Koos v. Medical Staff of Ronald Reagan etc. CA2/4

Filed 11/29/22 Koos v. Medical Staff of Ronald Reagan etc. CA2/4 NOT TO BE PUBLISHED IN THE OFFICIAL REPORTS California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for publication or ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication or ordered published for purposes of rule 8.1115. IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA SECOND APPELLATE DISTRICT DIVISION FOUR BRIAN J. KOOS, B315136 Plaintiff and Appellant, (Los Angeles County Super. Ct. No. 19STCP04685) v. MEDICAL STAFF OF RONALD REAGAN UCLA MEDICAL CENTER et al., Defendants and Respondents. APPEAL from a judgment of the Superior Court of Los Angeles County, Mitchell L. Beckloff, Judge. Affirmed. Fenton Law Group, Henry R. Fenton, Dennis E. Lee for Plaintiff and Appellant. Nelson Hardiman, Sara Hersh, Sarvnaz Mackin for Defendants and Respondents. Physician and medical school professor Dr. Brian Koos, M.D., Ph.D. accessed unredacted medical records of patients he did not treat and shared those records with a physician unaffiliated with the hospital and school. Respondent Medical Staff of Ronald Reagan UCLA Medical Center (the Medical Staff) charged Koos with violations of the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 U.S.C. § 1320d et seq.) and UCLA policies and bylaws.1 A hearing panel of the Medical Staff found the charges substantiated and disciplined Koos by imposing a suspension and fine and requiring him to complete a course on medical records or medical ethics. An administrative appeal board upheld the findings and discipline. The superior court denied Koos’s petition for writ relief. In this appeal, Koos contends the decisions of the Medical Staff hearing panel and appeal board are not supported by their findings, which themselves are not supported by the evidence. Specifically, Koos contends his conduct was proper as a matter of law because it was authorized by written patient consent forms, fell within the “healthcare operations” exception to HIPAA, and was required by policies of UCLA’s accrediting body. We reject these contentions and affirm the judgment of the superior court. 1 Respondents in this matter identify themselves as “Ronald Reagan UCLA Medical Center Medical Staff, sued as Medical Staff of Ronald Reagan UCLA Medical Center [and] Regents of the University of California.” Neither UCLA nor the medical school, whose official name is the David Geffen School of Medicine at UCLA, is a party to the case. — 2 — BACKGROUND I. Underlying Events The following evidence was elicited at Koos’s hearing before a hearing panel consisting of three physician members of the Medical Staff and presided over by a legally trained hearing officer. Koos is a physician who is board-certified in obstetrics and gynecology. He has worked at the UCLA medical school for over 30 years and has been a full professor there since 1993. His responsibilities include acting as an attending physician; in that capacity, he supervises and evaluates resident physicians. Koos and other UCLA medical school physicians, residents, and fellows attend weekly “stats conferences,” at which residents give presentations about cases they worked on during the preceding week. During the stats conference on April 13, 2018, resident Dr. Clara Chan presented a case involving the delivery of an infant born in a “depressed” state with Apgar scores of 0/0/0. During the presentation, Chan referred to the mother as “Patient A” and the infant as “Patient B,” a convention the parties use and we adopt here. Chan testified that all cases presented during stats conferences are presented in this “completely deidentified” manner: all names, medical record numbers (MRNs), and other protected health information (PHI) are redacted. During the presentation, Chan discussed various aspects of the case, including Patient B’s “fetal heart tracing,” and reviewed the clinical decisions made by the treatment team. Chan testified that no one in attendance, including Koos, requested further review of the case when the presentation concluded. Koos — 3 — testified that he had raised his hand, but was never recognized or given an opportunity to present his thoughts on the case. Chan testified that Koos approached her immediately after the conference and asked her to give him Patient A and Patient B’s MRNs. Chan thought the request was unusual, as Koos was not part of the treatment team and she had not asked him to review the records. Chan did not provide Koos with the MRNs at that time. Koos did not dispute that he spoke to Chan after the conference. However, he testified that he first spoke to Dr. Carla Janzen, a maternal fetal medicine specialist who also served on the Quality Assurance Evaluating Committee. Koos told Janzen he was “very upset” by Chan’s presentation, because no one had been able to explain Patient B’s “anomalous heart rate tracing” or other issues in the case. Koos testified that he told Janzen the case needed further review, but she responded, “‘we don’t have the expertise to do that. And in any case, the case is closed.’” Koos testified that he believed closing the case without further review was against the “sentinel events” policy of the hospital’s accreditation body, the Joint Commission, which required a “root cause analysis.” We discuss “sentinel events” and this project below. Three days later, on April 16, 2018, Koos requested Patient A and Patient B’s MRNs from Chan via email. Chan stated during an interview with Derek Kang, UCLA Health Sciences Chief Compliance and Privacy Officer, that she felt “compelled” to provide Koos with the requested information, because he was one of her supervisors. On April 19, 2018, Koos called a different resident, Dr. Julie Hein, and asked her how to locate fetal heart rate tracings — 4 — of patients who, like Patient A and Patient B, been discharged from the hospital. Hein testified that she “walked him through it on the phone, what to click on, what steps to take.” Hein stated that Koos called her back a few minutes later and asked the same questions specifically with respect to Patient A. Koos provided Hein with Patient A’s MRN, and Hein accessed Patient A’s electronic medical records so she could “talk him through it.” Logs from the electronic medical records system show that Koos and Hein accessed Patient A’s records around the same time on the morning of April 19, 2018. On April 20, 2018, Koos called Chan and asked her how to access fetal heart tracings in the electronic medical records system. Chan talked him through the process. Logs show that Koos accessed Patient A’s records again that morning. Chan testified that she was in the resident work room on the labor and delivery floor later that morning. Koos entered the employees-only room with Dr. Barry Schifrin, who did not work at UCLA.2 Koos asked Chan to pull up Patient B’s fetal heart tracing on the desktop computer. Chan complied, though she was “very uncomfortable” because Koos was not Patient B’s treating physician and Schifrin was “a stranger” to her. Chan testified that there were two computer monitors on the desktop, and one of them displayed Patient B’s medical records while the other displayed the fetal heart tracing. The records and tracing were 2 Schifrin testified that he was a specialist in obstetrics and gynecology, particularly high-risk pregnancies. At the time of the events in this case, he was on the faculty at Western University of Health; he previously had been on the full-time and clinical faculties at USC. Schifrin estimated that he had given approximately six lectures at UCLA over the years, and regularly attended “Grand Rounds” lectures that were open to the public. — 5 — unredacted, and PHI was visible. Photos of the room taken later showed additional monitors displaying patient data mounted on the walls. Koos testified that, at the time of the incident, the monitors in the room showed only de-identified information. He acknowledged during cross-examination that information about “vaginal examination, [and] the patient’s name” was visible, but stated that was “not personally identifiable information.” Koos asked Chan to “move through the fetal heart tracing to show Dr. Schifrin what was happening on the fetal heart tracing.” While she was doing so, “Dr. Schifrin would comment on the fetal heart tracing” and “continue to ask [Chan] to move forward.” After a few minutes, an attending physician, Dr. Tina Nguyen, entered the resident work room. Nguyen, who testified she was surprised to see Koos and Schifrin, asked Koos if “this was sanctioned.” Nguyen testified that Koos responded, “I sanctioned it.” Both Chan and Nguyen testified that Nguyen then stepped out of the room. Nguyen explained that she did so to telephone Dr. Deborah Krakow, the chair of the obstetrics and gynecology department, and inform her that Koos and Schifrin were looking at Patient B’s medical records. Krakow instructed Nguyen to put Koos on the phone, which she did. The contents of the call are disputed but not relevant. Chan testified that while Koos was outside the room on the phone, Schifrin continued directing her to move forward in the tracing and commenting on its contents. Another resident physician who was in the room, Dr. Ilina Datkhaeva, testified that Schifrin’s comments included things like, “‘That doesn’t look very good,’” and “‘That’s not what I would have done.’” Datkhaeva also testified that Schifrin looked at and remarked upon other monitors visible in the room that contained PHI about — 6 — patients currently admitted to the hospital. Datkhaeva discreetly paged Chan and told her to “stop.” Chan then closed the fetal heart tracing. Koos returned to the room, and he and Schifrin left. Later that day, Koos emailed Krakow the following, with the subject, “Follow UP”: “Sorry about Barry. He came by to talk and I remembered an unconventional [fetal heart rate] case that was presented last week. Barry is very interested in teaching, and I thought he could contribute to the heart rate analysis. As you probably know, the infant was severely depressed even though the fetus was not asphyxiated. I have worked with him for a long time and felt comfortable showing him the [fetal heart tracing] strip. I did not realize that this was a problem until I talked to you. I realize now that I did not take into consideration the reputation he apparently has by some. Obviously, I should have asked you first before showing him the tracing. [¶] In any case, I am indeed sorry for the aggravation. We left . . . after you called. He only saw the initial part of the tracing. Barry just wants to teach. But I understand your concern. Maybe we can talk about it later.” II. Investigation and Charges Shortly after the above events, compliance officer Kang received a report that Koos “brought an unauthorized individual into a resident room and had requested and authorized access of a patient’s records for this unauthorized individual.” Kang consulted the data logs for Patient A and Patient B’s electronic medical records and conducted fact-finding interviews with several people, including Chan, Hein, Nguyen, Krakow, and Koos. — 7 — According to Kang’s notes, which were admitted into evidence at the hearing over Koos’s hearsay objection, Koos confirmed during his April 23, 2018 interview that he asked Chan for Patient A and Patient B’s MRNs even though he did not have patient relationships with them. Koos told Kang that he had not spoken with anyone on the patients’ care team about the case or the fetal heart data, or “discussed his thoughts regarding the fetal monitoring data . . . or engaged in the dialogue with his peers at the STATS meeting in which the case was discussed.” He told Kang he “was curious if the baby had suffered any brain damage” and “he had a suspicion about the case and wanted to confirm it in his own mind.” Koos told Kang that Schifrin was a “renowned expert in fetal monitoring and that he wanted Schifrin’s opinion on the case,” even though he did not have consent or authorization from Patient A for Schifrin to review the records. Koos and Schifrin had been collaborating on some research and had a pre-arranged appointment on April 20, 2018; Koos “took the opportunity to bring Dr. Schifrin to view the record with him.” Koos stated he was unaware that PHI was visible on the computer screen, and the fetal monitoring data he and Schifrin viewed “did not have any PHI displayed.” Koos also stated that Schifrin stood at least six feet behind Chan while viewing the tracing.3 Koos initially told Kang there were no other monitors on the wall in the resident work room, though later in the interview he conceded Kang was “probably right” that such monitors were present and “there was patient information on those monitors.” 3 Both Chan and Nguyen told Kang that Schifrin had been seated next to Chan, directly in front of the monitors. Schifrin testified that he stood behind Chan. — 8 — Koos said Nguyen entered the resident work room while he and Schifrin were viewing the record and “became very upset.” When she asked him what he was doing, he told her “they were viewing the record for teaching purposes.” Later in the interview, however, Koos said he did not provide any teaching to Chan, Hein, or any other resident, and the residents who had been in the room “would likely not agree that there was a teaching purpose” behind Koos and Schifrin’s visit.4 When asked if Schifrin had provided teaching, “Koos said that Schifrin made comments about the fetal monitoring tracing.” Nguyen told Koos that Krakow wanted to speak to him, and he stepped out of the room to take the call. Koos said he had difficulty hearing Krakow due to a bad connection, though he tried to explain what he and Schifrin had been doing. Koos acknowledged that Krakow had not authorized the activity, and that sharing PHI with Schifrin “was not sanctioned by the department.” On April 24, 2018, Koos sent Kang a letter stating that his goals were to “improve patient care and increase the rigor of medico-legal opinions” and “promote an accurate understanding of fetal physiology, including cerebral blood regulation.” Koos also stated that his lengthy relationship with Schifrin, “respect for his fund of knowledge and expertise, his interest in improving patient care, [and] dedication to teaching” led him to believe that Schifrin “would give confidential and much needed teaching insight into this seemingly contradictory case.” Koos noted he had a “strong belief that appropriate care was given by our obstetrical team” and “emphasize[d] that Dr. Schifrin neither 4 Indeed, both Datkhaeva and Chan testified that they did not consider the interaction to be “teaching.” — 9 — accessed UCLA patient records nor saw patient identifiers, including names and medical record numbers.” Koos stated that to his knowledge, his department “does not have a formal process to review all abnormal fetal heart rate records,” and “this deficiency is a major contributor to ad hoc assessments.” He requested that Kang send him a copy of the report he was preparing. On April 24, 2018, Kang sent Koos and the Medical Staff a confidential memorandum summarizing his investigation. Kang opined that Koos’s actions “do not meet the regulatory or UCLA Health policy approved purposes for accessing a patient’s medical record.” Kang cited three UCLA Health policies: HS-9401, Protection of Confidential Patient Information (PHI); HS-9412, Authorization for Use/Disclosure of PHI; and HS-1352, Family/Visitor Access. Two days later, on April 26, 2018, Koos sent a letter to Dr. Carlos Lerner, Vice Chief of the Medical Staff. Koos noted that Chan’s presentation “did not provide an explanation for the adverse neonatal outcome” suffered by Patient B. Koos stated that he suspected “a fetal stroke,” based on a similar case from a few years ago, but he “did not fully express [his] thoughts at the time because [he] needed further information.” Koos therefore “accessed the patient’s records in an ad hoc quality review to substantiate [his] suspicions regarding the etiology of the injury and to determine whether the obstetrical care was appropriate.” He explained that he “planned to reveal [his] findings to the care providers (who wanted an explanation for the unexpected outcome) as well as to other residents, trainees, and attending physicians,” and “would also inform the Department Chair.” Koos also repeated, essentially verbatim, the assertions about — 10 — Schifrin’s expertise and failure to view PHI that he made in the letter to Kang. Koos added that his “Department has a long tradition of . . . clinicians providing management advice and direction for patients not under their direct care,” and “[a]d hoc reviews by qualified physicians are common.” He further stated that the “unfavorable outcome demanded timely discussion for teaching and improving patient care,” and opined that “[p]rotocols for patient confidentiality at UCLA Medical Center should not impede education or advances in medical care.” On May 22 and June 28, 2018, the Medical Staff Executive Committee, consisting of approximately 30 physicians, met and discussed the matter. The committee concluded that Koos’s “activities did not constitute any form of appropriate practice,” and there was “no authorized or appropriate reason, legally or in policy, for Dr. Koos to have granted access to Dr. Schifrin.” The committee recommended Koos pay a $25,000 fine, receive a 90day suspension from the Medical Staff and a potentially longer suspension from resident training, and complete a two-day course in medical record keeping or medical ethics. On July 3, 2018, Lerner sent Koos a “Notice of Proposed Action” outlining the committee’s findings and recommendations and advising him of his right to a hearing under the Medical Staff bylaws. Koos requested a hearing. On August 16, 2018, Lerner sent Koos a “Notice of Hearing and Notice of Charges.” Charge No. 1 alleged that Koos violated HIPAA and UCLA Medical Center Policies HS-9401 and HS-9412 when he “gained unauthorized access to the medical records of a UCLA patient and [ ] caused an outside, non-treating, non-UCLA physician to gain access to identified medical records of a UCLA patient.” Charge No. 2 alleged that Koos violated the same — 11 — provisions when he “facilitated unauthorized access to Dr. Barry Schifrin to view confidential medical information absent consent and authorization.” Charge No. 3 alleged that Koos violated HIPAA and UCLA Medical Center Policies HS-9401, HS-9412, and HS-1352 when, “absent permission of Ronald Reagan UCLA Medical Center [he] allowed Dr. Schifrin, a non-member of the medical staff or the faculty, unauthorized access to the Labor and Delivery Floor and the Resident Work Room where confidential patient information is continuously displayed.” Charge No. 4 alleged that Koos violated Articles 3.2.1 and 3.3.1(d) of the Medical Staff Bylaws by improperly obtaining “PHI of patients (and access to the medical records) with whom [he] had no treatment relationship and no authorized purpose.” III. Hearing and Decision A hearing panel composed of three physician members of the Medical Staff heard the matter over non-consecutive days in January, February, and March 2019. Koos and the Medical Staff were represented by counsel, and an attorney served as the hearing officer. During the hearing, Koos testified extensively that his conduct was for the purposes of “patient safety” and “quality assessment and improvement,” and therefore fell within the “healthcare operations” exception set forth in HIPAA. Koos also maintained the fetal heart tracing “was a de-identified record,” and his review was required under by the Joint Commission’s “sentinel events” policy discussed below. He conceded, however, that there “might be other alternatives” to ensure the material he provided to Schifrin did not contain PHI, “but that wouldn’t have been time efficient because this happened to be on a Friday, and he would have to be present, and — 12 — we wanted to evaluate this.” Both Koos and the Medical Staff filed written closing briefs. The hearing panel issued a written decision in May 2019. It made the following factual findings, from which we omit record citations. “1) Dr. Koos was not a member of the treatment team for Patient A or Patient B. He did not discuss the case with the actual care team or the attending physician. No evidence was introduced to show that he was asked by any of the treatment team to review the case of Patient A or Patient B. He did not obtain authorization for an outside review from the Department Chair, the patient, the Medical Staff, or the Medical Center. “2) In early April 2018, Patient B was born with Apgar scores of 0/0/0. . . . [A]t the regular Obstetrical Statistics (Stats) Conference held on April 13, 2018, the case was presented in detail, and in de-identified fashion, by the Chief Resident, Dr. Carla [sic] Chan. Following the detailed presentation at the Stats Conference, the group of MFMs (Maternal Fetal Medicine specialists trained in high risk pregnancies with skills in the interpretation of fetal monitor tracings), along with Residents, fellows and attendings, concluded that the case could not have been predicted from the tracing and the outcome. Days after the Stats Conference, Dr. Koos contacted Residents involved in the patient’s treatment, and sought information regarding their Patients A and B. Dr. Koos directed Residents Chan and Hein to disclose to him the identity of the patient medical record numbers for Patient A and Patient B. Thereafter, Dr. Koos directed the Residents to open the electronic medical records for him and with that access, Dr. Koos remotely opened the records and viewed the — 13 — patients’ medical histories, diagnostic test results, clinic records, and other healthcare information. “3) On Friday, April 20, 2019 [sic], without authorization, Dr. Koos brought a non-UCLA physician to a Medical Center patient floor and requested a Resident to access the electronic patient medical records of Patient A and B, and show the records to the unauthorized, non-treating, non-UCLA physician, Dr. Barry Schifrin for his review. There was no scheduled meeting or conference on that date. This review occurred in restricted patient care space, the Residents Room, located on the Labor and Delivery floor. In that Resident space, patient medical information was openly displayed for continuous monitoring by the Residents. . . . “4) On April 20, 2018, when Dr. Koos and Dr. Schifrin were seen by Dr. Nguyen inside the Resident’s [sic] Room viewing the medical record, Dr. Nguyen asked who had sanctioned this activity, whereupon Dr. Koos responded ‘I sanctioned it.’ Subsequently, Dr. Koos claimed that enabling Dr. Schifrin to have access to the Residents Room to view patient information constituted Dr. Koos’ own ‘ad hoc review’ and that Dr. Barry Schifrin was part of Dr. Koos’ two person ‘investigative team.’ “5) Dr. Koos’ multiple directives to Dr. Chan and Dr. Hein on April 15, 19, and 20, 2018 placed two Ob-Gyn Residents in the difficult position of following orders directed by their superior, causing them to also violate hospital polices and patient privacy. These concerns were reported and within three days of the events, an investigation was undertaken, Witnesses were interviewed by Chief Compliance Officer Derek Kang and the results of the interviews were reported to the Medical Staff and separately to the Privacy Disciplinary Action Committee of the — 14 — Medical Center. The Medical Staff conducted further fact finding, and determined what action should be taken. “6) The Hearing Panel noted varying explanations provided by Dr. Koos as to his reasons for accessing the patient charts. In his first explanation by email to the Department Chair, Dr. Krakow on April 20, 2018, Dr. Koos stated that the outside nonUCLA physician ‘Barry [Schifrin] is very interested in teaching and I thought he could contribute to the heart rate analysis.’ On April 23, 2018, Dr. Koos then stated to the Compliance and Privacy Officers that he and Schifrin were working on an article, and that he had verbally discussed the case with Schifrin prior to reviewing the record in the Resident Room, and that he wanted to show Schifrin the record . . . ‘in order to get his opinion.’ A third explanation occurred on April 24, 2018, in which Dr. Koos’ [letter] stated to the Compliance Officer that he desired ‘to improve patient care and increase the rigor of medico-legal opinions.’ Later, on April 26, 2018, Dr. Koos wrote a letter to the Vice Chief of Staff, Dr. Carlos Lerner, indicating for the first time that the patient’s records were accessed through the Residents for his personal ‘ad hoc quality review.’ Notwithstanding the above explanations, Dr. Koos testified at the hearing that the records of Patient A and Patient B contained a ‘sentinel event’ for which a root cause analysis was needed. Although Dr. Koos did not previously report this as a Sentinel Event to any committee. [sic]” IV. Administrative Appeal Pursuant to the Medical Staff Bylaws, Koos appealed the hearing panel’s findings and decision to an appeal board consisting of three different UCLA physicians. Koos and the Medical Staff were represented at the July 15, 2019 appellate — 15 — hearing by counsel, who made oral and written arguments on their behalf. The appeal board issued a written decision in August 2019, affirming the decision of the hearing panel. Under the Medical Staff Bylaws, the appeal board’s review was limited to determining whether Koos received a fair hearing, whether the hearing panel’s decision was reasonable and warranted, and whether any of the rules, bylaws, or policies the hearing panel relied upon were unreasonable or unwarranted. The appeal board also noted that Koos did “not dispute any facts cited by the Hearing Committee in its Decision, nor does Dr. Koos . . . raise any challenges to the accuracy or authenticity of any evidence, either testimonial or documentary, that was presented by the [Medical Staff] during the hearing.” The appeal board first rejected Koos’s contentions that he did not receive a fair hearing. Koos does not repeat these contentions here. The appeal board next considered whether the hearing panel’s conclusion that Koos violated HIPAA and UCLA policies was reasonable and warranted. The board rejected Koos’s contention that there was no evidence presented “as to ‘what federal or state regulation he allegedly violated under HIPAA.’” It found that “[t]hroughout the hearing, it was well-understood that the applicable HIPAA provisions were those commonly referred to as the ‘HIPAA Privacy Rule,’’ which are regulations that generally prohibit the disclosure of ‘individually identifiable health information’ (or ‘PHI’) without a patient’s authorization.” The board observed that Koos introduced as an exhibit “a detailed summary and explanation of the HIPAA Privacy Rule,” and that he “testified that the HIPAA Privacy Rule applied to him in these proceedings.” The appeal board concluded that, — 16 — “absent an exception, Dr. Koos’ conduct violated HIPAA and UCLA Policies.” The board was unpersuaded by Koos’s contention that the entirety of his conduct—both accessing the records and sharing them with Schifrin—fell within the health care operations exception. The appeal board noted that Koos changed his explanation for his actions several times during the investigation, and never referred to “sentinel event,” “root cause analysis,” or the health care operations exception until he took the stand at the hearing. It thus found “reasonable and warranted” the hearing panel’s determination that Koos’ arguments about the exception were “not credible.” The appeal board also rejected Koos’s alternative argument that his actions were authorized by Patient A’s written consent form. The board first found that Koos’s “unilateral decision” to investigate the case without UCLA authorization did not constitute one of the permissible “UCLA[ ] purposes, such as quality improvement, patient safety and education” that were authorized by the form. It further found that disclosure to Schifrin, a non-UCLA physician, was not a UCLA purpose, particularly in light of Koos’s testimony that he could have requested de-identified records but did not do so because it was not “time efficient” on a Friday. The board also found that the consent form allowed use of patient information only “in accordance with state and federal law,” and that criterion was not satisfied in light of Koos’s HIPAA violations. The appeal board also rejected Koos’s final argument that the hearing panel’s decision was arbitrary, unreasonable, and capricious. The board expressly found that the charges were — 17 — supported by “the evidence and testimony presented during the hearing.” V. Writ Proceedings On October 30, 2019, Koos filed a verified petition for writ of administrative mandate pursuant to Code of Civil Procedure section 1094.5. He requested that the superior court set aside the decision of the appeal board and the corrective actions it imposed because his “access to the patients’ records was for the purpose of healthcare operations defined by HIPAA” and was authorized by Patient A’s consent form. After receiving written briefing and reviewing the administrative record, the superior court issued a written tentative decision denying relief. In the tentative, the court explained Code of Civil Procedure section 1094.5, subdivision (b) limited its consideration to “whether the respondent has proceeded without jurisdiction, whether there was a fair trial, and whether there was a prejudicial abuse of discretion.” Because UCLA is a public hospital, the court used its independent judgment when determining whether the administrative findings were supported by the weight of the evidence. The court found that the weight of the evidence supported the conclusions that the healthcare operations exception to HIPAA was inapplicable, Patient A’s consent form did not authorize Koos’s actions, and Koos’s testimony about the healthcare operations exception was not credible. The court also found that the weight of the evidence supported the findings that Koos violated HIPAA, UCLA bylaw articles 3.2.1 and 3.3.1(d), and UCLA policies HS-9401 and HS-9412. The court agreed with Koos that policy HS-1352 regarding visitation was inapplicable, but concluded the weight of the evidence nevertheless supported — 18 — the findings on Charge No. 3 because the charge also cited HIPAA and policies HS-9401 and HS-9412. The court adopted its tentative after hearing oral argument from both sides. The court issued an order denying the writ on May 5, 2021 and entered judgment on July 29, 2021. Koos timely appealed. DISCUSSION I. Standard of Review “A hospital’s final decision in a peer review proceeding may be judicially reviewed by a petition for writ of administrative mandate.” (Ellison v. Sequoia Health Services (2010) 183 Cal.App.4th 1486, 1495 .) Here, the final decision is that of the appeal board. The inquiry in administrative writ proceedings “shall extend to the question of whether the respondent has proceeded without, or in excess of, jurisdiction; whether there was a fair trial; and whether there was any prejudicial abuse of discretion. Abuse of discretion is established if the respondent has not proceeded in the manner required by law, the order or decision is not supported by the findings, or the findings are not supported by the evidence.” (Code Civ. Proc., § 1094.5, subd. (b).) “Where it is claimed that the findings are not supported by the evidence, in cases in which the court is authorized by law to exercise its independent judgment on the evidence, abuse of discretion is established if the court determines that the findings are not supported by the weight of the evidence. In all other cases, abuse of discretion is established if the court determines that the findings are not supported by substantial evidence in the light of the whole record.” (Id., subd. (c).) The independent judgment test applies here because UCLA is a public hospital. (Cipriotti v. — 19 — Board of Directors of Northridge Hospital Foundation Medical Center (1983) 147 Cal.App.3d 144, 154 .) “Even when, as here, the trial court is required to review an administrative decision under the independent judgment standard of review, the standard of review on appeal of the trial court’s determination is the substantial evidence test.” (Fukuda v. City of Angels (1999) 20 Cal.4th 805, 824 .) Our function is essentially the same as the superior court’s. (Hongsathvij v. Queen of Angels/Hollywood Presbyterian Medical Center (1998) 62 Cal.App.4th 1123, 1136 (Hongsathvij).) We consider whether the appeal board applied the correct standard when it conducted its review of the evidence and, if so, whether its decision was supported by substantial evidence. (Ellison v. Sequoia Health Services, supra, 183 Cal.App.4th at p. 1496 .) We afford no deference to the superior court’s decision (id. at p. 1495), but “must uphold administrative findings unless the findings are so lacking in evidentiary support as to render them unreasonable.” (Hongsathvij, supra, 62 Cal.App.4th at p. 1137 .) II. Analysis A. Healthcare Operations Exception Koos contends he did not violate HIPAA or UCLA policies HS-9401 and HS-9412 because his conduct was permissible under the “health care operations” exception. We disagree. HIPAA is a federal law. (See Brown v. Mortenson (2011) 51 Cal.4th 1052, 1066 .) In connection with its 1996 passage, Congress tasked the Department of Health and Human Services “with promulgating regulations setting forth national medical information privacy standards.” (Ibid.) The resultant “wealth of detailed regulations” are codified at 45 C.F.R. §§ 160 , 164 and are commonly known as the “Privacy Rule.” (Ibid.; see also 42 C.F.R. — 20 — § 3.20 (“HIPAA Privacy Rule means the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), at 45 CFR part 160 and subparts A and E of part 164.”).) As relevant here, the Privacy Rule generally prohibits the disclosure of PHI, defined as “individually identifiable health information . . . [t]ransmitted or maintained in any . . . form or medium.” ( 45 C.F.R. §§ 160.103 , 164.502(a).) “Individually identifiable health information” includes health information, collected from an individual that is received by a health care provider and “[r]elates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual;” and “identifies the individual” or “[w]ith respect to which there is a reasonable basis to believe the information can be used to identify the individual.” ( 45 C.F.R. § 160.103 .) Entities subject to HIPAA may disclose PHI “[f]or treatment, payment or health care operations, as permitted by and in compliance with [45 C.F.R.] § 164.506.” ( 45 C.F.R. § 164.502 (a)(1)(ii).) “Health care operations” include “[c]onducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities.” ( 45 C.F.R. § 164.501 .) They also include “patient safety activities,” which encompass “[e]fforts to improve patient safety and the quality of health care delivery.” ( 45 C.F.R. § 164.501 ; 42 C.F.R. § 3.20 .) UCLA policy HS-9401, Protection of Confidential Patient Information (Protected Health Information (PHI)), “sets forth — 21 — guidelines for protecting and maintaining the confidentiality” of PHI as required by the HIPAA Privacy Rule and California law. Like the Privacy Rule, it provides that “Members of the UCLA Workforce may not disclose, share, or otherwise use any individually identifiable health information except for Treatment, Payment and Health Care Operations (referred to hereafter as ‘TPO’) unless expressly authorized by the patient or otherwise permitted or required by law.” Its definition of PHI is similar to the HIPAA definition, including “any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, . . . , or other information that, alone or in combination with other publicly available information, reveals the individual’s identity.” The policy also expressly provides that “[a]ll information contained in patient medical . . . records is confidential regardless of format,” and gives as examples “medical record numbers,” “case histories,” and “information orally communicated about a particular patient.” Additionally, HS-9401 requires “[a]ll members of the UCLA Health Workforce” to “make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose,” and states that Workforce members “should only access and use PHI as necessary for their job functions.” UCLA policy HS-9412, Authorization for Use/Disclosure of Protected Health Information (‘PHI’), “describe[s] the circumstances in which UCLA Health System must obtain the patient’s authorization to use or disclose Protected Health Information (‘PHI’) . . . . It also discusses instances when patient written authorization is not required . . . .” HS-9412 uses the same definition of PHI as HS-9401. It requires patient written authorization whenever PHI is used or disclosed “for a purpose — 22 — that does not fit an exception under the HIPAA or California law.” Both HS-9401 and HS-9412 contain “health care operations” exceptions akin to that in the Privacy Rule. Thus, if Koos’s conduct falls within the health care operations exception to the Privacy rule, it also falls within the policy exceptions. Likewise, the appeal board concluded, and Koos does not dispute, that a violation of the Privacy Rule would also result in a violation of HS-9401 and HS-9412. Citing his testimony at the hearing, Koos asserts it is “undisputed” that his review of Patient B’s records was for “patient safety reasons—to figure out the root cause of Patient B’s injuries and prevent such injuries in future patients.” 5 He contends the hearing panel’s conclusion that this explanation was not credible, which the appeal board found was “reasonable and warranted,” rested on its “dishonest at best” characterization of the testimony as contradictory of previous explanations Koos provided for his actions. He argues that the evidence cited by the panel—Koos’s April 20, 2018 email to Krakow, Kang’s notes from his April 23, 2018 interview with Koos, Koos’s April 24, 2018 letter to Kang, and Koos’s April 26, 2018 letter to Lerner—was in no “way inconsistent with or contradictory to his testimony at hearing [sic] that a root cause analysis was needed of this case.” Substantial evidence supports the appeal board’s decision. In the email Koos sent to Krakow shortly after the incident, he emphasized Schifrin’s interest in teaching and suggested Schifrin 5 Although his argument heading refers to his “activities” generally as permissible under the healthcare operations exception, Koos only specifically addresses his access of Patient B’s records in the substance of the argument. — 23 — “could contribute to the heart rate analysis.” It is unclear to what or whose analysis Koos was referring, and evidence at the hearing established that no teaching occurred during the incident. During his interview with Kang a few days later, Koos stated that he “was curious if the baby had suffered any brain damage” and “he had a suspicion about the case and wanted to confirm it in his own mind.” In his subsequent letter to Kang, Koos asserted that, in addition to “improv[ing] patient care,” his goals included “promot[ing] an accurate understanding of fetal physiology” and “increas[ing] the rigor of medico-legal opinions.” Finally, in his letter to Lerner, he explained that he “accessed the patient’s records in an ad hoc quality review to substantiate [his] suspicions regarding the etiology of the injury and to determine whether the obstetrical care was appropriate.” While some of these explanations are consistent with Koos’s testimony regarding his intentions, “[t]he fact that there was substantial evidence in the record to support a contrary finding does not compel the conclusion that there was no substantial evidence to support the judgment.” (Rayii v. Gatica (2013) 218 Cal.App.4th 1402, 1408 .) Several of the explanations, particularly those regarding “curiosity,” personal “suspicions,” and Schifrin’s desire to teach, support a finding that Koos was concerned with issues other than patient safety, and therefore was not credible at the hearing.6 6 In any event, the health care operations exception to the Privacy Rule does not apply when “the obtaining of generalizable knowledge is . . . the primary purpose of any studies resulting from such activities.” ( 45 C.F.R. § 164.501 .) Koos’s repeated mentions of personal suspicions and assertions that he had a “strong belief that appropriate care was given by our obstetrical team” reasonably support a conclusion that his primary concern — 24 — Moreover, as the appeal board observed, “[n]otably absent from these communications . . . is any reference to a ‘root cause analysis,’ a ‘sentinel’ event, or a HIPAA exception that would have permitted Dr. Schifrin to view Patient B’s medical records.” Koos contends there is “simply no requirement whatsoever in HIPAA or its healthcare operations exception that a physician must announce that he will be conducting an activity under said HIPAA exception before undertaking such activity,” and “HIPAA, much less the hospital operations exception, does not mandate a certain number of individuals to conduct patient safety activities. However, the challenged finding is that Koos’s explanation was not credible. His failure to mention his purported rationale for his actions prior to the hearing constitutes substantial evidence in support of that finding. B. Written Authorization Koos alternatively contends that the “‘patient safety,’ ‘quality improvement’ and ‘education’ being conducted by Dr. Koos . . . falls squarely within the terms of the authorizations” Patient A signed on behalf of herself and Patient B. Those authorizations provided, in relevant part: “I understand that my medical information, photographs, and/or video in any form may be used for other UCLAH purposes, such as quality improvement, patient safety and education. I also understand that my medical information and tissue, fluids, cells and other specimens (collectively, ‘Specimens’) that UCLAH may collect during the course of my treatment and care may be used and shared with researchers. . . . I further understand that any use of my medical was “obtaining generalizable knowledge,” not improving patient safety for patients who had already been discharged from the hospital. — 25 — information or Specimens by UCLAH or other research institutions will be in accordance with state and federal law, including all laws and regulations governing patient confidentiality, in the manner outlined in the UCLAH Notice of Privacy Practices.”7 The appeal board found that Koos did not use the information for “UCLAH purposes,” because he made a “unilateral decision” to investigate the case without being requested to do so or receiving “any authorization from OB/GYN,” and shared PHI with a non-UCLA physician despite being aware of de-identification options. The appeal board also found that the consent form required the use of PHI to be “in accordance with state and federal law, including all laws and regulations governing patient confidentiality,” and therefore did not cover Koos’s HIPAA-violating conduct. These findings are supported by substantial evidence. Koos asserts the appeal board “simply brushed aside the authorizations, stating that Dr. Koos’ activities were not for ‘UCLAH purposes,’” and “is simply creating requirements and conditions that are not present in the law.” The authorizations by their terms, however, required that the information be used for UCLAH purposes. As discussed above, substantial evidence supported the appeal board’s conclusion that Koos’s purposes were primarily personal. Indeed, Koos acknowledged to Nguyen during the incident that he, not UCLA, personally “sanctioned” Schifrin’s visit to the resident work room. Koos further asserts that “the language about sharing . . . information with other research institutions covers Dr. Schifrin,” but that the appeal board incorrectly “stated that Dr. Schifrin’s 7 “UCLAH” is defined in the form as UCLA Health Care. — 26 — mere presence obviates the language of the authorizations.” The appeal board said: “‘UCLAH purposes’ would not apply to Dr. Schifrin, an outside non-UCLA physician with no treatment or billing relationship with Patient A or B. This is particularly true where, as here, there were existing authorization processes in place that may have allowed Dr. Koos to share Patient B’s PHI with Dr. Schifrin.” Though he suggests the “authorization processes” were insufficiently communicated to him, and Janzen essentially shut down any such processes after the stats conference, Koos acknowledged during the hearing that there “might be other alternatives” to ensure the material he provided to Schifrin did not contain PHI, “but that wouldn’t have been time efficient because this happened to be on a Friday, and he would have to be present, and we wanted to evaluate this.” There is no evidence that “time efficiency” is a UCLAH purpose. Furthermore, a previous portion of the consent form provides that “a University institutional review board approves projects conducted by University researchers,” and informs patients that they “may be contacted and asked to participate in research studies but [are] under no obligation to do so.” There is no evidence that Koos sought approval from any UCLA body or board or contacted Patient A for permission to share her information or that of her child with an outside physician or researcher. Koos also asserts, in a footnote, that the hearing panel and appeal board made “conclusory findings/conclusions that Dr. Schifrin viewed PHI,” but that “is simply not the case and disputed.” Though Koos may dispute it, Chan testified that Patient B’s fetal tracing contained PHI, and she and Datkhaeva both testified that Schifrin remarked upon PHI during his time — 27 — in the resident work room. This is substantial evidence on which the board was entitled to rely. Koos also acknowledged during cross-examination that “the patient’s name” was visible in the resident work room. A name is PHI under the HIPAA and UCLA policies despite Koos’s testimony to the contrary. C. “Sentinel Event” At the hearing, Koos introduced into evidence the “Sentinel Events Policy” of the Joint Commission, the hospital’s accrediting body. The policy states that its aim is “to help hospitals that experience serious adverse events improve safety and learn from those sentinel events,” which it defines as “a patient safety event (not primarily related to the natural course of the patient’s illness or underlying condition) that reaches a patient and results in . . . [d]eath[,] [p]ermanent harm[,] or [s]evere temporary harm.”8 The policy requires all sentinel events to “be reviewed by the hospital” and provides extensive guidance about responding to and reporting such events. Koos testified at length that he believed closing the case without further review was against the policy, so he took it upon himself to ensure compliance by reviewing the matter. Koos contends the hearing panel and appeal board “failed to consider the Sentinel Event Policy, only concluding that Dr. Koos believed there to be a sentinel event. However, the facts are clear. This was a sentinel event. He had spoken with Dr. Janzen and Dr. Krakow. This sentinel event was not going to be investigated further. Not only does HIPAA explicitly permit the 8 Koos also cites to UCLA policy HS-0328, which he asserts “mirrors much of the Sentinel Event Policy.” This policy was never mentioned during the administrative proceedings and is not in the appellate record. — 28 — type of activity undertaken by Dr. Koos, it was indeed required by the policies of the Joint Commission.” The hearing panel found that “Dr. Koos testified at the hearing that the records of Patient A and Patient B constituted a ‘sentinel event’ for which a root cause analysis was needed. Although Dr. Koos did not previously report this as a Sentinel Event to any committee [sic].” The appeal board found this testimony by Koos was not credible due to his failure to invoke the policy prior to the hearing or report the alleged sentinel event to anyone at the university. The board thus did not fail to consider the policy, the provisions of which Koos himself cited only in conclusory fashion. D. Medical Staff Bylaws Koos was charged with violating and was found to have violated Articles 3.2.1 and 3.3.1(d) of the Medical Staff Bylaws by improperly obtaining “PHI of patients (and access to the medical records) with whom [he] had no treatment relationship and no authorized purpose.” Article 3.2.1 provides, “The Code of Ethics of the American Medical Association, the American College of Surgeons, and the University Of California Code Of Conduct, as outlined in the UCLA Health System Compliance Handbook, shall govern the professional conduct of members of the Medical Staff. Each applicant to the Medical Staff shall agree to abide by this code of ethics by execution of the application.” Article 3.3.1(d) provides, “Disruptive and inappropriate medical staff member conduct affects or could affect the quality of patient care at the hospital and includes . . . [i]nappropriate access and unauthorized release of protected health information and patient information.” Koos argues these bylaws “simply repeat the allegations and charges Respondents have already made against — 29 — Dr. Koos. With respect to Section 3.2.1, there is no indication anywhere in record [sic] or any evidence set forth by Respondents of what provision or aspect of the ‘Code of Ethics’ or ‘Code of Conduct’ Dr. Koos is alleged to have violated. From the Appeal Board Decision, it would appear that it believes Dr. Koos violated the ‘Compliance Handbook’ by ‘disclosing confidential patient information.’ In response to this, and to the allegation that Dr. Koos violated Section 3.3.1(d), the argument that the disclosure of PHI was permitted under HIPAA, its healthcare operations exception, and by authorization applies.” Koos’s argument here mirrors his earlier contentions that his conduct did not violate HIPAA. As we have found those arguments unpersuasive above, we equally reject them here. We also note that the appeal board expressly considered and rejected Koos’s argument that the hearing panel “failed to ‘stat[e] what portion or how’ Dr. Koos violated UCLA policy, HIPAA, or the Bylaws.” It found that the relevant “rules and policies were . . . exchanged between the parties and presented to the [hearing panel] as exhibits,” “counsel for Dr. Koos described, in detail, each of the charges levied against Dr. Koos in his opening statement,” and “several witnesses, including Dr. Koos, testified at length about these specific rules and polices during the hearing.” These findings are supported by the evidence. E. Visitor Access Koos briefly contends that UCLA policy HS-1352, Family/Visitor Access, applies only to visitors of hospital patients. He contends the hearing panel and appeal board “simply fail[ed] to address this issue altogether in their respective Decisions, which instead erroneously conclude that Dr. Koos violated this policy by virtue of Dr. Schifrin’s presence.” — 30 — HS-1352 states that its purpose is “to provide a safe and welcoming environment for patients, visitors and staff.” It continues, “Our patient’s [sic] preferences and well being will determine who visits, when the visits occur and how long the visits last.” The policy does not define the term “visitors.” It does, however, “request[ ] that visitors wear a visitors badge” indicating “the destination in the hospital, the date of the visit and the name of the person who issued the badge.” The hearing panel found that Koos violated HS-1352 by providing Schifrin “unauthorized access to the Labor and Delivery Floor and the Resident Work Room where confidential patient information is continuously displayed.” The appeal board found that Schifrin “was not wearing a visitor badge and Dr. Koos did not provide any explanation why Dr. Schifrin was in the resident work room.” It further found that HS-1352 “prohibits visitors without a legitimate reason for being at the hospital from entering.” Both bodies thus clearly addressed the issue. Koos did not elaborate on or support his interpretation of the policy, so there was no basis for the panel or board to address it further. Moreover, the only charge that invoked this policy, Charge No. 3, also alleged that Koos violated HIPAA, HS-9401, and HS-9412. Thus, even if HS-1352 is inapplicable, the ultimate finding on the charge is supported by substantial evidence. — 31 — DISPOSITION The judgment of the superior court is affirmed. Respondents are awarded their costs on appeal. NOT TO BE PUBLISHED IN THE OFFICIAL REPORTS COLLINS, J. We concur: MANELLA, P. J. CURREY, J. — 32 —