FOR PUBLICATION


ATTORNEY FOR APPELLANTS:                       ATTORNEYS FOR APPELLEES:

ROBERT MONTGOMERY                              ROBERT F. PARKER
Munster, Indiana                               DANIEL A. GIOIA
                                               Burke Costanza & Carberry LLP
                                               Merrillville, Indiana

                                                                          FILED
                                                                        Aug 13 2012, 9:05 am
                             IN THE
                   COURT OF APPEALS OF INDIANA                                   CLERK
                                                                               of the supreme court,
                                                                               court of appeals and
                                                                                      tax court




E. J., a minor by his mother                   )
and father VICTOR and LYNELL JEFFREY,          )
and VICTOR and LYNELL JEFFREY,                 )
individually,                                  )
                                               )
      Appellants-Plaintiffs,                   )
                                               )
             vs.                               )       No. 45A03-1201-CT-15
                                               )
PAUL OKOLOCHA, M.D., OKOLOCHA                  )
MEDICAL CORP., and OKOLOCHA                    )
MEDICAL, PAIN and WEIGHT,                      )
                                               )
      Appellees-Defendants.                    )


                     APPEAL FROM THE LAKE SUPERIOR COURT
                      The Honorable Diane Kavadias Schneider, Judge
                             Cause No. 45D01-0808-CT-63


                                     August 13, 2012


                               OPINION - FOR PUBLICATION


CRONE, Judge
                                      Case Summary

       This case involves a very unfortunate set of circumstances. A New York couple

adopted what they thought was a healthy baby boy from Indiana who, unbeknownst to them

prior to the adoption, has profound neurological deficits which cause significant and

permanent learning and physical abnormalities. A prenatal sonogram performed by the birth

mother’s doctor revealed significant brain abnormalities in the unborn baby. Prior to

finalizing the adoption, the adoptive parents sought the prenatal records of the birth mother

from her doctor as well as postnatal records of the birth mother and the baby from the

hospital. Although they received the postnatal records from the hospital, which revealed no

problems, the adoptive parents did not receive any prenatal records, including the sonogram

report, because the birth mother’s doctor did not send them those records. Nevertheless, the

adoption was finalized.      The adoptive parents subsequently learned of the baby’s

neurological deficits and resulting learning and physical abnormalities.

       The adoptive parents filed a complaint for negligence against the birth mother’s doctor

alleging that the doctor was negligent in failing to provide them the prenatal records when

they requested them. The doctor filed a motion for summary judgment contending that he

had no legal duty to release the prenatal records to the adoptive parents because the medical

records authorization submitted to him did not comply with the Health Insurance Portability

and Accountability Act of 1996 (“HIPAA”). The adoptive parents responded with a motion

for partial summary judgment contending, as a matter of law, that the doctor owed them a

duty to provide them with the prenatal records at the time they requested them. The trial


                                              2
court agreed with the doctor and entered summary judgment in his favor. On appeal, the

adoptive parents argue that the trial court erred in entering summary judgment in favor of the

doctor on the issue of duty and in failing to enter partial summary judgment in their favor on

the same issue. Concluding as a matter of law that the doctor owed no duty to the adoptive

parents, we affirm the judgment of the trial court.

                              Facts and Procedural History

       The undisputed facts indicate that in February 2006, Paul Okolocha, M.D. (“Dr.

Okolocha”), a family practice physician from Gary, provided prenatal care to V.S. As part of

that prenatal care, on February 1, 2006, Dr. Okolocha ordered that a sonogram be performed

on V.S. The sonogram report showed that V.S.’s unborn baby had significant brain

abnormalities. The report indicated abnormalities associated with brain development delay,

profound retardation, paralysis on one or more sides of the body, spasticity, and other severe

neurological deficits that would preclude the baby from ever leading a normal life and would

require the baby to receive a lifetime of medical care and assistance. On February 12, 2006,

Dr. Okolocha delivered a baby boy for V.S. at Methodist Hospital.

       Around that same time, Victor and Lynell Jeffrey began proceedings to adopt V.S.’s

baby. The Jeffreys hired New York attorney Aaron Britvan to represent them in the adoption

process. Two days prior to the birth, on February 10, 2006, Britvan’s legal assistant faxed

Dr. Okolocha a cover letter and a medical records authorization to obtain V.S.’s prenatal

records. Specifically, the cover letter was addressed to Dr. Okolocha and advised him that

Britvan’s office represented the prospective adoptive parents of V.S.’s baby. The cover letter


                                              3
indicated that enclosed was an authorization to obtain V.S.’s prenatal medical records

inclusive of lab test results and sonograms. Appellant’s App. at 61. The enclosed

authorization, signed by V.S. on February 1, 2006, was directed “TO WHOM IT MAY

CONCERN” and requested the release to “AARON BRITVAN, or his medical

representative, with a copy of the physician and/or hospital medical records and any other

information which he may request in relation to the pre-natal or post-placement care of the

child born to me.” Id. at 62. The authorization further provided that “this consent will

authorize the office of Aaron Britvan to forward my medical records to the adoptive parents

and/or their pediatrician or other medical professionals.” Id. Dr. Okolocha did not send

Britvan any records. On August 25, 2006, despite having had no access to V.S’s prenatal

medical records, the Jeffreys completed the adoption process and adopted V.S.’s baby, E.J.

       By December 2006, the Jeffreys had become concerned that E.J. was not developing

as other children his age.     Doctors later clinically confirmed the existence of brain

abnormalities and profound neurological deficits in E.J. that resulted in learning and physical

abnormalities of a significant and permanent nature. Had the Jeffreys known of the

catastrophic birth defects of E.J. prior to finalizing the adoption process, they would not have

completed the adoption.

       In April 2007, Dr. Okolocha sent Britvan a letter stating that he would release V.S.’s

prenatal records after his bill for medical services was paid. Indeed, the reason Dr. Okolocha

did not release the records to Britvan when originally presented with the authorization signed

by V.S. was because a $15 record copying fee was not paid to his office and his outstanding


                                               4
bill for newborn services in the amount of $450 remained unpaid. On April 25, 2007, the

Jeffreys paid the outstanding bill and Dr. Okolocha released the prenatal records to Britvan,

including the sonogram report.

        On September 10, 2009, the Jeffreys filed their amended complaint for negligence

against several defendants, including Dr. Okolocha, Okolocha Medical Corporation, and

Okolocha Medical Pain, and Weight (hereinafter collectively referred to as “Dr. Okolocha”).1

Specifically, the Jeffreys’ theory was that Dr. Okolocha was negligent in failing to timely

provide them with V.S.’s prenatal records. On January 6, 2011, Dr. Okolocha filed a motion

for summary judgment arguing that he had no legal duty to provide V.S.’s medical records to

the Jeffreys. The Jeffreys responded with a motion for partial summary judgment arguing

that Dr. Okolocha had a duty, as a matter of law, to provide them with the records. On May

5, 2011, the trial court held a hearing on both motions for summary judgment. Then, on

December 12, 2011, the trial court entered its findings of fact and conclusions thereon

granting summary judgment in favor of Dr. Okolocha. Upon Dr. Okolocha’s motion

pursuant to Indiana Trial Rule 56(C), and finding no just reason for delay, the trial court




        1
           The amended complaint for negligence also named as defendants the Jeffreys’ Indiana adoption
attorneys and their New York adoption attorneys, including Britvan. Appellants’ App. at 29-37. The Jeffreys
subsequently settled their claims with those defendants. Appellants’ Br. at 3.


                                                    5
entered a final appealable judgment on January 12, 2012.2 This appeal ensued. Additional

facts will be supplied in our discussion where necessary.

                                       Discussion and Decision

        The Jeffreys contend that the trial court erred in granting Dr. Okolocha’s motion for

summary judgment and in denying their motion for partial summary judgment on the same

issue. Our standard of review is well settled:

                Pursuant to Rule 56(C) of the Indiana Rules of Trial Procedure,
        summary judgment is appropriate when there are no genuine issues of material
        fact and the moving party is entitled to judgment as a matter of law. When we
        review a grant of summary judgment, our standard of review is the same as
        that of the trial court. We consider only those facts that the parties designated
        to the trial court. The Court must accept as true those facts alleged by the
        nonmoving party, construe the evidence in favor of the nonmovant, and
        resolve all doubts against the moving party.

              A trial court’s order on summary judgment is cloaked with a
        presumption of validity; the party appealing from the grant of summary
        judgment must bear the burden of persuading this Court that the decision was
        erroneous. We may affirm the grant of summary judgment upon any basis
        argued by the parties and supported by the record.

Breining v. Harkness, 872 N.E.2d 155, 158 (Ind. Ct. App. 2007) (citations omitted), trans.

denied (2008).

        Where, as here, cross-motions for summary judgment are involved, our standard of

review remains unchanged. Kelley v. Med-1 Solutions, LLC, 952 N.E.2d 817, 827 (Ind. Ct.


        2
           We note that the Jeffreys also filed medical malpractice claims against Methodist Hospitals and Dr.
Okolocha. The trial court in that case entered summary judgment in favor of Dr. Okolocha because the
Jeffreys’ malpractice complaint was filed outside the two-year medical malpractice limitations period. Another
panel of this Court affirmed summary judgment in favor of Dr. Okolocha in Jeffrey v. Methodist Hospitals, 956
N.E.2d 151 (Ind. Ct. App. 2011).



                                                      6
App. 2011), trans. denied (2012). We consider each motion separately to determine whether

the moving party is entitled to judgment as a matter of law. Id. Moreover, when the trial

court enters findings of fact and conclusions thereon in rendering summary judgment, those

findings aid in our appellate review but are not binding on this Court. Turner v. Stuck, 778

N.E.2d 429, 431 (Ind. Ct. App. 2002). Indeed, our standard of review is not altered due to

findings and conclusions, and we will affirm a summary judgment order if it is sustainable

upon any theory or basis found in the record. Id.

       The Jeffreys seek to recover against Dr. Okolocha on a theory of negligence. To

prevail on a negligence claim, “a plaintiff must prove: (1) that the defendant owed plaintiff a

duty; (2) that [the defendant] breached the duty; and (3) that plaintiff’s injury was

proximately caused by the breach.” A.S. v. LaPorte Reg’l Health Sys., Inc., 921 N.E.2d 853,

856 (Ind. Ct. App. 2010). The breach of duty and proximate cause elements of a negligence

claim are particularly fact-sensitive and rarely suitable for resolution on summary judgment.

Price v. Kuchaes, 950 N.E.2d 1218, 1235 (Ind. Ct. App. 2011) (citing Rhodes v. Wright, 805

N.E.2d 382, 387 (Ind. 2004)), trans. denied. However, the existence of a legal duty owed by

one party to another in a negligence case is appropriate for summary judgment, as it is

generally a pure question of law for the court to decide. Indiana Dep’t of Transp. v. Howard,

879 N.E.2d 1119, 1122 (Ind. Ct. App. 2008).

       The Jeffreys negligence claim centers around a duty that they allege was owed to them

by virtue of the medical records authorization they submitted to Dr. Okolocha. The Jeffreys

contend that Dr. Okolocha owed a duty, as a matter of law, to release V.S’s prenatal records


                                              7
to them when presented with an authorization signed by V.S. Dr. Okolocha contends, and

the trial court agreed, that he had no legal duty to release V.S.’s prenatal records to the

Jeffreys because the medical authorization signed by V.S. and submitted to him did not

comply with HIPAA or Indiana law. We begin our discussion with HIPAA.

        HIPAA protects individuals from unwarranted dissemination of medical and mental

health records by restricting access to such records without the individual’s direct consent. In

re C.B., 865 N.E.2d 1068, 1072 (Ind. Ct. App. 2007) (citing In re A.H., 832 N.E.2d 563, 567

(Ind. Ct. App. 2005)), trans. denied. In general, HIPAA requires that “covered entities,”

such as Dr. Okolocha,3 obtain patient authorization before disclosing protected health

information. State v. Eichhorst, 879 N.E.2d 1144, 1151 (Ind. Ct. App. 2008) (citing 45

C.F.R. § 164.508(a)), trans. denied. Pursuant to 45 C.F.R. § 164.508(c)(1), a valid HIPAA

authorization must contain “at least” the following “core elements”:

        (i) A description of the information to be used or disclosed that identifies the
        information in a specific and meaningful fashion.

        (ii) The name or other specific identification of the person(s), or class of
        persons, authorized to make the requested use or disclosure.

        (iii) The name or other specific identification of the person(s), or class of
        persons, to whom the covered entity may make the requested use or disclosure.

        (iv) A description of each purpose of the requested use or disclosure. The
        statement “at the request of the individual” is a sufficient description of the
        purpose when an individual initiates the authorization and does not, or elects
        not to, provide a statement of the purpose.


        3
         It is undisputed that Dr. Okolocha, as a provider of medical services, is a “covered entity” for
purposes of HIPAA. See 45 C.F.R. §§ 160.102, 160.103.



                                                   8
       (v) An expiration date or an expiration event that relates to the individual or
       purposes of the use or disclosure. The statement “end of the research study,”
       “none,” or similar language is sufficient if the authorization is for a use or
       disclosure of protected health information for research, including for the
       creation and maintenance of a research database or research repository.

       (vi) Signature of the individual and date. If the authorization is signed by a
       personal representative of the individual, a description of such representative’s
       authority to act for the individual must also be provided.

       In addition to those “core elements,” a valid HIPAA authorization must contain

certain “required statements.” 45 C.F.R. § 164.508(c)(2). Specifically, 45 C.F.R. §

164.508(c)(2) provides in relevant part that a valid HIPAA authorization must place the

patient on notice of the following:

       (i) The individual’s right to revoke the authorization in writing….

       (ii) The ability or inability to condition treatment, payment, enrollment or
       eligibility for benefits on the authorization….

       (iii) The potential for information disclosed pursuant to the authorization to be
       subject to redisclosure by the recipient and no longer be protected by this
       subpart.

       Similarly, patient information is also protected from unauthorized disclosure under

Indiana law. Ind. Code §§ 16-39-1-1 et seq. Pursuant to Indiana law, on a patient’s written

request and reasonable notice, a healthcare provider “shall” furnish the patient or the

patient’s designee the patient’s health record. Ind. Code § 16-39-1-1(d). However, a

patient’s written consent for release of the patient’s health record to a third party must

include the following:

       (1) The name and address of the patient.

       (2) The name of the person requested to release the patient’s record.

                                              9
       (3) The name of the person or provider to whom the patient’s health record is
       to be released.

       (4) The purpose of the release.

       (5) A description of the information to be released from the health record.

       (6) The signature of the patient, or the signature of the patient’s legal
       representative if the patient is incompetent.

       (7) The date on which the consent is signed.

       (8) A statement that the consent is subject to revocation at any time, except to
       the extent that action has been taken in reliance on the consent.

       (9) The date, event, or condition on which the consent will expire if not
       previously revoked.

Ind. Code § 16-39-1-4.

       Although the trial court’s findings and conclusions in entering summary judgment in

favor of Dr. Okolocha are not binding on this Court, we must clarify some confusion with the

trial court and the parties regarding the interplay between HIPAA and Indiana law. In its

findings and conclusions, the trial court unnecessarily determined that HIPAA preempts

Indiana law regarding what constitutes a valid authorization or consent for the release of

medical records. This Court has recognized that the provisions of HIPAA override or

preempt state law. A.H., 832 N.E.2d at 568. However, that is only if a HIPAA provision is

contrary to a provision of state law. 42 C.F.R. § 160.203.       Our review of the relevant

statutes at issue here reveals that Indiana law is not contrary to HIPAA. As one commentator

has explained, HIPAA will rarely preempt state law because in most instances, implementing

HIPAA will mean complying with its procedural requirements along with the requirements of

                                             10
state law. Beverly Cohen, Reconciling the HIPAA Privacy Rule with State Laws Regulating

Ex Parte Interviews of Plaintiffs’ Treating Physicians: A Guide to Performing HIPAA

Preemption Analysis, 43 HOUS. L. REV. 1091, 1123-1134 (2006). Accordingly, instead of

superseding state law, HIPAA simply imposes an additional layer of procedural requirements

over the privacy law that already exists in most states. Id.

       Merely because Indiana law requires that certain procedures be followed before proper

disclosure of medical records can occur and HIPAA requires different procedures does not

mean that the laws conflict. The Indiana procedures and the HIPAA procedures all can be

performed simultaneously. Compliance with our state statute and HIPAA can be achieved by

satisfying the procedural requirements of both.        HIPAA merely provides additional

procedural requirements with which the parties must comply when making disclosures

permitted or mandated by state law. See id. Accordingly, Dr. Okolocha’s required course of

action and thus, his legal duty, was action that complied with both HIPAA and Indiana law.

In this case, our state statute and HIPAA are not contrary, and therefore preemption analysis

is unnecessary.

       The undisputed facts indicate that the authorization signed by V.S. and tendered to Dr.

Okolocha by Britvan complies with neither HIPAA nor Indiana Code Section 16-39-1-4.

First, as to HIPAA, the authorization signed by V.S. does not name Dr. Okolocha anywhere

on the document but is directed “TO WHOM IT MAY CONCERN.” Thus, the authorization

fails to include “specific identification of the person authorized to make the disclosure.” 45

C.F.R. § 164.508(c)(1)(iii). The critical nature of this core element cannot be understated.


                                             11
It must be apparent from the face of the authorization that the signing patient knows

specifically whom she is authorizing to make disclosure of her protected health records. The

authorization here fails in this regard. 4

        The authorization is also missing a “description of each purpose of the requested use

or disclosure.” 45 C.F.R. § 164.508(c)(1)(iv). The Jeffreys point to very general language of

the authorization which provides that V.S. is authorizing Britvan to forward V.S.’s medical

records “to the adoptive parents and/or their pediatrician or other medical professionals.”

Appellant’s App. at 62. However, we agree with Dr. Okolocha that such language merely

describes to whom the disclosure will subsequently be made. There is no language in the

authorization which describes, for example, that the information will be used to aid in the

medical treatment or assessment of V.S.’s baby or to facilitate the future adoption

proceedings. The signing patient must know not simply to whom, but for what purpose her

protected information will be disclosed. Moreover, we agree with the trial court that a clear

description of the purpose of the disclosure is also critical because when a covered entity

receives an authorization requesting disclosure of confidential information, its disclosure


        4
           The Jeffreys argue that the cover letter faxed with the authorization specifically identifies Dr.
Okolocha as the person authorized to make the disclosure. First, the Jeffreys direct us to no authority, and we
are unaware of any, which would permit us to construe the two documents together to satisfy the requirements
of HIPAA or Indiana law. Significantly, the cover letter was signed by neither V.S. nor Britvan as her
representative. The only document signed by the protected person, V.S., was an authorization directed to an
unspecified person or entity. Under the Jeffreys’ interpretation of the law, nothing would prevent third parties
from randomly attaching cover letters to signed, yet generically directed, authorizations, thus permitting
basically anyone access to the patient’s protected health information unbeknownst to the patient. Such a result
would be absurd. The Jeffreys also make a spurious argument that because the authorization was faxed to Dr.
Okolocha with a cover letter addressed to him, he knew that the authorization was specifically directed to him.
The Jeffreys ignore the only relevant inquiry as to the specific identification requirement: that is, the
knowledge of the authorizing patient.


                                                      12
“must be consistent with such authorization.” 45 C.F.R. § 164.508(a)(1). The authorization

here contains no description of purpose.

       Finally, the authorization is missing the “required statement” that “the potential for

information disclosed pursuant to the authorization to be subject to redisclosure by the

recipient and no longer be protected.” 45 C.F.R. § 164.508(c)(2)(iii). In other words, a valid

HIPAA authorization must put the signing patient on notice that her protected medical

information may potentially be redisclosed by the recipient and is no longer protected

information. Although the current authorization may have put V.S. on notice that the

information would be forwarded to the adoptive parents and/or their pediatrician, she was not

put on notice that her information is no longer protected and could potentially be redisclosed

to additional individuals. The inclusion of simple boilerplate statutory language would have

satisfied this required statement. Without that language, however, the authorization does not

comply with HIPAA.

       The Jeffreys do not fare much better when the procedural requirements of a valid

authorization for medical records are considered pursuant to Indiana law. The authorization

does not contain V.S.’s address as required by Indiana Code Section 16-39-1-4(1). As

discussed above, the authorization similarly does not specifically name Dr. Okolocha as “the

person requested to release the patient’s record.” Ind. Code § 16-39-1-4(2). Moreover, as

also discussed above, the authorization does not indicate the “purpose of the release.” Ind.

Code § 16-39-1-4(4). The authorization submitted to Dr. Okolocha does not comply with

Indiana law.


                                             13
        Under the circumstances, Dr. Okolocha owed no duty to release V.S.’s medical

records to the Jeffreys absent a valid authorization pursuant to both HIPAA and Indiana Code

Section 16-39-1-4.5 Contrary to the Jeffreys’ contention, Dr. Okolocha’s “real motive” for

not releasing V.S.’s medical records is irrelevant. Appellant’s Br. at 8. The fact remains that

Dr. Okolocha only has a duty to release medical records when properly authorized by a

patient to do so. There was no such authorization here, and therefore no duty. The Jeffreys

claim for negligence must fail.

        We are mindful of the great emotional and monetary harm suffered by the Jeffreys in

this case. However, it cannot be ignored that the Jeffreys and their attorneys were in the best

position to avoid the harm suffered. The Jeffreys and their attorneys finalized the adoption of

E.J. despite the fact that they had not received V.S.’s prenatal records from Dr. Okolocha.

Unfortunately, there were tragic consequences to that gamble. Nevertheless, we cannot find

a duty in negligence when none exists. Summary judgment in favor of Dr. Okolocha is

appropriate. The judgment of the trial court is affirmed.

        Affirmed.

VAIDIK, J., and BRADFORD, J., concur.




        5
           The Jeffreys maintain that Dr. Okolocha cannot now claim that he owed no duty to release the
records because he eventually released the records to them without requiring a valid authorization. However,
the unauthorized release of V.S.’s records by Dr. Okolocha is of no moment to the case at bar. The
unauthorized disclosure of V.S.’s protected health information by Dr. Okolocha, in violation of HIPAA and
Indiana law, is not an issue properly before this Court.


                                                    14
