Alvista Healthcare Center, Inc. v. Miller

• Citation: 686 S.E.2d 96,286 Ga. 122
• Decision Date: 02 November 2009
• Docket Number: No. S09G1005.,S09G1005.
• Parties: ALVISTA HEALTHCARE CENTER, INC., et al. v. MILLER.
• Court: Supreme Court of Georgia

686 S.E.2d 96

286 Ga. 122

ALVISTA HEALTHCARE CENTER, INC., et al. v. MILLER.

No. S09G1005.

Supreme Court of Georgia.

November 2, 2009.

Arnall, Golden & Gregory, Glenn P. Hendrix, Jason E. Bring, Robert T. Strang III, William J. Rissler, Charles L. Gregory, Atlanta, for appellants.

Watkins, Lourie, Roll & Chance, Lance D. Lourie, Stephen Chance, Atlanta, for appellee.

CARLEY, Presiding Justice.

Mary Miller is the surviving spouse of Stanton Miller, who resided in a nursing care facility owned and operated by Alvista Healthcare Center, Inc. After he died intestate on March 19, 2006, Ms. Miller, who was investigating a potential wrongful death action, requested copies of his medical records from Alvista in January and March 2008. Those requests were denied on the ground that, under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the privacy regulations promulgated thereunder, the records could be released only to a permanent executor or administrator of Mr. Miller's estate, which was still unrepresented. On March 4, 2008, Ms. Miller brought this action against Alvista and related entities (Appellants), seeking a temporary restraining order and permanent injunction requiring release of the medical records, as well as a declaratory judgment that she is entitled to those records.

The trial court granted all requested relief, determining that, because OCGA § 31-33-2(a)(2)(B) specifically authorizes a surviving spouse to obtain access to her deceased spouse's medical records, Ms. Miller "has authority to act on behalf of a deceased individual or of the individual's estate" and, therefore, must be treated as a "personal representative" to whom protected health information may be disclosed. 45 C.F.R. § 164.502(g)(4). The Court of Appeals affirmed, holding that a surviving spouse who wishes to pursue an action for the decedent's wrongful death has authority to act on his behalf, as the measure of damages for wrongful death in Georgia is the full value of the decedent's life to him, rather than to the surviving spouse who brings the action. Alvista Healthcare Center v. Miller, 296 Ga. App. 133, 137(1), 673 S.E.2d 637 (2009). Having granted certiorari to review this ruling, we affirm the judgment of the Court of Appeals, but on a different basis. We hold that OCGA § 31-33-2(a)(2)(B) authorizes a surviving spouse to act on behalf of the decedent or his estate in obtaining medical records and, therefore, that the surviving spouse is entitled to access the decedent's protected health information in accordance with 45 C.F.R. § 164.502(g)(4).

HIPAA "authorized the Secretary of the Department of Health and Human Services to promulgate rules and regulations which would ensure the privacy of patients' medical information. 42[U.S.C.] § 1320d-2 (d)(2)(A)." Moreland v. Austin, 284 Ga. 730, 731, 670 S.E.2d 68 (2008). Those privacy regulations apply "`to the protected health information of a deceased individual.' 45 C.F.R. § 164.502(f). . . . In cases of a deceased individual, the covered entity must `treat a personal representative as the individual.' 45 C.F.R. § 164.502(g)(1)." Estate of Broderick, 34 Kan.App.2d 695, 125 P.3d 564, 570 (2005).

If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.

45 C.F.R. § 164.502(g)(4). This definition is a functional one and, therefore, the "applicable law" to which the regulation refers clearly is state law. See Daniel B. Evans, What Estate Lawyers Need to Know about HIPAA and "Protected Health Information", 18-AUG Prob. & Prop. 20, 22 (2004); Helen W. Gunnarsson, Are Statutory Health Care POAs HIPAA-Compliant?, 92 Ill. B.J. 302, 303 (2004) ("`Applicable law' generally means state law, since that's what governs who may act on behalf of another."). Ms. Miller asserts that OCGA § 31-33-2(a)(2)(B) constitutes the "applicable law" which gives her "authority to act on behalf of [the] deceased individual or of the individual's estate."

Prior to 2006, OCGA § 31-33-2 did not expressly recognize the applicability of HIPAA, and it specified several different persons, any of whom could obtain a deceased patient's record. Ga. L. 2002, pp. 641, 642, § 2. In 2006, however, the General Assembly amended subsections (a) and (b) of the statute so as "to change certain provisions relating to furnishing a copy of records to patient, provider, or other authorized person" and "to provide for compliance with" HIPAA. Ga. L. 2006, p. 494. Thus, OCGA § 31-33-2(b)(1) now provides, in pertinent part, that any request for a deceased patient's medical records by a person authorized under subsection (a)(2) shall be accompanied by an authorization in compliance with HIPAA and its implementing regulations. Subsection (a)(2) requires a healthcare provider to furnish a copy of a deceased patient's record upon written request by

(A) The executor, administrator, or temporary administrator for the decedent's estate if such person has been appointed; (B) If an executor, administrator, or temporary administrator for the decedent's estate has not been appointed, by the surviving spouse; (C) If there is no surviving spouse, by any surviving child; and (D) If there is no surviving child, by any parent.

Thus, subsection (a)(2) establishes a definite order of priority with respect to who is authorized to obtain a deceased patient's medical records. The first priority, set forth in OCGA § 31-33-2(a)(2)(A), obviously is consistent with the specification in 45 C.F.R. § 164.502(g)(4) of an executor, administrator, or other person having authority to act on behalf of the decedent or his estate. OCGA § 31-33-2(a)(2)(B) applies only if an executor or administrator has not been appointed. The evident purpose of subsection (a)(2), when read in conjunction with subsection (b)(1), is to identify several persons, the executor or administrator being the first choice and the surviving spouse being the second, who have authority to submit an authorization in compliance with HIPAA and to obtain medical records on behalf of the decedent or his estate. Accordingly, we conclude that OCGA § 31-33-2(a)(2) constitutes the applicable state law to which 45 C.F.R. § 164.502(g)(4) refers and that subsection (a)(2)(B) necessarily implies that, when there is no executor or administrator, the surviving spouse is granted authority to act on behalf of the decedent or his estate with respect to requests for medical records.

45 C.F.R. § 164.502(g)(4) requires that "a covered entity" such as Alvista "treat such person" having authority to act on behalf of the decedent or his estate "as a personal representative . . . with respect to protected health information relevant to such personal representation." As the preceding discussion of OCGA § 31-33-2(a)(2) makes clear, that statute treats the surviving spouse as a personal representative in lieu of the executor or administrator with respect to requests for medical records. Subsection (a)(2)(B) of the statute establishes a limited personal representation in the surviving spouse for the express purpose of obtaining the decedent's medical records in compliance with HIPAA. The Georgia statute does not provide for personal representation by the surviving spouse for other purposes. However, the statute permits her to obtain all types of medical records, other than mental health records as excepted by OCGA § 31-33-4, and subject to the preservation in OCGA § 31-33-6 of the privileged or confidential nature of communications recognized in other laws. Therefore, OCGA § 31-33-2(a)(2) is carefully tailored to provide the authority contemplated by 45 C.F.R. § 164.502(g)(4). Except for mental health records and any records which remain privileged or confidential, all of the decedent's protected health information is relevant to the limited personal representation granted to a surviving spouse by OCGA § 31-33-2(a)(2)(B). Therefore, Ms. Miller, by qualifying for that limited personal representation and requesting medical records which she is authorized to request by virtue of such representation, has met every requirement of 45 C.F.R. § 164.502(g)(4).

Contrary to the contention of the dissent, the federal regulation does not require that the person having authority to act on behalf of the decedent or his estate and requesting medical records must intend to make future use of those records in her fiduciary capacity as a personal representative. When the person having authority to act on behalf of the decedent or his estate makes a request for medical records which is within the scope of that authority, the very request constitutes an action in that person's capacity as a limited personal representative. Indeed, such request is the only action which can come within the limited personal representation established by OCGA § 31-33-2(a)(2) for the purpose of obtaining medical records. Once the medical records are obtained by a person authorized by state law to act on behalf of the decedent or his estate by requesting them, 45 C.F.R. § 164.502(g)(4) does not restrict the future use of those records. After obtaining the medical records, therefore, the surviving spouse may pursue a wrongful death claim, she may seek appointment as administrator in order to bring a survival action on behalf of the estate pursuant to OCGA § 51-4-5(b), she may do both, or she may do neither.

The logical result of the dissent's analysis is that a wrongful death complaint, together with any affidavit required by OCGA § 9-11-9.1, cannot be filed unless and until an estate has been opened, there has been an appointment of an executor or administrator who is willing to cooperate with the potential wrongful death claimant, and the executor or...