                                                                                       04/16/2020
               IN THE COURT OF APPEALS OF TENNESSEE
                          AT KNOXVILLE
                               August 21, 2019 Session

     JESSICA OWENS, ET AL. v. GARY W. STEPHENS, D. O., ET AL.

                  Appeal from the Circuit Court for Knox County
                       No. 1-80-18 Kristi M. Davis, Judge
                     ___________________________________

                          No. E2018-01564-COA-R3-CV
                      ___________________________________


This is a healthcare liability action resulting from the death of a child. The defendants
moved to dismiss the action for failure to comply with the notice requirements set out in
Tennessee Code Annotated section 29-26-121(a)(2)(E). The trial court agreed with the
defendants and dismissed the action without prejudice. The plaintiffs appeal the
dismissal to this court. We affirm.

       Tenn. R. App. P. 3 Appeal as of Right; Judgment of the Circuit Court
                            Affirmed; Case Remanded

JOHN W. MCCLARTY, J., delivered the opinion of the court, in which CHARLES D.
SUSANO, JR., J., and D. MICHAEL SWINEY, C.J., joined.

Cody F. Fox, Shelley S. Breeding, Bradley L. Henry, and Jimmy B. Carter, Jr.,
Knoxville, Tennessee, for the appellants, Jessica M. Owens and Jimmy L. Owens.

Rick L. Powers and Rachel P. Hurt, Knoxville, Tennessee, for the appellees, Fort Sanders
Women’s Specialists, assumed name of Fort Sanders Perinatal Center; Fort Sanders
Regional Medical Center; and Covenant Health.

James G. O’Kane, Raymond G. Lewallen, Jr., and Kathryn C. O’Neal, Knoxville,
Tennessee, for the appellees, Gary W. Stephens and Periclis Roussis.

Mark A. Castleberry and T. Mitchell Panter, Knoxville, Tennessee, for the appellee,
Mark Moser.
                                       OPINION

                                   I. BACKGROUND

       Jimmy and Jessica Owens (collectively “Parents”), individually and as natural
parents of Jaxsen Owens (“the Child”), and as Administrator of the Estate of Jaxsen
Owens, filed this healthcare liability action on March 5, 2018. Parents alleged that the
named providers (“Defendants”) negligently provided medical care to Jessica Owens
(“Mother”) during her admission at Fort Sanders Regional Medical Center (“FSRMC”) in
November 2016, and that treatment by Defendants resulted in the death of the Child.

        Prior to filing the action, on November 1, 2017, Parents mailed the statutorily
required documents to numerous providers, 45 in all, advising them that a health care
liability action would be asserted against them. Among the documents was a notice letter,
a four-page list of “names and addresses of all healthcare providers against whom claim
is being made and to whom notice is being provided,” and two separate documents
entitled     “AUTHORIZATION           FOR      RELEASE      OF     HEALTH-RELATED
INFORMATION” for the release of Mother’s and the Child’s records (collectively “the
Authorizations”).

      The Authorizations provided:

             I authorize any health plan, physician, health care
             professional, mental health specialist, hospital, clinic,
             laboratory, pharmacy, pharmacy benefit manager, medical
             billing clerk, medical facility, insurance company, consumer
             reporting agency, or any other health care provider that has
             provided payment, treatment, or services to me or on my
             behalf (“My Providers”) to disclose my entire medical record
             and any other protected health information concerning me to
             BREEDING & HENRY, LLC. 900 S. Gay Street, Suite 1950,
             Knoxville, Tennessee 37902.

Upon review of the Authorizations, Defendants moved to dismiss the claims asserted
against them based on Parents’ failure to substantially comply with Tennessee Code
Annotated section 29-26-121. According to Defendants, Parents did not include HIPAA1
compliant medical authorization forms with the pre-suit notice, as the forms only
permitted the release of Mother’s medical records to her own counsel. Defendants
asserted that these forms prejudiced them because they could not access and review the
medical records from each of the numerous other providers being sent notice to evaluate

      1
        HIPAA is an acronym for the federal Health Insurance Portability and Accountability
Act of 1996.
                                           -2-
the merits of the claim. Tennessee Code Annotated section 29-26-121(a)(2)(E) provides
that a plaintiff’s notice shall also include “[a] HIPAA compliant medical authorization
permitting the provider receiving the notice to obtain complete medical records from each
other provider being sent a notice.” They contended that because there was not
substantial compliance, Parents are unable to avail themselves of an extension of the
statute of limitations under Tennessee Code Annotated section 29-26-121(c).2
Consequently, Defendants requested that the time-barred claims be dismissed with
prejudice.

       Parents admitted that the Authorizations were not strictly HIPAA-compliant but
opposed the dismissal on three fronts. First, they acknowledged that the Authorizations
were not strictly HIPAA-compliant but asserted that they were substantially compliant
with Tennessee Code Annotated section 29-26-121(a)(2)(E), as they otherwise met
HIPAA’s core requirements. Second, Parents argued that the providers that received pre-
suit notice constituted a “single provider” for purposes of Tennessee Code Annotated
section 29-26-121(a)(2)(E) and that no additional pre-suit medical authorizations were
required. Third, they suggested that even if Defendants were entitled to medical
authorizations as separate providers, they were not prejudiced because they had access to
the records.

       On July 20, 2018, the trial court heard arguments on Defendants’ motions and
ruled that Parents’ claims should be dismissed for substantial noncompliance with
Tennessee Code Annotated section 29-26-121(a)(2)(E). The court specifically noted that
because Parents sent pre-suit notice to 45 providers, Parents’ “single provider” argument
was inapplicable. The trial court explained that 45 C.F.R. §§ 164.501, .502, and .506 do
not permit providers to disclose medical records to other providers for legal services
absent a valid HIPAA authorization and, because there was no valid HIPAA
authorization permitting Defendants to obtain records from all other providers receiving
notice, Defendants were prejudiced. Because Defendants could not obtain medical
records from each of the other providers receiving notice, they were denied the
opportunity to examine those records, fully investigate the claims, fully consider early
resolution, and “mount a defense.” The trial court entered its written order on July 31,
2018. Parents filed a timely notice of appeal on August 28, 2018.

                                          II. ISSUES

        Parents present the following issues on appeal, which we restate and consolidate
as follows:


       2
         Tennessee Code Annotated section 29-26-116(a) provides a one-year statute of
limitations applicable to healthcare liability actions, which, with proper pre-suit notice, may be
extended by 120 days pursuant to Tennessee Code Annotated section 29-26-121(c).
                                              -3-
              A) Whether a pre-suit medical authorization restricting
              disclosure of Mother’s medical records to her own counsel,
              not the providers receiving pre-suit notice, substantially
              complied with Tennessee Code Annotated section 29-26-
              121(a)(2)(E).

              B) Whether Defendants were prejudiced and constituted a
              “single” group able to access those records as in Bray v.
              Khuri, 523 S.W.3d 619 (Tenn. 2017).

              C) Whether Parents were able to utilize the 120-day extension
              of the statute of limitations pursuant to Tennessee Code
              Annotated section 29-26-121(c).

                              III. STANDARD OF REVIEW

       Defendants properly filed a motion to dismiss the healthcare liability action based
upon Parents’ noncompliance with Tennessee Code Annotated section 29-26-121. Our
Supreme Court has instructed that the proper way for a defendant to challenge a
complaint’s compliance with Tennessee Code Annotated section 29-26-121 is to file a
motion to dismiss pursuant to Rule 12.02 of the Tennessee Rules of Civil Procedure.
Myers v. AMISUB (SFH), Inc., 382 S.W.3d 300, 307 (Tenn. 2012).3 The trial court’s
grant of the motion to dismiss is subject to a de novo review with no presumption of
correctness because we are reviewing the trial court’s legal conclusion. Blackburn v.
Blackburn, 270 S.W.3d 42, 47 (Tenn. 2008); J.A.C. by and through Carter v. Methodist
Healthcare Memphis Hosps., 542 S.W.3d 502, 509 (Tenn. Ct. App. 2016).


                                      IV. DISCUSSION

       We first address whether the trial court erred in holding that Parents did not
substantially comply with the Tennessee Code Annotated section 29-26-121(a)(2)(E)
requirement to provide a HIPAA-compliant medical authorization when Parents named

       3
         Parents contend that the trial court should have considered Defendants’ motion under the
summary judgment standard because the court considered evidence outside the four corners of
the complaint. According to Parents, the trial court considered the HIPAA authorization form
that was not part of the complaint, received argument from Defendants’ counsel on legal issues
that were not addressed in the complaint including the sufficiency of Covenant Health’s Privacy
Notice and disputes regarding the requirements mandated by HIPAA, and considered evidence
outside of the pleadings. In its order, the court explained that it did not consider any matters
outside of the pleadings and attachments thereto, the applicable case law, HIPAA regulations,
and state statutes referenced and argued during the hearing. We find no error.
                                              -4-
Breeding & Henry, LLC as the sole recipient of the private health information. The issue
as to whether Defendants have been prejudiced is also considered in tandem with
substantial compliance. See Stevens ex rel. Stevens v. Hickman Cmty. Health Care Servs.,
Inc., 418 S.W.3d 547, 555 (Tenn. 2016). The Stevens Court specifically stated: “First,
and most importantly, by permitting disclosure only to Plaintiff’s counsel, Plaintiff’s
medical authorization failed to satisfy the express requirement of Tenn. Code Ann. § 29-
26-121(a)(2)(E) that a plaintiff’s medical authorization ‘permit[] the provider receiving
the notice to obtain complete medical records from each other provider being sent a
notice.’” Id. at 556.

       Tennessee Code Annotated section 29-26-121(a)(2)(E) requires that plaintiffs in
healthcare liability suits send, as part of their pre-suit written notices, HIPAA-compliant
authorizations “permitting the provider receiving the notice to obtain complete medical
records from each other provider being sent a notice.” Here, the only permitted party
provided in the pre-suit notice was Henry & Breeding, LLC.

        With defective HIPAA authorizations, the Code of Federal Regulations provides
that:

              (2) Defective authorizations. An authorization is not valid, if
              the document submitted has any of the following defects:
              …(ii) The authorization has not been filled out completely
              with respect to an element described by paragraph (c) of this
              section . . . .

45 C.F.R. § 164.508(b). The Code of Federal Regulations also provides the following
requirements for a HIPAA-compliant authorization:

              A valid authorization under this section must contain at least
              the following elements:
              …(ii) The name or other specific information of the
              person(s), or class of persons, authorized to make the
              requested use or disclosure;
              (iii) The name or other specific identification of the person(s),
              or class or persons, to whom the covered entity may make the
              requested use or disclosure. . . .

45 C.F.R. § 164.508(c)(1). The trial court found that Parents did not provide Defendants
with HIPAA-compliant medical authorizations because of Parents’ failure to name the
necessary entities pursuant to Tennessee Code Annotated section 29-26-121(a)(2)(E).

       Imperfect compliance is not necessarily fatal to a healthcare liability plaintiff’s
case. Our Supreme Court has indicated as follows:
                                          -5-
              A plaintiff’s less-than-perfect compliance with Tenn. Code
              Ann. § 29-26-121(a)(2)(E), however, should not derail a
              healthcare liability claim. Non-substantive errors and
              omissions will not always prejudice defendants by preventing
              them from obtaining a plaintiff’s relevant medical records.
              Thus, we hold that a plaintiff must substantially comply,
              rather than strictly comply, with the requirements of Tenn.
              Code Ann. § 29-26-121(a)(2)(E). . . . [Tennessee Code
              Annotated § 29-26-121(a)(2)(E)] serve[s] an investigatory
              function, equipping defendants with the actual means to
              evaluate the substantive merits of a plaintiff’s claim by
              enabling early discovery of potential co-defendants and early
              access to a plaintiff’s medical records.

Stevens, 418 S.W.3d at 554. Substantial compliance still requires that medical
authorizations must be sufficient to enable defendants to obtain and review relevant
medical records. Id. at 555. Normally, HIPAA prevents medical providers from using a
plaintiff’s medical records without a fully compliant authorization form, and “a reviewing
court should consider the extent and significance of the plaintiff’s errors and omissions
and whether the defendant was prejudiced by the plaintiff’s noncompliance.” Id. at 556.

       Here, again, Parents provided in the Authorizations the persons authorized to
receive documents as Henry and Breeding, LLC. The forms did not specifically name
each Defendant that was permitted access to the medical records. No other parties were
given authorizations to make requests of protected private health information. In a similar
case, Lawson v. Knoxville Dermatology Grp. P.C., 544 S.W.3d 704 (Tenn. Ct. App.
2017), this court addressed the effect of a plaintiff’s failure to identify the party
authorized to disclose records on the required medical authorizations. The Lawson Court
determined that the missing element was necessary, and the error led to the defendants
suffering prejudice; specifically, the defendants were unable to use the medical records to
prepare a defense to any claims. Id. at 712-713. The court concluded that the plaintiff was
in substantial noncompliance regarding the notice requirements. Id. at 713.

        Defendants contend that for evaluation of the merits of a claim, the relevant statute
does not limit the requirement of a HIPAA compliant authorization only to providers who
a plaintiff will eventually sue or only from providers who a plaintiff unilaterally
determines are in possession of relevant or helpful records. As explained by Defendants,
at the pre-suit notice stage, a defendant does not know which of the noticed providers a
plaintiff may sue or which noticed providers possess records that would help in claim
evaluation. Each noticed provider could possess relevant records. Without the ability to
obtain these records, a defendant is prejudiced. See Dolman v. Donovan, No. W2015-
00392-COA-R3-CV, 2015 WL 9315565, at * 6 (Tenn. Ct. App. Dec. 23, 2015).
                                            -6-
       We follow the Lawson Court findings in determining that the errant
Authorizations prevented Defendants from obtaining records for investigatory purposes
prior to the action’s start. As a result, we find that Defendants were prejudiced by
Parents’ noncompliance, as the Authorizations were not sufficient to allow Defendants to
obtain needed medical records from other providers sent a pre-suit notice. Like the trial
court, we hold that Parents did not substantially comply with Tennessee Code Annotated
section 29-26-121(a)(2)(E).

       Parents cite to the Supreme Court’s opinion in Bray v. Khuri, 523 S.W.3d 619,
622 (Tenn. 2017) and argue that they were not required to provide Defendants with a
HIPAA-compliant medical authorization because Defendants are all subsidiaries of one
parent organization.4 In Bray, the Supreme Court held that:

              based on the clear and unambiguous language of section 29-
              26-121(a)(2)(E), a plaintiff need not provide a HIPAA-
              compliant authorization when a single healthcare provider is
              given pre-suit notice of a healthcare liability claim. The
              authorization only allows a potential defendant to obtain the
              prospective plaintiff’s medical records from any other
              healthcare provider also given notice and identified as a
              potential defendant in the pre-suit notice. This authorization
              requirement is consistent with section 29-26-121(d)(1), which
              specifies that all parties to a healthcare suit “shall be entitled
              to obtain complete copies of the claimant’s medical records
              from any other provider receiving notice” and that the
              claimant complies with this requirement by providing a
              HIPAA-compliant medical authorization with pre-suit notice.
              Id., § 29-26-121(d)(1).

Id.

       The present case before us is distinguishable from Bray. The Bray Court held that
a HIPAA-compliant medical authorization is not required when a plaintiff sends pre-suit
notice to only one provider, not when he or she ultimately files suit against only one
provider. Id. (emphasis added). Parents sent pre-suit notice to a multitude of providers.
Defendants are not a “single provider” as in Bray; each provider holds individual licenses
from the appropriate boards, and each provider records medical documents related only

       4
         Parents assert that Defendants were not prejudiced by any deficiency found within the
authorizations because Defendants, as covered entities/healthcare professionals employed by
Covenant Health, possessed the ability to access the relevant medical records for the purpose of
legal services pursuant to Covenant Health’s Privacy Notice.
                                             -7-
to their specific care of the patient. Defendants were not able to investigate Parents’
claims against them due to the insufficiency of the authorization given in the pre-suit
notice. Further, Parents’ insistence that Defendants are all covered under the Privacy
Notice of Covenant Health ignores the fact that the protected health information was
maintained by providers such as East Tennessee Children’s Hospital, Innovative
Pathology Services, LLC, Dr. Stephen Prinz, and Dr. William Wooldridge who are not
Covenant Health entities, business associates, or in any way connected to Covenant
Health. (Emphasis added.). Additionally, the Privacy Notice at issue does not permit one
with the “health care Notice to use the records of another “health care provider” for
“legal services.”

        Finally, this court will consider whether Parents’ noncompliance with Tennessee
Code Annotated section 29-26-121(a)(2)(E) should be excused for extraordinary cause.5
“The question of whether [a plaintiff] has demonstrated extraordinary cause that would
excuse compliance with the statutes is a mixed question of law and fact, and our review
of that determination is de novo with a presumption of correctness applying only the trial
court’s findings of fact and not to the legal effect of those findings.” Myers, 382 S.W.3d
at 307-08 (citing Starr v. Hill, 353 S.W.3d 478, 481-82 (Tenn. 2011)). This court
reviews a “trial court’s decision to excuse compliance under an abuse of discretion
standard.” Id. at 308. If a discretionary decision is within a range of acceptable
alternatives, we will not substitute our judgment for that of the trial court simply because
we may have chosen a different alternative. White v. Vanderbilt Univ., 21 S.W.3d 215,
223 (Tenn. Ct. App. 1999).

        Our Supreme Court has defined “extraordinary cause” narrowly, and points to
examples such as “illness of plaintiff’s lawyer, a death in the lawyer’s immediate family,
[or] illness or death of the plaintiff’s expert in the days before filing became necessary.”
Myers, 382 S.W.3d at 310-11. We cannot conclude that the trial court abused its
discretion in not excusing Parents’ noncompliance with Tennessee Code Annotated
section 29-26-121(a)(2)(E). Because the 120-day extension in Tennessee Code Annotated
section 29-26-121(c) is unavailable to Parents, this cause of action is time-barred
pursuant to the one-year statute of limitations set forth in Tennessee Code Annotated
section 29-26-116.

                                       V. CONCLUSION

       The judgment of the trial court is affirmed. The cause is remanded for such further
proceedings as may be necessary and are consistent with this opinion. Costs on appeal are
assessed against the appellants, Jessica M. Owens and Jimmy L. Owens.

                                                     _________________________________

       5
           Parents did not make an extraordinary cause argument.
                                               -8-
      JOHN W. MCCLARTY, JUDGE




-9-
