IN THE COURT OF APPEALS OF TENNESSEE

AT JACKSON

January 19, 2017 Session

GERALD RUSH, ET AL. v. JACKSON SURGICAL ASSOCIATES PA, ET 

AL.

Appeal from the Circuit Court for Madison County

No. C-15-319 Kyle Atkins, Judge

___________________________________

No. W2016-01289-COA-R3-CV

___________________________________

This is a healthcare liability action. After sustaining injuries as a result of alleged 

surgical error, Appellant filed this action against the surgeon and his medical group. 

Appellees moved to dismiss the action for failure to comply with the notice requirement 

of Tennessee Code Annotated Section 29-26-121(a)(2)(E). The trial court granted the 

motion to dismiss, and Appellant appeals. Discerning no error, we affirm and remand. 

Tenn. R. App. P. 3 Appeal as of Right; Judgment of the Circuit Court is Affirmed 

and Remanded.

KENNY ARMSTRONG, J., delivered the opinion of the Court, in which J. STEVEN 

STAFFORD, P.J., W.S., and BRANDON O. GIBSON, J., joined.

Matthew E. Wright, Franklin, Tennessee, for the appellants, Gerald Rush, and Betty 

Rush.

Jerry D. Kizer, Brandon J. Stout, Jackson, Tennessee, for the appellees, Jackson Surgical 

Associates, PA, and David Villarreal.

OPINION

I. Background

On November 6, 2015, Gerald and Betty Rush (together “Appellants”) filed a 

healthcare liability complaint in Madison County Circuit Court against Jackson Surgical 

Associates (“JSA”) and Dr. David Villarreal (together with JSA, “Appellees”). The 

complaint alleged that, on July 18, 2014, while performing gallbladder surgery on Mr. 

02/13/2017
- 2 -

Rush, Dr. Villarreal negligently cut the wrong duct, clipped the hepatic artery, and cut the 

small intestine causing Mr. Rush serious injuries including organ failure.

On December 9, 2015, Appellees filed a motion seeking dismissal of the lawsuit 

pursuant to Tennessee Rule of Civil Procedure 12.02 for failure to comply with the presuit notice requirements of Tennessee Code Annotated Section 29-26-121, which 

provides:

(a)(1) Any person, or that person's authorized agent, asserting a potential 

claim for health care liability shall give written notice of the potential claim 

to each health care provider that will be a named defendant . . . .

(2) The notice shall include:

***

(E) A HIPAA compliant medical authorization permitting the provider 

receiving the notice to obtain complete medical records from each other 

provider being sent a notice.

Appellees asserted that the complaint failed to conform with the statute because 

Appellants did not include a medical authorization compliant with the Health Insurance 

Portability and Accountability Act (“HIPAA”). Specifically, Appellees argued that the 

HIPAA authorization did not permit each health care provider the opportunity to obtain 

the complete medical records of each of the providers being sent notice. Additionally, 

Appellees argued that the medical authorizations were deficient because they failed to 

comply with several core elements required by federal regulations. Appellees argued that 

Appellants’ failure to comply with the requirements outlined in Tennessee Code 

Annotated Section 29-26-121(a), precluded the 120-day extension provided in Tennessee 

Code Annotated Section 29-26-121(c), and, thus, the complaint is time-barred.

Following a hearing, the trial court issued an order dismissing the complaint. The 

trial court found that Appellant’s medical authorizations did not substantially comply 

with Tennessee Code Annotated Section 29-26-121 and that Appellees were prejudiced 

by the noncompliance. Specifically, the trial court found that: (1) the medical 

authorizations provided to JSA for the release of records held by Dr. Villarreal and JSA 

were not HIPAA compliant because the authorizations inadequately described the agency 

or individual authorized to receive information as “bearer” and also failed to state the 

purpose for the release of health information; and (2) the medical authorization provided

to JSA, for the release of records held by Jackson-Madison County General Hospital 

District (JMCGHD), as well as the medical authorizations provided to Dr. Villarreal, for 

the release of records held by JSA and JMCGHD, were not HIPAA compliant because 

they, likewise, failed to state the purpose for the release. Due to these omissions, the trial 
- 3 -

court found that the authorizations were not HIPAA compliant and that neither JSA nor 

Dr. Villarreal was authorized to use their own records to investigate Appellants’ claim 

during the pre-suit period. The trial court further found that Appellants violated the 

statute by failing to provide a medical authorization allowing Appellees to request 

records from Bolivar General Hospital, Inc. despite the fact that Bolivar General 

Hospital, Inc. was listed as a medical provider receiving pre-suit notice. Appellants 

appeal.

II. Issues

Appellants raise the following issue as stated in their brief:

Whether the trial court erred in ordering the dismissal with prejudice of all 

claims by holding that Plaintiffs did not substantially comply with the 

Tennessee Code Annotated Section 29-26-121(a), and that Defendants 

suffered prejudice as a result, thereby negating all tolling provisions for the 

statute of limitations?

III. Standard of Review

The Appellees properly filed a motion to dismiss pursuant to Tennessee Rule of 

Civil Procedure 12.02. Myers v. AMISUB (SFH), Inc., 382 S.W.3d 300, 307 (Tenn. 

2012) (“The proper way for a defendant to challenge a complaint’s compliance with 

Tennessee Code Annotated Section 29-26-121 is to file a Tennessee Rule of [Civil] 

Procedure 12.02 motion to dismiss.”). The issue before us is a question of law. 

Accordingly, the trial court’s grant of the motion to dismiss is subject to a de novo review 

with no presumption of correctness because we are reviewing the trial court’s legal 

conclusion. Blackburn v. Blackburn, 270 S.W.3d 42, 47 (Tenn. 2008); Union Carbide 

Corp. v. Huddleston, 854 S.W.2d 87, 91 (Tenn. 1993).

To the extent that Appellants’ issue involves interpretation of any statutory 

provision, we review questions of statutory construction de novo with no presumption of 

correctness. In re Estate of Tanner, 295 S.W.3d 610, 613 (Tenn. 2009). This court’s 

primary objective is to carry out legislative intent without broadening or restricting the 

Act beyond its intended scope. Houghton v. Aramark Educ. Res., Inc., 90 S.W.3d 676, 

678 (Tenn. 2002). In construing legislative enactments, we presume that every word in a 

statute has meaning and purpose and should be given full effect if the obvious intention 

of the legislature is not violated by so doing. In re C.K.G., 173 S.W.3d 714, 722 (Tenn. 

2005). When a statute is clear, we should apply the plain meaning without complicating 

the task. Eastman Chem. Co. v. Johnson, 151 S.W.3d 503, 507 (Tenn. 2004).

IV. Analysis
- 4 -

A. HIPAA Compliant Medical Authorizations

Tennessee Code Annotated Section 29-26-121(a)(2)(E) provides that a plaintiff 

“shall” include, in the pre-suit notice, a “HIPAA compliant medical authorization 

permitting the provider receiving the notice to obtain complete medical records from each 

other provider being sent a notice.” Federal regulations state that a HIPAA-compliant 

authorization must include the following six elements:

(i) A description of the information to be used or disclosed that 

identifies the information in a specific and meaningful fashion.

(ii) The name or other specific identification of the person(s), or class of 

persons, authorized to make the requested use or disclosure.

(iii) The name or other specific identification of the person(s) or class of 

persons, to whom the covered entity may make the requested use or 

disclosure.

(iv) A description of each purpose of the requested use or disclosure. The 

statement “at the request of the individual” is a sufficient description 

of the purpose when an individual initiates the authorization and 

does not, or elects not to, provide a statement of the purpose.

(v) An expiration date or an expiration event that relates to the 

individual or the purpose of the use or disclosure. . . .

(vi) Signature of the individual and date. If the authorization is signed by 

a personal representative of the individual, a description of such 

representative's authority to act for the individual must also be 

provided.

Stevens ex rel. Stevens v. Hickman Community Health Care Services, Inc., 418 S.W. 3d 

547, 555-56 (Tenn. 2013)(quoting 45 C.F.R. §164.508(c)(1)). 

Appellees assert that the Appellants’ pre-suit notice did not include a HIPAA 

compliant medical authorization that permitted each health care provider the opportunity 

“to obtain the complete medical records from each other provider being sent notice.”

Tenn. Code Ann. § 29-26-121(a)(2)(E). Specifically, Appellees argue that Appellants 

failed to provide a medical authorization allowing Appellees to request records from 

Bolivar General Hospital, Inc. even though Bolivar General Hospital, Inc. was listed as a 

medical provider receiving pre-suit notice. Appellants assert that they mistakenly 

believed Bolivar General Hospital, Inc. was a registered agent for JMCGHD and that 

Bolivar General Hospital, Inc. was only listed “out of an abundance of caution” as an 
- 5 -

agent for JMCGHD. Appellants contend that Mr. Rush was never treated at Bolivar 

General Hospital, Inc., and, as such, there were no relevant medical records to be 

obtained from Bolivar General Hospital, Inc. However, in the pre-suit notice letters sent 

to both JSA and Dr. Villarreal, Bolivar General Hospital, Inc. was listed as one of the 

healthcare providers for Mr. Rush; it was not listed as an agent for JMCGHD. 

Furthermore, Appellants did not reveal to Appellees that Bolivar General Hospital, Inc. 

was listed as a purported agent for JMCGHD until they filed their response to Appellees’

motion to dismiss. Therefore, Appellees did not know, during the pre-suit notice phase,

that Bolivar General did not have relevant medical records. Accordingly, Appellees 

argue that they were prejudiced in that they could not properly evaluate the merits of 

Appellants’ claim during the pre-suit notice phase. The trial court, in its ruling,

specifically found that the Appellants 

listed Bolivar General Hospital, Inc. as a provider being sent pre-suit notice 

but no medical authorization was provided to [Appellees] allowing them to 

request records from Bolivar General Hospital, Inc. during the pre-suit 

period; consequently, [Appellees] were prejudiced because they were not 

given the opportunity to investigate and evaluate the claim by requesting 

records from Bolivar General Hospital, Inc.

Tennessee Code Annotated Section 29-26-121(d) clearly states that “[a]ll parties 

... shall be entitled to obtain complete copies of the claimant’s medical records from any 

other provider receiving notice.” Tenn. Code Ann. § 29-26-121(d). It is undisputed that 

Appellants did not provide a HIPAA-compliant medical authorization to either of the 

Appellees so as to allow them to request records from Bolivar General Hospital, Inc. The 

very purpose of Tennessee Code Annotated Section 29-26-121(a)(2)(E) is “to equip 

defendants with the actual means to evaluate the substantive merits of a plaintiff's claim 

by enabling early access to a plaintiff's medical records.” Stevens, 418 S.W. 3d at 555. 

However, the Tennessee Supreme Court has held that a “plaintiff must substantially 

comply, rather than strictly comply, with the requirements of Tenn. Code Ann. § 29-26-

121(a)(2)(E).” Id. Therefore, a party’s “less-than-perfect compliance with Tenn. Code 

Ann. § 29-26-121(a)(2)(E) . . . should not derail a healthcare liability claim. Nonsubstantive errors and omissions will not always prejudice defendants by preventing them 

from obtaining a plaintiff’s relevant medical records.” Id.

Even if we assume, arguendo, that Appellants’ failure to provide a medical 

authorization for Bolivar General Hospital, Inc. is not fatal to the pre-suit notice 

requirements, this is not Appellants’ only error concerning the medical authorizations. 

As argued by Appellees, there were other deficiencies with the medical authorizations 

provided by the Appellants. The trial court found that “[t]he two medical authorizations 

provided to JSA for the release of records by Dr. Villarreal and JSA were not HIPAAcompliant because . . . these authorizations inadequately described the agency or 

individuals authorized to receive health information as ‘bearer.’” The Code of Federal 
- 6 -

Regulations requires “[t]he name or other specific identification of the person(s) or class 

of persons, to whom the covered entity may make the requested use or disclosure.” 45 

C.F.R. § 164.508(c)(1)(iii). Appellants contend that the term “bearer” used in the 

medical authorizations provided named the class of persons authorized to obtain records, 

thus satisfying the federal regulations. Appellants further assert that they intentionally 

used the term “bearer” as a courtesy and as an accommodation so that Appellees could 

provide the authorization to their agent, lawyer, or representative in order to obtain the 

records. Appellees argue that the person or entity whom the patient is authorizing to 

receive records must be specifically apparent, from the face of the authorization. In 

support of this argument, Appellees rely on an Indiana Court of Appeals case, E.J. ex rel. 

Jeffrey v. Okolocha, 972 N.E. 2d 941 (Ind. Ct. App. 2012). In the Indiana case, the court 

considered the use of “TO WHOM IT MAY CONCERN” to describe the person 

authorized to disclose information on a medical authorization. Id. at 947. The Indiana 

court ultimately held that the identification did not satisfy HIPAA requirements because 

the authorization failed to include “specific identification of the person . . . authorized to 

make the . . . disclosure.” 45 C.F.R. § 164.508(c)(1)(ii). Id. The court concluded that the 

“specific identification of the person” is a core element, which is critical and that “[i]t 

must be apparent from the face of the authorization that the signing patient knows 

specifically whom she is authorizing to make disclosure of her protected health records.”

Id. Although the instant case differs from E.J. ex rel. Jeffrey in that, here, we are 

addressing the question of the specific identification of the person or class of persons 

authorized to receive the protected health records rather than the person or entity 

providing the protected health records, the Indiana court’s reasoning is still applicable. 

Under the plain language of the regulation, a name is not required so long as there is 

specific identification of the entity, person, or class of persons authorized to receive the 

protected health records. The U.S. Department of Health and Human Services (HHS) 

explains that a valid authorization may authorize disclosures to a “class of persons, such 

as the employees of XYZ division of ABC insurance company.” U.S. Dep’t of Health 

and Human Servs., FAQ, Health Information Privacy (Sept. 24, 2003), 

http://www.hhs.gov/hipaa/for-professionals/faq/473/may-a-valid-authorization-listcategories-of-persons-who-may-use-protected-information/index.html. Accordingly, 

HHS confirms that even where an authorization provides for a “class of persons,” the 

class must, nonetheless, be specifically identified. The term “bearer” does not satisfy the 

specificity requirement and, therefore, is not HIPAA-compliant. 

Appellees further argue that several of the medical authorizations provided by 

Appellants fail to state the purpose for the release of the health information. A review of 

the record shows that the section for the purpose of the release was left blank for the 

medical authorizations provided to JSA, for the release of records by JMCGHD, Dr. 

Villarreal, and JSA. The medical authorization provided to Dr. Villarreal, for the release 

of records by JSA, also fails to state the purpose for the release of the protected health 

information. As set out above, the purpose for the release of protected health information 

is one of the six essential “core elements” for HIPAA-compliance. Regarding the 
- 7 -

purpose of the requested use or disclosure, the Code of Federal Regulations states that a 

compliant HIPAA authorization requires:

A description of each purpose of the requested use or disclosure. The 

statement “at the request of the individual” is a sufficient description 

of the purpose when an individual initiates the authorization and 

does not, or elects not to, provide a statement of the purpose.

45 C.F.R §164.508(c)(1)(iv). The regulation does not require specificity, but it does 

require some effort. The regulations state that “[w]hen a covered entity obtains or 

receives a valid authorization for its use or disclosure of protected health information, 

such use or disclosure must be consistent with such authorization.” 45 C.F.R. § 

164.508(a)(1). Therefore, the form cannot simply be left blank. The trial court found 

that based on Appellant’s use of the term “bearer” and the failure to state the purpose for 

the release of medical records, neither Appellee “was authorized to use their own records 

to investigate the claim during the pre-suit period, which would have been essential in 

pre-suit evaluation of the case, resulting in prejudice to the [Appellees].” 

Although there is no bright line rule that determines whether a party has 

substantially complied with the requirements of Tenn. Code Ann. § 29-26-121(a)(2)(E), 

the Stevens court provides guidance. “In determining whether a plaintiff has 

substantially complied with a statutory requirement, a reviewing court should consider 

the extent and significance of the plaintiff’s errors and omissions and whether the 

defendant was prejudiced by the plaintiff’s noncompliance. Not every non-compliant 

HIPAA medical authorization will result in prejudice.” Stevens, 418 S.W. 3d at 556. 

Despite the Tennessee Supreme Court’s guidance, a review of recent case law 

indicates that Tennessee law is less than settled concerning the question of substantial

compliance. In J.A.C. v. Methodist Healthcare Memphis Hosps., No. W2016-00024-

COA-R3-CV, 2016 WL 6493229, at *2 (Tenn. Ct. App. Nov. 2, 2016), perm. app. 

pending, this Court upheld the trial court’s dismissal of a health liability action when the 

authorizations did not list the person or class of persons authorized to disclose protected 

health information and did not list the person or class of persons to whom a disclosure of 

information could be made. Additionally, the medical authorizations did not designate 

that mother was signing the forms on behalf of her young daughter as required by federal 

regulations. Id. at *7-8; see also Harmon v. Shore, No. M2014-01339-COA-R3-CV, 

2015 WL 1881467, *2 (Tenn. Ct. App. April 23, 2015) (“Although Appellants mailed a 

HIPAA medical authorization to the Appellees, the authorization only released [the 

patient’s] medical records to her own lawyer.”); Johnson v. Parkwest Medical Center, 

No. E2013-01228-COA-R3-CV, 2014 WL 3765702, *7 (Tenn. Ct. App. July 31, 2014), 

perm. app. denied (Tenn. Dec. 17, 2014) (“Without an appropriate HIPAA-compliant 

medical authorization, Parkwest could not appropriately utilize those records to mount a 

defense, even if the records were already in Parkwest's possession.”); Roberts v. Prill, 
- 8 -

No. E2013-02202-COA-R3-CV, 2014 WL 2921930, *5 (Tenn. Ct. App. June 26, 2014)

(“[T]he form only permitted the use or disclosure of the medical records by plaintiff’s 

counsel.”); and Hawkins v. Martin, No. W2013-02102-COA-R3-CV, 2014 WL 

2854256, *1 (Tenn. Ct. App. June 23, 2014)(finding that the pre-lawsuit notice did “not 

include medical authorization forms that complied with HIPAA, so as to permit the 

defendants to obtain relevant medical records.”). The Tennessee Supreme Court has 

recently granted certiorari in the case of Bray v. Khuri, No. W2015-00397-COA-R3-CV, 

2015 WL 7775316, (Tenn. Ct. App. Dec. 3, 2015), perm. app. granted (Tenn. June 23, 

2015). In Bray, this Court affirmed the trial court’s dismissal of the healthcare liability 

action. Specifically, we held that “Appellant’s form left blank a core element and 

therefore failed to provide Appellee with the proper authorization to use Decedent’s 

medical records to mount a defense.” Id. at *4. The Bray Appellant left blank the portion 

of the authorization form describing the type and amount of information to be used. Id.

However, there is another line of cases in which noncompliance did not result in 

the dismissal of the healthcare liability action. In Hughes v. Henry Cty. Med. Ctr., No. 

W2014-01973-COA-R3-CV, 2015 WL 3562733, at *4 (Tenn. Ct. App. June 9, 2015), 

this Court reversed the trial court’s dismissal of a healthcare liability claim. In that case, 

an error in the medical authorization form, which was provided to Henry County Medical 

Center (“HCMC”), did not permit HCMC to obtain medical records from Dr. Gold. 

However, Dr. Gold saw the patient only at HCMC, and he had no records other than the 

hospital’s records. HCMC was able to obtain all of the Appellants’ relevant medical 

records and to evaluate the merits of the claim despite Appellants’ technical failure to 

include Dr. Gold’s records in its release. Id. at *1; see also Hunt v. Nair, E2014-01261-

COA-R9-CV, 2015 WL 5657083, (Tenn. Ct. App. Sept. 25, 2015) perm. app. denied

(Tenn. Jan. 21, 2016) (holding that Appellant’s authorization was substantially compliant 

despite “plaintiff’s failure to employ certain language from §164.508(c)(ii)-(iii)” because 

the omission did not prejudice the defendants.). Id at *6. In the case of Hamilton v. 

Abercrombie Radiological Consultants, Inc., E2014-003433-COA-R3-CV, 2014 WL 

7117802 (Tenn. Ct. App. Dec. 15, 2014), perm. app. denied (May 15, 2015), the date line 

on the medical release was intentionally left blank for the medical provider to fill in so 

that the release form would not “become stale.” Id. at *1. There was no evidence to 

support a finding that the defendants were prejudiced and unable to obtain the necessary 

medical records. Id. at *5. Consequently, this Court held that the relatively minor 

shortcoming in the HIPAA release was not fatal to the appellant’s cause of action. Id. at 

*7; see also, Chambers ex rel. Chambers v. County, No. E2013-01064-COA-R10-CV, 

2014 WL 1266101 (Tenn. Ct. App. Mar. 28, 2014) (affirming the trial court’s denial of 

the motion to dismiss where the sole issue on appeal was whether dismissal was 

warranted because the plaintiff failed to file, with the complaint, an affidavit of the party 

mailing the pre-suit notice.).

In this case, the Appellants’ failure is cumulative in that they did not comply with 
- 9 -

three separate provisions of the Code of Federal Regulations.

1

 First, they failed to 

provide a release for Bolivar General Hospital, Inc. even though it was listed as a 

provider receiving notice. On the authorizations provided to JSA, Appellants failed to 

identify, with any specificity, the person or class of persons able to receive Mr. Rush’s

private health information. Finally, on four of the medical authorizations provided by 

Appellants, the Appellants failed to describe the purpose of the requested disclosure. As 

noted by our Supreme Court, “[p]laintiff—not [d]efendants—[is] responsible for 

complying with the requirements of section 29-26-121(a)(2)(E).” Stevens, 418 S.W.3d at 

559. In reviewing the totality of the Appellants’ errors and omissions, we conclude that 

Appellants did not substantially comply with federal regulations and that Appellees were

prejudiced by the fact that the authorizations submitted by Appellants did not allow it to 

review the necessary records during the pre-suit notice phase. 

B. Statute of Limitations

Here, the trial court found that the Appellants were “not entitled to the 120-day 

extension of the statute of limitations that would otherwise have been afforded by the 

statute.” The applicable statutes of limitations and repose in a health care liability action 

“shall be extended for a period of one hundred twenty (120) days” when proper pre-suit 

notice is provided. Tenn. Code Ann. § 29-26-121(c). In this case, the alleged negligence 

occurred on July 18, 2014, but the complaint was not filed until November 6, 2015. 

Having concluded that proper pre-suit notice was not provided pursuant to Tennessee 

Code Annotated Section 29-26-121(a)(2)(E), we also conclude that the trial court 

correctly held that Appellants were not entitled to the 120-day extension of the statute of 

limitations under Tennessee Code Annotated Section 29-26-121(c). The case, therefore,

is time-barred.

V. Conclusion

For the foregoing reasons, we affirm the order of the trial court. We remand the 

case for such further proceedings as may be necessary and are consistent with this 

opinion. Costs of the appeal are assessed against Appellants, Gerald and Betty Rush, and 

their surety, for all of which execution may issue if necessary.

_________________________________

KENNY ARMSTRONG, JUDGE

 

1

In this case, we are not called upon to determine whether any one of these deficiencies warrant 

dismissal. As such, we express no opinion whether one of these deficiencies, in isolation, is enough to 

warrant dismissal.