Mary Miller brought this wrongful death action against Alvista Healthcare Center, Inc., the owner and operator of the nursing care facility in which Miller’s husband lived at the time of his death. Before bringing suit, Miller asked Alvista to provide her with copies of her deceased husband’s medical records. Alvista refused, based on its determination that the Health Insurance Portability and Accountability Act of 1996 “HIPAA”1 and the HIPAA privacy regulations promulgated thereunder2 collectively referred to as the “privacy rule” deny it the authority to provide Miller with the records. Concluding otherwise, the trial court ordered Alvista to provide the decedent’s medical records to Miller. For reasons that follow, we affirm. When Miller’s husband died intestate on March 19, 2006, he resided in an Alvista nursing care facility known as Atlanta Care Home. In January and March 2008, Miller, as the surviving spouse of the decedent, made written requests upon Alvista for copies of his medical records. Alvista, through its representative, UHS Pruitt Corporation Pruitt, denied the requests on grounds that, under HIPAA and the privacy rule, it could release such records to only the permanent administrator or executor of the decedent’s estate, which was unrepresented.
On March 4, 2008, Miller, again in her capacity as the decedent’s surviving spouse, brought this action against Alvista and others collectively referred to as Alvista. In her complaint, as amended, she sought a temporary restraining order and permanent injunction requiring Alvista to release decedent’s medical records to her, as well as a judgment declaring her legal entitlement to such records.