ALVISTA HEALTHCARE CENTER, INC. v. Miller

673 S.E.2d 637 (2009)

ALVISTA HEALTHCARE CENTER, INC. et al. v. MILLER.

No. A08A1899.

Court of Appeals of Georgia.

February 17, 2009.

*638 Arnall, Golden & Gregory, Jason E. Bring, Robert T. Strang, III, Atlanta, for appellants.

Watkins, Lourie, Roll & Chance, Lance D. Lourie, Stephen R. Chance, Atlanta, for appellee.

PHIPPS, Judge.

Mary Miller brought this wrongful death action against Alvista Healthcare Center, Inc., the owner and operator of the nursing care facility in which Miller's husband lived at the time of his death. Before bringing suit, Miller asked Alvista to provide her with copies of her deceased husband's medical records. Alvista refused, based on its determination that the Health Insurance Portability and Accountability Act of 1996 ("HIPAA")[1] and the HIPAA privacy regulations promulgated thereunder[2] (collectively referred to as the "privacy rule") deny it the authority to provide Miller with the records. Concluding otherwise, the trial court ordered Alvista to provide the decedent's medical records to Miller. For reasons that follow, we affirm.

When Miller's husband died intestate on March 19, 2006, he resided in an Alvista nursing care facility known as Atlanta Care Home. In January and March 2008, Miller, as the surviving spouse of the decedent, made written requests upon Alvista for copies of his medical records. Alvista, through its representative, UHS Pruitt Corporation (Pruitt), denied the requests on grounds that, under HIPAA and the privacy rule, it could release such records to only the permanent *639 administrator or executor of the decedent's estate, which was unrepresented.

On March 4, 2008, Miller, again in her capacity as the decedent's surviving spouse, brought this action against Alvista and others (collectively referred to as Alvista). In her complaint, as amended, she sought a temporary restraining order and permanent injunction requiring Alvista to release decedent's medical records to her, as well as a judgment declaring her legal entitlement to such records.

In support of its position that it is precluded from releasing the medical records to her, Alvista relies on a January 31, 2007 letter ruling by the Office for Civil Rights ("OCR") of the United States Department of Health and Human Services ("HHS"). OCR is the federal agency charged with enforcement of HIPAA's privacy rule. "The intent of HIPAA is `to ensure the integrity and confidentiality of patients' information and to protect against unauthorized uses or disclosures of the information.'"[3]

As recognized by the OCR in its letter ruling, the privacy rule permits a "covered entity," such as a health care provider, to disclose "protected health information" to an "individual" under various specified circumstances.[4] As further recognized by the OCR, the privacy rule generally requires the covered entity to treat a "personal representative" as an "individual."[5] With regard to deceased individuals, the privacy rule provides:

If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative ..., with respect to protected health information relevant to such personal representative.[6]

In the January 2007 letter ruling, the OCR thus concluded that, before a health care provider can disclose protected health information to an individual's personal representative, the privacy rule requires: (1) authority by the personal representative to act on behalf of the individual or estate; (2) authority by the individual under state law to access the protected health information; and (3) relevance of the protected health information to the personal representative.

The letter ruling was issued in response to a complaint filed against Athens Heritage Nursing Home, a division of Pruitt, by a woman who had requested access to the medical records of her deceased mother. Initially, the woman sought access to the records because, among other things, she had been appointed temporary administrator of her mother's estate. Pruitt denied the woman's initial request, but advised her that she would be provided with the records if she were appointed permanent administrator of the estate. And after she was appointed permanent administrator, Pruitt provided her with the records. The question addressed in the letter ruling was whether Pruitt had acted in compliance with the privacy rule in denying the woman's initial request in her capacity as the temporary administrator.

In its letter ruling, the OCR recognized that Georgia law codified at OCGA § 31-33-2(a)(2) then required a health care provider having custody and control of a patient's record to furnish a copy of the record to the patient upon written request. If the patient was deceased, the Code section allowed such request to be made by the executor, temporary executor, administrator, temporary administrator, or any survivor as defined in Georgia's wrongful death statute.[7] The woman thus had authority under applicable state law to access her deceased mother's medical records. The OCR, nonetheless, reasoned that because the Georgia law codified at OCGA § 53-6-31 authorizes a temporary administrator to bring an action on *640 behalf of an estate only in two limited circumstances (i.e., for collection of debts or personal property of the decedent), the woman in her capacity as temporary administrator did not meet all three requirements imposed by the privacy rule for obtaining access to her deceased mother's medical records. Specifically, as temporary administrator, she had not made a showing that the protected health information was relevant to her representation of the estate.

Finally, the OCR in its letter ruling noted that the privacy rule preempts contrary state law unless such law affects privacy of protected health information and is more stringent than federal regulations, and a state law is more stringent if it provides greater privacy protection for the individual whose protected health information is sought.[8]

In the order appealed by Alvista, the trial court in granting Miller injunctive and declaratory relief determined that under the facts present here, she is authorized to access her deceased spouse's medical records. The court noted that the current version of OCGA § 31-33-2, in subsection (a)(2)(B), requires a health care provider having custody and control of a patient's medical records to furnish a copy of the records to a surviving spouse of a deceased patient if an executor, administrator, or temporary administrator for the decedent's estate has not been appointed.[9] Moreover, the trial court reasoned that Georgia's wrongful death statute gives Miller, as the decedent's surviving spouse, the authority to act on his behalf in investigating and pursuing his wrongful death claim. The court, therefore, concluded that, in conformity with the privacy rule,[10] "under applicable law" Miller is a "person" with "authority to act on behalf of [the] deceased individual." Finding that the statute of limitation was about to expire on the wrongful death claim, the court found that Miller lacked an adequate legal remedy and that injunctive relief was therefore appropriate.

1. Alvista argues that Miller has not shown an entitlement to access her deceased spouse's medical records under the privacy rule[11] and that the trial court's order is in conflict with the OCR's January 2007 letter ruling. We disagree.

"OCGA § 51-4-2(a) ... provides for a right of action for the wrongful death of a spouse to reside in the surviving spouse, and, if no surviving spouse, in the child or children."[12] The recovery of damages permitted by OCGA § 51-4-2(a) is for the "full value of the life of the decedent, as shown by the evidence." As held in Brock v. Wedincamp,[13]

It is clear ... that under Georgia's wrongful death statute, damages are measured from the decedent's point of view.... [T]he measure of the recovery is the full value of the life of the deceased, irrespective of its value to the person in whom the cause of action is vested.[14]

As thus recognized in Georgia's leading treatise on wrongful death actions, "Georgia is unique in its measure of damages for a wrongful death act, because it uses the value of the decedent's life to him."[15]

*641 The OCR letter ruling was issued in response to a request for medical records by a woman in her capacity as the temporary administrator of her deceased mother's estate. There was no indication that the woman was the person entitled to bring suit for the decedent's wrongful death or that such an action was being investigated. The OCR simply did not factor that possibility into its ruling.

Here, however, Miller is requesting the decedent's medical records in her capacity as a surviving spouse who wishes to pursue an action for the decedent's wrongful death. In such an action, under Georgia's wrongful death statute, such person has authority to act on behalf of the deceased individual; the decedent's medical records are certainly relevant to such person's representation; and, under OCGA § 31-33-2(a)(2)(B), the surviving spouse is authorized to access the medical records. Therefore, Miller has satisfied all three requirements identified in the OCR letter ruling for obtaining access to her deceased husband's medical records. As indicated in the letter ruling, OCGA § 31-33-2(a)(2)(B) would be preempted by HIPAA to the extent that it gives a person the right to obtain protected health information of a patient without satisfying all HIPAA requirements.

2. There is no merit in Alvista's challenge to the trial court's authority to compel Alvista to produce the medical records under that part of the privacy rule providing that a covered entity may disclose protected health information in response to a court order entered in the course of any judicial proceeding.[16] Here, the trial court's order "complies with HIPAA requirements for the disclosure of such records."[17]

3. Contrary to argument advanced by Alvista, the trial court was authorized to find that filing a complaint with the OCR did not provide Miller with an adequate legal remedy, due to the impending expiration of the wrongful death statute of limitation.[18]

4. There is no merit in Alvista's argument that this is not an appropriate case for a declaratory judgment. It is true that "[t]o proceed under a declaratory judgment a party must establish that it is necessary to relieve himself of the risk of taking some future action that, without direction, would jeopardize his interests."[19] And, as argued by Alvista, Miller has failed to make that showing. But first and foremost this is an action for injunctive relief in a case involving an actual controversy.

In cases of actual controversy, the respective superior courts of this state shall have power, upon petition or other appropriate pleading, to declare rights and other legal relations of any interested party petitioning for such declaration, whether or not further relief is or could be prayed; and the declaration shall have the force and effect of a final judgment or decree and be reviewable as such.[20]

Judgment affirmed.

JOHNSON, P.J., and BARNES, J., concur.

NOTES

[1] Pub.L. No. 104-191.

[2] 45 C.F.R. Parts 160 and 164, Subparts A and E.

[3] Northlake Medical Center v. Queen, 280 Ga.App. 510, 511(2), 634 S.E.2d 486 (2006) (footnote omitted).

[4] See 45 C.F.R. §§ 164.502, 164.524, 164.528.

[5] 45 C.F.R. § 164.502(g)(1).

[6] 45 C.F.R. § 164.502(g)(4).

[7] OCGA § 51-4-1 et seq.; see OCGA § 31-33-2(a)(2)(B), as amended by Ga. L. 2002, pp. 641-642, § 2.

[8] 42 U.S.C. § 1320d-7 (a)(1); 45 C.F.R. §§ 160.202(2), 160.203(b); see Allen v. Wright, 282 Ga. 9, 644 S.E.2d 814 (2007) (approving this court's decision in Queen by holding that OCGA § 9-11-9.2 is preempted by HIPAA to the extent that OCGA § 9-11-9.2's requirements concerning the contents of an authorization for release of medical records are less stringent than those set forth in HIPAA); compare Austin v. Moreland, 288 Ga.App. 270, 273-274(2), 653 S.E.2d 347 (2007) (holding that OCGA § 9-11-34(c)'s requirements for production of medical records are not preempted by HIPAA because they provide more stringent privacy protection than HIPAA), rev'd on other grounds, Moreland v. Austin, 284 Ga. 730, 670 S.E.2d 68 (2008).

[9] Ga. L.2008, pp. 12, 70-71, § 2-32.

[10] 45 C.F.R. § 164.502(g)(4).

[11] Id.

[12] Carringer v. Rodgers, 276 Ga. 359, 365, 578 S.E.2d 841 (2003).

[13] 253 Ga.App. 275, 558 S.E.2d 836 (2002).

[14] Id. at 280-281, 558 S.E.2d 836 (citation omitted).

[15] Eldridge's Georgia Wrongful Death Actions, § 6:1, p. 464 (4th ed.2008). Williams v. Ga. Dept. of Human Resources, 272 Ga. 624, 626, n. 14, 532 S.E.2d 401 (2000) cited Lovett v. Garvin, 232 Ga. 747, 208 S.E.2d 838 (1974) as authority for the rule that a claim for wrongful death accrues when the decedent dies rather than at the time of infliction of the injuries causing the death. As recognized in Williams, Lovett gave as the reason for the rule that the gist of the action is the injury suffered by the beneficiaries rather than the injury suffered by the deceased. A more fundamental reason for the rule, however, is that an action accrues when suit can first be brought, and it is axiomatic that a wrongful death action cannot be brought until death occurs. We, therefore, interpret the rationale expressed in Lovett and Williams to be unbinding dicta.

[16] 45 C.F.R. § 164.512(e)(1); see Ussery v. Children's Healthcare of Atlanta, 289 Ga.App. 255, 269-270(4), 656 S.E.2d 882 (2008); Austin v. Moreland, supra.

[17] Ussery, supra at 270(4), 656 S.E.2d 882.

[18] It does not appear that Miller was required to exhaust her administrative remedies with OCR as a condition to seeking judicial relief.

[19] Porter v. Houghton, 273 Ga. 407, 542 S.E.2d 491 (2001) (footnote omitted).

[20] OCGA § 9-4-2(a).