BSCR Firm News/Blogs Feed

Healthcare Entities Beware: Cyberattack vulnerability leads to HIPAA liability risk

22 Feb 2024

ABSTRACT: With an increase in recent HHS enforcement and accountability for the healthcare sector, understanding cybersecurity vulnerabilities, cyberattack risks, and data breach of sensitive and confidential information is vital to prevent liability and promote best practices for risk management.

In light of the recent U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) settlements with healthcare organizations pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) last year, it is worth analyzing key potential liability concerns for healthcare clients, specifically as they relate to cyberattacks on sensitive protected health information (PHI).

HHS Resources for HIPAA Cybersecurity Compliance

The OCR has published multiple resources for covered healthcare entities to protect themselves and patients from cyber-attacks. The HHS website includes newsletters advising on HIPAA Rule compliance for defending against common cyberattacks, development of sufficient policies, and other helpful guidance. Importantly, HHS released a Concept Paper in early December 2023 outlining its healthcare sector cybersecurity strategy—a key signal of HHS’ intent to enforce cybersecurity compliance more aggressively.

HHS’ recent focus on healthcare sector cybersecurity is undoubtedly linked to the Biden Administration’s National Cybersecurity Strategy released March 1, 2023, which detailed the federal approach to improving national cyber-defense and solidifying digital infrastructure in the United States’ inevitably digital future. Essentially all key industries are undergoing a digital transformation through AI-launches and ever-advancing technology in delivery of service to consumers.

Through its recently released Concept Paper, HHS details its plan to improve cybersecurity with concurrent steps of: establishing voluntary performance goals; providing incentive resources; and—most relevant—increasing enforcement and accountability for the healthcare sector.

Recent OCR Settlements

In October 2023, OCR and a medical management company (DMS) entered into a Ransomware Settlement after DMS’ network server was infected with ransomware from April 2017, going undetected by DMS until December 2018 when the ransomware encrypted files containing PHI. More than 200,000 individuals’ electronic PHI (ePHI) was affected by this data breach. DMS paid OCR $100,000 and entered into a resolution agreement after the OCR investigation found DMS failed to: conduct sufficient risk analysis; implement proper audit procedures to track PHI-including system activity; and create and enforce acceptable policies and procedures to comply with HIPAA rules. The resolution agreement required DMS to: review and update risk analyses for vulnerabilities in DMS PHI-related data; update its risk management plan to mitigate any security risks and vulnerabilities; revise written policies and procedures to better comply with HIPAA rules; and provide HIPAA training to all staff who have access to PHI.

In December 2023, OCR and a medical group specializing in emergency and occupational practice and laboratory testing (LMG) entered into a Phishing Settlement after LMG was victim to a phishing attack where an unauthorized hacker obtained access to an LMG owner’s email account. LMG was unable to definitively identify which patients’ PHI was affected, thus leading to notification of all patients—nearly 35,000. OCR investigation determined LMG failed to: conduct the requisite HIPAA risk analysis and implement policies and procedures to safeguard PHI through regular system activity review. LMG agreed to pay OCR $480,000 and enter a corrective action plan through resolution agreement, including OCR-monitoring for two years. The action plan requires LMG to: establish and implement a detailed risk management plan to reduce security vulnerability to ePHI (including conducting annual risk analyses); and develop and enforce written policies and procedures in compliance with HIPAA, including regular review of all records of information system activity and processes for evaluating when collection of new or different records must be updated.

Healthcare Cybersecurity and other Legal Risks of Data Breach

In addition to HHS penalties, data breach can also have other severe consequences on healthcare entities, including reputational damages, broken trust, monetary loss, and legal liability. Data breach frequency continues to rise, with healthcare hit most often.

Focusing on fundamentals of cybersecurity is crucial, such as basic protections and best practices for reinforcement. To strengthen healthcare data security, entities should encrypt sensitive data throughout the chain of custody; implement strict retention and destruction policies; minimize storing PHI on servers; establish comprehensive risk management policies; and investigate security practices of relevant third-party vendors or partners. Implementing best practices should include standards for monitoring and access control of all individuals handling PHI; two-factor authentication credentials; automatic time-outs; password strength criteria and regular update requirements; and routine training on phishing, ransomware, and cybersecurity generally.

Despite an organization’s best efforts, though, data breaches compromising PHI can still occur. When that happens, strict compliance with notification rules is necessary. Under HIPAA, covered entities and their business associates must report a breach within 60 days of discovery. If more than 500 individuals are affected, HHS, the media, and the affected individuals must also be notified.

Notably, it is not just the covered entities who can be held accountable under HIPAA. Even individuals such as directors, employees, or officers of a covered entity can also be held directly and criminally liable for HIPAA violations, including both fines and possible jail time. Though a patient cannot sue on the sole grounds of a HIPAA violation, patients can generally pursue damages through state privacy laws overlapping with HIPAA.

Cyber Liability Coverage

Many professional liability insurers offer cyber liability coverage which may provide comprehensive protection for high-risk sensitive information (SSN, DOB, PHI, billing records, etc.) Some insurers also provide resources to help prevent breaches and expert guidance in necessary steps if a breach occurs.

Law Firms Beware – “Business Associates” by Definition

Law firms who counsel healthcare clients must remain vigilant in their responsibility to protect PHI. HIPAA defines such firms as “business associates” who may also be directly liable under HIPAA Rules, meaning not only the client, but also the firm, could be subject to civil, and in some cases, criminal penalties for a data breach. See 45 CFR 160.103.

Illinois Supreme Court Determines Termination on Death Clause Voids Long-Term Care Arbitration Agreement

15 Nov 2023

ABSTRACT: Illinois Supreme Court resolves appellate court dispute by ruling a resident’s death can terminate entire arbitration clause due to the termination-on-death clause -- even actions that survive through the Illinois Survival Act.

Long Term Facilities in Illinois should review their arbitration agreements if they want personal injury claims to be resolved through arbitration. The Illinois Supreme Court has determined that an overly broad termination-on-death clause can prevent all claims, including those that survive a decedent’s death, from being decided in arbitration. Clanton v. Oakbrook Healthcare Centre, Ltd., 2023 IL 129067.

Case Facts

In Clanton, plaintiff, Nancy Clanton, as the independent administrator of the Estate of the Decedent, Laurel Jansen, brought a claim of negligence-wrongful death against multiple defendants associated with care provided in a long-term care facility. Defendants filed a motion to compel arbitration, which would have stayed the civil suit and sent the entire case to arbitration. The trial court denied defendants’ motion to compel arbitration, and the Illinois Supreme Court affirmed this decision.

It was undisputed that Jansen, acting through her power of attorney, signed a contract with the long-term care facility. That contract forced arbitration to resolve any civil claim arising out of the services provided by the facility. The contract also included a termination clause, which noted the contract is terminated, “[i]mmediately upon the resident’s death.”

According to plaintiff’s complaint, Jansen suffered falls while a resident at Oak Brook, which led to her death. Plaintiff alleged four counts of negligence against the facility, (1) a violation of the Nursing Home Care Act (210 ILCS 45/1-101 et seq. (West 2018), (2) a common-law negligence claim, (3) a wrongful death claim, and (4) a res ipsa loquitur claim. All these claims, aside from the wrongful death claim, were brought through the Survival Act (755 ILCS 5/27-6 (West 2018)), while the wrongful death claim was brought through the Wrongful Death Act (740 ILCS 180/0.01 et seq. (West 2018)). The Survival Act allows a representative of the decedent to maintain any statutory or common law actions that accrued before decedent’s death. Wrongful death actions do not accrue until the death of an individual.

Oak Brook, along with the other defendants, filed a motion to compel arbitration of all claims brought through the Survival Act and to stay the wrongful death claim. In response, plaintiff argued defendants, including Oak Brook, waived their right to arbitrate by litigating for nearly a year, that the arbitration clause was procedurally and substantively unconscionable, and that the POA lacked the authority to execute an arbitration clause on decedent’s behalf. The trial court concluded that the defendants did not waive their right to arbitrate, nor was the contract procedurally unconscionable, as the POA could sign the arbitration agreement. However, the trial court concluded that the contract was substantively unconscionable because it waived plaintiff’s entitlement to punitive or treble damages. The trial court declined to sever the limitation on damages from the rest of the contract and determined that the entire dispute resolution provision was unconscionable.

Defendants appealed this decision, arguing that the trial court erred in its decision, and alternatively argued it erred in not severing that portion it found unconscionable. In response, plaintiff reasserted its arguments from the trial court but added the argument that the arbitration clause terminated upon decedent’s death.

Appellate Review

The First District agreed that the defendants did not waive their right to arbitrate but also ruled it was not precluded from reviewing the new issue raised by the parties – Whether the arbitration clause terminated upon decedent’s death. Taking the plain language of the contract, the Appellate Court determined the contract, therefore the arbitration provision, terminated upon decedent’s death.

Defendants relied on the Fourth District opinion in Mason v. St. Vincent’s Home, Inc., 2022 IL App (4^th) 210458, 459 Ill. Dec. 893. In Mason, the arbitration clause was similar, and the court concluded the arbitration clause was valid because the Survival Act Claims accrued before the decedent’s death, so the arbitration provision was still valid when the cause of action accrued.

The First District rejected the Mason analysis, citing the plain language of the contract, which stated it terminated upon the resident’s death. There was no exception which stated the Survival Act claims survived the resident’s death.

The Illinois Supreme Court decided to take this issue up for appellate review, as the Fourth and First District Opinions were in conflict. At the Illinois Supreme Court, the plaintiff argued the Mason court was incorrect because it added an exception not contained in the termination-on-death clause. Further, the plaintiff argued that if defendants had intended the arbitration clause to survive the resident’s death, the burden was on them to explicitly state that exception in the resident’s contract.

Defendants argued the arbitration agreement provision was not terminated on death, as the contract specifically provided that “all civil claims arising in any way out of this Agreement,” made it clear the arbitration agreement survived decedent’s death. Defendants argued their obligation to provide personal services to decedent was terminated upon death, but the dispute resolution provision remained. This interpretation was necessary to “harmonize” the entire contract so that the arbitration clause was not in conflict with or neutralized by the termination-on-death clause.

The Illinois Supreme Court found the contract was unambiguous, as the plain language of the contract compelled arbitration, but only up until the resident’s death. Upon death, the entire contract ceased to exist. The Illinois Supreme Court determined Defendants could have drafted the contract differently, by allowing specific portions to remain in effect after the resident’s death, including the arbitration clause.

Conclusion

All long-term care facilities should review their arbitration agreements. Termination on death clauses should be narrowly tailored to exclude arbitration clauses or any claim that would survive through the Illinois Survival Act. If a resident’s contract includes such a clause, and no exception exists, then a resident’s death could void the entire contract, including the arbitration agreement based on Clanton.

Missouri Appellate Court Holds Affidavit of Merit Requirement Inapplicable to Privacy Breach Claim Against Hospital

26 Oct 2023

ABSTRACT: In September 2023, the Missouri Court of Appeals, Eastern District, reversed a trial court’s judgment granting Poplar Bluff Regional Medical Center’s (PBRMC) motion to dismiss for plaintiff’s failure to file an “affidavit of merit,” as prescribed by RSMo. § 538.225. The statute provides that in a personal injury or wrongful death action, the plaintiff must certify in an affidavit that he or she has obtained the written opinion of a legally qualified health care provider that the defendant failed to exercise reasonable care, and that this caused or contributed to the alleged injury.

J.J. v. Poplar Bluff Regional Medical Center, LLC was a suit brought by a minor psychiatric patient alleging the hospital breached its fiduciary duty of confidentiality and violated HIPAA, the Health Information Technology Act (HITECH), and the Missouri Merchandising Practices Act when a PBRMC employee, who was uninvolved in the plaintiff’s medical treatment, accessed his mental health records and disclosed his protected health information to the employee’s daughter. The daughter, a school classmate of the plaintiff, then is alleged to have disclosed this information to other students in the school. Plaintiff claims this was an invasion of privacy that led to his being harassed and bullied at school.

The trial court granted PBRMC’s motion to dismiss under RSMo. § 538.225.1 on the grounds that the plaintiff failed to file the statutorily required affidavit of merit applicable to suits against health care providers arising out of the provision of health care services. Plaintiff appealed, successfully arguing that Section 538.225’s affidavit requirement did not apply to his claim.

On appeal, the court applied a two-part test to determine whether an affidavit of merit was required: (1) whether the relationship between the parties is that of a health care provider and recipient; and (2) whether the claims relate solely to the provision of health care services. The court acknowledged the first part was easily met in that the plaintiff received healthcare services at PBRMC. However, the second part was more difficult and dispositive. The court reviewed RSMo. § 538.205.7 and determined “health care services” necessarily involve a question of professional judgment, and the affidavit of merit requirement only applies to claims of alleged injury from the rendering of or failure to render health care services involving professional judgment. However, that does not mean this requirement is limited solely to medical negligence claims – it applies to various other types of claims against healthcare providers, such as claims for surgical battery, lack of informed consent, libel, and others.

Turning to the facts of the case, the court noted that other Missouri courts had determined a health care provider’s duty to keep medical records confidential is not a “health care service” under Section 538.225 because it is an administrative duty incidental to medical treatment and does not necessarily involve a question of professional judgment that complies with a reasonable standard of care. Therefore, because the plaintiff’s claims stemmed solely from an alleged breach of confidentiality, and did not involve a question or professional judgment, the court held an affidavit of merit was not required and the trial court erred in dismissing the case. The appellate holding is limited to the plaintiff’s recitation of the facts specific to this case, which the court accepted as true, that the alleged privacy breach did not involve a question of professional judgment and was more akin to “an act of gossip” by a PBRMC employee who was uninvolved in the plaintiff’s care.

The holding in J.J. distinguishes certain medical privacy claims from medical negligence and other personal injury claims against health care providers that involve a question of professional judgment. The latter requires the filing of an affidavit of merit to verify that the claim involves services requiring professional judgment that fell below the standard of reasonable care. A medical privacy claim, however, may not require an affidavit of merit if the claim is unrelated to medical treatment and does not involve a question of professional judgment. However, healthcare privacy is a highly regulated and specialized space that constantly evolves as technology evolves. The court did not address whether a privacy breach claim could involve questions of healthcare privacy policy, procedure, and process developed and implemented by health care providers using professional judgment and whether that should trigger the affidavit of merit requirement. J.J. does not appear to establish a bright line rule, and the answer to this question in future cases will likely depend on the specific facts of each individual case.

Eighth Circuit Court of Appeals Allows COVID-19 Case to Proceed in Missouri State Court

22 Sep 2023

ABSTRACT: The Eighth Circuit Court of Appeals ruled that Defendant’s removal to federal court based on (1) diversity; (2) preemption; (3) and U.S.C. § 1442(a)(1) were improper and thus, a COVID-19 nursing home wrongful death suit can proceed in Missouri state court.

In June 2020, the plaintiff, the son of a nursing home resident who contracted and died from COVID-19, brought suit in Missouri state court against the nursing home, its corporate owners, and twelve individual defendants. Plaintiff asserted Missouri causes of action for wrongful death, negligence per se, and lost chance of survival. While none of the corporate defendants were Missouri citizens, most of the individual defendants were. Thus, after the corporate defendants were served – but prior to service on the individual defendants – the corporate defendants attempted to remove the case to federal court. The district court concluded that it lacked subject matter jurisdiction, remanded the case to state court, and the corporate defendants appealed.

On appeal, the corporate entities asserted three independent grounds for federal jurisdiction: (1) diversity jurisdiction existed because none of the “properly joined and served” defendants were Missouri citizens at the time of the attempted removal; (2) federal question jurisdiction because the plaintiff’s claims were preempted by a federal statute, the Public Readiness and Emergency Preparedness Act (PREP) Act; and (3) the increased federal regulation of nursing homes during the COVID-19 pandemic effectively federalized the corporate defendants and availed them of the federal officer statute set forth in 28 U.S.C § 1442(a)(1).

On the first issue – diversity jurisdiction – the Eighth Circuit rejected the corporate defendants’ attempt at “snap removal” because it was undisputed that the plaintiff and some of the named individual defendants were all Missouri citizens. The Court noted the attempt at snap removal – filing for removal before all parties are served – did not cure the underlying lack of complete diversity among the named parties. Without complete diversity, the suit could not have been brought in a federal district court and the case could not be removed based on diversity of citizenship.

Defendants’ second argument – federal question jurisdiction – was similarly rejected by the Eighth Circuit. It concluded the PREP Act did not completely preempt state causes of action for negligence. The Court also addressed the defendants’ alternative argument - even if Plaintiff’s claims were not “completely preempted” by the PREP Act, the claims still “necessarily raise[d]” a federal question. The Court rejected this argument as well, noting the defendants failed to identify a federal issue that was a necessary element of the plaintiff’s state law claims and, thus, the mere assertion of PREP Act immunity did not create federal jurisdiction.

On the last issue – federal officer removal – the Court acknowledged corporate entities like the defendants played an important role during the COVID-19 pandemic, but ruled, “the federal government’s designation of a private industry as important – or even critical – was not sufficient to federalize that industry’s operations and confer federal jurisdiction.”

With its ruling, the Eighth Circuit joined a majority of other circuits that have considered the issue of the protections of the PREP Act and determined it either did not apply to a defendants’ alleged conduct or that the Act does not completely preempt state law claims because it fails to provide an exclusive federal cause of action to enable federal courts to adjudicate plaintiffs’ claims on the merits.

* Sara Rakowiecki, Law Clerk, assisted in the research and drafting of this post. Rakowiecki is a Law Clerk pending being sworn into the Missouri Bar on September 29.

Missouri Court of Appeals Holds a Healthcare Provider Has No Legal Duty to Protect a Patient's Child from Unforeseen Criminal Abuse by a Third Party

10 Aug 2023

ABSTRACT: The Missouri Court of Appeals, Eastern District, affirmed a defense verdict in a suit in which the plaintiff alleged a hospital negligently caused an infant to suffer shaken baby syndrome by failing to alert authorities about potential child abuse by the patient/mother’s then-boyfriend. The court held that a converse jury instruction instructing that the jury should find for the hospital if it believed the boyfriend injured the infant, along with evidence of the boyfriend’s fault, was not improper because the hospital owed no legal duty to protect the infant from the unforeseen act of a third party outside the patient-provider relationship.

In June 2023, the Missouri Court of Appeals, Eastern District, affirmed a defense verdict for Poplar Bluff Regional Medical Center in Hollis v. Poplar Bluff Regional Medical Center, LLC, a suit brought by an infant (through the mother as next friend) alleging the hospital negligently failed to alert authorities about the patient/mother’s potential for committing child abuse and thereby caused the child to suffer shaken baby syndrome. The mother had been a voluntary patient in the hospital’s psychiatric ward over five days, about four months before the child abuse occurred. After the child was injured, the mother pleaded guilty to child abuse. The plaintiff alleged the hospital negligently failed to report the mother’s risk for committing child abuse or neglect when the mother was a patient. However, at trial, the trial court permitted the hospital to introduce evidence that the mother’s boyfriend at the time, rather than the mother herself, was the one who abused the child and caused his injuries. The trial court also allowed the hospital’s converse jury instruction that the verdict must be for the hospital if the jury believed the boyfriend injured the infant. The jury found the hospital not liable for the infant’s injuries. On appeal, the plaintiff made several arguments, but we will focus on the claims of trial court error surrounding the hospital’s converse jury instruction admission of the hospital’s evidence that the boyfriend caused the infant’s injuries.

Missouri recognizes a general common law rule that there is no legal duty to protect someone from a third party's criminal act. The reason that courts do not generally impose such a duty is because criminal acts are rarely foreseeable. The touchstone for the creation of a legal duty is foreseeability – if a healthcare provider were held liable for failing to warn of any potential harm that a third party might cause to another third party, there would be almost no limit to the potential legal liability. In Missouri, as in other states, there is, however, an exception to this general rule. Nearly 30 years ago, in Bradley v. Ray, 904 S.W.2d 303, 311 (Mo. App. W.D. 1995), the Court of Appeals held that liability for a failure to warn may be imposed only where there is a "special relationship" between a healthcare provider and a patient who is the foreseeable perpetrator of harm against a readily identifiable victim.

In reaching its holding, the Bradley court discussed Tarasoff v. Regents of Univ. of Cal., 17 Cal. 3d 425 (Cal. 1976). the seminal case imposing a legal duty on a healthcare provider to warn an impending victim of foreseeable violence at the hand of a patient. In that case, a patient informed a university psychologist that he intended to kill Tatiana Tarasoff before he took her life. Tarasoff's parents filed suit, alleging the university psychologist owed Tarasoff a duty to warn of the threat. The California Supreme Court noted that foreseeability was the most important consideration in establishing whether a duty exists. The court acknowledged the difficulty of predicting whether a mental health patient may criminally act against his intended victim but held the "special relationship" between a psychologist and a patient establishes a duty of care for the safety of both the patient and "any third person whom the [mental health provider] knows to be threatened by the patient.” Most jurisdictions, including Missouri, have adopted a Tarasoff duty exception.

Just as Bradley relied on the analysis in Tarasoff, the Hollis court looked to the holding in Bradley, the sole Missouri case addressing a failure to warn in the context of child abuse where the victim was abused by a patient who had a "special relationship" with a mental healthcare provider. Bradley emphasized the critical role of foreseeability in establishing duty even under the recognized narrow "special relationship" exception. Critically, Bradley noted that the duty to warn arose not only from the special relationship between the healthcare provider and the patient, but from the healthcare provider having specific knowledge that the patient posed a dangerous threat to a third party, as well as having sufficient time and ability to prevent the harm.

Since Bradley, there has been at least a narrow duty to warn relevant to Missouri mental healthcare providers in certain situations. Notably, however, Missouri courts have refused to expand the "special relationship" exception to create a blanket duty for a mental healthcare provider to warn the public at large about dangerous propensities of a patient.

Following this standard, the Hollis court reasoned that evidence of a special relationship between the hospital and the mother arising out of her mental health treatment could impose on the hospital a duty to warn of foreseeable child abuse by the mother, but not for abuse at the hands of a third party who was not a hospital patient. The hospital’s converse instruction in Hollis was proper because if the boyfriend and not the mother abused the infant, then it negated any legal duty to warn because the boyfriend was not a hospital patient. Bradley, as well as Tarasoff and its progeny, imposed a duty to warn because the harm to the victim by the patient (rather than by a third party) was foreseeable by the mental healthcare providers.

Ultimately, the Hollis court explained that if the child abuse that injured the plaintiff was committed by the patient’s boyfriend, as submitted in the court’s instructions to the jury, then the foreseeability of such abuse would be too speculative to establish a duty to warn arising out of a patient-provider relationship with the mother. “To hold otherwise potentially would make a mental health provider liable for an indeterminate range of harms for an indeterminate amount of time.”

Implications

The holding in Hollis clarifies that in Bradley, which imposed a duty to warn of a foreseeable risk of future abuse by a patient against a child only when the patient is in a special relationship with a mental health provider and the patient is the perpetrator of the child abuse. Because of the critical role of foreseeability in establishing a duty, the duty to warn does not apply to third parties outside of the special relationship between a patient and healthcare provider, as imposing liability in such a manner would be impossible to foresee. In other words, healthcare providers should keep in mind that they may have a duty to warn of risks of a patient committing harm to a third party, but there is generally no such duty to warn of potential risk of harm committed by a third-party individual who is not a patient.

* Hans Liu, 2023 Summer Law Clerk, assisted in the research and drafting of this post. Liu is a rising 3L student at Washington University School of Law.

Illinois Rules Telephone Consultation Created Physician-Patient Relationship

10 Feb 2023

ABSTRACT: In a wrongful death lawsuit alleging medical malpractice, the Illinois Appellate Court for the Fourth District reversed the trial court’s entry of summary judgment in favor of several medical defendants and ruled a telephone consultation between an emergency medicine physician and an on-call physician concerning the decedent’s medical condition created a physician-patient relationship and duty of care.

In Blagden v. McMillin et. al., 2023 IL App (4^th) 220238, the decedent came to the emergency department of a hospital in central Illinois in the summer of 2017 complaining of severe pain in his neck, upper back, and swelling in his right elbow that he related to a bug bite. The decedent further reported the onset of symptoms began the night before he came to the hospital and involved a bad headache, fever, and nausea. The treating emergency medicine physician completed a physical exam, ordered lab work, and ultimately diagnosed decedent with a muscular condition of his shoulders and neck.

Because the treating emergency medicine physician did not have admitting privileges, he contacted the on-call internal medicine physician via telephone and discussed the decedent’s course of treatment in the emergency department, as well as whether decedent should be admitted to the hospital. The emergency medicine physician testified the on-call internal medicine physician told him he did not think decedent should be admitted. While the on-call internal medicine physician did not recall the specifics of the conversation, he confirmed that the decision of whether to admit a patient was a collaborative one that ultimately was his to make. Following the telephone conversation, the decedent was released from the emergency department with instructions to follow-up with his personal physician the following day. Decedent did not follow-up with his personal physician, but instead returned to the same emergency room three days later and ultimately died of sepsis caused by a spinal epidural abscess.

After decedent’s wife filed a lawsuit, the on-call internal medicine physician and his practice group moved for summary judgment, arguing that the internal medicine physician owed no duty of professional care to the decedent based on the single phone call with the emergency medicine physician and the lack of directing any medical treatment of the decedent. The trial court granted the defendants’ motion for summary judgment and the plaintiff appealed.

The single question on appeal was whether the trial court properly concluded that the internal medicine physician owed no duty of professional care to the decedent because the single phone call with the emergency medicine physician did not create a physician-patient relationship with decedent.

The Appellate Court noted that in medical malpractice cases, a physician’s duty to a patient arises in only two situations: (1) when a physician-patient relationship has been expressly established; or (2) there is a “special relationship” such as when one physician is asked by another physician to provide a service to the patient, conduct laboratory tests, or review test results. The Appellate Court noted that only the latter situation applied to the case and, thus, its inquiry was limited to whether a special relationship existed between the internal medicine physician and the decedent that gave rise to a physician-patient relationship and imposed a professional duty of care upon the internal medicine physician.

In analyzing the issue, the Appellate Court noted that a special relationship giving rise to a duty of care could exist without any meeting between the physician and the patient where the physician performs specific services for the benefit of the patient or when the physician takes some affirmative action to participate in the care, evaluation, diagnosis or treatment of a specific patient. The appellate court concluded that the central inquiry is whether the physician has been asked to provide a specific service for the benefit of a specific patient, such as conducting laboratory tests, reviewing the patient’s test results, directing the treating physicians in their care of the patient, or otherwise knowingly accepting the patient as his or her patient – not merely dispending medical advice or offering a professional opinion in response to an inquiry from the treating physician.

After discussing numerous prior Illinois decisions addressing whether a physician-patient relationship is established when an on-call physician participates in a telephone conference with another physician about the proper management of a patient’s care, the Appellate Court found this case to be more analogous to the cases holding that a physician-patient relationship was established through the specific facts of the case, namely: (1) the on-call internal medicine physician was contractually obligated to consult with emergency department physicians at the hospital; (2) he was compensated for those consulting services; (3) he was consulted by decedent’s treating physician for the purpose of rendering medical advice regarding possible hospital admission; (4) he received specific information from the emergency department physician regarding decedent’s history, symptoms, and diagnostic test results; (5) he considered that information and collaborated on a medical opinion that decedent was not in immediate danger of infection; (6) he was ultimately responsible for making the decision on whether to admit the decedent; and (7) he decided the decedent did not need to be admitted.

Of the seven facts cited by the Appellate Court, it took particular note that only the on-call internal medicine physician had admitting privileges and the decision of whether to admit decedent was ultimately his to make. The Appellate Court held the facts justified imposition of the physician-patient relationship and its associated duty of care on the internal medicine physician and his practice group.

In finding a duty based on the undisputed facts, the Appellate Court also rejected defendants’ public policy argument of a “chilling effect upon the practice of medicine” caused by a rule that phone conversations could create a physician-patient relationship. While acknowledging the importance of the exchange of information and expertise among physicians in the practice of medicine, the Appellate Court noted the undisputed facts in this case demonstrated the conversation was not the “informal conference” addressed in those cases where no physician-patient relationship was created, but instead was a conference resulting from a contractual obligation on the internal medicine physician to provide admission decisions that directly affected decedent’s care.

As the Appellate Court in Blagden made clear, there is no bright line rule regarding whether telephone conferences between healthcare providers creates a physician-patient relationship. Instead, the determination of whether a duty is created is fact-specific and takes into consideration the potential concern of a “chilling effect” on the free exchange of information and expertise between physicians.

Too Little, Too Late – Untimely Filed Affidavit of Merit Requires Dismissal of Medical Negligence Lawsuit

13 Oct 2022

ABSTRACT: A Supreme Court of Missouri decision affirmed the dismissal of a medical negligence suit for plaintiff's failure to comply with the mandatory affidavit of merit requirement.

Giudicy v. Mercy Hosps. E. Cmtys., 645 S.W.3d 492 (Mo. 2022) is a Supreme Court of Missouri case that dealt with the statutory affidavit of merit requirement in a medical negligence suit. Mo. Rev. Stat. § 538.225 requires a plaintiff to file an affidavit of merit against each defendant within 90 days after suit has been filed. The statute permits a court to extend the deadline, but not longer than 90 days, meaning there is an absolute 180-day deadline for the filing of an affidavit of merit. An affidavit of merit must be signed by the plaintiff or her attorney and state that she has obtained a written opinion from a legally qualified health care provider stating the defendant health care provider failed to use reasonable care, and that failure caused the plaintiff’s damages.

In Giudicy, the plaintiff was born at Mercy Hospital St. Louis with a rare congenital condition that required several surgeries. In January 2014, Giudicy sued the hospital and the surgeon who performed the surgeries. One month later, Giudicy filed an affidavit of merit against each defendant. Several years later, in May 2019, the plaintiff voluntarily dismissed the action, without prejudice to re-filing. In January 2020, Giudicy filed a second suit against the hospital and the surgeon. For reasons unknown, Giudicy failed to file the affidavits of merit until 198 days after filing suit. The defendants filed a motion to dismiss for failure to timely file the affidavits before the deadline. The trial court granted the motion and dismissed the case (this dismissal was effectively with prejudice considering the underlying limitations period had expired, and the plaintiff has already utilized the savings statute to re-file the suit).

On appeal, the plaintiff argued six points, each of which the Supreme Court rejected. The first four points involved various arguments that § 538.225 violates the Missouri Constitution. The final two points concerned waiver and substantial compliance arguments addressed below.

First, Giudicy argued the defendants waived the affidavit of merit issue because they failed to raise it as one of the affirmative defenses included in their answers to the petition. The Court found the statutory requirement is not a true affirmative defense that is waived if not pleaded, as there is no statute or other law finding as such. Part of the reason for this conclusion is that the 30-day deadline for filing an answer comes before the 90-day (up to 180-day) deadline for filing an affidavit of merit. Thus, it is unrealistic to require a defendant to plead as an affirmative defense a plaintiff’s failure to file an affidavit of merit months before the statutory deadline has expired. The defendants followed the procedure outlined in § 538.225 for raising the affidavit issue in a motion to dismiss.

Finally, Giudicy argued the trial court erred in rejecting his argument and dismissing the suit because he substantially complied with the statute despite the untimely filing of the affidavits. The plaintiff argued he substantially complied with the statute because the substance of each affidavit was appropriate, and his failure to meet the 180-day deadline was a mere technicality. The Supreme Court found the failure to timely file an affidavit of merit does not constitute substantial compliance. The purpose of § 538.225 is to weed out, during the early stages, frivolous medical negligence suits. Allowing a plaintiff to file an affidavit or merit outside after the statutory deadline infringes on that purpose.

The Giudicy opinion is important because it upheld the statutory mandate requiring the timely filing of an appropriate affidavit of merit against each defendant, or the suit must be dismissed. The Court’s rejection of plaintiff’s substantial compliance argument reflects a bright line rule that a plaintiff must strictly comply with the statutory mandate or risk dismissal.

Severe Burn Injury Leads to Application of Higher Noneconomic Damage Cap Limit after Plaintiff Verdict in Missouri Medical Malpractice Trial

27 Sep 2022

ABSTRACT: In Missouri, noneconomic damages in a medical negligence lawsuit are limited by a statutory damage cap. There are two potentially applicable cap limits – a higher cap limit for "catastrophic" injury or death and a lower cap limit for "non-catastrophic" injury. In a new opinion, an appellate court affirmed a trial court's decision to apply the higher "catastrophic" cap limit based on a severe burn injury and found that trial courts have significant discretion in deciding this issue.

2015 Noneconomic Damage Cap

In 2015, RSMO § 538.210 put into effect a noneconomic damage cap for use in cases against healthcare provider defendants. This includes two different cap limits, one of which will apply to any given suit. The higher limit is reserved for “catastrophic” personal injury or death, and the lower limit is for all other “non-catastrophic” injury. The statutory limits are $700,000 for “catastrophic” personal injury/death and $400,000 for “non-catastrophic” injury. These limits increase by 1.7% each year for inflation and are determined as of the date the case is tried. Velazquez v. Univ. Physician Assocs., 625 S.W.3d 445, 454 (Mo. 2021). The 2022 amounts are $787,671 and $450,098.

In Velazquez, the Supreme Court of Missouri upheld the 2015 noneconomic damage cap as constitutional and discussed the statutory definitions of “catastrophic” and “non-catastrophic” injury. At issue was § 538.205(1)(e), which defines “catastrophic” personal injury as “irreversible failure of one or more major organ systems.” This is just one of six subparagraphs defining “catastrophic” personal injury.[1]

In Velazquez, the plaintiff’s expert argued the plaintiff suffered complete, irreversible damage to her bladder and urinary organ system during a c-section. However, the defense elicited testimony that surgery may proveeffective in reversing the alleged urinary organ system failure. After a plaintiff verdict, the defense filed motions for remittitur asking the court to reduce the noneconomic damage award to the lower cap limit. The trial court denied the motions, finding that plaintiff’s injury had caused irreversible failure of a major organ system and thus the higher cap limit applied. The Supreme Court of Missouri affirmed the trial court’s decision to classify plaintiff’s injuries as “catastrophic” and apply the higher cap limit because the plaintiff’s position was supported by competent evidence at trial.

The Harned Opinion

Harned v. Spurlock (WD84990), a Western District Court of Appeals case, is the first appellate opinion to deal with this issue after Velazquez. The appellate court affirmed the trial court’s determination that the plaintiff’s injury was “catastrophic,” leading to application of the higher noneconomic damage cap limit.

The plaintiff in Harned had a history of mental illness and hospital admissions for suicidal ideation. Defendant, a consulting psychologist, saw plaintiff after she attempted suicide by overdosing on prescribed anti-depressant and pain medication. The defendant testified it was his job to evaluate whether plaintiff should be discharged to an inpatient psychiatric treatment facility or if she could be safely discharged with alternative plans. After his evaluation, he decided plaintiff was doing well, and she could be safely discharged to her mother’s care and follow up outpatient care. Several days after discharge, the plaintiff attempted suicide by dousing herself in hairspray and setting herself on fire, resulting in severe third-degree burns to 42% of her body, including her face, neck, torso, arms, and legs. The plaintiff survived the ordeal and underwent four skin graft surgeries and nearly two dozen laser surgeries.

A jury returned a verdict in favor of plaintiff and awarded $560,000 in noneconomic damages. After trial, the defense argued the trial court should reduce the award by $117,426 to the amount of the “non-catastrophic” limit because plaintiff’s injury did not meet the statutory definition of “catastrophic” injury in the absence of irreversible failure of a major organ system. The trial court denied this request and entered judgment for the full amount of the award.

On appeal, the appellate court affirmed and declined to disturb the trial court’s discretionary decision. The appellate court reasoned that “major organ system” is not defined by Missouri law, but no party disputed the fact that the skin is a major organ system. Rather, the defense argued the injury did not meet the statutory definition because no expert testified the burns caused irreversible failure, and the evidence at trial showed plaintiff’s skin had healed over time through skin grafting, though some of the plaintiff’s skin had permanent contraction and scarring, with nerve damage, resulting in permanent discomfort and reduced function. The appellate court disagreed with the defense position and held that a trial court has the discretion to choose, after careful deliberation, between two reasonable alternatives, each of which is supported by competent evidence. The court found the plaintiff was not required to present “magic language,” testimony specifically stating the injury met the statutory definition. Rather, the plaintiff needed only to present competent evidence that supported the trial court’s conclusion, which the court found she did.

The Harned opinion suggests that if there are two reasonable alternatives on this issue, each supported by competent evidence presented at trial, the appellate court will not disturb the trial court’s decision. What must not be overlooked is the fact that the plaintiff has the burden of proof and must prove each element of her case by a preponderance of the evidence, including whether the injury meets the statutory definition of “catastrophic” personal injury. This is a much higher bar for a plaintiff to clear than merely producing some competent evidence in support of her position.

[1] Missouri law, § 538.205(1) defines “catastrophic personal injury” to mean:

a. Quadriplegia defined as the permanent loss of functional use of all four limbs;

b. Paraplegia defined as the permanent loss of functional use of two limbs;

c. Loss of two or more limbs;

d. An injury to the brain that results in permanent cognitive impairment resulting in the permanent inability to make independent decisions or engage in one or more of the following activities of daily living: eating, dressing, bathing, toileting, transferring, and walking;

e. An injury that causes irreversible failure of one or more major organ systems; or

f. Vision loss such that the patient’s central visual acuity is no more than twenty/two-hundred in the better eye with the best correction or whose field of vision in the better eye is restricted to a degree that its widest diameter subtends an angle no greater than twenty degrees.

Mulligan of an Affirmative Defense: Missouri Supreme Court holds physician-patient privilege not waived by having asserted certain affirmative defenses

25 May 2022

ABSTRACT: Missouri Supreme Court rules that an affirmative defense relating to a golf cart driver's intoxication does not waive the physician-patient privilege.

At issue before the Missouri Supreme Court was whether a party’s assertion of an “assumption of the risk” affirmative defense – i.e., that the plaintiff-passenger knew that defendant driving a golf cart was intoxicated and rode with her anyway - waived the driver’s physician-patient privilege.

Background Facts and Procedural Posture

A golf cart driven by the defendant was involved in an accident with the plaintiff as a passenger. The passenger sustained personal injuries and sued the driver alleging she was negligent in operating the vehicle because, among other reasons, the driver was intoxicated. The driver denied the allegations, including that she operated the golf car intoxicated. The driver also asserted several affirmative defenses including comparative fault, implied primary assumption of risk, and implied secondary assumption of risk. Specifically, the driver claimed that the passenger “assumed the risk of injury and accident by entering and continuing to ride in the golf cart if the driver of said vehicle was under the influence”, and accordingly, the passenger could not recover against the driver, and/or the passenger’s fault should also be considered.

In discovery, the passenger sought the medical records of the driver from the night of the accident through the following morning. The driver objected and asserted the physician-patient privilege. The passenger filed a motion to compel production of the requested medical records or alternatively to strike the driver’s affirmative defenses. The passenger argued that the driver had waived the physician-patient privilege by “affirmatively interjecting her intoxication into the case via her affirmative defenses.”

The circuit court sustained the motion to compel and ordered the production of the medical records related to her “alleged intoxication on the date of the incident and the following day.” The driver filed a petition for writ of mandamus or prohibition in the court of appeals, where she sought to prevent the disclosure of her medical records. The court of appeals denied the petition and the driver informed the circuit court of her intention to petition the Missouri Supreme Court for relief. The circuit court ordered the driver to produce the medical records within twenty days, unless the petition to the Supreme Court was still pending. The next day, the driver filed a petition for writ of prohibition or mandamus with the Supreme Court and a preliminary writ of prohibition was issued, commanding the circuit court to take no further action, other than setting aside the order compelling the medical records or show cause why the writ should not issue.

Missouri Authority on the Physician-Patient Privilege

The Supreme Court held unanimously that defendant had not waived the physician-patient privilege and reviewed both the statutory and case law authority underlying that privilege. R.S. Mo. Section 491.060(5) provides:

“The following persons shall be incompetent to testify: …

(5) A physician licensed pursuant to chapter 334, a chiropractor licensed pursuant to chapter 331, a licensed psychologist or a dentist licensed pursuant to chapter 332, concerning any information which he or she may have acquired from any patient while attending the patient in a professional character, and which information was necessary to enable him or her to prescribe and provide treatment for such patient as a physician, chiropractor, psychologist, or dentist.

“Any information a physician acquires from a patient while attending the patient and which is necessary to enable the physician to provide treatment is privileged.” State ex rel. Jones v. Syler, 936 S.W.2d 805, 807 (Mo. banc 1997). Additionally, the physician-patient privilege applies to medical records. State ex rel. Dean v. Cunningham, 182 S.W.3d 561, 567 (Mo. banc 2006). The privilege is for the patient’s benefit and belongs to the patient, not the physician. Id. at 566 n.5. Therefore, even when medical records are directly relevant to a party’s claims, if they are protected by the privilege, they are not discoverable.” State ex rel. Stinson v. House, 316 S.W.3d 915, 919 (Mo. banc 2010)

Affirmative Defenses do not Waive the Physician-Patient Privilege

The passenger argued that the affirmative defenses constituted a waiver because it brought the driver’s physical condition into issue. The Missouri Supreme Court held the medical records were protected by the physician-patient privilege, thus not discoverable. The Court reasoned that the driver had not sought any damages for injury, and her claims of comparative fault and assumption of risk were purely defenses. Thus, the driver’s assertion of affirmative defenses of comparative fault and assumption of risk remains involuntary because she would have waived those defenses if she did not.

The passenger argued that the case was distinguishable from previous Missouri cases and the driver’s affirmative defense must waive the privilege because it places her intoxication at issue. In other words, for the driver to succeed on her affirmative defenses, she must prove the fact of her intoxication. However, the Missouri Supreme Court reasoned that the driver’s affirmative defenses as plead are of a nature that are relevant only if the passenger establishes the driver’s intoxication as alleged in the petition. Thus, if the passenger introduces evidence at trial that establishes the driver’s intoxication, then the driver may rely on the passenger’s evidence to pursue and establish her affirmative defense and will not have waived her physician-patient privilege.

Further, while the medical records could establish quickly and definitively whether the driver was intoxicated, simply because the privileged records were relevant did not make them discoverable. Finally, the passenger asserted that the assertion of the privilege in this situation was unfair. The Missouri Supreme Court recognized that the physician-patient privilege is always invoked at the expense of truth-seeking and the equities supporting the privilege are not great in all cases. However, the privilege is set by statute and any challenges to the propriety of the physician-patient privilege is for the legislature.

Conclusion

This case reinforces the importance of the physician-patient privilege, even in the assertion of affirmative defenses.

State ex rel. Kimberly Barks v. The Honorable Daniel Pelikan, No. SCR99024

Court Applies Two-Year Statute of Limitations for Health Care Providers to Bar Plaintiff's Claim Despite Attempt to Label It as One for Ordinary Negligence

21 Feb 2022

In Payne v. Rehabilitation Institute of St. Louis, the Missouri Court of Appeals, Eastern District, affirmed a trial court’s grant of summary judgment in favor of a rehabilitation hospital on statute of limitations grounds where the plaintiff filed her personal injury claim approximately two and one-half years after the date of injury. No. ED109560, 2022 Mo. App. LEXIS 37 (Ct. App. Jan. 25, 2022). Payne was receiving intensive inpatient stroke rehabilitation at the defendant’s facility and confined to a wheelchair. One day, while she was unattended, she fell out of bed and sustained injury. Payne argued that her claim was not time-barred because her injury arose out of ordinary negligence, rather than medical negligence, so her claim was governed by a five-year limitations period rather than the two-year limitations period applicable to medical negligence actions. The appellate court’s ruling confirms that, regardless of how a plaintiff may characterize her claim, any claim arising out of the provision of health care services must be brought within the two-year limitations period proscribed under § 516.105, RSMo.

The central issue on appeal was whether the alleged negligence “related to health care” and, therefore must be brought within two years from the date of her injury as required under § 516.105. At both the trial and appellate levels, Payne asserted that her claims were for general negligence not medical negligence, because she was not receiving health care services at the time of her fall injury. Therefore, Payne argued, her suit was outside of the purview of § 516.105’s two-year limitations period. Rehabilitation Institute argued that because the plaintiff’s cause of action “involve[d] conduct consistent with medical malpractice and negligence,” her claims fell under § 516.105 and were time-barred.

The court first turned to Supreme Court of Missouri analysis of § 516.105 in Robinson v. Health Midwest Development Group, where the Court specified: “Any act or omission related to the care, custody, or treatment of the patient, whether plead as ordinary negligence or negligence relating to malpractice is covered under section 516.105.” 58 S.W.3d 519, 522 (Mo. banc 2001) (emphasis added). Thus, courts must focus not on the label a plaintiff applies to her claim but the substance of the claim to decide this issue.

In support of her “ordinary negligence” argument, Payne cited Beard v. Pemiscot Memorial Health Systems, wherein the court found that a negligence claim arising out of a slip and fall incident in a shower at an inpatient psychiatric facility did not fall within the purview of § 516.105 and was not time barred event though it was filed more than two years after the injury date. 2019 U.S. Dist. LEXIS 229859 (E.D. Mo. Aug. 12, 2019). In Beard, § 516.105 did not apply because the injury was entirely incidental to the inpatient psychiatric care plaintiff was receiving and did not arise out of the provision of psychiatric health care services. Id.

The court distinguished Beard in that Payne was treated at the defendant’s facility for deficits from a stroke, which made her a high fall risk and necessitated 24-hour rehabilitative nursing care. Unlike the plaintiff in Beard, Payne’s fall risk was not merely incidental to the care she was receiving but was a central reason for which she was admitted for convalescent care. The fact that Payne was not receiving hands on therapy services at the precise moment that she fell was inconsequential to the determination of medical vs. ordinary negligence.

The court found the facts of Dunagan v. Shalom more analogous. 976 S.W.2d 285 (Mo. App. W.D. 1998). In Dunagan, a plaintiff with Alzheimer’s disease who lived in a nursing home fell on five separate occasions and was injured. Id. Dunagan argued the nursing home’s negligence arose out of safety failings rather than medical treatment and, therefore, § 516.105’s two-year limitations period did not apply to bar his claim. Id. The appellate court found that because the plaintiff was admitted to the nursing facility to receive 24-hour care for his medical conditions, his injuries related to the provision of medical care, and, thus, were time barred under § 516.105. Id.

In Payne, much like Dunagan, the appellate court upheld the trial court’s finding that the claim labeled as “ordinary negligence” nevertheless arose out of the provision of health care and was time barred under § 516.105. This decision confirms that, regardless of how a negligence claim is plead, so long as it arises out of the provision of health care, the two-year limitations period applies. The Payne court refused to weaken an important statutory protection for health care providers. The statute of limitations benefits health care providers because it curtails the timeline for suit filing and ensures health care providers will not be forced to defend against stale claims. The Payne decision makes sure this protection will remain, even when plaintiff counsel attempts to evade the statute of limitations with artful pleading.