Fourth Circuit Rejects HIPAA Privacy Defense

On February 24, 2022, the Court of Appeals for the Fourth Circuit ruled that HIPAA did not allow a carrier to deny the plaintiff’s request for documents when the documents at issue did not contain protected information and the carrier had a fiduciary duty to allow the plaintiff an opportunity to correct an inadequate HIPAA release form. In Wilson v. United Healthcare Ins. Co. (4th Cir., No. 20-2044, February 24, 2022), the plaintiff challenged the defendant carrier’s denial of a series of claims the plaintiff submitted to cover his son’s residential behavioral health treatment.

Specifically, the plaintiff challenged the defendant’s denial of benefits for residential treatment that took place over a period that began on December 1, 2015, and ended on July 31, 2017. The district court organized these claims into three groups based on dates of service (“DOS”). The carrier denied the claims in the first and second DOS because the residential treatment was not medically necessary. Plaintiff appealed these decisions as part of the plan’s claim review process, and he engaged an attorney to represent him in the appeal of the second DOS. As part of that appeal, the attorney requested copies of the documents that the carrier relied on when making its decisions, such as plan documents. The attorney attached a HIPAA release form with the request. The carrier did not respond to this and to a subsequent request for documents because the signature purporting to belong to the plaintiff’s son on the HIPAA release form was illegible. The plaintiff’s son continued to receive residential treatment during this time, although the plaintiff did not submit claims from the third DOS to the carrier.

When the carrier failed to respond to the plaintiff’s request for documents, the plaintiff filed suit in federal district court. The district court held that the carrier’s denial of the first DOS was supported by substantial evidence and that the carrier did not abuse its discretion when coming to this decision. The district court also found that the carrier did not abuse its discretion when it did not respond to the request for documents relating to the second DOS and that the attorney’s request was not an appeal. Since the plaintiff did not submit claims relating to the third DOS, the court found that the plaintiff had not exhausted its administrative remedies when it came to the second and third DOS, and so dismissed the plaintiff’s claims with prejudice (i.e., the plaintiff could not bring those claims to court again).

The Fourth Circuit upheld the district court’s ruling regarding the first and third DOS; however, it reversed the district court’s rulings regarding the second DOS. The Fourth Circuit reasoned that the faulty HIPAA release did not excuse the carrier from an obligation to produce documents that did not contain protected information (such as the plan documents). In addition, the Fourth Circuit found that the carrier had a fiduciary duty under ERISA to notify the plaintiff of the problem with the HIPAA release and allow the plaintiff an opportunity to fix the problem. Since the failure to respond to the request for documents put the plaintiff at a disadvantage in the claim review process, the Fourth Circuit remanded the issues surrounding the second DOS back to the district court for another review.

This case demonstrates the importance of providing documents relating to a claim to the person who submitted the claim, as well as a reminder of a plan’s fiduciary duty to deal with participants fairly. Employers should be aware of these obligations.

Wilson v. United Healthcare Ins. Co. »