Alvista Healthcare Center, Inc. v. Miller

• Citation: 296 Ga. App. 133,673 S.E.2d 637
• Decision Date: 17 February 2009
• Docket Number: No. A08A1899.,A08A1899.
• Parties: ALVISTA HEALTHCARE CENTER, INC. et al. v. MILLER.
• Court: United States Court of Appeals (Georgia)

673 S.E.2d 637

296 Ga. App. 133

ALVISTA HEALTHCARE CENTER, INC. et al. v. MILLER.

No. A08A1899.

Court of Appeals of Georgia.

February 17, 2009.

Arnall, Golden & Gregory, Jason E. Bring, Robert T. Strang, III, Atlanta, for appellants.

Watkins, Lourie, Roll & Chance, Lance D. Lourie, Stephen R. Chance, Atlanta, for appellee.

PHIPPS, Judge.

Mary Miller brought this wrongful death action against Alvista Healthcare Center, Inc., the owner and operator of the nursing care facility in which Miller's husband lived at the time of his death. Before bringing suit, Miller asked Alvista to provide her with copies of her deceased husband's medical records. Alvista refused, based on its determination that the Health Insurance Portability and Accountability Act of 1996 ("HIPAA")¹ and the HIPAA privacy regulations promulgated thereunder² (collectively referred to as the "privacy rule") deny it the authority to provide Miller with the records. Concluding otherwise, the trial court ordered Alvista to provide the decedent's medical records to Miller. For reasons that follow, we affirm.

When Miller's husband died intestate on March 19, 2006, he resided in an Alvista nursing care facility known as Atlanta Care Home. In January and March 2008, Miller, as the surviving spouse of the decedent, made written requests upon Alvista for copies of his medical records. Alvista, through its representative, UHS Pruitt Corporation (Pruitt), denied the requests on grounds that, under HIPAA and the privacy rule, it could release such records to only the permanent administrator or executor of the decedent's estate, which was unrepresented.

On March 4, 2008, Miller, again in her capacity as the decedent's surviving spouse, brought this action against Alvista and others (collectively referred to as Alvista). In her complaint, as amended, she sought a temporary restraining order and permanent injunction requiring Alvista to release decedent's medical records to her, as well as a judgment declaring her legal entitlement to such records.

In support of its position that it is precluded from releasing the medical records to her, Alvista relies on a January 31, 2007 letter ruling by the Office for Civil Rights ("OCR") of the United States Department of Health and Human Services ("HHS"). OCR is the federal agency charged with enforcement of HIPAA's privacy rule. "The intent of HIPAA is `to ensure the integrity and confidentiality of patients' information and to protect against unauthorized uses or disclosures of the information.'"³

As recognized by the OCR in its letter ruling, the privacy rule permits a "covered entity," such as a health care provider, to disclose "protected health information" to an "individual" under various specified circumstances.⁴ As further recognized by the OCR, the privacy rule generally requires the covered entity to treat a "personal representative" as an "individual."⁵ With regard to deceased individuals, the privacy rule provides:

If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative ..., with respect to protected health information relevant to such personal representative.⁶

In the January 2007 letter ruling, the OCR thus concluded that, before a health care provider can disclose protected health information to an individual's personal representative, the privacy rule requires: (1) authority by the personal representative to act on behalf of the individual or estate; (2) authority by the individual under state law to access the protected health information; and (3) relevance of the protected health information to the personal representative.

The letter ruling was issued in response to a complaint filed against Athens Heritage Nursing Home, a division of Pruitt, by a woman who had requested access to the medical records of her deceased mother. Initially, the woman sought access to the records because, among other things, she had been appointed temporary administrator of her mother's estate. Pruitt denied the woman's initial request, but advised her that she would be provided with the records if she were appointed permanent administrator of the estate. And after she was appointed permanent administrator, Pruitt provided her with the records. The question addressed in the letter ruling was whether Pruitt had acted in compliance with the privacy rule in denying the woman's initial request in her capacity as the temporary administrator.

In its letter ruling, the OCR recognized that Georgia law codified at OCGA § 31-33-2(a)(2) then required a health care provider having custody and control of a patient's record to furnish a copy of the record to the patient upon written request. If the patient was deceased, the Code section allowed such request to be made by the executor, temporary executor, administrator, temporary administrator, or any survivor as defined in Georgia's wrongful death statute.⁷ The woman thus had authority under applicable state law to access her deceased mother's medical records. The OCR, nonetheless, reasoned that because the Georgia law codified at OCGA § 53-6-31 authorizes a temporary administrator to bring an action on behalf of an estate only in two limited circumstances (i.e., for collection of debts or personal property of the decedent), the woman in her capacity as temporary administrator did not meet all three requirements imposed by the privacy rule for obtaining access to her deceased mother's medical records. Specifically, as temporary administrator, she had not made a showing that the protected health information was relevant to her representation of the estate.

Finally, the OCR in its letter ruling noted that the privacy rule preempts contrary state law unless such law affects privacy of protected health information and is more stringent than federal regulations, and a state law is more stringent if it provides greater privacy protection for the individual whose protected health information is sought.⁸

In the order appealed by Alvista, the trial court in granting Miller injunctive and declaratory relief determined that under the facts present here, she is authorized to access her deceased spouse's medical records. The court noted that the current version of OCGA § 31-33-2, in subsection (a)(2)(B), requires a health care provider having custody and control of a patient's medical records to furnish a copy of the records to a surviving spouse of a deceased patient if an executor, administrator, or temporary administrator for the decedent's estate has not been appointed.⁹ Moreover, the trial court reasoned that Georgia's wrongful death statute gives Miller, as the decedent's surviving spouse, the authority to act on his behalf in investigating and pursuing his wrongful death claim. The court, therefore, concluded that, in conformity with the privacy rule,¹⁰ "under applicable law" Miller is a "person" with "authority to act on behalf of [the] deceased individual." Finding that the statute of limitation was about to expire on the wrongful death claim, the court found that Miller lacked an adequate legal remedy and that injunctive relief was therefore appropriate.

1. Alvista argues that Miller has not shown an entitlement to access her deceased spouse's medical records under the privacy rule¹¹ and that the trial court's order is in conflict with the OCR's January 2007 letter ruling. We disagree.

"OCGA § 51-4-2(a) ... provides for a right of action for the wrongful death of a spouse to reside in the surviving spouse, and, if no surviving spouse, in the child or children."¹² The recovery of damages permitted by OCGA § 51-4-2(a) is for the "full value of the life of the decedent, as shown by the evidence." As held in Brock v. Wedincamp,¹³

It is clear ... that under Georgia's wrongful death statute, damages are measured from the decedent's point of view.... [T]he measure of the recovery is the full value of the life of the deceased, irrespective of its value to the person in whom the cause of action is vested.¹⁴

As thus recognized in Georgia's leading treatise on wrongful death actions, "Georgia is unique in its measure of damages for a wrongful death act, because it uses the value of the decedent's life to him."¹⁵

The OCR letter ruling was issued in response to a request for medical records by a woman in her capacity as the temporary administrator of her deceased mother's estate. There was no indication that the woman was the person entitled to bring suit for the decedent's wrongful death or that such an action was being investigated. The OCR simply did not factor that possibility into its ruling.

Here, however, Miller is requesting the decedent's medical records in her capacity as a surviving spouse who wishes to pursue an action for the decedent's wrongful death. In such an action, under Georgia's wrongful death statute, such person has authority to act on behalf of the deceased individual; the decedent's medical records are certainly relevant to such person's representation; and, under OCGA § 31-33-2(a)(2)(B), the surviving spouse is authorized to access the medical records. Therefore, Miller has satisfied all three requirements identified in the OCR letter ruling for obtaining access to her deceased husband's medical records. As indicated in the letter ruling, OCGA § 31-33-2(a)(2)(B) would be preempted by HIPAA to the extent that it gives a person the right to obtain protected health information of a patient without satisfying all HIPAA requirements.

2. There is no merit in Alvista's challenge to the trial court's authority to compel Alvista to produce the medical records under that part of the privacy rule providing that a covered entity may disclose protected health information in response to a court order...