Kenneth Wilson v. UnitedHealthcare Insurance Co ( 2022 )


Menu:
  • USCA4 Appeal: 20-2044     Doc: 48            Filed: 02/24/2022   Pg: 1 of 41
    PUBLISHED
    UNITED STATES COURT OF APPEALS
    FOR THE FOURTH CIRCUIT
    No. 20-2044
    KENNETH WILSON, as Parent and Natural Guardian of J.W., a minor child,
    Plaintiff – Appellant,
    v.
    UNITEDHEALTHCARE INSURANCE COMPANY,
    Defendant – Appellee.
    Appeal from the United States District Court for the District of South Carolina, at
    Charleston. David C. Norton, District Judge. (2:17-cv-03059-DCN)
    Argued: December 8, 2021                                     Decided: February 24, 2022
    Before AGEE, THACKER and QUATTLEBAUM, Circuit Judges.
    Affirmed in part, vacated in part, and remanded with instructions by published opinion.
    Judge Agee wrote the opinion, in which Judge Thacker and Judge Quattlebaum joined.
    ARGUED: M. Leila Louzri, FOSTER LAW FIRM, LLC, Greenville, South Carolina, for
    Appellant. Cavender Crosby Kimble, BALCH & BINGHAM LLP, Birmingham,
    Alabama, for Appellee. ON BRIEF: Nathaniel W. Bax, FOSTER LAW FIRM, LLC,
    Greenville, South Carolina, for Appellant. Robert L. Brown, WILSON, JONES, CARTER
    & BAXLEY, P.A., Columbia, South Carolina, for Appellee.
    USCA4 Appeal: 20-2044      Doc: 48          Filed: 02/24/2022     Pg: 2 of 41
    AGEE, Circuit Judge:
    After health insurance payments for services provided to his minor son were denied,
    Kenneth Wilson filed a complaint in district court challenging that determination under 
    29 U.S.C. § 1132
    (a)(1)(B). The court affirmed the plan administrator’s denial of coverage for
    the son’s treatment from December 1, 2015, through May 15, 2016, concluding the plan
    administrator acted reasonably under the relevant factors identified in Booth v. Wal-Mart
    Stores, Inc. Assocs. Health & Welfare Plan, 
    201 F.3d 335
     (4th Cir. 2000). In addition, the
    district court dismissed Wilson’s claims arising from treatment his son received from May
    15, 2016, through his discharge on July 31, 2017, for failure to exhaust administrative
    remedies.
    Wilson appeals both dispositions. For the reasons set forth below, we affirm the
    district court’s judgment against Wilson for the denial of coverage for services provided
    from December 1, 2015, through May 15, 2016. We have broken up the analysis for
    Wilson’s claims related to the remaining services his son received based on a slightly
    different measure than the district court relied on, looking to whether the plan administrator
    denied coverage of the claims on or before January 26, 2017. Using that measure, we vacate
    the district court’s dismissal of Wilson’s claims for the administrator’s coverage
    determinations that were made before January 26, 2017, and that were not for services
    provided from December 1, 2015, through May 15, 2016. Lastly, we affirm the court’s
    dismissal of Wilson’s claim for coverage determinations the administrator made after
    January 26, 2017, (regardless of when the corresponding services were provided) because
    Wilson failed to exhaust his administrative remedies for those claims. Accordingly, we
    2
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022      Pg: 3 of 41
    affirm in part, vacate in part, and remand the case to the district court for entry of an order
    remanding the relevant claims to the plan administrator for a full and fair review under
    ERISA and the Plan.
    I.
    A. The Plan
    Wilson participates in the Towers Research Capital, LLC Welfare Benefit Plan (“the
    Plan”), a health insurance plan governed by the Employee Retirement Income Security Act
    of 1974 (“ERISA”). Wilson’s minor son, J.W., is a beneficiary of the Plan.
    UnitedHealthcare Insurance Co. (“United”) began insuring the Plan on December
    1, 2015, thus making it the plan administrator throughout the relevant period. 1 The parties
    agree that the Plan gave United, as plan administrator, discretionary authority to interpret
    its terms and make benefits determinations. While the Plan provides for coverage of both
    outpatient and inpatient, i.e., residential, behavioral health care services, only “[m]edically
    [n]ecessary” inpatient health services and treatments are covered. J.A. 54. The medical
    necessity criteria require that a patient’s care be provided in the least costly setting likely
    to produce an equivalent therapeutic result.
    The Plan establishes the process for United to make benefits determinations and for
    beneficiaries to appeal adverse coverage determinations. The medical necessity
    1
    Different versions of the Plan governed each calendar year at issue in this case, but
    the three versions contain substantially similar relevant language. The district court and
    parties rely on the 2016 version and neither party has noted a reason not to do so. We
    therefore rely on the 2016 version.
    3
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022      Pg: 4 of 41
    determination is made during a “Utilization Review” process. J.A. 55. That process can
    occur before, during, or after a health care provider performs the services for which
    coverage is sought. If the administrator denies coverage for lack of medical necessity,
    beneficiaries can pursue two levels of internal review as well as an external review. 2
    Beneficiaries have 180 days after receiving notice of an adverse benefits determination to
    initiate a first-level appeal and must file a second-level appeal “within 45 days of receipt
    of the final adverse determination on the first level Appeal.” J.A. 58. The Plan requires the
    administrator to acknowledge a member’s request to appeal “within 15 calendar days of
    receipt,” 
    id.,
     and further requires notification of each level’s appeal decision within 30 days
    of receiving the request.
    B. J.W.’s Treatment
    Over a two-year period from July 2015 to July 2017, J.W. received residential
    treatment to address mood and behavior issues. Until that time, he’d never received
    inpatient psychiatric treatment, despite years of medication and counseling. J.W. was first
    admitted to residential treatment at Change Academy at Lake of the Ozarks (“CALO”)
    after experiencing behavioral issues, including “struggl[ing] with emotional regulation,
    depression, anxiety, anger and general mood swings.” J.A. 2353. At that time, he’d been
    diagnosed with disruptive mood dysregulation disorder, generalized anxiety disorder,
    attention-deficit/hyperactivity disorder, and an unspecified neurodevelopmental disorder.
    Two months before the coverage periods at issue in this case, he was moved from CALO
    2
    The external appeal is governed by other deadlines and criteria that are not at issue
    in this case.
    4
    USCA4 Appeal: 20-2044      Doc: 48         Filed: 02/24/2022     Pg: 5 of 41
    to an area hospital because he had suicidal thoughts and had threatened to kill himself,
    though he was released back to CALO after a four-day stay.
    This case involves claims for coverage of J.W.’s residential treatment at CALO
    from December 1, 2015 (when United took over the Plan’s administration) until July 31,
    2017 (when J.W. was discharged). As discussed in the analysis that follows, the parties and
    the district court divided Wilson’s claims into three groups based on the dates of service
    (“DOS”). The First DOS encompasses services CALO provided from December 1, 2015,
    through May 15, 2016. The Second DOS encompasses services CALO provided for three
    periods in 2016: July 16–31, 2016; August 1–15, 2016; and November 1–30, 2016. The
    Third DOS encompasses all other dates of services CALO provided from May 15, 2016,
    through J.W.’s discharge.
    C. The Claims
    1. Claims for Coverage During the First DOS
    United denied Wilson’s claims for the First DOS based on its finding that J.W.’s
    residential treatment was not medically necessary. A letter from United explained that
    coverage was unavailable because J.W. “was admitted for inpatient treatment of his mood
    problems” that “did not need the 24-hour monitoring provided in a residential setting [given
    that] care could have been provided at a lower level of care such as partial hospital or
    intensive outpatient services.” J.A. 2873. Specifically, a board-certified psychiatrist made
    the initial benefits determination based on CALO’s records and other clinical records
    concerning the services provided to J.W. She determined that J.W. made progress in the
    months preceding the First DOS such that he did not satisfy the Plan’s criteria for
    5
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022      Pg: 6 of 41
    residential treatment. She pointed in particular to the lack of evidence that J.W. had a severe
    lack of behavioral control, required frequent medication changes, or needed 24-hour
    monitoring.
    On Wilson’s behalf, CALO appealed the denial of coverage for the First DOS.
    Consistent with the Plan’s procedures, United assigned the appeal to a different psychiatrist
    who was not involved in the initial denial. After reviewing “all aspects of clinical care
    involved in [J.W.’s] treatment” and discussing J.W.’s condition with his treating
    psychiatrist, the appeal psychiatrist upheld the initial determination to deny benefits. J.A.
    2889. In sum, he concluded that J.W.’s “behaviors had improved” by December 1, 2015,
    such that any disruptive episodes could have been safely treated in an outpatient setting.
    
    Id.
    CALO next sought an external appeal, which similarly upheld the denial as not
    medically necessary.
    2. Additional Claims for Coverage
    As the First DOS claims were being reviewed and appealed, J.W. continued to be
    treated at CALO, and CALO continued to submit claims for those residential services to
    United. However, United denied these claims, again finding a lack of medical necessity for
    inpatient treatment. As the claims were denied, United sent multiple Explanation of
    Benefits (“EOB”) letters to Wilson, setting out the reasons for United’s decision and
    explaining Wilson’s rights and responsibilities under ERISA and the Plan.
    On January 26, 2017, Wilson’s counsel faxed a letter to United indicating that she
    had been “retained to represent [Wilson] in connection with the appeal of [United’s] denial
    6
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022     Pg: 7 of 41
    of his health insurance benefits.” J.A. 2930. The letter’s subject line identified three
    specific claim numbers, which were for CALO’s services provided during the time periods
    the parties and district court later designated as the Second DOS. The letter also stated that
    Wilson’s “appeal is for the claims referenced above as well as any and all denied claims
    related to treatment received at [CALO].” 
    Id.
    The January 26 letter identified two purposes for writing. First, it stated that Wilson
    “do[es] wish a review of the denial of Mr. Wilson’s claim pursuant to 
    29 U.S.C. § 1133
    ”
    and indicated that although counsel “request[ed] that [United] begin [its] review,” she did
    “not wish for [United] to complete the review until [she was] able to submit to [United] all
    of Mr. Wilson’s medical records,” which she was in the process of obtaining. 
    Id.
     Counsel
    indicated that it was “absolutely essential” that United consider those records “as a part of
    this review.” 
    Id.
    Second, the letter asked United for “a complete copy of each and every document
    upon which [it had] based [its] denial of Mr. Wilson’s claim,” including “any medical
    documents, substantive documents, the plan document and any internal guidelines or
    regulations which [United] ha[d] used in evaluating [the] claim.” J.A. 2931. As support for
    the right to obtain copies of these records, the letter referenced “
    29 U.S.C. § 1132
    (c) and
    
    29 U.S.C. § 1133
     as interpreted by the Fourth Circuit Court of Appeals in Ellis v.
    Metropolitan Life Insurance Company, 
    126 F.3d 228
     (4th Cir. 1997) and the Code of
    Federal Regulations interpreting 
    29 U.S.C. § 1133
    .” 
    Id.
     The letter reiterated its position
    that Wilson must “be given the documentation upon which his claim has been denied so
    7
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022     Pg: 8 of 41
    that [he has] a full and fair opportunity to respond to the same should he deem it
    appropriate.” 
    Id.
    Attached to the January 26 letter were two signed documents: (1) a “Confirmation
    of Representation and Authorization for Release of Records and Reports,” Wilson’s Letter
    re: Court Order at 1, Wilson v. UnitedHealthcare Ins. Co., No. 20-2044 (4th Cir. filed Dec.
    13, 2021), ECF No. 45, and (2) a “Medical Authorization for Release of Records and Other
    . . . Identifying Information” to comply with the Health Insurance Portability and
    Accountability Act of 1996 (“HIPAA”) (“the HIPAA authorization form”), J.A. 2932.
    The confirmation of representation form contains a signature on a line for the
    “client” to sign, followed by Wilson’s social security number and birthdate. It states that
    the attorney who sent the January 26 letter had been retained to represent Wilson “in
    connection with [his] claim for health insurance benefits” and that Wilson authorized
    United to send his counsel “any and all information, which may be requested, from any
    medical provider, [his] insurance company or [his] employer regarding [him].” Wilson’s
    Letter re: Court Order at 4, ECF No. 45.
    The HIPAA authorization form similarly sought to authorize counsel to obtain
    copies of “patient” J.W.’s records that would otherwise be protected by privacy laws. In a
    section setting out the “Authorization and Scope” of the release, it identified ten categories
    of materials, including medical and psychiatric records, hospital records, laboratory
    reports, and medical opinions. J.A. 2932. It also authorized various entities to “discuss
    [J.W.’s] history, condition, treatment, claim and bills” with counsel. 
    Id.
     The HIPAA
    authorization form acknowledged that “to be valid[, the form] must comply with 45 C.F.R.
    8
    USCA4 Appeal: 20-2044       Doc: 48          Filed: 02/24/2022      Pg: 9 of 41
    § 164.508.” Id. The form contains an illegible signature on the line for a patient to “sign[]
    on his or her own behalf.” Id. The lines for a client to sign “on behalf of another person”
    and to indicate the basis for that authority to sign are blank. Id.
    Although United internally categorized the January 26 letter as an attorney’s request
    for release of information, it did not respond to the letter, produce any documents, or initiate
    an appeal.
    On February 24, 2017, counsel sent a second letter to United, which again
    specifically identified the three claim numbers associated with the Second DOS. It
    referenced the January 26 letter as having “notified” United that Wilson “was appealing”
    the denial of J.W.’s benefits and attached a copy of the prior letter. J.A. 2933. The letter
    observed that counsel had “not received any documents from [United] which [were]
    responsive to [her] attached request for documents.” Id. And it reiterated that counsel could
    not “prepare or submit any substantive documents . . . to be considered on review until
    [United] provide[d her] the” previously requested documents. Id. A response from United
    was requested within ten days. Further, the letter stated that if United did not provide the
    requested documents within the ten days, Wilson would be left with the assumption “that
    further attempts to exhaust administrative remedies [were] futile” and would instead “file
    suit” under ERISA. Id.
    United again internally categorized the letter as an attorney’s request for release of
    information, but did not respond, provide copies of documents, or initiate an appeal.
    9
    USCA4 Appeal: 20-2044      Doc: 48         Filed: 02/24/2022     Pg: 10 of 41
    D. The Litigation
    In November 2017, Wilson filed a complaint, which he later amended, in the U.S.
    District Court for the District of South Carolina, alleging that United improperly denied
    health insurance benefits for J.W.’s residential treatment at CALO. More broadly, Wilson
    pled that United denied him a “full and fair review” of his claims under ERISA. J.A. 7.
    United responded, raising substantive and procedural grounds. Substantively, it
    asserted that Wilson was not entitled to benefits because J.W. did not meet the standard of
    care for inpatient care under the Plan for the relevant timeframe. As such, United asserted
    the services were not medically necessary and thus were ineligible for coverage.
    Procedurally, it maintained that although Wilson had exhausted administrative remedies
    for claims related to the First DOS, he had failed to do so for the claims submitted for the
    Second and Third DOS. As such, it asked the court to dismiss that part of Wilson’s case.
    The parties filed cross-memoranda in support of judgment. 3
    The district court granted summary judgment to United. As to the claims for the
    First DOS, the district court applied the relevant factors the Court identified in Booth—
    which we detail below—and determined that United did not abuse its discretion in denying
    coverage because that decision “was the result of a deliberate, principled reasoning process
    and supported by substantial evidence.” J.A. 2978. As for United’s denial of claims for the
    Second and Third DOS, the court concluded Wilson had failed to exhaust his
    3
    The court’s ERISA management order relieved the parties of filing motions for
    summary judgment, but required them to submit memoranda in support of judgment and a
    stipulation setting out their positions on various questions.
    10
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022     Pg: 11 of 41
    administrative remedies and had not shown that exhaustion would be futile. The court
    determined that the January 26 letter requested a “Retrospective Review” under the Plan
    rather than an “appeal” and that United had no duty under the Plan or ERISA to respond to
    the letter because the Plan stated that an administrator’s failure to respond to a request for
    review should be viewed as a denial subject to appeal. J.A. 2963. Accordingly, the court
    dismissed with prejudice Wilson’s claims to the extent they were based on denial of
    coverage for services provided during the Second and Third DOS.
    Wilson noted a timely appeal, and we have jurisdiction under 
    28 U.S.C. § 1291
    .
    II. First DOS
    We first consider Wilson’s argument that the district court should have held that
    United abused its discretion in denying his claims for coverage during the First DOS. In
    sum, he asserts that United’s decision failed to consider “all relevant medical evidence in
    support of” coverage. Opening Br. 26. To assess this argument, we begin by reviewing the
    Plan’s criteria for admission to an inpatient or residential treatment program, turn next to
    the Booth factors governing a court’s review of a coverage determination, and then recount
    the district court’s analysis. Lastly, we consider the record in light of Wilson’s challenges
    to the district court’s determination.
    We review the district court’s grant of summary judgment de novo, using the same
    standards as the district court to review the plan administrator’s decisions. Brogan v.
    Holland, 
    105 F.3d 158
    , 161 (4th Cir. 1997). In the ERISA context, the Supreme Court has
    “significantly curtailed a court’s ability to review a discretionary decision of the
    11
    USCA4 Appeal: 20-2044        Doc: 48          Filed: 02/24/2022       Pg: 12 of 41
    administrators of an employee benefits plan,” such that “a reviewing court may reverse the
    denial of benefits only upon a finding of abuse of discretion.” 
    Id.
    A. The Plan’s Guidelines for Residential Treatment
    To assist fiduciaries in making the medical-necessity determination, the Plan
    permits them to “develop and maintain clinical policies that describe the Generally
    Accepted Standards of Medical Practice . . .[,] prevailing medical standards and clinical
    guidelines supporting [medical-necessity] determinations regarding specific services.” J.A.
    62. United did so through “Level of Care Guidelines,” which contain criteria relevant to all
    care and to behavioral health services specifically. J.A. 70. The generally applicable criteria
    for admission require that the condition for which the patient seeks coverage “cannot be
    safely, efficiently, and effectively . . . treated in a less intensive level of care,” and that the
    assessments and treatment of the factors leading to admission “require the intensity of
    services provided in the proposed level of care.” J.A. 72. In addition to this criteria
    applicable for all admissions, the particular guidelines for admission to a residential
    treatment center require: (1) that “[t]he member . . . not [be] in imminent or current risk of
    harm to self, others, and/or property”; and (2) that the factors that led to admission cannot
    “be safely, efficiently or effectively assessed and/or treated in a less intensive setting due
    to acute changes in the member’s signs and symptoms and/or psychosocial and
    environmental factors.” J.A. 70. Both the initial and continued residential treatment criteria
    point to the need for such services based on a behavioral or cognitive impairment that
    interferes with activities of daily life to the extent that the patient’s or others’ welfare is
    endangered. J.A. 70–72.
    12
    USCA4 Appeal: 20-2044      Doc: 48         Filed: 02/24/2022     Pg: 13 of 41
    These standards govern both the utilization review that occurs during the initial
    benefits determination and during the appeals process.
    B. Booth’s Legal Standard
    In Booth, the Court set out a non-exhaustive list of factors to consider when
    determining whether an ERISA administrator abused its discretion. Those factors assist
    courts in undertaking their overarching and ultimate review “to determine whether the
    decision was reasonable,” i.e., “result[ing] from a deliberate, principled reasoning process
    and . . . supported by substantial evidence.” Griffin v. Hartford Life & Accident Ins. Co.,
    
    898 F.3d 371
    , 381 (4th Cir. 2018) (internal quotation marks omitted). Substantial evidence
    is evidence that “a reasonable mind might accept as adequate to support a conclusion.”
    Pearson v. Colvin, 
    810 F.3d 204
    , 207 (4th Cir. 2015).
    Courts should consider the following, non-exhaustive, factors under Booth: the
    Plan’s language, the materials the administrator consulted in reaching its decision, whether
    the Plan has been interpreted consistently, “whether the decision was consistent with the
    procedural and substantive requirements of ERISA,” the existence of “any external
    standard relevant to the exercise of discretion,” and “the fiduciary’s motives and any
    conflict of interest it may have.” 
    201 F.3d at
    342–43.
    C. The District Court’s Analysis
    The district court weighed the relevant Booth factors and determined that United’s
    decision to deny coverage for services J.W. received at CALO during the First DOS was
    the product of a principled and reasoned decisionmaking process. At the outset, the court
    observed that, under the Plan, United had full discretionary authority to determine
    13
    USCA4 Appeal: 20-2044       Doc: 48        Filed: 02/24/2022     Pg: 14 of 41
    eligibility for benefits and there’s no suggestion that it failed to follow the Plan’s
    procedures in determining the First DOS claims. See 
    id. at 343
     (explaining courts should
    “examin[e] the language of the Plan to determine whether the provision of benefits is
    prescriptive or discretionary and, if discretionary, whether the plan administrator acted
    within its discretion”).
    The district court then examined “the adequacy of the materials considered to make
    the decision and the degree to which they support it.” 
    Id. at 342
    . It found that the denial
    determinations were made after considering adequate materials, which included “J.W.’s
    treatment history, [his specific] treatment while at CALO, his underlying medical
    conditions, his family involvement, drugs prescribed to [him], conversations with J.W.’s
    psychiatrist at CALO, and his complete medical history.” J.A. 2973. And it observed that
    the denial determinations were later confirmed by an “independent, external reviewer”
    during Wilson’s external review. 
    Id.
    The court also found that the decision-making process was reasoned and principled,
    and supported by substantial evidence. It observed, for example, that United followed Plan
    procedures and policies throughout the utilization review and first-level internal appeal.
    Further, the court determined that although “J.W.’s medical records show that he did
    exhibit isolated incidents that required emergency safety physical interventions during the
    First DOS, [when] taken in its entirety[,] the administrative record shows that [United’s]
    decision for a denial of coverage was supported by substantial evidence.” J.A. 2974.
    Next, the court considered whether United’s decision was consistent with ERISA’s
    procedural and substantive requirements. In determining that it was, the court observed that
    14
    USCA4 Appeal: 20-2044        Doc: 48        Filed: 02/24/2022     Pg: 15 of 41
    United complied with ERISA’s time frames for making each step of the determination,
    Wilson was timely notified of its findings and next-step rights to appeal the decision, and
    Wilson did not dispute United’s compliance with ERISA throughout its review of the
    claims for coverage during the First DOS.
    Booth also provides that an administrator’s compliance with any external standards
    are relevant to the reasonableness of its determination, so the district court reviewed New
    York’s laws governing the denial of health insurance benefits. 4 Specifically, it observed
    that New York allows for an external review of the denial of benefits, and that United
    informed Wilson of that right. Wilson did pursue an external appeal, in which the external
    reviewer independently examined the record and agreed with the determination that J.W.’s
    treatment was not medically necessary. The court also noted that Wilson did not dispute
    United’s compliance with New York law.
    Lastly, the court considered United’s motives and any potential conflicts of interest.
    Wilson had not asserted any perceived conflicts, but the court nonetheless observed that
    any potential conflict would be defeated by the external appeal’s independent
    determination agreeing with United’s determination.
    Finding that the Booth factors weighed strongly in United’s favor, the district court
    concluded that it had not abused its discretion in denying coverage for claims submitted
    for the First DOS.
    4
    The Plan is subject to New York law.
    15
    USCA4 Appeal: 20-2044      Doc: 48         Filed: 02/24/2022      Pg: 16 of 41
    D. Analysis
    Wilson challenges the district court’s determination, but does not dispute most of
    its factor-specific analysis under Booth. Instead, he contests the specific conclusion that
    United’s decision to deny was reasoned and principled, and supported by substantial
    evidence. He asserts that United “‘cherry picked’ evidence” because “the entirety of the
    administrative record” shows more than isolated incidents warranting physical intervention
    and, thus, residential treatment. Opening Br. 41–42. As support, Wilson points to “several”
    instances in which J.W. engaged in self-harm (scratching, cutting, and hanging over a
    balcony railing), admitted to suicidal ideation, and got into physical or verbal altercations
    with staff members or peers. Opening Br. 43. Wilson asserts that only by ignoring this
    record evidence could United conclude that J.W.’s time at CALO was “essentially
    unremarkable and uneventful” and thus deny coverage for claims based on the First DOS.
    
    Id.
    Having reviewed the record and the admission guidance, we conclude that United
    acted within its discretion to deny J.W.’s claims for the First DOS. As a whole, the medical
    record establishes that J.W. routinely engaged in reciprocal conversations and interacted
    with both peers and staff. He did not require intensive psychological intervention. Indeed,
    it appears that J.W. saw a licensed psychiatrist only about one time each month.
    Against that backdrop, the record does not show that J.W. required constant physical
    interventions for safety. The noted episodes occurred irregularly and thus do not call into
    question United’s overarching assessment. Here, the district court fairly characterized the
    16
    USCA4 Appeal: 20-2044      Doc: 48         Filed: 02/24/2022      Pg: 17 of 41
    six incidents Wilson identifies as “isolated” considering that they occurred on six days
    during the First DOS’s five-month span. J.A. 2974.
    These incidents do not substantially call into question United’s discretion in denying
    benefits for the First DOS. In a situation with a more closely conflicting medical record to
    resolve, we observed that it is the ERISA fiduciary’s “duty” “to resolve the conflicts” and
    “it is not an abuse of discretion for a plan fiduciary to deny benefits where conflicting
    medical reports were presented.” See Booth, 
    201 F.3d at 345
     (internal quotation marks,
    citation, and alteration omitted). So long as sufficient evidence supports the decision, and
    the process by which the determination was made is principled and reasoned, the Court has
    “no basis” to second-guess an administrator’s denial of benefits. 
    Id. at 346
    .
    Before issuing a final determination to deny coverage, three levels of review
    occurred—the initial utilization review, the first-level internal appeal, and an external
    review. The three independent reviewers separately arrived at the same conclusion: the 24-
    hour residential setting of services provided at CALO were no longer needed by the
    beginning of—and throughout—the First DOS. E.g., J.A. 2867–68 (denying coverage at
    the utilization review stage after determining that J.W. “did not need the 24 hour
    monitoring provided in a residential setting, and care could have been provided at a lower
    level of care” such as an “intensive outpatient setting with individual psychotherapy, family
    therapy and medication management”); J.A. 2889 (upholding the initial determination on
    appeal because during the First DOS J.W.’s “behaviors had improved” and “[h]e appeared
    to be able to continue his care at a day program,” which was “available in [the Wilsons’]
    home area,” and thus did not meet the criteria for residential treatment); J.A. 2856
    17
    USCA4 Appeal: 20-2044      Doc: 48         Filed: 02/24/2022     Pg: 18 of 41
    (agreeing, at the external appeal stage, that residential treatment “was not medically
    necessary” because “[n]othing in the documentation reviewed indicates that this patient
    required or could benefit from 24-hour daily confinement, observation, and treatment” and
    that a “more appropriate treatment plan would have included intensive outpatient treatment
    with a very strong family therapy component while the patient lived in his community with
    his family”). That determination is consistent with the criteria United established pursuant
    to the Plan, which set out that coverage can be denied for not being medically necessary
    when care could have occurred at a less intensive setting.
    ****
    At bottom, Wilson has not identified a sufficient basis for concluding that United
    abused its discretion in denying coverage for the claims submitted for the First DOS.
    United’s decision to deny coverage during that period “was the result of a deliberate,
    principled reasoning process and supported by substantial evidence.” J.A. 2978. We
    therefore affirm the district court’s entry of judgment in United’s favor as to the decision
    to deny coverage for the First DOS.
    III. The Second & Third DOS
    We next turn to Wilson’s challenge to the district court’s dismissal—for failure to
    exhaust remedies—of his claims based on United’s denial of coverage for services
    provided during the Second and Third DOS. Wilson asserts he was excused from
    exhausting those remedies because he initiated an appeal and requested copies of
    documents, but United failed to respond to either, thwarting the Plan’s internal review
    18
    USCA4 Appeal: 20-2044      Doc: 48         Filed: 02/24/2022      Pg: 19 of 41
    process and making exhaustion futile. He contends the district court erred in holding that
    counsel’s January 26 and February 24 letters (collectively “the 2017 letters”) did not
    initiate an “appeal” of United’s initial decisions to deny coverage and that United was
    required to respond and also to provide copies of requested materials to which he was
    entitled under ERISA and the Plan.
    In response, United urges us to affirm the district court’s dismissal of these claims.
    It asserts that the district court properly construed the 2017 letters to request something
    short of an unequivocal appeal of the denial of coverage. Further, it contends the 2017
    letters could not operate as an appeal of any coverage denials falling within the Third DOS
    that post-date when the letters were written, i.e., claims that were provided or denied after
    February 24, 2017. United also argues that it had no duty to respond to the letters’ request
    for production of documents because all of the requested materials are privileged by
    HIPAA and the HIPAA authorization form was defective because it was not properly
    signed.
    A. ERISA’s Exhaustion Requirement
    Although “ERISA does not contain an explicit exhaustion provision,” “an ERISA
    claimant generally is required to exhaust the remedies provided by the employee benefit
    plan in which he participates as a prerequisite to an ERISA action for denial of benefits
    under 
    29 U.S.C. § 1132
    .” Makar v. Health Care Corp. of Mid-Atlantic (CareFirst), 
    872 F.2d 80
    , 82 (4th Cir. 1989). Courts have imposed this requirement because it is consistent
    with the “Act’s text and structure as well as the strong federal interest encouraging private
    resolution of ERISA disputes.” 
    Id.
     The exhaustion requirement means that claimants must
    19
    USCA4 Appeal: 20-2044       Doc: 48          Filed: 02/24/2022    Pg: 20 of 41
    follow the Plan’s internal procedures for a “full and fair review” of a plan administrator’s
    denial of a claim for benefits. 
    Id. at 83
    .
    We have previously recognized that a failure to exhaust may be excused when
    pursuing internal remedies would be “futile.” 
    Id.
     More than “bare allegations of futility”
    must be demonstrated, however, as a claimant must come forward with a “clear and
    positive showing” to warrant “suspending the exhaustion requirement.” 
    Id.
     (internal
    quotation marks omitted); see Hickey v. Digital Equip. Corp., 
    43 F.3d 941
    , 945 (4th Cir.
    1995) (rejecting an assertion of futility when claimant did not file a written claim and
    alleged, with no further foundation, that doing so would have been “a mere formality if not
    a charade”). Further, an administrator’s failure to “provide a reasonable claims procedure”
    under ERISA “entitle[s] [beneficiaries] to pursue any available remedies” and thus to “be
    deemed to have exhausted the administrative remedies available under the [P]lan.” 
    29 C.F.R. § 2560-503-1
    (l)(1). 5
    When exhaustion is excused, the district court may consider “the claimant’s
    entitlement to benefits in the first instance.” Riggs v. Ballard Tire & Oil Co. Pension Plan
    5
    Courts have taken different approaches in classifying the grounds for excusing
    exhaustion. Some courts have grouped a variety of reasons to excuse exhaustion under the
    umbrella term “futility.” E.g., Brown v. J.B. Hunt Transp. Servs., Inc., 
    586 F.3d 1079
    , 1085
    (8th Cir. 2009) (citing other circuit courts). Others use a narrower definition of futility,
    requiring, for example, proof that the claim would have been denied, and classifying other
    grounds for excusing exhaustion as something other than “futility.” 
    Id.
     at 1085–87
    (declining to label an argument as “futility,” but observing that it nonetheless was “a
    winner” that excused the claimant’s failure to exhaust). While our cases have only
    previously discussed “futility,” the labels don’t necessarily matter because they lead to the
    same result—sufficient evidence, rather than a mere assertion, that relieves the claimant of
    navigating the administrative process before filing suit.
    20
    USCA4 Appeal: 20-2044        Doc: 48         Filed: 02/24/2022     Pg: 21 of 41
    & Tr., 
    979 F.2d 848
    , 
    1992 WL 345584
    , at *2 (4th Cir. 1992) (unpublished table decision)
    (citing Licensed Div. Dist. No. 1 MEBA/NMU, AFL-CIO v. Defries, 
    943 F.2d 474
    , 478–80
    (4th Cir. 1991)). But in the case of procedural noncompliance with ERISA’s full and fair
    review process, we have recognized that the appropriate relief is to remand for the
    administrative process to be properly applied. Gagliano v. Reliance Standard Life Ins. Co.,
    
    547 F.3d 230
    , 239–42 (4th Cir. 2008).
    We review the district court’s determination that Wilson failed to exhaust his
    administrative remedies for abuse of discretion. DuPerry v. Life Ins. Co. of N. Am., 
    632 F.3d 860
    , 876 (4th Cir. 2011). A district court “abuses its discretion when it acts arbitrarily
    or irrationally, fails to consider judicially recognized factors constraining its exercise of
    discretion, relies on erroneous factual or legal premises, or commits an error of law.”
    Newport News Shipbuilding & Dry Dock Co. v. Holiday, 
    591 F.3d 219
    , 226–27 (4th Cir.
    2009).
    B. The Claims Affected by the 2017 Letters
    Before analyzing the substantive requests made in the 2017 letters, we must first
    determine which claims they relate to and therefore which claims our analysis affects.
    Although the district court and the parties have treated the Second and Third DOS claims
    identically, we conclude that a more nuanced approach is required.
    The 2017 letters indisputably address the claims for the entire Second DOS, that is,
    the services CALO provided on July 16–31, 2016; August 1–15, 2016; and November 1–
    30, 2016. As noted, the 2017 letters’ subject lines referenced three claim numbers that
    corresponded with Wilson’s claims for these three specific timeframes. The district court
    21
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022      Pg: 22 of 41
    and the parties carved out the claims for services provided during these three delineated
    timeframes as the “Second DOS.” J.A. 2955. Because of this explicit cross-reference in the
    letters, any analysis of the 2017 letters’ contents applies to the denial of coverage for
    services provided during the Second DOS so defined.
    The record is less developed for the claims designated as the “Third DOS.” J.A.
    2958. This label served as a catch-all for claims relating to J.W.’s residential treatment at
    CALO that did not fall within the First DOS or Second DOS and for which United had
    denied coverage. Put another way, as described by the parties and the district court, the
    Third DOS encompasses claims submitted for services provided from May 16, 2016, (the
    day after the First DOS ended) to July 31, 2017, (the date of J.W.’s discharge), except for
    the claims submitted for services provided during the three timeframes comprising the
    Second DOS.
    We conclude that it’s appropriate to consider claims for services denied before the
    date of the January 26 letter as part of the analysis of the 2017 letters’ substance, but that
    claims for services denied after that date do not reasonably fall within its scope. The text
    of the January 26 letter expressly stated that its requests pertained to “the claims referenced
    above as well as any and all denied claims related to treatment received at [CALO].” J.A.
    2930 (emphasis added). Thus, the plain language of the letter encompasses more than just
    the claims for the Second DOS; it also refers to additional claims United had denied as of
    the letter’s date. But it does not follow that the letter references all other past and future
    claims Wilson submitted for coverage of his son’s treatment at CALO.
    22
    USCA4 Appeal: 20-2044        Doc: 48        Filed: 02/24/2022     Pg: 23 of 41
    Setting aside the question of whether a letter could effectively pull in future denials
    of coverage, the January 26 letter did not do so. The letter repeatedly characterized both
    counsel’s representation of Wilson and its specific requests in terms of claims that United
    had already denied. For example, the letter stated counsel’s retention to represent Wilson
    “in connection with the . . . denial of his health insurance benefits,” and elsewhere
    referenced Wilson’s “denied claims” and the “denial of Mr. Wilson’s claim.” 
    Id.
     (emphases
    added). This language looks only to United’s past conduct. It does not make any requests
    about United’s process for reviewing then-pending or not-yet-submitted claims, let alone
    clearly indicate that the letter’s requests encompass future claims for services that had not
    yet been provided.
    Consistent with this reading, one of the January 26 letter’s purposes was to notify
    United that Wilson “d[id] wish a review” or an “appeal.” 
    Id.
     Regardless of what this request
    actually accomplished under the Plan, one cannot “review” or “appeal” a decision that has
    not yet been made. Similarly, the letter requested “medical documents” United relied on to
    deny coverage. J.A. 2931. Regardless of whether United needed to respond to that request,
    the request itself could only be made for claims that had been denied as of the time it was
    made. For these reasons, although the January 26 letter’s contents pulled in more than just
    the claims comprising the Second DOS, it only encompasses additional claims for which
    United had already denied coverage.
    The February 24 letter did not expand the scope of the January 26 letter because it
    merely cross-referenced and reiterated the requests made in the earlier letter.
    23
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022      Pg: 24 of 41
    In sum, when analyzing the substantive requests made in the 2017 letters, we are
    discussing a narrower number of claims than what the district court addressed—only those
    claims for which United had denied coverage as of January 26, 2017. 6 We will adopt the
    phrase “modified Third DOS” to refer to the subset of Third DOS claims affected by our
    analysis of the 2017 letters’ requests. To reiterate, the modified Third DOS consists of any
    claims that are not part of the First DOS or Second DOS and that United had denied
    coverage for as of January 26, 2017. The analysis that follows concerning the 2017 letters
    relates solely to the Second DOS and the modified Third DOS.
    C. 2017 Letters’ Request for Documents
    Our review convinces us that the district court abused its discretion in dismissing
    Wilson’s claims based on the denial of coverage during the Second and modified Third
    DOS. Given the interconnectedness of the various arguments, we begin our analysis with
    the thread that leads to the cleanest untangling for the parties upon remand: the 2017 letters’
    request for production of documents.
    1. Underlying Facts & Law
    Four facts are beyond dispute—First, quite apart from whether they initiated an
    appeal, the 2017 letters unequivocally requested that United provide certain materials to
    Wilson’s counsel. The January 26 letter stated as its “second purpose” “to request a
    complete copy of each and every document upon which [United had] based [its] denial of
    6
    On the record before us we cannot say what specific claims for which dates of
    service comprise the modified Third DOS. We leave for the parties to settle that issue on
    remand, with the cut off being that United denied coverage for those claims on or before
    January 26, 2017, (and are not part of the First DOS).
    24
    USCA4 Appeal: 20-2044       Doc: 48        Filed: 02/24/2022      Pg: 25 of 41
    Mr. Wilson’s claims. Such documents include any medical documents, substantive
    documents, the plan document and any internal guidelines or regulations which [United
    had] used in evaluating [the] claim.” J.A. 2931. And, as noted earlier, the letter expressly
    referenced Wilson’s right to review this “documentation” to prepare a response that would
    be used during the full and fair review of the prior adverse benefits determination. 
    Id.
     The
    February 24 letter similarly informed United that counsel had not received “any
    documents” requested in the earlier January 26 letter, all of which counsel deemed
    necessary to prepare Wilson’s response to the denial of coverage. J.A. 2933.
    Second, United did not provide any of the requested materials or respond to the
    letters in any fashion.
    Third, as a general matter, Wilson—whom the 2017 letters identified as a Plan
    participant, a fact uncontested by United—had the right to request and receive copies of
    the requested documents, which United would ordinarily be obligated to provide. For
    example, 
    29 U.S.C. § 1133
     gives beneficiaries the right to a “full and fair review” of denied
    claims, part of which includes the right to request—and the obligation on administrators to
    “provide[], upon request and free of charge, reasonable access to, and copies of, all
    documents, records, and other information relevant to the claimant’s claim for benefits.”
    
    29 C.F.R. § 2560.503-1
    (h)(2)(iii); see also 
    id.
     § 2560.503-1(h)(3) (stating this requirement
    applies to group health plans); 
    29 U.S.C. § 1024
    (b)(4) (stating that copies of plan
    documents are to be provided to participants “upon written request”); 
    29 U.S.C. § 1132
    (c)
    (addressing the forms of relief available when administrators refuse to supply information
    to which beneficiaries are entitled upon request). As it was required to do, the Plan
    25
    USCA4 Appeal: 20-2044       Doc: 48          Filed: 02/24/2022     Pg: 26 of 41
    incorporated these principles. E.g., UnitedHealthcare Choice Plus Certificate of Coverage
    (“Plan Document”) at 242, Wilson v. UnitedHealthcare Ins. Co., No. 2:17-cv-03059-DCN
    (D.S.C. filed June 19, 2019), ECF No. 35-4 (stating that “[s]pecific guidelines and
    protocols [to assist in determining if services are medically necessary] are available for
    [Plan participants] upon request”); 7 see also 
    id. at 304, 312
    .
    Fourth, Plan participants can authorize third parties to request copies of materials
    on the participants’ behalf. See, e.g., 
    29 C.F.R. § 2560.503-1
    (b)(4) (permitting “an
    authorized representative of a claimant” to “act[] on behalf of such claimant in pursuing a
    benefit claim or appeal of an adverse benefit determination”); Plan Document at 304, ECF
    No. 35-4 (permitting Plan participants to authorize a third party to request copies of the
    participants’ health information).
    2. United’s HIPAA Defense
    United does not dispute these factual points and acknowledges that it ordinarily
    would have had a duty to provide Wilson with copies of the requested documents.
    Nonetheless, United insists that it had no obligation to produce any materials because they
    are all protected by HIPAA and Wilson’s HIPAA authorization form was fatally defective.
    Specifically, United asserts the signature on the authorization form does not satisfy
    HIPAA’s requirements for a valid authorization. The authorizing signature, which is
    7
    United filed this document as part of its evidentiary appendix to the parties’ joint
    stipulation in the district court below. See Evidentiary App. to Joint Stipulation, Wilson v.
    UnitedHealthcare Ins. Co., No. 2:17-cv-03059-DCN (D.S.C. filed June 19, 2019), ECF
    No. 35. It is not included in full in the Joint Appendix, so the opinion cites the document
    that is part of the district court record as appropriate.
    26
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022      Pg: 27 of 41
    illegible, was on the line for a “client/patient” to sign “on his or her own behalf” as opposed
    to the line designated for a “client” to sign “on behalf of another person.” J.A. 2932. United
    contends that because J.W. was a minor, he could not sign the HIPAA authorization form
    personally and was required to have an authorized individual sign on his behalf. Thus,
    United posits, either J.W. signed the form and that was ineffective, or else Wilson signed
    the form and it’s ineffective because he signed on the incorrect line and failed to identify
    his authority to do so as required by 
    45 C.F.R. § 164.508
    (c)(vi). Either way, United argues
    the form did not comply with HIPAA’s exacting standards and, as such, no documents
    could be provided to Wilson’s counsel.
    United further contends that it had no obligation under the Plan, ERISA, or HIPAA
    to notify Wilson’s counsel that it would not produce any materials or to explain why.
    Indeed, United maintains that it could not contact counsel because doing so would itself
    violate HIPAA by disclosing protected information about J.W. Related to this broad view
    of HIPAA’s scope, United asserts that HIPAA protected all the materials requested in the
    2017 letters, including copies of the Plan and any internal guidelines or regulations that
    United used to evaluate any Plan participant’s claims for coverage, including Wilson’s.
    3. Analysis of United’s HIPAA Defense
    HIPAA is a sometimes confusing and obtuse federal law that prohibits covered
    entities from “knowingly” disclosing an individual’s “individually identifiable health
    information” “without authorization.” 42 U.S.C. § 1320d-6(a), (b); 45 C.F.R.
    27
    USCA4 Appeal: 20-2044      Doc: 48          Filed: 02/24/2022     Pg: 28 of 41
    § 164.508(a)(1). 8 “Individually identifiable health information” is “a subset of health
    information,” 
    45 C.F.R. § 160.103
    , and understanding the difference between the two terms
    of art aids in understanding the flaws in United’s argument. “Health information” means
    information that “is created or received by a health care provider, health plan, public health
    authority, employer, life insurer, school or university, or health care clearinghouse” that
    “relates to the past, present, or future physical or mental health or condition of an
    individual, the provision of health care to an individual, or the past, present, or future
    payment for the provision of health care to an individual.” 42 U.S.C. § 1320d(4); 
    45 C.F.R. § 160.103
    . “Individually identifiable health information” has the same initial requirements,
    but must also either “identif[y] the individual” or be of a type “to which there is a
    reasonable basis to believe that the information can be used to identify the individual.” 42
    U.S.C. § 1320d(6); 
    45 C.F.R. § 160.103
    .
    a. Request for Plan-Related Documents
    Applying these definitions to the 2017 letters, it is clear that some of the requested
    materials should have been disclosed because they do not constitute and would not lead to
    J.W.’s “individually identifiable health information” and thus would not require a HIPAA-
    compliant authorization form before being provided to Wilson’s counsel. Further, it’s
    undisputed that the 2017 letters plainly identified Wilson as a Plan participant, such that he
    8
    It is uncontested that United is a covered entity subject to HIPAA’s limitations on
    the use and disclosure of protected health information. See generally 
    45 C.F.R. §§ 160.102
    (a), 164.500, 164.502.
    28
    USCA4 Appeal: 20-2044      Doc: 48          Filed: 02/24/2022     Pg: 29 of 41
    had a right under the Plan and ERISA to obtain copies of certain generally applicable Plan-
    related documents upon request (or upon his authorized representative’s request).
    As the definition of “individually identifiable health information” demonstrates, to
    fall within this term’s scope, the material must either identify or be such that it could
    reasonably be used to identify a specific individual. We fail to see how a copy of the Plan—
    applicable to all beneficiaries—could conceivably identify J.W. directly or indirectly.
    Similarly, the “internal guidelines or regulations” established pursuant to the Plan for
    determining medical necessity would not identify J.W. or lead to his identification. J.A.
    2931. These are generic documents governing United’s assessment of any beneficiary’s
    claims. Further, the 2017 letters requested any “substantive documents” used to deny
    coverage as part of a utilization review. 
    Id.
     United may have had in its possession additional
    documents that fall within this category, must be disclosed under ERISA, and do not bear
    the individual identifiers that would subject it to HIPAA. These three categories of
    materials share the common feature of lacking any contents that either identifies or could
    reasonably be used to identify J.W. personally. See 
    45 C.F.R. § 164.514
    (a) (“Health
    information that does not identify an individual and with respect to which there is no
    reasonable basis to believe that the information can be used to identify an individual is not
    individually identifiable health information.”).
    United was required under ERISA and the Plan to provide copies of all the foregoing
    information to Wilson’s counsel irrespective of the validity of the HIPAA authorization
    form. E.g., Plan Document at 312, ECF No. 35-4 (reiterating that Plan participants “are
    entitled to obtain, upon written request to the Plan Administrator, copies of documents
    29
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022      Pg: 30 of 41
    governing the operation of the plan”); 
    29 C.F.R. § 2560.503-1
    (g)(v) (setting out a group
    health plan’s obligation to provide copies of “an[y] internal rule, guideline, protocol, or
    other similar criterion . . . relied upon in making [an] adverse [benefit] determination”); 
    id.
    § 2560.503-1(h)(iii) (setting out a plan administrator’s obligation to provide “upon request
    and free of charge, reasonable access to, and copies of, all documents, records, and other
    information relevant to the claimant’s claim for benefits”). It possessed the January 26
    letter describing the request as well as Wilson’s confirmation of representation designating
    his counsel as a third party who could act on his behalf. As an undisputed plan participant,
    Wilson—or his designated representative—had the right to request these materials under
    both the Plan and ERISA, and United had a corresponding duty to provide them.
    Responding to that request would not have disclosed anything to identify J.W., as it would
    disclose only the Plan and related documents governing any plan participant’s claims.
    United, however, failed to respond in any way.
    Without copies of the Plan and guidelines, Wilson was put at a distinct disadvantage
    in understanding how to proceed. Ellis, 
    126 F.3d at
    236–37 (observing that ERISA’s
    extensive procedural requirements “have been read as ensuring that a full and fair review
    is conducted by the administrator[] [and] that a claimant is enabled to prepare an appeal
    for further administrative review or recourse to the federal courts” (emphasis added)). As
    but one example, United contends that the January 26 letter was not a proper request for an
    appeal under the Plan by pointing to criteria set out in the Plan documents (and not
    contained in the EOBs). But by failing to provide these documents, United violated its
    fiduciary obligations under ERISA and the Plan, and impeded the appeal process.
    30
    USCA4 Appeal: 20-2044      Doc: 48         Filed: 02/24/2022     Pg: 31 of 41
    Upon hearing nothing from United in response to either of the 2017 letters, Wilson
    had reason to believe that United was not going to comply with the procedures set out in
    the Plan as to the Second DOS and modified Third DOS. The EOBs accompanying
    United’s initial denial of coverage informed Wilson that he could “request copies (free of
    charge) of information relevant to [his] claim by contacting [United] at the above address.”
    E.g., J.A. 2907. Moreover, ERISA obligates administrators to respond to requests for
    information that ERISA requires the administrator to provide participants “within 30 days
    after [the] request.” 
    29 U.S.C. § 1132
    (c)(1); Plan Document at 312, ECF No. 35-4 (reciting
    this participant right and administrator duty in the Plan’s notice of ERISA rights). 9 The
    letters were sent January 26, 2017, and February 24, 2017, respectively, and Wilson heard
    nothing from United for well over 30 days.
    United’s failure to provide the requested Plan-related documents provides a “clear
    and positive showing of futility” in attempting further communications with it about the
    production of documents and warrants excusing Wilson from the exhaustion requirement.
    Makar, 872 F.2d at 82 (internal quotation marks omitted); e.g., Brown, 
    586 F.3d at
    1085–
    86 (concluding claimant was excused from failing to exhaust after the administrator failed
    to respond to repeated requests for documents she was entitled to under the plan and ERISA
    because, “[w]ithout the Administrative Record and other requested documents in hand,
    [she] was unable fully and fairly to prepare her appeal”); Lanfear v. Home Depot, Inc., 536
    9
    Copies of materials relating to the Plan and benefits determinations are not a mere
    courtesy. Indeed, ERISA authorizes courts to impose a daily fine for an administrator’s
    failure to timely provide copies of materials that must be turned over upon request. 
    29 U.S.C. § 1132
    (c)(1).
    31
    USCA4 Appeal: 20-2044       Doc: 48        Filed: 02/24/2022     Pg: 32 of 
    41 F.3d 1217
    , 1224–25 (11th Cir. 2008) (observing that past cases had found “exhaustion was
    futile because plan administrators had denied a participant meaningful access to
    administrative proceedings by repeatedly ignoring requests for documents supporting the
    denial of benefits”).
    b. Request for J.W.-Specific Documents
    In addition to the request to provide Plan-oriented documents, the 2017 letters also
    requested materials that do fall within the definition of “individually identifiable health
    information,” most notably any “medical documents” United relied on to deny coverage.
    J.A. 2931. J.W.’s medical records and opinions about his diagnoses and treatment would
    contain J.W.’s name and other contents from which he could be reasonably identified. As
    such, those and similar materials with such markers that were responsive to the request
    required a HIPAA-compliant authorization form before they could be disclosed to counsel.
    See 
    45 C.F.R. § 164.508
    (a)(1) (“Except as otherwise permitted or required by this
    subchapter, a covered entity may not use or disclose protected health information without
    an authorization that is valid under this section. When a covered entity obtains or receives
    a valid authorization for its use or disclosure of protected health information, such use or
    disclosure must be consistent with such authorization.”). United therefore was precluded
    by HIPAA from turning over these materials without a “valid” HIPAA authorization form.
    As to the documents protected by HIPAA, it’s not clear that Wilson’s signed HIPAA
    authorization form complied with the relevant regulations. 
    Id.
     To be valid, the form must
    meet certain criteria, including containing several “core elements.” 
    Id.
     § 164.508(b), (c).
    In relevant part, the authorization form must contain the “[s]ignature of the individual and
    32
    USCA4 Appeal: 20-2044       Doc: 48          Filed: 02/24/2022      Pg: 33 of 41
    date,” and “[i]f the authorization is signed by a personal representative of the individual, a
    description of such representative’s authority to act for the individual.” Id.
    § 164.508(b)(1)(ii), (c)(1)(vi); see also id. § 164.508(b)(2)(ii) (stating that an authorization
    from is “defective” if it has “not been filled out completely, with respect to an element
    described by paragraph (c) of this section”).
    But Wilson’s HIPAA authorization form contained an illegible signature. The top
    of Wilson’s HIPAA authorization form identifies J.W. as the patient; provides his social
    security number and date of birth; and identifies the Foster Law Firm, L.L.P., as the entity
    to whom HIPAA-protected information can be disclosed. The form is signed illegibly; it is
    simply not readable to determine who actually signed it. Nor does any surrounding
    information clear up that illegibility. The signature appears in the subsection for a
    “client/patient” to sign “on his or her own behalf” and appears above the typed word,
    “Client,” suggesting it was signed by the individual who hired the Foster Law Firm, L.L.P.,
    Wilson, despite being a request to disclose J.W.’s HIPAA-protected records. J.A. 2932.
    The next section’s signature line is left blank, but is where a client should have signed “on
    behalf of another person.” Id. That section also contains a designated space for identifying
    the document being attached to verify the signatory’s authority to sign on behalf of the
    named patient, but that too was left blank. As noted, however, to be a valid signature
    authorizing the release of another individual’s protected health information, HIPAA
    requires that the authorization form describe the basis for that authority. 
    45 C.F.R. § 164.508
    (c)(1)(vi). It’s not clear that the signature on the form here satisfies HIPAA’s
    requirements.
    33
    USCA4 Appeal: 20-2044      Doc: 48          Filed: 02/24/2022     Pg: 34 of 41
    Separate from United’s valid refusal to produce J.W.-specific materials without a
    valid HIPAA authorization form is the independent question of whether—as United
    contends—HIPAA prohibited it from alerting Wilson’s counsel that the signature on the
    authorization form was illegible and that as a consequence it could not determine that the
    HIPAA authorization form complied with 
    45 C.F.R. § 164.508
    . The answer to that question
    is that HIPAA did not prohibit United from contacting Wilson’s counsel. Doing so would
    take no particular legal expertise and would not disclose any individually identifiable
    health information. For example, United could have simply responded that it was in
    possession of counsel’s January 26 letter, but the attached HIPAA authorization form
    contained an illegible signature that meant United could not determine whether the
    signature complied with 
    45 C.F.R. § 164.508
    ’s requirements for a valid authorization form.
    Such a straightforward response would not disclose any “health information” at all, let
    alone “individually identifiable” health information.
    United’s arguments to the contrary find no support in the definition of individually
    identifiable health information or the case law on which it relies. In response to questioning
    at oral argument, United cited Tate v. N.C. Pepsi-Cola Bottling Co. of Charlotte, Inc., No.
    3:09CV36–RJC–DSC, 
    2009 WL 3242117
     (W.D.N.C. Oct. 5, 2009), as its “best case” to
    support the argument that it could not respond in any manner to the 2017 letters without
    violating HIPAA. There, the plaintiff’s lawyer sought production of medical records from
    an entity subject to HIPAA, but failed to provide a HIPAA-compliant medical
    authorization form. The district court held that the covered entity could not “release [the
    plaintiff’s] medical records, even to his attorney,” without a HIPAA-compliant
    34
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022     Pg: 35 of 41
    authorization, nor could the entity “even confirm whether [p]laintiff received health care
    services from it” without that form. 
    Id. at *1
    .
    Tate is inapposite. Confirming that a specific individual received services from a
    specific provider may well involve individually identifiable health information because it
    conveys information about “the provision of health care” to an identified person. 42 U.S.C.
    § 1320d(4); 
    45 C.F.R. § 160.103
    . But responding to counsel’s request for production of
    documents by noting that the attached HIPAA authorization form contains an illegible
    signature does not implicate any aspect of HIPAA-protected information. 10
    To be sure, concluding that HIPAA did not prohibit United from alerting Wilson’s
    counsel to the illegible signature does not mean that United had an obligation to do so. That
    requires us to consider the scope of United’s fiduciary duties under the Plan, ERISA, and
    our case law describing the plan administrator’s duties in providing claimants with a full
    and fair review of the denial of their claims for benefits. Our assessment leads to the narrow
    conclusion that under the specific circumstances of this case, United had an obligation to
    notify Wilson’s counsel of the illegible signature.
    At the outset, ERISA’s overarching structure supports our conclusion. The Act
    generally “imposes broad fiduciary responsibilities on plan trustees,” requiring them to
    10
    At the Court’s instruction, the parties submitted supplemental letters on the
    question of whether HIPAA prohibited United from disclosing nonmedical documents in
    response to the 2017 letters. The cases United cites to support its position are
    distinguishable and reaffirm that the specific inquiry is not whether the materials
    conceivably or actually relate to health information in the abstract, but rather center on
    whether the recipient would be able to use that information or surrounding circumstances
    to connect that information to a specific individual’s health, conditions, health care
    treatment, or payment for health care. 42 U.S.C. § 1320d(4); 
    45 C.F.R. § 160.103
    .
    35
    USCA4 Appeal: 20-2044       Doc: 48         Filed: 02/24/2022      Pg: 36 of 41
    “perform their obligations with diligence” and to “discharge their duties ‘solely’ in the
    interest of plan participants and their beneficiaries.” Makar, 872 F.2d at 83 (quoting 
    29 U.S.C. § 1104
    (a)(1)); Aetna Health Inc. v. Davila, 
    542 U.S. 200
    , 220 (2004) (observing
    that a plan administrator acts as a plan fiduciary when carrying out ERISA’s “extensive
    requirements to ensure full and fair review of benefit denials”); see also Plan Document at
    312, ECF No. 35-4 (notifying Plan participants that ERISA imposes duties on the plan
    fiduciaries to operate the Plan “prudently and in the interest of you and other plan
    participants and beneficiaries”). To permit a fiduciary such as United to remain silent under
    the circumstances presented in this case would hardly be consistent with this objective. It
    would sanction an administrator’s silence in the face of attempts by an undisputed bona
    fide Plan participant, Wilson, to obtain materials to which he had a right under the Plan
    and ERISA.
    United’s failure to answer regarding the illegible signature is counter to an
    administrator’s role under ERISA as a fiduciary who must discharge its duties in the
    interests of its participants and beneficiaries. We have previously recognized, for example,
    that although claimants bear “primary responsibility” for presenting their claims for
    review,
    ERISA does not envision that the claims process will mirror an adversarial
    proceeding where the [claimant] bear[s] almost all of the responsibility for
    compiling the record, and the [fiduciary] bears little or no responsibility to
    seek clarification . . . . Rather, the law anticipates, where necessary, some
    back and forth between administrator and beneficiary.
    Harrison v. Wells Fargo Bank, N.A., 
    773 F.3d 15
    , 21 (4th Cir. 2014) (internal quotation
    marks and citation omitted) (first three alterations in original).
    36
    USCA4 Appeal: 20-2044      Doc: 48          Filed: 02/24/2022     Pg: 37 of 41
    Had United alerted Wilson’s counsel to the problem with the HIPAA authorization
    form, Wilson could have timely cured it and continued with the process established in
    ERISA for a full and fair review of the denial of his claims for coverage during the Second
    DOS and modified Third DOS rather than turning to the courts. That course would further
    ERISA’s intended framework: “[t]he full and fair review procedural requirements serve
    two complementary purposes,” “permit[ting] a plan’s administrators to resolve disputes in
    an efficient, streamlined, non-adversarial manner” while also “ensur[ing] that a plan
    participant is protected from arbitrary or unprincipled decision-making.” Ellis, 
    126 F.3d at 236
    .
    We are careful to note the fact-specific nature of our holding as ERISA clearly
    places on claimants the ultimate burden of pursuing their claims. While we have recognized
    that plan administrators are not required to hand-hold a claimant through the review
    process, they are not entitled to sandbag the process either. Cf. 
    id. at 237
    . We have
    previously recognized that because “plan administrators possess limited resources, and . . .
    there are practical constraints” on processing requests, the governing rule should be “one
    of reason.” Harrison, 773 F.3d at 22. Here, as noted, United had multiple requests from
    Wilson’s counsel, a signed confirmation of representation, and an illegibly signed HIPAA
    authorization form that implicated whether HIPAA’s signature requirement had been
    satisfied. United’s limited fiduciary duty was solely to notify Wilson’s counsel about the
    illegible signature on the attached form. Doing so would not violate HIPAA because it
    would not have disclosed any individually identifiable health information, but would have
    fulfilled a limited fiduciary duty of United as the Plan administrator.
    37
    USCA4 Appeal: 20-2044       Doc: 48          Filed: 02/24/2022      Pg: 38 of 41
    ****
    In sum, United should have responded to the 2017 letters’ request for copies of
    materials to which Wilson was entitled under ERISA, but it failed to do so. Those letters
    requested copies of the “plan document” and “internal guidelines or regulations” governing
    the denial of claims, J.A. 2931, materials that the Plan obligated United to provide to
    Wilson or his authorized representative upon request and which did not require a valid
    HIPAA authorization form before disclosure. 11 In addition, United could not substantively
    comply with the request to provide copies of J.W.’s individually identifiable health
    information (i.e., the “medical documents, substantive documents,” and other responsive
    materials that fall within this definition). Id. Nonetheless, ERISA and the Plan obligated
    United to respond to the request by notifying Wilson’s counsel of the existence of the
    potentially defective HIPAA authorization form attached to the 2017 letters.
    D. Appropriate Relief and the 2017 Letters’ Request for an Appeal
    Wilson contended on brief and at oral argument that it would be appropriate for the
    district court to review the denial of its claims directly because, in his view, the 2017 letters
    requested an appeal of the denial of claims arising during the Second DOS and modified
    Third DOS. When questioned on the matter of relief at oral argument, however, Wilson
    stated that he had no objection to the Court remanding for the plan administrator to
    undertake the full and fair review in the first instance.
    11
    As discussed, it’s also possible that other “substantive documents” referred to in
    the 2017 letters, J.A. 2931, would have been responsive and also not subject to HIPAA
    protection, but that remains undeveloped in the record as it stands.
    38
    USCA4 Appeal: 20-2044       Doc: 48          Filed: 02/24/2022      Pg: 39 of 41
    Having considered the parties’ arguments about how to proceed and our precedent,
    we conclude the best course is to remand for the plan administrator to undertake a full and
    fair review in the first instance. That is our usual course when a plan administrator fails to
    comply with ERISA’s procedural requirements. Gagliano, 
    547 F.3d at 240
     (recognizing
    that in most instances, the appropriate remedy for an administrator’s procedural
    noncompliance “is to remand the matter to the plan administrator so that a ‘full and fair
    review’ can be accomplished”); accord Weaver v. Phoenix Home Life Mut. Ins. Co., 
    990 F.2d 154
    , 159 (4th Cir. 1993). 12 Following this course is more consistent with ERISA’s
    structure, which contemplates a robust administrative process to resolve claims disputes
    and guarantees certain rights to Wilson that were denied to him. See Gagliano, 
    547 F.3d at 235
    .
    As further support for this course, we have previously recognized that one purpose
    of the administrative “full and fair review” is to “make an administrative record for a court
    [to] review if that later occurs.” 
    Id.
     Here, we do not have such a record because the ordinary
    administrative process was short-circuited and the parties were never able to develop their
    positions as to the denied claims. Consequently, remand will afford the parties the
    12
    In light of our determination to remand as a result of United’s failure to produce
    materials relevant to Wilson’s preparations for an appeal, we need not determine whether
    the 2017 letters effectuated an appeal on their own. Nevertheless, we briefly note that the
    district court’s reason for finding the 2017 letters did not initiate an appeal was in error, as
    United conceded during oral argument. Contrary to the district court’s finding, the Plan
    does not allow claimants to seek an intermediary review known as a “Retrospective
    Review” from which a formal appeal lies. Instead, the Plan defines a “Retrospective
    Review” to be the specific type of utilization review—i.e., the type of initial benefits
    determination—that occurs after the services for which benefits are claimed have already
    been performed. Plan Document at 53–54, ECF No. 35-4.
    39
    USCA4 Appeal: 20-2044         Doc: 48      Filed: 02/24/2022     Pg: 40 of 41
    “opportunity to make a meaningful administrative record” that the court could consider
    upon any future review. 
    Id.
     To do so, the process should be reset to the time remaining on
    January 26, 2017, so that Wilson can provide a HIPAA-compliant authorization form
    attached to a new request for materials protected by HIPAA, receive those materials as well
    as the Plan and other materials discussed earlier that were not subject to HIPAA, and pursue
    a timely appeal. 13
    13
    We recognize that ERISA’s times for response are essential for the timely
    processing of claims. Our decision to bypass the question of whether the January 26 letter
    initiated an appeal is bolstered by the fact that had United timely responded within 30 days
    to its request for materials, Wilson would still have had several weeks—and as to some
    claims, months—to provide a substantive response. Thus, even if the letters did not initiate
    an appeal, the process could have unfolded in a timely manner by the submission of
    additional materials requesting an appeal accompanied by additional support for that
    appeal.
    The denial of benefits for claims relating to the Second DOS explain why this is so.
    The 180-day clock for initiating a first-level appeal begins upon the Plan participant
    receiving notice of the denial of his claims for benefits. The EOB statements denying
    coverage for services provided July 16 to 31, 2016, and August 1 to 15, 2016, are dated
    October 10, 2016, and the statement denying coverage for services provided November 1
    to 30, 2016, is dated December 16, 2016. Wilson’s January 26, 2017, letter was sent 108
    and 41 days, respectively, after the earliest date on which he received notice of the denial
    of coverage, meaning that even if that letter did not initiate an appeal, he had 72 and 139
    more days in which to do so. United was required to respond to a request for copies of
    documents within 30 days of the request, meaning that had it done so, Wilson would still
    have had over one month to initiate an appeal as to the first two claims and over three
    months to initiate an appeal as to the third claim.
    Some of the earlier claims in the modified Third DOS may not have been timely if
    a request for an appeal was made on January 26, 2017. If so, then United can raise that as
    a new ground for denying a full and fair review on remand for those particular claims. But
    any claims that would have been timely as of January 26 should be treated the same as the
    claims for the Second DOS on remand—allowing Wilson to submit a new letter requesting
    an appeal and properly request materials to review as part of that process.
    40
    USCA4 Appeal: 20-2044      Doc: 48         Filed: 02/24/2022     Pg: 41 of 41
    E. Exhaustion of Claims United Denied after January 26, 2017
    As for the claims that United denied after January 26, 2017, Wilson has failed to
    show that he exhausted his administrative remedies or that the futility exception should
    apply. To demonstrate exhaustion and excuse, Wilson relied solely on United’s failure to
    respond to the 2017 letters. But since the 2017 letters did not apply to claims denied after
    January 26, nothing in the record would support a finding that Wilson exhausted his
    administrative remedies as to those claims. Nor has he shown futility because that requires
    a “clear and positive showing” that United would not follow the Plan’s procedures for
    reviewing those denied claims. Makar, 872 F.2d at 82 (internal quotation marks omitted).
    Accordingly, we hold that the district court properly dismissed Wilson’s claim arising from
    any requests for coverage that United denied after January 26, 2017.
    IV. Conclusion
    For the foregoing reasons, the judgment of the district court is affirmed in part and
    vacated in part, and the case is remanded for entry of an order to remand to United as plan
    administrator for a “full and fair review” of the claims submitted for the Second DOS and
    modified Third DOS.
    AFFIRMED IN PART, VACATED IN PART,
    AND REMANDED WITH INSTRUCTIONS
    41