In the most recent chapter of the seemingly endless litigation over Tennessee’s medical malpractice statute (known as the “Tennessee Health Care Liability Act,” or “HCLA”), the Tennessee Supreme Court has held that plaintiffs need not include a HIPAA-compliant authorization form in their pre-suit notice packages if only one defendant is being sued. Thus, in single-defendant medical malpractice cases, the Court’s holding operates to remove one of the many landmines that medical malpractice plaintiffs must navigate in order to get through the courthouse door.
“In Tennessee, people who want to file lawsuits involving the provision of health care services are first required to comply with a variety of procedural requirements that are unique to [medical malpractice] claims.” In theory, the myriad pre-suit notice requirements contained in the HCLA are intended to “allow health care providers to evaluate the merits of potential health care liability claims before a suit is commenced, facilitat[e] communication among the parties, and encourage[e] early settlement negotiations.” In practice, however, these procedural requirements operate “as a minefield to unwary litigants and frequently result in otherwise-valid claims being dismissed on technical procedural grounds.” Consequently, in one of his prior publications, this author has characterized the HCLA’s pre-suit notice requirements as “red tape with fangs.”
One pre-suit notice requirement of the HCLA—codified at Tenn. Code Ann. § 29-26-121(a)(2)(E)—compels plaintiffs to provide prospective medical malpractice defendants with “[a] HIPAA compliant medical authorization permitting the provider receiving the notice to obtain complete medical records from each other provider being sent a notice.” In Bray v. Khuri—a wrongful death case involving a patient who committed suicide while receiving in-patient psychiatric care—Tennessee’s Court of Appeals held that the medical authorization form that the decedent’s surviving spouse had provided in her pre-suit notice package had not been HIPAA-compliant. As a result, the Court of Appeals held that the plaintiff’s lawsuit had to be dismissed outright before it could even begin.
On appeal to the Tennessee Supreme Court, the Bray plaintiff argued that whether or not her medical authorization form had complied with HIPAA (something that the parties disputed), she was not even required to comply with Tenn. Code Ann. § 29-26-121(a)(2)(E) because there was only a single defendant in the case. Intuitively, the argument had substantial force. If the purpose of Tenn. Code Ann. § 29-26-121(a)(2)(E) is to ensure that defendants could “obtain complete medical records from each other provider being sent a notice,” the plaintiff’s argument went, then it is difficult to imagine how or why this requirement would apply when there isn’t any “other provider being sent a notice” at all.
In response, the defendant in Bray argued that compliance with Tenn. Code Ann. § 29-26-121(a)(2)(E) is necessary even when just a single provider is sued because defendants are prohibited from discussing potential lawsuits with their attorneys unless they have received a HIPAA-compliant authorization form. Specifically, the defendant argued, “HIPAA prohibits the disclosure of a patient’s medical records to counsel for evaluating the merits of a potential claim absent a valid medical authorization.”
Flatly rejecting this argument, the Tennessee Supreme Court noted that “HIPAA regulations allow a healthcare provider to ‘use or disclose protected health information for treatment, payment, or health care operations,’” and that in turn, federal regulations expressly define “health care operations” to include “[c]onducting or arranging for legal services.” The Court further noted that:
The United States Department of Health and Human Services (“HHS”), in its Frequently Asked Questions (“FAQ”) for Professionals pages of its website, indicates that a healthcare provider may use or disclose protected health information for litigation “whether for judicial or administrative proceedings, . . . or as part of the covered entity’s health care operations.” HHS further recognizes that “[i]n most cases, the covered entity will share protected health information for litigation purposes with its lawyer, who is either a workforce member or a business associate.” HIPAA regulations define a “business associate” to include a person who provides legal services to or for a healthcare provider.
Thus, the Tennessee Supreme Court concluded that “HIPAA does not require [defendants] to obtain a medical authorization to use a patient’s medical records in [their own] possession,” and that such records may be used to “consult with counsel to evaluate the merits of a potential claim” even without authorization from a patient. As such, because neither the text nor the purpose of Tenn. Code Ann. § 29-26-121(a)(2)(E) indicated that it applied to medical malpractice cases involving just a single defendant, the Tennessee Supreme Court reversed the lower court’s ruling and permitted the plaintiff’s lawsuit to move forward.
The Court’s sensible and straightforward ruling in Bray represents a small victory for a narrow subset of medical malpractice plaintiffs in Tennessee. As a whole, however, the larger problems with the statute persist. It has been more than a hundred years since Roscoe Pound, the preeminent former Dean of Harvard Law School, condemned the “sporting theory of justice” that was in vogue during the 19th and early 20th centuries, when lawsuits turned on whether “the rules of the game been carried out strictly” rather than on what “substantive law and justice require.” Since then, the legal system has evolved to reflect the broader understanding that “dismissals based on procedural grounds . . . run counter to the judicial system’s general objective of disposing of cases on the merits.” Regrettably, however, in the realm of medical malpractice liability, the “sporting theory” of justice has largely returned to prominence in Tennessee.
Read the Tennessee Supreme Court’s unanimous decision in Bray v. Khuri, authored by Justice Sharon Lee, here.
 Daniel A. Horwitz, All claims related to the provision of health care are now governed by the Health Care Liability Act, holds Tennessee Supreme Court, ScotBlog (Dec. 7, 2015), available at http://scotblog.org/2015/12/all-claims-related-to-the-provision-of-health-care-are-now-governed-by-the-health-care-liability-act-holds-tennessee-supreme-court/.
 Stevens ex rel. Stevens v. Hickman Cmty. Health Care Servs., Inc., 418 S.W.3d 547, 564 (Tenn. 2013).
 See Daniel A. Horwitz, The Law of Unintended Consequences: Avoiding the Health Care Liability Act Booby Trap, Nashville Bar Journal (June 2015) (feature article), available at http://issuu.com/nbanikki/docs/nbjjune15/17.
 Tenn. Code Ann. § 29-26-121(a)(2)(E).
 Tenn. Code Ann. § 29-26-121(a)(2)(E) (emphasis added).
 Bray v. Khuri, __ S.W. 3d __, __ (2017), No. W2015-00397-SC-R11-CV (July 5, 2017), available at http://www.tba.org/sites/default/files/brayd_070517.pdf?fid=16e9ebec9f8d4e9e754ea118283ffe7c1c180148.
 Id. (citing 45 C.F.R. § 164.506(a); 45 C.F.R. § 164.506(c)(1)).
 Id. (citing HIPAA for Professionals FAQ 705,HHS (Jan. 7, 2005), https://www.hhs.gov/hipaa/for-professionals/faq/705/may-a-covered-entity-in-a-legalproceeding-use-protected-health-information/index.html).
 See Daniel A. Horwitz, The Law of Unintended Consequences: Avoiding the Health Care Liability Act Booby Trap 8, available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2577156 (citing Roscoe Pound, The Causes of Popular Dissatisfaction with the Administration of Justice, Address at American Bar Association Convention (Aug. 26, 1906), available at 35 F.R.D. 273, 282 (1964)).
 Id. (quoting Bowers, 2003 WL 22994302 at *5; see also Childress, 816 S.W.2d at 316 (noting that “it is the general rule that courts are reluctant to give effect to rules of procedure . . . which prevent a litigant from having a claim adjudicated upon its merits.”)).