec. 23, 2015) (declining to find no prejudice when eight separate providers were given 

pre-suit notice, only one defendant-hospital actually had relevant records, but the 

providers did not know this information during the pre-suit notice period and were unable 

to use the defective authorizations to request whatever records might have existed).

We recognize that our holding with regard to this issue seems to conflict with the 

portion of the Lawson opinion analyzing the issue of prejudice when two defendants are 

involved. Again, Lawson involved two defendant medical providers – a physician’s 

assistant and the dermatology practice that employed her. Lawson, 544 S.W.3d at 705. 

However, the plaintiffs only appealed the dismissal of the claim against the dermatology 

practice. Id. On appeal, the plaintiffs argued that the defendant-practice was not 

prejudiced by a defective HIPAA release because it “already had access to the medical 

record it generated” when the plaintiff was treated and “was already in possession of the 

only medical record relevant to the case at bar.” Id. at 710. We found the “onedefendant exception” from Bray inapplicable and instead relied on the pre-Bray decision 

in Roberts (which had only discussed the applicability of the HIPAA exception for 

psychotherapy notes). Id. Applying Roberts, we concluded that the fact that the records 

were already in the defendant’s possession did not excuse compliance with the HIPAA 

authorization requirement because, in the absence of one of HIPAA’s limited exceptions,

HIPAA generally provides that a covered entity may not use protected health information 

without a valid authorization. Id. As in Roberts, the only exception we referenced was 

the one for psychotherapy notes. Id. We concluded that in light of the defective HIPAA 

form, the defendant medical practice would not be allowed to consult with anyone about 

the records and “would not be allowed to use Mr. Lawson’s medical records to mount a 

defense.” Id. at 713. 

Essentially, in Lawson, we concluded that “the one-defendant exception 

articulated in Bray [did] not apply” to excuse the plaintiffs from providing HIPAA 

authorizations, but we did not discuss whether the “health care operations” exception to 

HIPAA that was secondarily discussed in Bray would nevertheless permit the defendantpractice to use the records in its possession. Id. at 711. Having carefully reviewed 

Lawson, Roberts (and cases citing it), and the Tennessee Supreme Court’s decision in 

Bray, we simply conclude that our decision is controlled by the Bray decision and its 

conclusion regarding the use of records that are already in the possession of a health care 

provider. Discerning no prejudice to American Family Dentistry due to Plaintiff’s failure 
- 15 -

to provide it with a HIPAA compliant release, we conclude that Plaintiff substantially 

complied with Tennessee Code Annotated section 29-26-121(a)(2)(E), she was entitled to 

the 120-day extension to the statute of limitations, and her claim against American 

Family Dentistry was not time-barred. We reverse the trial court’s dismissal of Plaintiff’s 

claim against American Family Dentistry.

We now consider the existence of prejudice to Dr. Yu, who did not already 

possess the records, resulting from his inability to utilize the HIPAA authorization 

provided by Plaintiff. Before the trial court, counsel for the defendants acknowledged 

that American Family Dentistry and Dr. Yu are “in an employer-employee relationship.” 

Although Plaintiff does not cite any HIPAA regulations on appeal, she suggests that it is 

incomprehensible that Dr. Yu would not have “free access” to obtain medical records 

from American Family Dentistry when he continues to work at the clinic. 

We disagree. HIPAA distinguishes between uses or disclosures for purposes of 

treatment and those for purposes of health care operations.11 The “health care 

operations” exception to the general requirement of a HIPAA compliant authorization, 

which was discussed in Bray, does not extend to the lengths implicitly urged by Plaintiff. 

Keeping in mind that the purpose of American Family Dentistry providing these records 

to Dr. Yu would be for Dr. Yu’s own health care operations, we look to the language of 

the regulation:

(c) Implementation specifications: Treatment, payment, or health care 

operations.

(1) A covered entity may use or disclose protected health information for its 

own treatment, payment, or health care operations.

. . . . 

(4) A covered entity may disclose protected health information to another 

covered entity for health care operations activities of the entity that receives 

the information, if each entity either has or had a relationship with the 

individual who is the subject of the protected health information being 

requested, the protected health information pertains to such relationship, 

and the disclosure is:

(i) For a purpose listed in paragraph (1) or (2) of the definition of health 

care operations; or

 

11

 “Treatment means the provision, coordination, or management of health care and 

related services by one or more health care providers, including the coordination or management 

of health care by a health care provider with a third party; consultation between health care 

providers relating to a patient; or the referral of a patient for health care from one health care 

provider to another.” 45 C.F.R. § 164.501.
- 16 -

(ii) For the purpose of health care fraud and abuse detection or compliance.

45 C.F.R. § 164.506(c) (emphasis added). The referenced purposes listed in paragraphs 

(1) and (2) are for quality-related health care operations and do not include legal services, 

which is separately addressed in paragraph (4).12 Accordingly, this exception to the 

authorization requirement would not permit American Family Dentistry to disclose 

records to Dr. Yu for the purposes of Dr. Yu’s health care operations (i.e., conducting or 

arranging for legal services). 

“Requiring a HIPAA compliant medical authorization to accompany the pre-suit 

notice was a policy decision by the General Assembly that ‘equip[s] defendants with the 

actual means to evaluate the substantive merits of a plaintiff’s claim by enabling early 

access to a plaintiff’s medical records.’”13 J.A.C. by & through Carter, 542 S.W.3d at 

 

12

 See https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosurestreatment-payment-health-care-operations/index.html (characterizing paragraphs (1) and (2) as 

“quality-related health care operations activity”). The definition of health care operations 

provides: 

Health care operations means any of the following activities of the covered entity

to the extent that the activities are related to covered functions:

(1) Conducting quality assessment and improvement activities, including 

outcomes evaluation and development of clinical guidelines, provided that the 

obtaining of generalizable knowledge is not the primary purpose of any studies 

resulting from such activities; patient safety activities (as defined in 42 CFR 

3.20); population-based activities relating to improving health or reducing health 

care costs, protocol development, case management and care coordination,

contacting of health care providers and patients with information about treatment 

alternatives; and related functions that do not include treatment;

(2) Reviewing the competence or qualifications of health care professionals, 

evaluating practitioner and provider performance, health plan performance, 

conducting training programs in which students, trainees, or practitioners in areas 

of health care learn under supervision to practice or improve their skills as health 

care providers, training of non-health care professionals, accreditation,

certification, licensing, or credentialing activities;

. . . . 

(4) Conducting or arranging for medical review, legal services, and auditing 

functions, including fraud and abuse detection and compliance programs;

45 C.F.R. § 164.501.

13 We note that HIPAA also permits a covered entity to disclose protected health 

information “in the course of any judicial or administrative proceeding” but only “[i]n response 

to an order of a court or administrative tribunal” or “a subpoena, discovery request, or other 

lawful process” and provided that other conditions are met. 45 C.F.R. § 164.512(e).
- 17 -

521 (quoting Stevens, 418 S.W.3d at 555). In the case before us, the authorization 

Plaintiff sent to Dr. Yu was not HIPAA-compliant, and Plaintiff has not demonstrated 

that Dr. Yu had another means of access to the records maintained by American Family 

Dentistry that would have enabled him to evaluate her claim. See Myers, 382 S.W.3d at 

307 (“Once the defendant makes a properly supported motion under this rule, the burden 

shifts to the plaintiff to show [] that it complied with the statutes . . . . Based on the 

complaint and any other relevant evidence submitted by the parties, the trial court must 

determine whether the plaintiff has complied with the statutes.”); Dolman, 2015 WL

9315565, at *4 (concluding that plaintiffs presented only sparse evidence regarding an 

alleged affiliation between defendant entities that failed to reveal the extent of the 

defendants’ access to records). We therefore conclude that Dr. Yu was prejudiced by the 

lack of a HIPAA compliant authorization. “‘Defendants are clearly prejudiced when 

unable, due to a form procedural error, to obtain medical records needed for their legal 

defense.’” Hamilton v. Abercrombie Radiological Consultants, Inc., 487 S.W.3d 114, 

120 (Tenn. Ct. App. 2014). Plaintiff failed to substantially comply with Tennessee Code 

Annotated section 29-26-121(a)(2)(E) because her authorization would not allow Dr. Yu 

to obtain medical records from the other health care provider receiving pre-suit notice. 

Due to Plaintiff’s failure to substantially comply with the statute within the original 

statute of limitations, Plaintiff did not receive the 120-day extension of the statute of 

limitations, and her complaint against Dr. Yu was not timely filed. See Byrge, 442 

S.W.3d at 250. We affirm the trial court’s dismissal of the claim against Dr. Yu.

V. CONCLUSION

For the aforementioned reasons, we affirm the decision of the circuit court in part, 

we reverse in part, and we remand this cause for further proceedings consistent with this 

opinion. Costs of this appeal are taxed equally to the appellant, Mary Wenzler, and to 

appellee American Family Dentistry, for which execution may issue if necessary.

_________________________________

BRANDON O. GIBSON, JUDGE