Rowe, J.
Shands Jacksonville Medical Center, Inc. seeks a writ of certiorari to review an order denying its motion to dismiss Eartha Pushas medical malpractice complaint. Pusha alleged that Shands negligent treatment of Pushas mother, Regina Freeman, resulted in Freemans death. Shands argued that Pushas suit should be dismissed because of her failure to comply with the Medical Malpractice Act by obtaining a verified written medical expert opinion corroborating her claims before she filed suit. Pusha countered that Shands waived this presuit requirement when it failed to respond to her requests for Freemans medical records. Shands argued that no waiver occurred because the hospital did not refuse to produce Freemans records, but rather asked for additional information to ensure that the persons seeking Freemans confidential medical records were legally authorized to receive the records. The trial court denied Shands motion to dismiss, concluding that Shands waived its entitlement to an expert opinion by failing to produce Freemans medical records in response to Pushas requests.
The question before this Court is: During the course of the presuit investigation authorized under the Medical Malpractice Act, may a hospital seek verification that a person requesting confidential medical records is legally authorized to obtain those records? For the reasons that follow, we answer the question in the affirmative, and grant the petition.
I. BACKGROUND
In September 2010, Regina Freeman was experiencing heart problems, which led to her admission to Shands for mitral valve replacement surgery. After the surgery, Freeman was transferred to the cardiovascular intensive care unit for post-surgical monitoring. While in the ICU, she experienced ventral fibrillation and was returned to the operating room. Freeman never regained consciousness and remained on life support for several days following the surgery. She died on October 5, 2010.
A. Pre-Suit Actions
Shortly after Freemans death, Eartha Pusha, Freemans mother, and/or Takara Teague, Freemans daughter, contacted the law firm of Fenster & Cohen, P.A. about representing the family in a medical malpractice suit against Shands.
1. December 23, 2010 Request for Medical Records
On December 23, 2010, an attorney from the Fenster law firm sent a letter to Shands requesting Freemans medical records. The letter identified Pusha as Freemans personal representative. The letter expressly provided that this firm represents the above-named individual, referring only to Pusha and did not reflect that the firm represented anyone else. The letter did not indicate that Freeman was deceased or that Pusha was Freemans mother. And the letter contained no reference to the Medical Malpractice Act.
A form purporting to authorize the release of Freemans confidential medical records was attached to the letter. The stated purpose for requesting the records was at the request of the individual. But the form was not signed by Pusha, the client identified in the letter. Rather, it was signed by Teague, who was identified on the form as Freemans personal representative and daughter. Nothing on the form allowed Shands to verify that Teague was in fact Freemans daughter or to determine whether any relationship existed between Pusha and Teague. Further, it is undisputed that neither Pusha nor Teague was a personal representative of Freemans estate at the time the letter was sent.
Iron Mountain, Shands contracted copy service, responded to the request on January 8, 2011. Iron Mountain informed Pushas counsel that Shands could not provide the requested records because the authorization form enclosed with her letter did not comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as it did not include a valid power of attorney authorizing the release of Freemans medical records.
Jeffery Fenster, in his deposition, asserted that his staff probably contacted Shands after receipt of the response to his records request and probably explained to them that Freeman was deceased and thus no power of attorney was necessary. But Fenster failed to maintain a paper file for Pushas case, so he could not recall what actually transpired. Instead, he testified only to his firms general practice.
2. April 6, 2011 Request for Medical Records
On April 6, 2011, the Fenster law firm sent Shands a second letter requesting Freemans medical records. The letter included a request that Freemans medical records be produced within ten days pursuant to section 766.204(1), Florida Statutes. Otherwise, the April letter was virtually identical to the December letter. Pusha was identified as the client and personal representative of Freemans estate. Attached to the letter was an authorization form signed by Teague, who purported to be the personal representative and daughter of Freeman. Again, nowhere in the letter was Teague identified as a client. The letter did not explain the relationship between Pusha (identified in the letter as the client) and Teague (identified on the form as the personal representative and daughter of Freeman). Nor did either the letter or form indicate that Freeman was deceased.
Shands director of health information management, Annette Wrabel, testified that a letter was sent in response to this request informing Pusha that no records could be released without an authorization signed by the patient or a valid power of attorney. Wrabel was unable to produce a copy of the letter, but she did produce a record from their log system showing a letter was sent in response to the request.
3. July 2011 Requests for Medical Records
On July 6, 2011, the Fenster law firm sent Shands a third letter requesting Freemans medical records. Five days later, the law firm faxed the same authorization form attached to the two prior letters, but this time he also included a copy of Freemans death certificate. Two days later, on July 11, 2011, after Shands was able to verify that Freeman was deceased and that Teague was Freemans daughter, the hospital produced the requested medical records to the Fenster law firm.
Fenster requested additional records on July 21, 2011, which Shands produced within ten business days.
B. Complaint
On June 15, 2011, the law firm mailed a Notice of Intent to Initiate Litigation to Shands. The notice identified Pusha and Teague as personal representatives of Freemans estate. Shands responded by letter dated September 26, 2011, stating that the notice was deficient because it did not contain a written medical expert opinion corroborating Pushas claim as required by section 766.203(2), Florida Statutes (2011).
On May 24, 2012, Pusha, as personal representative of Freemans estate, filed a complaint alleging that Shands negligence directly led to Freemans death. Pusha did not obtain a written medical expert opinion before she filed suit.
In 2015, Shands moved to dismiss the complaint on grounds that Pusha failed to comply with the presuit requirements of section 766.203(2) because she never obtained a written medical expert opinion corroborating her medical malpractice claims. Pusha argued that Shands waived this presuit requirement because Shands failed to produce Freemans medical records during presuit discovery as required by section 766.204(2), Florida Statutes. Shands replied that it was not required to produce the records because the hospital could not produce Freemans confidential medical records until it had a valid authorization to release the records.
After an evidentiary hearing, the trial court denied the motion to dismiss.
II. STANDARD OF REVIEW
A petitioner seeking certiorari relief from the denial of a motion to dismiss must demonstrate a departure from the essential requirements of the law that would result in irreparable harm that could not be corrected on direct appeal. Williams v. Oken , 62 So.3d 1129, 1132 (Fla. 2011). When a petitioner seeks certiorari relief on grounds that a plaintiff has not complied with the presuit requirements of the Medical Malpractice Act, the latter two prongs of the certiorari standard are satisfied as [t]he statutes requiring presuit notice and screening cannot be meaningfully enforced postjudgment because the purpose of the presuit screening is to avoid the filing of the lawsuit in the first instance. St. Josephs Hosp., Inc. v. Doe , 208 So.3d 1200, 1201-02 (Fla. 2d DCA 2017) (citations omitted). Thus, for certiorari relief to be granted, Shands was required to show that the order denying its motion to dismiss departed from the essential requirements of the law. If no competent, substantial evidence supports the order, then the trial court has departed from the essential requirements of the law. See C.O. v. State , 203 So.3d 200, 200 (Fla. 5th DCA 2016) (holding that when competent, substantial evidence fails to support the trial courts finding regarding competency, the trial court has departed from the essential requirements of the law);
In re Commitment of Reilly , 970 So.2d 453, 455 (Fla. 2d DCA 2007) (Where competent, substantial evidence does not support the trial courts finding regarding competency or involuntary commitment, the trial court has departed from the essential requirements of the law.).
Here, we must determine whether competent, substantial evidence supports the trial courts order denying the motion to dismiss. Specifically, we must determine whether Pusha was permitted to proceed with her lawsuit without obtaining a presuit written expert report corroborating her claims based on a finding that Shands waived entitlement to the report by not immediately producing Freemans medical records in response to Pushas requests. Although the trial court did not make specific findings, we conclude that the trial court found that at least one of the records requests made by Pusha before July 2011 was adequate to trigger Shands obligation to produce Freemans medical records.
Pusha made two concessions that narrow the scope of our review. First, she conceded that the December 2010 letter was not a formal request for medical records under the Medical Malpractice Act because it did not reference chapter 766. Second, she conceded that Shands timely responded to her July 2011 request for records. Consequently, our review centers on the April 2011 request for medical records and whether the request was sufficient to require Shands to produce the records.
III. THE MEDICAL MALPRACTICE ACT
Before filing a medical negligence action, a claimant must comply with the presuit requirements of the Medical Malpractice Act. See Gordon v. Shield , 41 So.3d 931, 933 (Fla. 4th DCA 2010) (recognizing that the Act creates a complex presuit investigation procedure that both claimants and defendants must follow). One of the requirements is for the claimant to investigate whether there are reasonable grounds to believe that a defendant named in the suit provided negligent care or treatment and that such negligence resulted in an injury to the claimant. § 766.203(2), Fla. Stat. (2011). In order to assist a claimant with reviewing the merits of her potential claim, section 766.204(1), Florida Statutes (2011), requires copies of medical records to be turned over to a claimant or a defendant, or to the attorney therefore.
Once a claimant has undertaken the investigation required by the Act and before filing suit, the claimant must submit a verified written medical expert opinion to corroborate that there are reasonable grounds to support the claim of medical negligence. § 766.203(2), Fla. Stat. (2011). However, this requirement may be waived if a defendant fails to timely comply with a claimants request for medical records. See § 766.204(2), Fla. Stat. (2011) ; Martin Meml Med. Ctr., Inc. v. Herber , 984 So.2d 661, 664 (Fla. 4th DCA 2008) (holding that the failure of a hospital to timely comply with a request for medical records results in a waiver of the requirement for a claimant to file a corroborating medical affidavit); Watson v. Beckman , 695 So.2d 436, 437 (Fla. 3d DCA 1997) (holding that the requirement to file a verified corroborating expert opinion was waived by the defendants failure to comply with a records request); Escobar v. Olortegui, DDS , 662 So.2d 1361 (Fla. 4th DCA 1995) (holding that failure to provide copies of a plaintiffs medical records waived the necessity of filing a corroborating affidavit). Although Florida courts construing section 766.204(2) in some cases have found waiver of the right to the presuit written corroborating expert opinion, it has done so only where the defendant has wholly failed to produce records in response to a claimants request. See, e.g., Watson , 695 So.2d at 437 (healthcare provider completely failed to produce records, but plaintiff cured the presuit deficiency by obtaining the corroborating expert affidavit before the statute of limitations ran); Escobar , 662 So.2d at 1364 (healthcare providers failure to produce medical records waived right to the corroborating expert affidavit).
Here, Shands did not refuse to produce Freemans medical records, rather it sought to verify that Pusha and/or Teague were claimants or were otherwise legally authorized to receive Freemans records before producing them. A claimant is defined as any person who has a cause of action for damages based on personal injury or wrongful death arising from medical negligence. § 766.202(1), Fla. Stat. (2011). And pursuant to Floridas Wrongful Death Act, only a properly designated personal representative may bring a lawsuit for wrongful death. § 768.20 Fla. Stat. (2011). The April 2011 letter requesting Freemans medical records did not clearly identify Pusha or Teague as claimants or as persons legally authorized to receive Freemans medical records. In fact, the letter only served to confuse the issue. The letter did not identify Pusha as Freemans mother or next of kin. Further, although records may be released to an attorney for a claimant, the letter did not clearly identify that the person who was requesting the records was Fensters client. Pusha was identified as a client of the firm, but Teague, who signed the authorization form, was not so identified. In response, Shands did not refuse to produce the records. Instead, Shands sought to determine whether Pusha and/or Teague were authorized to receive Freemans medical records, and asked for a copy of a power of attorney or a copy of Freemans death certificate before producing the records.
Pusha argues that the plain language of section 766.204 contains no requirement that a person requesting records demonstrate their legal authority to receive the records. Nor does the statute expressly authorize a hospital to seek to verify that the person requesting confidential medical records is legally authorized to receive the records before producing them. Thus, Pusha argues that the statute requires only that a person requesting a patients medical records make a request, and without more, the hospital is obligated to produce the records. We reject this argument for two reasons: first, this construction of section 766.204 is inconsistent with the high degree of protection given to confidential medical records under Florida law; and second, to the extent that Floridas protection of confidential medical records under section 766.204 is less stringent than HIPAA, section 766.204 is preempted.
A. Floridas Laws Protecting the Privacy of Medical Records
Florida law prohibits the disclosure of confidential medical records without valid authorization. An authorization for the release of a persons confidential medical records is valid only if made by the patient or his or her legal representative. § 395.3025(4), Fla. Stat. (2011). Section 395.3025(1), Florida Statutes (2011), provides the following guidelines for obtaining medical records:
Any licensed facility shall, upon written request, and only after discharge of the patient, furnish, in a timely manner, without delays for legal review, to any person admitted therein for care and treatment or treated thereat, or to any such persons guardian, curator, or personal representative, or in the absence of one of those persons, to the next of kin of a decedent or the parent of a minor, or to anyone designated by such person in writing , a true and correct copy of all patient records, including X rays, and insurance information concerning such person, which records are in the possession of the licensed facility, provided the person requesting such records agrees to pay a charge.
(emphasis added).
Pushas request for Freemans medical records is deficient under section 395.3025(1) because it does not demonstrate that Pusha and/or Teague were legally authorized to act as Freemans guardian, curator, or personal representative. The request was not accompanied by a copy of Freemans death certificate, so it was unclear that Teague, who was identified as Freemans daughter, could request the records as Freemans next of kin. Instead, the request served to create confusion about the identity of the firms client(s). On the one hand, the caption of the letter indicated that it was seeking Freemans records on behalf of its client, Pusha. On the other hand, the enclosed authorization form to release the medical records was signed by Teague, a person not identified in the letter as a client of the firm. Because the request for Freemans medical records did not include a valid authorization for their release, the request failed to comply with section 395.3025(1), and Shands was prohibited from releasing the records.
The protection for confidential medical records is not provided only by statute; the Florida Constitution also extends additional protections in connection with the right to privacy. Weaver v. Myers , 229 So.3d 1118, 1126 (Fla. 2017) (recognizing that the right to privacy in the Florida Constitution applies to medical records). The supreme court recently held that the right to privacy provides protection for a patients medical records even after the patients death:
Death does not retroactively abolish the constitutional protections for privacy that existed at the moment of death. To hold otherwise would be ironic because it would afford greater privacy rights to plaintiffs who survived alleged medical malpractice while depriving plaintiffs of the same protections where the alleged medical malpractice was egregious enough to end the lives of those plaintiffs.
Id. at 1127-28. In light of this strong protection for the confidentiality of medical records under other provisions of Florida law, a hospital cannot be deemed to have failed to comply with section 766.204(2) simply by seeking to verify that the person requesting disclosure of anothers confidential medical records is the legal representative of the person whose records have been requested. A contrary rule would allow any person to identify themselves as a claimant or the patients legal representative and thereby demand and receive records from a hospital. Such a rule would undermine Floridas statutory and constitutional protections for the privacy of confidential medical records.
B. HIPAA
But even if Pushas request for Freemans medical records was sufficient under section 766.204(1), and complied with Floridas laws protecting the confidentiality of medical records, Shands was also required to comply with HIPAA and could not produce Freemans confidential medical records without a valid authorization form.
The disclosure of confidential medical records by healthcare providers is heavily regulated by HIPAA. See Murphy v. Dulay , 768 F.3d 1360, 1368-69 (11th Cir. 2014). HIPAA was enacted in recognition of the strong privacy interest a patient has in her personal health information. OPIS Mgmt. Res., LLC v. Secy, Fla. Agency for Health Care Admin. , 713 F.3d 1291, 1294-95 (11th Cir. 2013). Subject to certain exceptions not applicable here, HIPAA expressly prohibits the disclosure of medical records without valid written authorization. 45 C.F.R. § 164.508(a)(1). To be valid, the authorization must be completed by someone legally authorized to receive the records. OPIS Mgmt. Res. , 713 F.3d at 1295.
The April 2011 letter does not comply with the requirements of HIPAA. Nothing in the letter identifies Pusha and/or Teague as persons legally authorized to receive the records and no power of attorney was attached. The letter merely asserts that they are Freemans personal representatives. It is never asserted that Freeman is deceased, and her death certificate was not attached to the letter. Neither Teague nor Pusha had been appointed personal representatives of Freemans estate. Thus, the authorization form signed by Teague was not valid authorization under HIPAA. 45 C.F.R. § 164.508(c)(1)(vi) (If the authorization is signed by a personal representative of the individual, a description of such representatives authority to act for the individual must also be provided.).
Pusha brushes away Shands arguments that it was required to comply with HIPAA before disclosing Freemans medical records, arguing that the hospital could not be held liable for improper disclosure of medical records pursuant to section 766.204(3), Florida Statutes (2011). That statute contains the following hold harmless provision purporting to release a hospital from civil damages for claims for releasing medical records required by the statute: A hospital shall not be held liable for any civil damages as a result of complying with this section. But Pushas argument misses the point. Even if section 766.204(3) could immunize a hospital that improperly released confidential medical records from a lawsuit filed under state law seeking civil damages , nothing in that provision would shield a hospital from federal prosecution if the hospital released the records in violation of HIPAA. See 42 U.S.C. § 1320d-6(b) (authorizing up to ten years imprisonment for the wrongful disclosure of individually identifiable health information).
Further, to the extent that section 766.204(3) could be construed to permit disclosure of confidential medical records without a valid authorization, it would be preempted by HIPAA. Although HIPAA does not preempt all state laws relating to the privacy of personal health information and medical records, it does preempt those state laws which are less stringent than HIPAAs privacy protections. Paylan v. Fitzgerald , 223 So.3d 431, 434 (Fla. 2d DCA 2017). An interpretation of section 766.204(3) that would permit disclosure of confidential medical records without a valid authorization necessarily affords less stringent protections to a patients privacy than does HIPAA.
Under Pushas construction of section 766.204(3), a hospital would be forced to navigate between Scylla and Charybdis in deciding whether to produce records in a presuit investigation or to comply with state and federal laws governing the privacy of confidential medical records. If the hospital attempted to verify the legal status of the person requesting the medical records, it would forfeit its right to require a potential claimant to seek an expert medical opinion to corroborate her claim. If the hospital produced the medical records without verifying the legal status of the requestor, it could face criminal prosecution under HIPAA. We hold that section 766.204 does not require Shands to face such a dilemma. When a hospital receives a request to produce medical records in a presuit investigation, it may verify the legal status of the person requesting the records to determine whether they are a claimant under section 766.206, and also take those steps necessary to comply with the requirements of HIPAA and state laws limiting disclosure of confidential medical records.
IV. CONCLUSION
The trial court departed from the essential requirements of law when it concluded that Shands was required to produce Freemans confidential medical records in response to Pushas incomplete and conflicting requests. Shands did not receive a valid authorization for the release of the records, so it was not required to produce the records. Because Shands did not wholly refuse to produce the records, Pusha was required to obtain a written medical expert opinion corroborating her claim before she filed suit. But because Pusha never obtained such an opinion and the statute of limitations has expired, her complaint must be dismissed with prejudice. Accordingly, we grant Shands petition for writ of certiorari and quash the order below.
GRANTED .
B.L. Thomas, C.J., and M.K. Thomas, J., concur.
Pusha was not appointed as personal representative of Freemans estate until more than twenty-two months later, on October 8, 2012.
To the extent that Pusha relies on the deposition testimony of Jeffery Fenster, Pushas original attorney, indicating that a death certificate was sent to Shands as an attachment to the April 11, 2011, letter, this reliance is misplaced. The record reflects that Fenster did not receive the death certificate until April 15; thus, it could not have been sent to Shands when Pusha sent the April 11, 2011, request for medical records.
In September 2011, after it had produced all of Freemans medical records, Shands put Pusha on notice of its argument that the hospital had not failed to produce records and thus had not waived the requirement for Pusha to provide a written medical expert opinion corroborating her claim before she filed suit. Nonetheless, Pusha chose not to cure this deficiency in the presuit process before she filed suit nine months later, or before the statute of limitations ran on her claim almost two years later, in 2013.