ALVISTA HEALTHCARE CENTER, INC. v. Miller

686 S.E.2d 96, 286 Ga. 122, 2009 Fulton County D. Rep. 3440, 2009 Ga. LEXIS 679

• Court: Supreme Court of Georgia
• Decided: November 2, 2009
• Docket: S09G1005
• Status: Published

Opinions

CARLEY, Presiding Justice.

Mary Miller is the surviving spouse of Stanton Miller, who resided in a nursing care facility owned and operated by Alvista Healthcare Center, Inc. After he died intestate on March 19, 2006, Ms. Miller, who was investigating a potential wrongful death action, requested copies of his medical records from Alvista in January and March 2008. Those requests were denied on the ground that, under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the privacy regulations promulgated thereunder, the records could be released only to a permanent executor or administrator of Mr. Miller’s estate, which was still unrepresented. On March 4, 2008, Ms. Miller brought this action against Alvista and related entities (Appellants), seeking a temporary restraining order and permanent injunction requiring release of the medical records, as well as a declaratory judgment that she is entitled to those records.

The trial court granted all requested relief, determining that, because OCGA § 31-33-2 (a) (2) (B) specifically authorizes a surviving spouse to obtain access to her deceased spouse’s medical records, Ms. Miller “has authority to act on behalf of a deceased individual or of the individual’s estate” and, therefore, must be treated as a “personal representative” to whom protected health information may be disclosed. 45 CFR § 164.502 (g) (4). The Court of Appeals affirmed, holding that a surviving spouse who wishes to pursue an action for the decedent’s wrongful death has authority to act on his behalf, as the measure of damages for wrongful death in Georgia is the full value of the decedent’s life to him, rather than to the surviving spouse who brings the action. Alvista Healthcare Center v. Miller, 296 Ga. App. 133, 137 (1) (673 SE2d 637) (2009). Having granted certiorari to review this ruling, we affirm the judgment of the Court of Appeals, but on a different basis. We hold that OCGA § 31-33-2 (a) (2) (B) authorizes a surviving spouse to act on behalf of the decedent or his estate in obtaining medical records and, therefore, that the surviving spouse is entitled to access the decedent’s protected health information in accordance with 45 CFR § 164.502 (g) (4).

HIPAA “authorized the Secretary of the Department of Health and Human Services to promulgate rules and regulations which would ensure the privacy of patients’ medical information. 42 [USC] § 1320d-2 (d) (2) (A).” Moreland v. Austin, 284 Ga. 730, 731 (670 SE2d 68) (2008). Those privacy regulations apply “ ‘to the protected health information of a deceased individual.’ 45 C.F.R. § 164.502 (f) .... In cases of a deceased individual, the covered entity must ‘treat a personal representative as the individual.’ 45 C.F.R. § 164.502 (g) (1).” Estate of Broderick, 125 P3d 564, 570 (Kan. App. 2005).

If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual’s estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.

45 CFR § 164.502 (g) (4). This definition is a functional one and, therefore, the “applicable law” to which the regulation refers clearly is state law. See Daniel B. Evans, What Estate Lawyers Need to Know about HIPAA and “Protected Health Information”, 18-AUG Prob. & Prop. 20, 22 (2004); Helen W. Gunnarsson, Are Statutory Health Care POAs HIPAA-Compliant?, 92 Ill. B.J. 302, 303 (2004) (“ ‘Applicable law’ generally means state law, since that’s what governs who may act on behalf of another.”). Ms. Miller asserts that OCGA § 31-33-2 (a) (2) (B) constitutes the “applicable law” which gives her “authority to act on behalf of [the] deceased individual or of the individual’s estate.”

Prior to 2006, OCGA § 31-33-2 did not expressly recognize the applicability of HIPAA, and it specified several different persons, any of whom could obtain a deceased patient’s record. Ga. L. 2002, pp. 641, 642, § 2. In 2006, however, the General Assembly amended subsections (a) and (b) of the statute so as “to change certain provisions relating to furnishing a copy of records to patient, provider, or other authorized person” and “to provide for compliance with” HIPAA. Ga. L. 2006, p. 494. Thus, OCGA § 31-33-2 (b) (1) now provides, in pertinent part, that any request for a deceased patient’s medical records by a person authorized under subsection (a) (2) shall be accompanied by an authorization in compliance with HIPAA and its implementing regulations. Subsection (a) (2) requires a healthcare provider to furnish a copy of a deceased patient’s record upon written request by

(A) The executor, administrator, or temporary administrator for the decedent’s estate if such person has been appointed; (B) If an executor, administrator, or temporary administrator for the decedent’s estate has not been appointed, by the surviving spouse; (C) If there is no surviving spouse, by any surviving child; and (D) If there is no surviving child, by any parent.

Thus, subsection (a) (2) establishes a definite order of priority with respect to who is authorized to obtain a deceased patient’s medical records. The first priority, set forth in OCGA § 31-33-2 (a) (2) (A), obviously is consistent with the specification in 45 CFR § 164.502 (g) (4) of an executor, administrator, or other person having authority to act on behalf of the decedent or his estate. OCGA § 31-33-2 (a) (2) (B) applies only if an executor or administrator has not been appointed. The evident purpose of subsection (a) (2), when read in conjunction with subsection (b) (1), is to identify several persons, the executor or administrator being the first choice and the surviving spouse being the second, who have authority to submit an authorization in compliance with HIPAA and to obtain medical records on behalf of the decedent or his estate. Accordingly, we conclude that OCGA § 31-33-2 (a) (2) constitutes the applicable state law to which 45 CFR § 164.502 (g) (4) refers and that subsection (a) (2) (B) necessarily implies that, when there is no executor or administrator, the surviving spouse is granted authority to act on behalf of the decedent or his estate with respect to requests for medical records.

45 CFR § 164.502 (g) (4) requires that “a covered entity” such as Alvista “treat such person” having authority to act on behalf of the decedent or his estate “as a personal representative . . . with respect to protected health information relevant to such personal representation.” As the preceding discussion of OCGA § 31-33-2 (a) (2) makes clear, that statute treats the surviving spouse as a personal representative in lieu of the executor or administrator with respect to requests for medical records. Subsection (a) (2) (B) of the statute establishes a limited personal representation in the surviving spouse for the express purpose of obtaining the decedent’s medical records in compliance with HIPAA. The Georgia statute does not provide for personal representation by the surviving spouse for other purposes. However, the statute permits her to obtain all types of medical records, other than mental health records as excepted by OCGA § 31-33-4, and subject to the preservation in OCGA § 31-33-6 of the privileged or confidential nature of communications recognized in other laws. Therefore, OCGA § 31-33-2 (a) (2) is carefully tailored to provide the authority contemplated by 45 CFR § 164.502 (g) (4). Except for mental health records and any records which remain privileged or confidential, all of the decedent’s protected health information is relevant to the limited personal representation granted to a surviving spouse by OCGA § 31-33-2 (a) (2) (B). Therefore, Ms. Miller, by qualifying for that limited personal representation and requesting medical records which she is authorized to request by virtue of such representation, has met every requirement of 45 CFR § 164.502 (g) (4).

Contrary to the contention of the dissent, the federal regulation does not require that the person having authority to act on behalf of the decedent or his estate and requesting medical records must intend to make future use of those records in her fiduciary capacity as a personal representative. When the person having authority to act on behalf of the decedent or his estate makes a request for medical records which is within the scope of that authority, the very request constitutes an action in that person’s capacity as a limited personal representative. Indeed, such request is the only action which can come within the limited personal representation established by OCGA § 31-33-2 (a) (2) for the purpose of obtaining medical records. Once the medical records are obtained by a person authorized by state law to act on behalf of the decedent or his estate by requesting them, 45 CFR § 164.502 (g) (4) does not restrict the future use of those records. After obtaining the medical records, therefore, the surviving spouse may pursue a wrongful death claim, she may seek appointment as administrator in order to bring a survival action on behalf of the estate pursuant to OCGA § 51-4-5 (b), she may do both, or she may do neither.

The logical result of the dissent’s analysis is that a wrongful death complaint, together with any affidavit required by OCGA § 9-11-9.1, cannot be filed unless and until an estate has been opened, there has been an appointment of an executor or administrator who is willing to cooperate with the potential wrongful death claimant, and the executor or administrator has made a request for the decedent’s medical records soon enough to prevent the action from being barred by the statute of limitations. However, nothing in either OCGA § 31-33-2 (a) (2) or 45 CFR § 164.502 (g) (4) requires the appointment of an executor or administrator and what may be an otherwise unnecessary administration of an estate. To the contrary, both the Georgia statute and the federal regulation provide for a request by a person who is neither an executor nor an administrator. If the very statute tailored to comply with 45 CFR § 164.502 (g) (4) could not be considered to provide anyone other than an executor or administrator with authority to act on behalf of the decedent or his estate for the purpose of obtaining medical records, then that portion of the federal regulation which specifies “other person[s]” having authority to act on behalf of the deceased individual or his estate would be meaningless with respect to this state.

Appellants contend that 45 CFR § 164.502 (g) (4) preempts OCGA § 31-33-2 (a) (2). However, HIPAA and the related regulations do not preempt any state law which provides more stringent requirements for the disclosure of protected health information. Moreland v. Austin, supra at 733; Allen v. Wright, 282 Ga. 9, 12 (1), 14 (2) (644 SE2d 814) (2007). 45 CFR § 164.502 (g) (4) permits an executor, administrator, or some other person authorized to act on behalf of the decedent or his estate to obtain protected health information. However, the person whom OCGA § 31-33-2 (a) (2) allows to act on behalf of the deceased individual or his estate is only the executor or administrator if the estate is represented, and only the surviving spouse if one exists and the estate is unrepresented. Therefore, OCGA § 31-33-2 (a) (2) is more stringent than, and thus is not preempted by, 45 CFR § 164.502 (g) (4). Compare Moreland v. Austin, supra; Allen v. Wright, supra at 12 (1), 14 (3).

Accordingly, we hold that, when OCGA § 31-33-2 (a) (2) (B) is applicable, a surviving spouse has authority thereunder to act on behalf of the decedent or his estate by requesting his medical records and, thus, is entitled to access the decedent’s protected health information pursuant to 45 CFR § 164.502 (g) (4). We further hold that the Court of Appeals correctly affirmed the trial court’s entry of injunctive and declaratory relief. Contrary to Appellants’ contention, the Court of Appeals did not hold that a trial court could circumvent HIPAA merely by entering an order compelling the production of medical records. The Court of Appeals clearly required that any such order must, as did the trial court’s order here, “ ‘compl[y] with HIPAA requirements for the disclosure of such records.’ [Cit.]” Alvista Healthcare Center v. Miller, supra at 138 (2). The entry of the trial court’s order was not erroneous on the ground that the constitutional right of privacy, as set forth in King v. State, 272 Ga. 788 (535 SE2d 492) (2000), required prior notice to the personal representative of the decedent’s estate. That right of privacy generally does not survive the death of the patient and, to the extent that it does, its assertion is a matter for the relatives of the deceased. Martin Luther King, Jr., Center for Social Change v. American Heritage Products, 250 Ga. 135, 139 (1) (296 SE2d 697) (1982). Furthermore, due to compliance with HIPAA regulations, the mandatory injunction did not place Appellants in danger of violating federal law, and the trial court was authorized to find the absence of any “adequate legal remedy, due to the impending expiration of the wrongful death statute of limitation.” Alvista Healthcare Center v. Miller, supra at 138 (3).

Judgment affirmed.

All the Justices concur, except Melton, J., who dissents.