Wall v. Pahl

¶ 1. STARK, RJ. Daniel Wall appeals orders dismissing his claims against Marion Pahl, Jacquelyn Schimke, and Gundersen Lutheran Health System, Inc. Wall contends Pahl and Schimke violated Wis. Stat. § 146.82,1 which prohibits the release of patient health care records except in specific circumstances enumerated in the statute. Wall also asserts Gundersen violated Wis. Stat. § 146.83(4)(b) by improperly concealing or withholding patient health care records. The circuit court concluded Wall's complaint failed to state a claim on which relief could be granted. We agree and affirm. BACKGROUND ¶ 2 Because this case is before us on review of the circuit court's decision on a motion to dismiss, the following facts are taken from Wall's complaint and are accepted as true for purposes of this appeal. See Walberg v. St. Francis Home, Inc., 2005 WI 64, ¶ 6, 281 Wis. 2d 99, 697 N.W.2d 36. 721 1 3. Gundersen is a Wisconsin corporation in the business of providing health care services. In the past, Wall has been a patient of Gundersen. At some point, Gundersen provided Wall with an "audit trail of people who [had] accessed his health care records." After reviewing the audit trail, Wall learned that Gundersen employees Pahl and Schimke had "accessed and observed" his health care records.2 Wall did not authorize or provide consent for Pahl or Schimke to access his health care records. Pahl and Schimke failed to follow Gundersen's policies and procedures for gaining Wall's consent to access the records. In addition, neither Pahl nor Schimke had "legitimate cause" to access the records. ¶ 4 Wall submitted a written request to Gundersen for the "reason why [Pahl and Schimke] accessed his confidential medical records." Gundersen responded it had "completed its investigation into whether [Pahl and Schimke] had legal authorization to access [Wall's] health care records and why[.]" However, it concealed the results of that investigation from Wall. ¶ 5 Wall's complaint asserted claims against Pahl and Schimke for "invasion of privacy of medical records." In addition, it alleged Gundersen had violated Wis. Stat. § 146.83(4)(b) by "blocking] and hinder [ing] [Wall] from investigating the reason why and authority upon which [Pahl and Schimke] accessed [Wall's] health care records." The complaint also alleged Gundersen had violated the federal regulations promulgated under the Health Insurance Portability and Accountability Act (HIPAA) by failing to answer 722 Wall's inquiry into why Pahl and Schimke accessed his medical records. Wall sought punitive damages from all three defendants. ¶ 6 Pahl and Schimke moved to dismiss Wall's claims, and Gundersen filed a separate motion to dismiss. In support of their motion, Pahl and Schimke noted that, aside from a generic reference to Wis. Stat. ch. 146, Wall's complaint did not identify the legal basis for his "invasion of privacy of medical records" claims. Regardless, Pahl and Schimke argued Wall's claims failed, as a matter of law, because the complaint did not state a claim for invasion of privacy under Wis. Stat. § 995.50, for a violation of HIPAA, or for a violation of Wis. Stat. §§ 146.82 or 146.83. In response, Wall clarified that his claims against Pahl and Schimke were based solely on ch. 146, in that Pahl and Schimke "did not have the 'informed consent' required by Chapter 146 to see [his] records," and none of the exceptions to the informed consent requirement in ch. 146 applied. In other words, Wall contended Pahl and Schimke had violated § 146.82. Wall also clarified, in response to Gundersen's motion, that his sole claim against Gundersen was for an alleged violation of § 146.83(4)(b).3 ¶ 7 The circuit court granted all three defendants' motions to dismiss. The court reasoned that, in order to state a claim for relief under Wis. Stat. ch. 146 against Pahl, Schimke, or Gundersen, Wall's complaint needed to allege that Pahl and Schimke "disclosed" Wall's medical records "to other people." The court concluded Wall's complaint failed to do so, in that it merely alleged Pahl and Schimke "briefly accessed" 723 Wall's medical records without his knowledge, but it failed to allege they "released, published or disclosed his medical record in any way." Wall now appeals from the orders dismissing his claims.4 DISCUSSION ¶ 8 Whether a complaint states a claim upon which relief can be granted is a question of law that we review independently. Data Key Partners v. Permira Advisers LLC, 2014 WI 86, ¶ 17, 356 Wis. 2d 665, 849 N.W.2d 693. When reviewing a circuit court's decision on a motion to dismiss for failure to state a claim, we accept the facts alleged in the complaint as true and draw all reasonable inferences from those facts in the plaintiffs favor. See id., ¶¶ 18-19. However, we need not accept as true any legal allegations in the complaint. Id., ¶ 19. In addition, we may not consider any facts outside the complaint. Id. ¶ 9 In this case, whether Wall's complaint states a claim for relief hinges on the interpretation of several statutes. Statutory interpretation presents a question of law that we review independently. Domino v. Walworth Cty., 118 Wis. 2d 488, 493, 347 N.W.2d 917 (Ct. App. 1984). Our analysis begins with the plain language of the statute. State ex rel. Kalal v. Circuit Court for Dane Cty., 2004 WI 58, ¶ 45, 271 Wis. 2d 633, 681 N.W.2d 110. "Statutory language is given its common, ordinary, and accepted meaning, 724 except that technical or specially-defined words or phrases are given their technical or special definitional meaning." Id. In addition, statutory language is interpreted "in the context in which it is used; not in isolation but as part of a whole; in relation to the language of surrounding or closely-related statutes; and reasonably, to avoid absurd or unreasonable results." Id., ¶ 46. "If this process of analysis yields a plain, clear statutory meaning, then there is no ambiguity, and the statute is applied according to this ascertainment of its meaning." Id. (quoting Bruno v. Milwaukee Cty., 2003 WI 28, ¶ 20, 260 Wis. 2d 633, 660 N.W.2d 656). I. Wall's claims against Pahl and Schimke ¶ 10 Wall contends Pahl and Schimke violated Wis. Stat. § 146.82, entitled "Confidentiality of patient health care records." Subsection (1) of that statute, entitled "Confidentiality," provides, in relevant part, "All patient health care records!5] shall remain confidential. Patient health care records may be released 725 only to the persons designated in this section or to other persons with the informed consent of the patient or of a person authorized by the patient." Subsection (2), entitled "Access without informed consent," then enumerates several situations in which, " [notwithstanding sub. (1)," patient health care records "shall be released upon request without informed consent." ¶ 11 Wall's complaint alleges Pahl and Schimke accessed his patient health care records without informed consent and without "legitimate cause" to do so. Accepting these allegations as true for purposes of this appeal, Pahl and Schimke nevertheless argue Wall's Wis. Stat. § 146.82 claim fails because Wall has not alleged they "released" any of his patient health care records. Pahl and Schimke contend the statutory term "release" requires disclosure of patient health care records or the information contained therein to someone outside the organization holding the records. In contrast, Wall contends that, whenever an employee of a health care organization accesses a patient's records, the organization has "released" the records to the employee for purposes of § 146.82. ¶ 12 The term "release" is not defined in Wrs. Stat. ch. 146. When a statutory term is undefined, its ordinary and accepted meaning can be established by reference to a recognized dictionary. Door Cty. Highway Dep't v. DILHR, 137 Wis. 2d 280, 293-94, 404 N.W.2d 548 (Ct. App. 1987). Here, however, the relevant dictionary definitions are unhelpful. One dic 726 tionary defines "release" in the relevant context as "allow (information) to be generally available" and provides the example "no details about the contents of the talks were released." New Oxford American Dictionary 1438 (2001). Another dictionary defines "release" as "to permit to be issued, published, etc." Webster's New World Dictionary 404 (1979). Both of these definitions can reasonably be read as encompassing both the dissemination of information to someone outside the organization holding the information and the internal dissemination of information from an organization to its employee. ¶ 13 Although dictionary definitions do not clarify the meaning of the term "release" as it is used in Wis. Stat. § 146.82, a statutory term is not ambiguous if its meaning can be discerned when read in context with surrounding or closely related statutes. See Kalal, 271 Wis. 2d 633, ¶ 46. Here, Pahl, Schimke, and the Wisconsin Hospital Association urge us to look to Wis. Stat. § 146.816 for guidance. ¶ 14 Wisconsin Stat. § 146.816 is entitled "Uses and disclosures of protected health information." Enacted in 2013, § 146.816 was intended to "change[] state confidentiality laws on patient health care records ... to more closely track. . . [HIPAA]."6 Laura Rose, Wis. Legislative Council Act Memo: 2013 Wis. Act 238, Patient Health Care Records Confidentiality (May 19, 2014), http://docs.legis.wisconsin.gov/2013/ related/lcactmemo/act238.pdf. Under § 146.816, a cov 727 ered entity7 that uses, discloses, or requests disclosure of protected health information8 in a patient health care record is exempt from the confidentiality requirements of Wis. Stat. § 146.82, the statute at issue in this case, if the use, disclosure, or request for disclosure complies with federal regulations and is made for the purposes of treatment, payment, or health care operations. See § 146.816(2); see also Wisconsin Legislative 728 Council Act Memo: 2013 Wis. Act 238, Patient Health Care Records Confidentiality. ¶ 15 Wisconsin Stat. § 146.816 expressly distinguishes between "use" and "disclosure" of protected health information and defines those terms by reference to 45 C.F.R. § 160.103. As used in § 146.816, "disclosure" means "the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information," 45 C.F.R. § 160.103, and includes "redisclosures and rereleases of information," § 146.816(l)(c). "Use," in turn, means "with respect to individually identifiable health information, [9] the sharing, employment, application, utili 729 zation, examination, or analysis of information within an entity that maintains such information." Sec. 146.816(l)(i); 45 C.F.R. § 160.103. ¶ 16 Notably, the term "disclosure" in Wis. Stat. § 146.816(l)(c) incorporates the term "release." See 45 C.F.R. § 160.103. Accordingly, "release" is one means of "disclosure" under 45 C.F.R. § 160.103. In addition, "disclosure" expressly refers only to disseminating information "outside the entity holding the information." Id. Conversely, the term "use" refers to the handling of information within the entity holding the information. See § 146.816(l)(i); 45 C.F.R. § 160.103. The latter is akin to what Pahl and Schimke are alleged to have done in this case. Thus, at first blush, reading Wis. Stat. § 146.82 in context with § 146.816 supports Pahl and Schimke's argument that they did not "release" Wall's patient health care records because Wall does not allege they revealed any information from those records to anyone outside Gundersen. ¶ 17 There are, however, potential weaknesses in this analysis. First, the definition of "disclosure" in 45 C.F.R. § 160.103 can be read in two ways. Again, under that regulation, "disclosure" means "the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information." Id. In this definition, the modifier "outside the entity holding the information" could be read as applying to each of the preceding terms describing what is being done with the information, that is "release," "transfer," "provision of access to," and "divulging in any manner." If that reading were cor 730 rect, it could suggest that the term "release," by itself, is not limited to the dissemination of information to persons outside the entity holding the information — if the unmodified term "release" included only the provision of information to persons outside the entity, the modifier "outside the entity holding the information" arguably would be unnecessary. ¶ 18 Conversely, one could also read the phrase "outside the entity holding the information" as modifying only the term describing what is being done with the information that immediately precedes it — that is, "divulging in any manner." Under this reading, the term "disclosure," as defined in 45 C.F.R. § 160.103, would simply include "release," without specifying whether the release of information was to someone inside or outside the organization holding the information. We have already concluded the term "release," on its own, can reasonably be read as encompassing both the dissemination of information within an organization and to persons outside the organization. Thus, without the modifier "outside the entity holding the information," the term "release" in 45 C.F.R. § 160.103 is arguably just as ambiguous as the term "release" in Wis. Stat. § 146.82. ¶ 19 There is an additional and even more compelling problem with using the definitions of "disclosure" and "use" that are set forth in 45 C.F.R. § 160.103 and incorporated into Wis. Stat. § 146.816 to inform our understanding of the term "release" in Wis. Stat. § 146.82. Section 146.816(2) provides that § 146.82 "do[es] not apply to a use, disclosure, or request for disclosure of protected health information by a covered entity" if the use, disclosure, or request for disclosure complies with the relevant federal regulations and is for the purposes of treatment, payment, 731 or health care operations.10 If the term "release" in § 146.82 did not include the mere "use" of protected health information within an organization holding the information, there would be no need for § 146.816(2) to exempt certain "uses" of protected health information from § 146.82. This implies that the term "release" in § 146.82 encompasses both the "disclosure" and "use" of protected health information, as those terms are defined in § 146.816(1), because, if the converse were true, § 146.816(2)'s exemption of "uses" of protected health information from the requirements of § 146.82 would be superfluous. ¶ 20 As the preceding discussion shows, the interplay between Wis. Stat. § 146.816 and Wis. Stat. 732 § 146.82 is not clear cut, and interpreting the statutes in context with one another yields more questions than answers. Thus, even after considering the definitions of "use" and "disclosure" in § 146.816, the meaning of the term "release" in § 146.82 remains unclear. ¶ 21 Nevertheless, we observe that statutes must be interpreted reasonably, in order to avoid absurd or unreasonable results. See Kalal, 271 Wis. 2d 633, ¶ 46. Here, interpreting Wis. Stat. § 146.82 to apply to the dissemination of patient health care records from the organization holding the records to its own employees would assuredly lead to unreasonable results. ¶ 22 Employees of health care organizations routinely access numerous patient health care records each day. If Wall were correct that Wis. Stat. § 146.82 applies each time an employee accesses a patient's health care records, giving rise to a private right of action against the employee, see Wis. Stat. § 146.84(1), health care employees would be liable not only for intentionally accessing patient health care records without informed consent or a valid purpose, but also for merely accidentally accessing a patient's records. Furthermore, when sued by a patient, possibly years after the fact, an employee would be faced with the difficult, potentially impossible, task of proving why he or she accessed a particular patient record in order to show that the access fell within one of the permissible circumstances set forth in § 146.82(2). For these reasons, we agree with Pahl and Schimke that interpreting § 146.82 to apply to internal use of patient health care records would run the risk of entering into a field with "no sensible or just stopping point." See Hoida, Inc. v. M&I Midstate Bank, 2006 WI 69, ¶ 41, 291 733 Wis. 2d 283, 717 N.W.2d 17 (quoting Colla v. Mandella, 1 Wis. 2d 594, 599, 85 N.W.2d 345 (1957)). ¶ 23 Moreover, as a practical matter, if Wall's interpretation were correct, health care organizations would be forced to put in place systems that either verified an employee's access was permissible each time he or she tried to access a patient record or required the employee to document his or her reasons for accessing a record each time he or she did so. Simply put, Wall's interpretation would "place too unreasonable a burden" on health care organizations and their employees. See id. (quoting Colla, 1 Wis. 2d at 599). We cannot fathom that the legislature intended to impose that type of burden when it enacted Wis. Stat. § 146.82. ¶ 24 Wall complains that interpreting the term "release" in Wis. Stat. § 146.82 to include only the dissemination of information outside the entity holding patient health care records means that "employees can have unlimited access" to patient health care records, and a "violation only occurs when they tell someone else." Although we recognize Wall's concern about health care organizations' employees accessing patient records for illegitimate reasons, contrary to Wall's assertion, our opinion in this case does not give those employees carte blanche to access patient records for nefarious purposes without consequence. We merely hold that an employee's internal access to patient records is not the type of conduct governed by § 146.82. Internal use of protected health information is, however, extensively regulated by HIPAA, which sets forth civil and criminal penalties for violations. See 42 U.S.C. § 1320d-5. 734 ¶ 25 Admittedly, HIPAA does not create a private right of action for improper use of protected health information. See Seaton v. Mayberg, 610 F.3d 530, 533 (9th Cir. 2010); Acara v. Banks, 470 F.3d 569, 572 (5th Cir. 2006). However, that fact actually supports our interpretation, as it suggests the United States Congress was also concerned about the ramifications of imposing a private right of action for the wrongful dissemination of protected health information. If Wall believes a private right of action is warranted for the conduct at issue in this case, he should direct that argument to the legislature. Given the uncertainty created by the interaction between Wis. Stat. §§ 146.816 and 146.82, a legislative review of these statutes would likely be beneficial in any event. f 26. For the reasons discussed above, we conclude Wis. Stat. § 146.82 does not apply when a health care organization's employee merely accesses a patient health care record, without disclosing any information from the record to anyone outside the organization. Because § 146.82 does not apply to the conduct at issue in this case, the circuit court properly dismissed Wall's claims against Pahl and Schimke. II. Wall's claim against Gundersen I 27. The circuit court also properly dismissed Wall's claim against Gundersen.11 Wall's complaint alleges that after Gundersen completed its investiga 735 tion into why Pahl, Schimke, and a third employee accessed Wall's records and whether they had legal authorization to do so, it concealed the results of that investigation from Wall. The complaint therefore alleges Gundersen "blocked and hindered" Wall from investigating its employees' access to his records. The complaint asserts these acts violated Wis. Stat. § 146.83(4)(b), which provides that no person may "[c]onceal or withhold a patient health care record with intent to prevent or obstruct an investigation or prosecution or with intent to prevent its release to the patient. . . ." ¶ 28 Wall's claim against Gundersen fails because Wis. Stat. § 146.83(4)(b) clearly and unambiguously applies only to the concealment or withholding of "patient health care recordfs]." As relevant here, the term "patient health care records" means "all records related to the health of a patient prepared by or under the supervision of a health care provider [.]" Wis. Stat. § 146.81(4). This definition has three salient facets, for purposes of this case. First, a patient health care record must be a "record." The statutory definition does not encompass mere information that is not reduced to a record. See State v. Straehler, 2008 WI App 14, ¶¶ 19-20, 307 Wis. 2d 360, 745 N.W.2d 431 (holding that a nurse's verbal statements based on observations about a patient's condition were not patient health care records). Second, the record must have been prepared by or under the supervision of a health care provider. See § 146.81(4). Third, the record must relate to the patient's health. See id. 736 ¶ 29 Wall's complaint does not allege that Gundersen concealed or withheld any patient health care records, as that term is defined in Wis. Stat. § 146.81(4). The complaint merely alleges Gundersen "concealed the results of the investigation into why [its employees] had accessed [Wall's] health care records and authority for the access." In other words, Wall alleges Gundersen concealed and withheld the information it obtained when it conducted an internal investigation into its employees' actions. He does not allege Gundersen withheld any record. In addition, any records Gundersen might have kept regarding its internal investigation would not have related to Wall's health or any treatment or services Wall received. Accordingly, such information, even if reduced to a record, would not have constituted a patient health care record as that term is defined by statute. Wall's complaint therefore fails to state a claim that Gundersen violated Wis. Stat. § 146.83(4)(b) by concealing or withholding patient health care records.12 By the Court. — Orders affirmed. Footnotes [1] All references to the Wisconsin Statutes are to the 2013-14 version unless otherwise noted. [2] The complaint also alleged a third employee had accessed Wall's health care records. However, that employee was not named as a defendant. [3] Wisconsin Stat. § 146.84(1) imposes civil liability for violations of Wis. Stat. §§ 146.82 and 146.83. [4] At our request, the Wisconsin Hospital Association and Disability Rights Wisconsin submitted amicus briefs in this appeal. We thank both entities for their participation in this matter. [5] The term "patient health care records" is defined as: all records related to the health of a patient prepared by or under the supervision of a health care provider; and all records made by an ambulance service provider, as defined in s. 256.01(3), an emergency medical technician, as defined in s. 256.01(5), or a first responder, as defined in s. 256.01(9), in administering emergency care procedures to and handling and transporting sick, disabled, or injured individuals. "Patient health care records" includes billing statements and invoices for treatment or services provided by a health care provider and includes health summary forms prepared under s. 302.388(2). "Patient health care records" does not include those records subject to s. 51.30, reports collected under s. 69.186, records of tests administered under s. 252.15(5g) or (5j), 343.305, 938.296(4) or (5) or 968.38(4) or (5), records 725 related to sales of pseudoephedrine products, as defined in s. 961.01(20c), that are maintained by pharmacies under s. 961.235, fetal monitor tracings, as defined under s. 146.817(1), or a pupil's physical health records maintained by a school under s. 118.125. Wis. Stat. § 146.81(4). [6] WISCONSIN Stat. § 146.82 was enacted in 1979. See 1979 Wis. Laws, ch. 221, § 649t. Those portions of the statutory language that are relevant to this case have not changed since that time. [7] WISCONSIN Stat. § 146.816(l)(b) specifies that "covered entity" has the meaning given in 45 C.F.R. § 160.103, which defines the term as: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. [8] "Protected health information" is defined in Wis. Stat. § 146.816(l)(f) by reference to 45 C.F.R. § 160.103, which provides: Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (1) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years. [9] "Individually identifiable health information" means: information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual. 45 C.F.R. § 160.103. "Health information," in turn, means: any information, including genetic information, whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care 729 to an individual; or the past, present, or future payment for the provision of health care to an individual. Id. [10] Wisconsin Stat. § 146.816(2) reads in full: Sections 51.30(4)(a) and (e) and 146.82 and rules promulgated under s. 61.30(12) do not apply to a use, disclosure, or request for disclosure of protected health information by a covered entity or its business associate that meets all the following criteria: (a) The covered entity or its business associate makes the use, disclosure, or request for disclosure in compliance with 45 CFR 164.500 to 164.534. (b) The covered entity or its business associate makes the use, disclosure, or request for disclosure in any of the following circumstances: 1. For purposes of treatment. 2. For purposes of payment. 3. For purposes of health care operations. Wisconsin Stat. § 51.30(4)(a) and (e) and the rules promulgated under § 51.30(12) pertain to the confidentiality of records created in the course of providing services to individuals for mental illness, developmental disabilities, alcoholism, or drug dependence. See § 51.30(l)(am), (b). Like Wis. Stat. § 146.82, § 51.30(4)(a) and (e) and the rules promulgated under § 51.30(12) refer to the "release" of these records. [11] Although we affirm the order dismissing Wall’s claim against Gundersen, we do so for different reasons from those relied on by the circuit court. See State v. Gribble, 2001 WI App 735 227, ¶ 27 n.10, 248 Wis. 2d 409, 636 N.W.2d 488 ("[W]e may affirm a trial court's ruling on a question of law on a different ground than that relied on by the trial court."). [12] In attempt to bolster his claim that Gundersen violated Wis. Stat. § 146.83(4)(b), Wall cites a letter he sent to Gundersen requesting "a copy of the authorization by which and the reason" why each employee accessed his records. He also cites a letter he received in response from Gundersen's associate general counsel. However, these letters are neither attached to the complaint nor referenced in it. As such, we may not consider them. See Data Key Partners v. Permira Advisers LLC, 2014 WI 86, ¶ 19, 356 Wis. 2d 665, 849 N.W.2d 693 (On review from a circuit court's decision on a motion to dismiss, we are limited to the facts alleged in the complaint.).