Koos v. Medical Staff of Ronald Reagan etc. CA2/4 ( 2022 )

Filed 11/29/22 Koos v. Medical Staff of Ronald Reagan etc. CA2/4
NOT TO BE PUBLISHED IN THE OFFICIAL REPORTS
California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions
not certified for publication or ordered published, except as specified by rule 8.1115(b). This opinion
has not been certified for publication or ordered published for purposes of rule 8.1115.
IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA
SECOND APPELLATE DISTRICT
DIVISION FOUR
BRIAN J. KOOS, B315136
Plaintiff and Appellant, (Los Angeles County
Super. Ct. No. 19STCP04685)
v.
MEDICAL STAFF OF RONALD
REAGAN UCLA MEDICAL CENTER
et al.,
Defendants and Respondents.
APPEAL from a judgment of the Superior Court of
Los Angeles County, Mitchell L. Beckloff, Judge. Affirmed.
Fenton Law Group, Henry R. Fenton, Dennis E. Lee for
Plaintiff and Appellant.
Nelson Hardiman, Sara Hersh, Sarvnaz Mackin for
Defendants and Respondents.
Physician and medical school professor Dr. Brian Koos,
M.D., Ph.D. accessed unredacted medical records of patients he
did not treat and shared those records with a physician
unaffiliated with the hospital and school. Respondent Medical
Staff of Ronald Reagan UCLA Medical Center (the Medical Staff)
charged Koos with violations of the federal Health Insurance
Portability and Accountability Act of 1996 (HIPAA) (42 U.S.C.
§ 1320d et seq.) and UCLA policies and bylaws.1 A hearing panel
of the Medical Staff found the charges substantiated and
disciplined Koos by imposing a suspension and fine and requiring
him to complete a course on medical records or medical ethics.
An administrative appeal board upheld the findings and
discipline. The superior court denied Koos’s petition for writ
relief.
In this appeal, Koos contends the decisions of the Medical
Staff hearing panel and appeal board are not supported by their
findings, which themselves are not supported by the evidence.
Specifically, Koos contends his conduct was proper as a matter of
law because it was authorized by written patient consent forms,
fell within the “healthcare operations” exception to HIPAA, and
was required by policies of UCLA’s accrediting body. We reject
these contentions and affirm the judgment of the superior court.
1 Respondents in this matter identify themselves as “Ronald
Reagan UCLA Medical Center Medical Staff, sued as Medical
Staff of Ronald Reagan UCLA Medical Center [and] Regents of
the University of California.” Neither UCLA nor the medical
school, whose official name is the David Geffen School of
Medicine at UCLA, is a party to the case.
2
BACKGROUND
I. Underlying Events
The following evidence was elicited at Koos’s hearing before
a hearing panel consisting of three physician members of the
Medical Staff and presided over by a legally trained hearing
officer.
Koos is a physician who is board-certified in obstetrics and
gynecology. He has worked at the UCLA medical school for over
30 years and has been a full professor there since 1993. His
responsibilities include acting as an attending physician; in that
capacity, he supervises and evaluates resident physicians. Koos
and other UCLA medical school physicians, residents, and fellows
attend weekly “stats conferences,” at which residents give
presentations about cases they worked on during the preceding
week.
During the stats conference on April 13, 2018, resident Dr.
Clara Chan presented a case involving the delivery of an infant
born in a “depressed” state with Apgar scores of 0/0/0. During
the presentation, Chan referred to the mother as “Patient A” and
the infant as “Patient B,” a convention the parties use and we
adopt here. Chan testified that all cases presented during stats
conferences are presented in this “completely deidentified”
manner: all names, medical record numbers (MRNs), and other
protected health information (PHI) are redacted. During the
presentation, Chan discussed various aspects of the case,
including Patient B’s “fetal heart tracing,” and reviewed the
clinical decisions made by the treatment team. Chan testified
that no one in attendance, including Koos, requested further
review of the case when the presentation concluded. Koos
3
testified that he had raised his hand, but was never recognized or
given an opportunity to present his thoughts on the case.
Chan testified that Koos approached her immediately after
the conference and asked her to give him Patient A and Patient
B’s MRNs. Chan thought the request was unusual, as Koos was
not part of the treatment team and she had not asked him to
review the records. Chan did not provide Koos with the MRNs at
that time.
Koos did not dispute that he spoke to Chan after the
conference. However, he testified that he first spoke to Dr. Carla
Janzen, a maternal fetal medicine specialist who also served on
the Quality Assurance Evaluating Committee. Koos told Janzen
he was “very upset” by Chan’s presentation, because no one had
been able to explain Patient B’s “anomalous heart rate tracing” or
other issues in the case. Koos testified that he told Janzen the
case needed further review, but she responded, “‘we don’t have
the expertise to do that. And in any case, the case is closed.’”
Koos testified that he believed closing the case without further
review was against the “sentinel events” policy of the hospital’s
accreditation body, the Joint Commission, which required a “root
cause analysis.” We discuss “sentinel events” and this project
below.
Three days later, on April 16, 2018, Koos requested Patient
A and Patient B’s MRNs from Chan via email. Chan stated
during an interview with Derek Kang, UCLA Health Sciences
Chief Compliance and Privacy Officer, that she felt “compelled” to
provide Koos with the requested information, because he was one
of her supervisors.
On April 19, 2018, Koos called a different resident, Dr.
Julie Hein, and asked her how to locate fetal heart rate tracings
4
of patients who, like Patient A and Patient B, been discharged
from the hospital. Hein testified that she “walked him through it
on the phone, what to click on, what steps to take.” Hein stated
that Koos called her back a few minutes later and asked the same
questions specifically with respect to Patient A. Koos provided
Hein with Patient A’s MRN, and Hein accessed Patient A’s
electronic medical records so she could “talk him through it.”
Logs from the electronic medical records system show that Koos
and Hein accessed Patient A’s records around the same time on
the morning of April 19, 2018.
On April 20, 2018, Koos called Chan and asked her how to
access fetal heart tracings in the electronic medical records
system. Chan talked him through the process. Logs show that
Koos accessed Patient A’s records again that morning.
Chan testified that she was in the resident work room on
the labor and delivery floor later that morning. Koos entered the
employees-only room with Dr. Barry Schifrin, who did not work
at UCLA.2 Koos asked Chan to pull up Patient B’s fetal heart
tracing on the desktop computer. Chan complied, though she was
“very uncomfortable” because Koos was not Patient B’s treating
physician and Schifrin was “a stranger” to her. Chan testified
that there were two computer monitors on the desktop, and one
of them displayed Patient B’s medical records while the other
displayed the fetal heart tracing. The records and tracing were
2 Schifrin testified that he was a specialist in obstetrics and
gynecology, particularly high-risk pregnancies. At the time of the
events in this case, he was on the faculty at Western University
of Health; he previously had been on the full-time and clinical
faculties at USC. Schifrin estimated that he had given
approximately six lectures at UCLA over the years, and regularly
attended “Grand Rounds” lectures that were open to the public.
5
unredacted, and PHI was visible. Photos of the room taken later
showed additional monitors displaying patient data mounted on
the walls. Koos testified that, at the time of the incident, the
monitors in the room showed only de-identified information. He
acknowledged during cross-examination that information about
“vaginal examination, [and] the patient’s name” was visible, but
stated that was “not personally identifiable information.”
Koos asked Chan to “move through the fetal heart tracing
to show Dr. Schifrin what was happening on the fetal heart
tracing.” While she was doing so, “Dr. Schifrin would comment
on the fetal heart tracing” and “continue to ask [Chan] to move
forward.” After a few minutes, an attending physician, Dr. Tina
Nguyen, entered the resident work room. Nguyen, who testified
she was surprised to see Koos and Schifrin, asked Koos if “this
was sanctioned.” Nguyen testified that Koos responded, “I
sanctioned it.” Both Chan and Nguyen testified that Nguyen
then stepped out of the room. Nguyen explained that she did so
to telephone Dr. Deborah Krakow, the chair of the obstetrics and
gynecology department, and inform her that Koos and Schifrin
were looking at Patient B’s medical records. Krakow instructed
Nguyen to put Koos on the phone, which she did. The contents of
the call are disputed but not relevant.
Chan testified that while Koos was outside the room on the
phone, Schifrin continued directing her to move forward in the
tracing and commenting on its contents. Another resident
physician who was in the room, Dr. Ilina Datkhaeva, testified
that Schifrin’s comments included things like, “‘That doesn’t look
very good,’” and “‘That’s not what I would have done.’”
Datkhaeva also testified that Schifrin looked at and remarked
upon other monitors visible in the room that contained PHI about
6
patients currently admitted to the hospital. Datkhaeva discreetly
paged Chan and told her to “stop.” Chan then closed the fetal
heart tracing. Koos returned to the room, and he and Schifrin
left.
Later that day, Koos emailed Krakow the following, with
the subject, “Follow UP”: “Sorry about Barry. He came by to talk
and I remembered an unconventional [fetal heart rate] case that
was presented last week. Barry is very interested in teaching,
and I thought he could contribute to the heart rate analysis. As
you probably know, the infant was severely depressed even
though the fetus was not asphyxiated. I have worked with him
for a long time and felt comfortable showing him the [fetal heart
tracing] strip. I did not realize that this was a problem until I
talked to you. I realize now that I did not take into consideration
the reputation he apparently has by some. Obviously, I should
have asked you first before showing him the tracing. [¶] In any
case, I am indeed sorry for the aggravation. We left . . . after you
called. He only saw the initial part of the tracing. Barry just
wants to teach. But I understand your concern. Maybe we can
talk about it later.”
II. Investigation and Charges
Shortly after the above events, compliance officer Kang
received a report that Koos “brought an unauthorized individual
into a resident room and had requested and authorized access of
a patient’s records for this unauthorized individual.” Kang
consulted the data logs for Patient A and Patient B’s electronic
medical records and conducted fact-finding interviews with
several people, including Chan, Hein, Nguyen, Krakow, and
Koos.
7
According to Kang’s notes, which were admitted into
evidence at the hearing over Koos’s hearsay objection, Koos
confirmed during his April 23, 2018 interview that he asked
Chan for Patient A and Patient B’s MRNs even though he did not
have patient relationships with them. Koos told Kang that he
had not spoken with anyone on the patients’ care team about the
case or the fetal heart data, or “discussed his thoughts regarding
the fetal monitoring data . . . or engaged in the dialogue with his
peers at the STATS meeting in which the case was discussed.”
He told Kang he “was curious if the baby had suffered any brain
damage” and “he had a suspicion about the case and wanted to
confirm it in his own mind.”
Koos told Kang that Schifrin was a “renowned expert in
fetal monitoring and that he wanted Schifrin’s opinion on the
case,” even though he did not have consent or authorization from
Patient A for Schifrin to review the records. Koos and Schifrin
had been collaborating on some research and had a pre-arranged
appointment on April 20, 2018; Koos “took the opportunity to
bring Dr. Schifrin to view the record with him.” Koos stated he
was unaware that PHI was visible on the computer screen, and
the fetal monitoring data he and Schifrin viewed “did not have
any PHI displayed.” Koos also stated that Schifrin stood at least
six feet behind Chan while viewing the tracing.3 Koos initially
told Kang there were no other monitors on the wall in the
resident work room, though later in the interview he conceded
Kang was “probably right” that such monitors were present and
“there was patient information on those monitors.”
3 Both Chan and Nguyen told Kang that Schifrin had been
seated next to Chan, directly in front of the monitors. Schifrin
testified that he stood behind Chan.
8
Koos said Nguyen entered the resident work room while he
and Schifrin were viewing the record and “became very upset.”
When she asked him what he was doing, he told her “they were
viewing the record for teaching purposes.” Later in the interview,
however, Koos said he did not provide any teaching to Chan,
Hein, or any other resident, and the residents who had been in
the room “would likely not agree that there was a teaching
purpose” behind Koos and Schifrin’s visit.4 When asked if
Schifrin had provided teaching, “Koos said that Schifrin made
comments about the fetal monitoring tracing.”
Nguyen told Koos that Krakow wanted to speak to him,
and he stepped out of the room to take the call. Koos said he had
difficulty hearing Krakow due to a bad connection, though he
tried to explain what he and Schifrin had been doing. Koos
acknowledged that Krakow had not authorized the activity, and
that sharing PHI with Schifrin “was not sanctioned by the
department.”
On April 24, 2018, Koos sent Kang a letter stating that his
goals were to “improve patient care and increase the rigor of
medico-legal opinions” and “promote an accurate understanding
of fetal physiology, including cerebral blood regulation.” Koos
also stated that his lengthy relationship with Schifrin, “respect
for his fund of knowledge and expertise, his interest in improving
patient care, [and] dedication to teaching” led him to believe that
Schifrin “would give confidential and much needed teaching
insight into this seemingly contradictory case.” Koos noted he
had a “strong belief that appropriate care was given by our
obstetrical team” and “emphasize[d] that Dr. Schifrin neither
4 Indeed, both Datkhaeva and Chan testified that they did
not consider the interaction to be “teaching.”
9
accessed UCLA patient records nor saw patient identifiers,
including names and medical record numbers.” Koos stated that
to his knowledge, his department “does not have a formal process
to review all abnormal fetal heart rate records,” and “this
deficiency is a major contributor to ad hoc assessments.” He
requested that Kang send him a copy of the report he was
preparing.
On April 24, 2018, Kang sent Koos and the Medical Staff a
confidential memorandum summarizing his investigation. Kang
opined that Koos’s actions “do not meet the regulatory or UCLA
Health policy approved purposes for accessing a patient’s medical
record.” Kang cited three UCLA Health policies: HS-9401,
Protection of Confidential Patient Information (PHI); HS-9412,
Authorization for Use/Disclosure of PHI; and HS-1352,
Family/Visitor Access.
Two days later, on April 26, 2018, Koos sent a letter to Dr.
Carlos Lerner, Vice Chief of the Medical Staff. Koos noted that
Chan’s presentation “did not provide an explanation for the
adverse neonatal outcome” suffered by Patient B. Koos stated
that he suspected “a fetal stroke,” based on a similar case from a
few years ago, but he “did not fully express [his] thoughts at the
time because [he] needed further information.” Koos therefore
“accessed the patient’s records in an ad hoc quality review to
substantiate [his] suspicions regarding the etiology of the injury
and to determine whether the obstetrical care was appropriate.”
He explained that he “planned to reveal [his] findings to the care
providers (who wanted an explanation for the unexpected
outcome) as well as to other residents, trainees, and attending
physicians,” and “would also inform the Department Chair.”
Koos also repeated, essentially verbatim, the assertions about
10
Schifrin’s expertise and failure to view PHI that he made in the
letter to Kang. Koos added that his “Department has a long
tradition of . . . clinicians providing management advice and
direction for patients not under their direct care,” and “[a]d hoc
reviews by qualified physicians are common.” He further stated
that the “unfavorable outcome demanded timely discussion for
teaching and improving patient care,” and opined that
“[p]rotocols for patient confidentiality at UCLA Medical Center
should not impede education or advances in medical care.”
On May 22 and June 28, 2018, the Medical Staff Executive
Committee, consisting of approximately 30 physicians, met and
discussed the matter. The committee concluded that Koos’s
“activities did not constitute any form of appropriate practice,”
and there was “no authorized or appropriate reason, legally or in
policy, for Dr. Koos to have granted access to Dr. Schifrin.” The
committee recommended Koos pay a $25,000 fine, receive a 90-
day suspension from the Medical Staff and a potentially longer
suspension from resident training, and complete a two-day course
in medical record keeping or medical ethics.
On July 3, 2018, Lerner sent Koos a “Notice of Proposed
Action” outlining the committee’s findings and recommendations
and advising him of his right to a hearing under the Medical
Staff bylaws. Koos requested a hearing.
On August 16, 2018, Lerner sent Koos a “Notice of Hearing
and Notice of Charges.” Charge No. 1 alleged that Koos violated
HIPAA and UCLA Medical Center Policies HS-9401 and HS-9412
when he “gained unauthorized access to the medical records of a
UCLA patient and [ ] caused an outside, non-treating, non-UCLA
physician to gain access to identified medical records of a UCLA
patient.” Charge No. 2 alleged that Koos violated the same
11
provisions when he “facilitated unauthorized access to Dr. Barry
Schifrin to view confidential medical information absent consent
and authorization.” Charge No. 3 alleged that Koos violated
HIPAA and UCLA Medical Center Policies HS-9401, HS-9412,
and HS-1352 when, “absent permission of Ronald Reagan UCLA
Medical Center [he] allowed Dr. Schifrin, a non-member of the
medical staff or the faculty, unauthorized access to the Labor and
Delivery Floor and the Resident Work Room where confidential
patient information is continuously displayed.” Charge No. 4
alleged that Koos violated Articles 3.2.1 and 3.3.1(d) of the
Medical Staff Bylaws by improperly obtaining “PHI of patients
(and access to the medical records) with whom [he] had no
treatment relationship and no authorized purpose.”
III. Hearing and Decision
A hearing panel composed of three physician members of
the Medical Staff heard the matter over non-consecutive days in
January, February, and March 2019. Koos and the Medical Staff
were represented by counsel, and an attorney served as the
hearing officer. During the hearing, Koos testified extensively
that his conduct was for the purposes of “patient safety” and
“quality assessment and improvement,” and therefore fell within
the “healthcare operations” exception set forth in HIPAA. Koos
also maintained the fetal heart tracing “was a de-identified
record,” and his review was required under by the Joint
Commission’s “sentinel events” policy discussed below. He
conceded, however, that there “might be other alternatives” to
ensure the material he provided to Schifrin did not contain PHI,
“but that wouldn’t have been time efficient because this
happened to be on a Friday, and he would have to be present, and
12
we wanted to evaluate this.” Both Koos and the Medical Staff
filed written closing briefs.
The hearing panel issued a written decision in May 2019.
It made the following factual findings, from which we omit record
citations.
“1) Dr. Koos was not a member of the treatment team for
Patient A or Patient B. He did not discuss the case with the
actual care team or the attending physician. No evidence was
introduced to show that he was asked by any of the treatment
team to review the case of Patient A or Patient B. He did not
obtain authorization for an outside review from the Department
Chair, the patient, the Medical Staff, or the Medical Center.
“2) In early April 2018, Patient B was born with Apgar
scores of 0/0/0. . . . [A]t the regular Obstetrical Statistics (Stats)
Conference held on April 13, 2018, the case was presented in
detail, and in de-identified fashion, by the Chief Resident, Dr.
Carla [sic] Chan. Following the detailed presentation at the Stats
Conference, the group of MFMs (Maternal Fetal Medicine
specialists trained in high risk pregnancies with skills in the
interpretation of fetal monitor tracings), along with Residents,
fellows and attendings, concluded that the case could not have
been predicted from the tracing and the outcome. Days after the
Stats Conference, Dr. Koos contacted Residents involved in the
patient’s treatment, and sought information regarding their
Patients A and B. Dr. Koos directed Residents Chan and Hein to
disclose to him the identity of the patient medical record numbers
for Patient A and Patient B. Thereafter, Dr. Koos directed the
Residents to open the electronic medical records for him and with
that access, Dr. Koos remotely opened the records and viewed the
13
patients’ medical histories, diagnostic test results, clinic records,
and other healthcare information.
“3) On Friday, April 20, 2019 [sic], without authorization,
Dr. Koos brought a non-UCLA physician to a Medical Center
patient floor and requested a Resident to access the electronic
patient medical records of Patient A and B, and show the records
to the unauthorized, non-treating, non-UCLA physician, Dr.
Barry Schifrin for his review. There was no scheduled meeting or
conference on that date. This review occurred in restricted
patient care space, the Residents Room, located on the Labor and
Delivery floor. In that Resident space, patient medical
information was openly displayed for continuous monitoring by
the Residents. . . .
“4) On April 20, 2018, when Dr. Koos and Dr. Schifrin were
seen by Dr. Nguyen inside the Resident’s [sic] Room viewing the
medical record, Dr. Nguyen asked who had sanctioned this
activity, whereupon Dr. Koos responded ‘I sanctioned it.’
Subsequently, Dr. Koos claimed that enabling Dr. Schifrin to
have access to the Residents Room to view patient information
constituted Dr. Koos’ own ‘ad hoc review’ and that Dr. Barry
Schifrin was part of Dr. Koos’ two person ‘investigative team.’
“5) Dr. Koos’ multiple directives to Dr. Chan and Dr. Hein
on April 15, 19, and 20, 2018 placed two Ob-Gyn Residents in the
difficult position of following orders directed by their superior,
causing them to also violate hospital polices and patient privacy.
These concerns were reported and within three days of the
events, an investigation was undertaken, Witnesses were
interviewed by Chief Compliance Officer Derek Kang and the
results of the interviews were reported to the Medical Staff and
separately to the Privacy Disciplinary Action Committee of the
14
Medical Center. The Medical Staff conducted further fact
finding, and determined what action should be taken.
“6) The Hearing Panel noted varying explanations provided
by Dr. Koos as to his reasons for accessing the patient charts. In
his first explanation by email to the Department Chair, Dr.
Krakow on April 20, 2018, Dr. Koos stated that the outside non-
UCLA physician ‘Barry [Schifrin] is very interested in teaching
and I thought he could contribute to the heart rate analysis.’ On
April 23, 2018, Dr. Koos then stated to the Compliance and
Privacy Officers that he and Schifrin were working on an article,
and that he had verbally discussed the case with Schifrin prior to
reviewing the record in the Resident Room, and that he wanted
to show Schifrin the record . . . ‘in order to get his opinion.’ A
third explanation occurred on April 24, 2018, in which Dr. Koos’
[letter] stated to the Compliance Officer that he desired ‘to
improve patient care and increase the rigor of medico-legal
opinions.’ Later, on April 26, 2018, Dr. Koos wrote a letter to the
Vice Chief of Staff, Dr. Carlos Lerner, indicating for the first time
that the patient’s records were accessed through the Residents
for his personal ‘ad hoc quality review.’ Notwithstanding the
above explanations, Dr. Koos testified at the hearing that the
records of Patient A and Patient B contained a ‘sentinel event’ for
which a root cause analysis was needed. Although Dr. Koos did
not previously report this as a Sentinel Event to any committee.
[sic]”
IV. Administrative Appeal
Pursuant to the Medical Staff Bylaws, Koos appealed the
hearing panel’s findings and decision to an appeal board
consisting of three different UCLA physicians. Koos and the
Medical Staff were represented at the July 15, 2019 appellate
15
hearing by counsel, who made oral and written arguments on
their behalf. The appeal board issued a written decision in
August 2019, affirming the decision of the hearing panel.
Under the Medical Staff Bylaws, the appeal board’s review
was limited to determining whether Koos received a fair hearing,
whether the hearing panel’s decision was reasonable and
warranted, and whether any of the rules, bylaws, or policies the
hearing panel relied upon were unreasonable or unwarranted.
The appeal board also noted that Koos did “not dispute any facts
cited by the Hearing Committee in its Decision, nor does Dr. Koos
. . . raise any challenges to the accuracy or authenticity of any
evidence, either testimonial or documentary, that was presented
by the [Medical Staff] during the hearing.”
The appeal board first rejected Koos’s contentions that he
did not receive a fair hearing. Koos does not repeat these
contentions here.
The appeal board next considered whether the hearing
panel’s conclusion that Koos violated HIPAA and UCLA policies
was reasonable and warranted. The board rejected Koos’s
contention that there was no evidence presented “as to ‘what
federal or state regulation he allegedly violated under HIPAA.’”
It found that “[t]hroughout the hearing, it was well-understood
that the applicable HIPAA provisions were those commonly
referred to as the ‘HIPAA Privacy Rule,’’ which are regulations
that generally prohibit the disclosure of ‘individually identifiable
health information’ (or ‘PHI’) without a patient’s authorization.”
The board observed that Koos introduced as an exhibit “a
detailed summary and explanation of the HIPAA Privacy Rule,”
and that he “testified that the HIPAA Privacy Rule applied to
him in these proceedings.” The appeal board concluded that,
16
“absent an exception, Dr. Koos’ conduct violated HIPAA and
UCLA Policies.”
The board was unpersuaded by Koos’s contention that the
entirety of his conduct—both accessing the records and sharing
them with Schifrin—fell within the health care operations
exception. The appeal board noted that Koos changed his
explanation for his actions several times during the investigation,
and never referred to “sentinel event,” “root cause analysis,” or
the health care operations exception until he took the stand at
the hearing. It thus found “reasonable and warranted” the
hearing panel’s determination that Koos’ arguments about the
exception were “not credible.”
The appeal board also rejected Koos’s alternative argument
that his actions were authorized by Patient A’s written consent
form. The board first found that Koos’s “unilateral decision” to
investigate the case without UCLA authorization did not
constitute one of the permissible “UCLA[ ] purposes, such as
quality improvement, patient safety and education” that were
authorized by the form. It further found that disclosure to
Schifrin, a non-UCLA physician, was not a UCLA purpose,
particularly in light of Koos’s testimony that he could have
requested de-identified records but did not do so because it was
not “time efficient” on a Friday. The board also found that the
consent form allowed use of patient information only “in
accordance with state and federal law,” and that criterion was
not satisfied in light of Koos’s HIPAA violations.
The appeal board also rejected Koos’s final argument that
the hearing panel’s decision was arbitrary, unreasonable, and
capricious. The board expressly found that the charges were
17
supported by “the evidence and testimony presented during the
hearing.”
V. Writ Proceedings
On October 30, 2019, Koos filed a verified petition for writ
of administrative mandate pursuant to Code of Civil Procedure
section 1094.5. He requested that the superior court set aside the
decision of the appeal board and the corrective actions it imposed
because his “access to the patients’ records was for the purpose of
healthcare operations defined by HIPAA” and was authorized by
Patient A’s consent form.
After receiving written briefing and reviewing the
administrative record, the superior court issued a written
tentative decision denying relief. In the tentative, the court
explained Code of Civil Procedure section 1094.5, subdivision (b)
limited its consideration to “whether the respondent has
proceeded without jurisdiction, whether there was a fair trial,
and whether there was a prejudicial abuse of discretion.”
Because UCLA is a public hospital, the court used its
independent judgment when determining whether the
administrative findings were supported by the weight of the
evidence. The court found that the weight of the evidence
supported the conclusions that the healthcare operations
exception to HIPAA was inapplicable, Patient A’s consent form
did not authorize Koos’s actions, and Koos’s testimony about the
healthcare operations exception was not credible. The court also
found that the weight of the evidence supported the findings that
Koos violated HIPAA, UCLA bylaw articles 3.2.1 and 3.3.1(d),
and UCLA policies HS-9401 and HS-9412. The court agreed with
Koos that policy HS-1352 regarding visitation was inapplicable,
but concluded the weight of the evidence nevertheless supported
18
the findings on Charge No. 3 because the charge also cited
HIPAA and policies HS-9401 and HS-9412.
The court adopted its tentative after hearing oral argument
from both sides. The court issued an order denying the writ on
May 5, 2021 and entered judgment on July 29, 2021. Koos timely
appealed.
DISCUSSION
I. Standard of Review
“A hospital’s final decision in a peer review proceeding may
be judicially reviewed by a petition for writ of administrative
mandate.” (Ellison v. Sequoia Health Services (2010) 183
Cal.App.4th 1486, 1495.) Here, the final decision is that of the
appeal board.
The inquiry in administrative writ proceedings “shall
extend to the question of whether the respondent has proceeded
without, or in excess of, jurisdiction; whether there was a fair
trial; and whether there was any prejudicial abuse of discretion.
Abuse of discretion is established if the respondent has not
proceeded in the manner required by law, the order or decision is
not supported by the findings, or the findings are not supported
by the evidence.” (Code Civ. Proc., § 1094.5, subd. (b).) “Where it
is claimed that the findings are not supported by the evidence, in
cases in which the court is authorized by law to exercise its
independent judgment on the evidence, abuse of discretion is
established if the court determines that the findings are not
supported by the weight of the evidence. In all other cases, abuse
of discretion is established if the court determines that the
findings are not supported by substantial evidence in the light of
the whole record.” (Id., subd. (c).) The independent judgment
test applies here because UCLA is a public hospital. (Cipriotti v.
19
Board of Directors of Northridge Hospital Foundation Medical
Center (1983) 147 Cal.App.3d 144, 154.)
“Even when, as here, the trial court is required to review
an administrative decision under the independent judgment
standard of review, the standard of review on appeal of the trial
court’s determination is the substantial evidence test.” (Fukuda
v. City of Angels (1999) 20 Cal.4th 805, 824.) Our function is
essentially the same as the superior court’s. (Hongsathvij v.
Queen of Angels/Hollywood Presbyterian Medical Center (1998)
62 Cal.App.4th 1123, 1136 (Hongsathvij).) We consider whether
the appeal board applied the correct standard when it conducted
its review of the evidence and, if so, whether its decision was
supported by substantial evidence. (Ellison v. Sequoia Health
Services, supra, 183 Cal.App.4th at p. 1496.) We afford no
deference to the superior court’s decision (id. at p. 1495), but
“must uphold administrative findings unless the findings are so
lacking in evidentiary support as to render them unreasonable.”
(Hongsathvij, supra, 62 Cal.App.4th at p. 1137.)
II. Analysis
A. Healthcare Operations Exception
Koos contends he did not violate HIPAA or UCLA policies
HS-9401 and HS-9412 because his conduct was permissible
under the “health care operations” exception. We disagree.
HIPAA is a federal law. (See Brown v. Mortenson (2011) 51
Cal.4th 1052, 1066.) In connection with its 1996 passage,
Congress tasked the Department of Health and Human Services
“with promulgating regulations setting forth national medical
information privacy standards.” (Ibid.) The resultant “wealth of
detailed regulations” are codified at 45 C.F.R. §§ 160, 164 and are
commonly known as the “Privacy Rule.” (Ibid.; see also 42 C.F.R.
20
§ 3.20 (“HIPAA Privacy Rule means the regulations promulgated
under section 264(c) of the Health Insurance Portability and
Accountability Act of 1996 (HIPAA), at 45 CFR part 160 and
subparts A and E of part 164.”).) As relevant here, the Privacy
Rule generally prohibits the disclosure of PHI, defined as
“individually identifiable health information . . . [t]ransmitted or
maintained in any . . . form or medium.” (45 C.F.R. §§ 160.103,
164.502(a).) “Individually identifiable health information”
includes health information, collected from an individual that is
received by a health care provider and “[r]elates to the past,
present, or future physical or mental health or condition of an
individual; the provision of health care to an individual; or the
past, present, or future payment for the provision of health care
to an individual;” and “identifies the individual” or “[w]ith respect
to which there is a reasonable basis to believe the information
can be used to identify the individual.” (45 C.F.R. § 160.103.)
Entities subject to HIPAA may disclose PHI “[f]or
treatment, payment or health care operations, as permitted by
and in compliance with [45 C.F.R.] § 164.506.” (45 C.F.R.
§ 164.502(a)(1)(ii).) “Health care operations” include
“[c]onducting quality assessment and improvement activities,
including outcomes evaluation and development of clinical
guidelines, provided that the obtaining of generalizable
knowledge is not the primary purpose of any studies resulting
from such activities.” (45 C.F.R. § 164.501.) They also include
“patient safety activities,” which encompass “[e]fforts to improve
patient safety and the quality of health care delivery.” (45 C.F.R.
§ 164.501; 42 C.F.R. § 3.20.)
UCLA policy HS-9401, Protection of Confidential Patient
Information (Protected Health Information (PHI)), “sets forth
21
guidelines for protecting and maintaining the confidentiality” of
PHI as required by the HIPAA Privacy Rule and California law.
Like the Privacy Rule, it provides that “Members of the UCLA
Workforce may not disclose, share, or otherwise use any
individually identifiable health information except for Treatment,
Payment and Health Care Operations (referred to hereafter as
‘TPO’) unless expressly authorized by the patient or otherwise
permitted or required by law.” Its definition of PHI is similar to
the HIPAA definition, including “any element of personal
identifying information sufficient to allow identification of the
individual, such as the patient’s name, . . . , or other information
that, alone or in combination with other publicly available
information, reveals the individual’s identity.” The policy also
expressly provides that “[a]ll information contained in patient
medical . . . records is confidential regardless of format,” and
gives as examples “medical record numbers,” “case histories,” and
“information orally communicated about a particular patient.”
Additionally, HS-9401 requires “[a]ll members of the UCLA
Health Workforce” to “make reasonable efforts to limit PHI to the
minimum necessary to accomplish the intended purpose,” and
states that Workforce members “should only access and use PHI
as necessary for their job functions.”
UCLA policy HS-9412, Authorization for Use/Disclosure of
Protected Health Information (‘PHI’), “describe[s] the
circumstances in which UCLA Health System must obtain the
patient’s authorization to use or disclose Protected Health
Information (‘PHI’) . . . . It also discusses instances when patient
written authorization is not required . . . .” HS-9412 uses the
same definition of PHI as HS-9401. It requires patient written
authorization whenever PHI is used or disclosed “for a purpose
22
that does not fit an exception under the HIPAA or California
law.”
Both HS-9401 and HS-9412 contain “health care
operations” exceptions akin to that in the Privacy Rule. Thus, if
Koos’s conduct falls within the health care operations exception
to the Privacy rule, it also falls within the policy exceptions.
Likewise, the appeal board concluded, and Koos does not dispute,
that a violation of the Privacy Rule would also result in a
violation of HS-9401 and HS-9412.
Citing his testimony at the hearing, Koos asserts it is
“undisputed” that his review of Patient B’s records was for
“patient safety reasons—to figure out the root cause of Patient
B’s injuries and prevent such injuries in future patients.” 5 He
contends the hearing panel’s conclusion that this explanation was
not credible, which the appeal board found was “reasonable and
warranted,” rested on its “dishonest at best” characterization of
the testimony as contradictory of previous explanations Koos
provided for his actions. He argues that the evidence cited by the
panel—Koos’s April 20, 2018 email to Krakow, Kang’s notes from
his April 23, 2018 interview with Koos, Koos’s April 24, 2018
letter to Kang, and Koos’s April 26, 2018 letter to Lerner—was in
no “way inconsistent with or contradictory to his testimony at
hearing [sic] that a root cause analysis was needed of this case.”
Substantial evidence supports the appeal board’s decision.
In the email Koos sent to Krakow shortly after the incident, he
emphasized Schifrin’s interest in teaching and suggested Schifrin
5 Although his argument heading refers to his “activities”
generally as permissible under the healthcare operations
exception, Koos only specifically addresses his access of Patient
B’s records in the substance of the argument.
23
“could contribute to the heart rate analysis.” It is unclear to
what or whose analysis Koos was referring, and evidence at the
hearing established that no teaching occurred during the
incident. During his interview with Kang a few days later, Koos
stated that he “was curious if the baby had suffered any brain
damage” and “he had a suspicion about the case and wanted to
confirm it in his own mind.” In his subsequent letter to Kang,
Koos asserted that, in addition to “improv[ing] patient care,” his
goals included “promot[ing] an accurate understanding of fetal
physiology” and “increas[ing] the rigor of medico-legal opinions.”
Finally, in his letter to Lerner, he explained that he “accessed the
patient’s records in an ad hoc quality review to substantiate [his]
suspicions regarding the etiology of the injury and to determine
whether the obstetrical care was appropriate.” While some of
these explanations are consistent with Koos’s testimony
regarding his intentions, “[t]he fact that there was substantial
evidence in the record to support a contrary finding does not
compel the conclusion that there was no substantial evidence to
support the judgment.” (Rayii v. Gatica (2013) 218 Cal.App.4th
1402, 1408.) Several of the explanations, particularly those
regarding “curiosity,” personal “suspicions,” and Schifrin’s desire
to teach, support a finding that Koos was concerned with issues
other than patient safety, and therefore was not credible at the
hearing.6
6 In any event, the health care operations exception to the
Privacy Rule does not apply when “the obtaining of generalizable
knowledge is . . . the primary purpose of any studies resulting
from such activities.” (45 C.F.R. § 164.501.) Koos’s repeated
mentions of personal suspicions and assertions that he had a
“strong belief that appropriate care was given by our obstetrical
team” reasonably support a conclusion that his primary concern
24
Moreover, as the appeal board observed, “[n]otably absent
from these communications . . . is any reference to a ‘root cause
analysis,’ a ‘sentinel’ event, or a HIPAA exception that would
have permitted Dr. Schifrin to view Patient B’s medical records.”
Koos contends there is “simply no requirement whatsoever in
HIPAA or its healthcare operations exception that a physician
must announce that he will be conducting an activity under said
HIPAA exception before undertaking such activity,” and “HIPAA,
much less the hospital operations exception, does not mandate a
certain number of individuals to conduct patient safety activities.
However, the challenged finding is that Koos’s explanation was
not credible. His failure to mention his purported rationale for his
actions prior to the hearing constitutes substantial evidence in
support of that finding.
B. Written Authorization
Koos alternatively contends that the “‘patient safety,’
‘quality improvement’ and ‘education’ being conducted by Dr.
Koos . . . falls squarely within the terms of the authorizations”
Patient A signed on behalf of herself and Patient B. Those
authorizations provided, in relevant part: “I understand that my
medical information, photographs, and/or video in any form may
be used for other UCLAH purposes, such as quality improvement,
patient safety and education. I also understand that my medical
information and tissue, fluids, cells and other specimens
(collectively, ‘Specimens’) that UCLAH may collect during the
course of my treatment and care may be used and shared with
researchers. . . . I further understand that any use of my medical
was “obtaining generalizable knowledge,” not improving patient
safety for patients who had already been discharged from the
hospital.
25
information or Specimens by UCLAH or other research
institutions will be in accordance with state and federal law,
including all laws and regulations governing patient
confidentiality, in the manner outlined in the UCLAH Notice of
Privacy Practices.”7
The appeal board found that Koos did not use the
information for “UCLAH purposes,” because he made a
“unilateral decision” to investigate the case without being
requested to do so or receiving “any authorization from OB/GYN,”
and shared PHI with a non-UCLA physician despite being aware
of de-identification options. The appeal board also found that the
consent form required the use of PHI to be “in accordance with
state and federal law, including all laws and regulations
governing patient confidentiality,” and therefore did not cover
Koos’s HIPAA-violating conduct. These findings are supported
by substantial evidence.
Koos asserts the appeal board “simply brushed aside the
authorizations, stating that Dr. Koos’ activities were not for
‘UCLAH purposes,’” and “is simply creating requirements and
conditions that are not present in the law.” The authorizations
by their terms, however, required that the information be used
for UCLAH purposes. As discussed above, substantial evidence
supported the appeal board’s conclusion that Koos’s purposes
were primarily personal. Indeed, Koos acknowledged to Nguyen
during the incident that he, not UCLA, personally “sanctioned”
Schifrin’s visit to the resident work room.
Koos further asserts that “the language about sharing . . .
information with other research institutions covers Dr. Schifrin,”
but that the appeal board incorrectly “stated that Dr. Schifrin’s
7 “UCLAH” is defined in the form as UCLA Health Care.
26
mere presence obviates the language of the authorizations.” The
appeal board said: “‘UCLAH purposes’ would not apply to Dr.
Schifrin, an outside non-UCLA physician with no treatment or
billing relationship with Patient A or B. This is particularly true
where, as here, there were existing authorization processes in
place that may have allowed Dr. Koos to share Patient B’s PHI
with Dr. Schifrin.” Though he suggests the “authorization
processes” were insufficiently communicated to him, and Janzen
essentially shut down any such processes after the stats
conference, Koos acknowledged during the hearing that there
“might be other alternatives” to ensure the material he provided
to Schifrin did not contain PHI, “but that wouldn’t have been
time efficient because this happened to be on a Friday, and he
would have to be present, and we wanted to evaluate this.”
There is no evidence that “time efficiency” is a UCLAH purpose.
Furthermore, a previous portion of the consent form provides
that “a University institutional review board approves projects
conducted by University researchers,” and informs patients that
they “may be contacted and asked to participate in research
studies but [are] under no obligation to do so.” There is no
evidence that Koos sought approval from any UCLA body or
board or contacted Patient A for permission to share her
information or that of her child with an outside physician or
researcher.
Koos also asserts, in a footnote, that the hearing panel and
appeal board made “conclusory findings/conclusions that Dr.
Schifrin viewed PHI,” but that “is simply not the case and
disputed.” Though Koos may dispute it, Chan testified that
Patient B’s fetal tracing contained PHI, and she and Datkhaeva
both testified that Schifrin remarked upon PHI during his time
27
in the resident work room. This is substantial evidence on which
the board was entitled to rely. Koos also acknowledged during
cross-examination that “the patient’s name” was visible in the
resident work room. A name is PHI under the HIPAA and UCLA
policies despite Koos’s testimony to the contrary.
C. “Sentinel Event”
At the hearing, Koos introduced into evidence the “Sentinel
Events Policy” of the Joint Commission, the hospital’s accrediting
body. The policy states that its aim is “to help hospitals that
experience serious adverse events improve safety and learn from
those sentinel events,” which it defines as “a patient safety event
(not primarily related to the natural course of the patient’s illness
or underlying condition) that reaches a patient and results in . . .
[d]eath[,] [p]ermanent harm[,] or [s]evere temporary harm.”8 The
policy requires all sentinel events to “be reviewed by the hospital”
and provides extensive guidance about responding to and
reporting such events. Koos testified at length that he believed
closing the case without further review was against the policy, so
he took it upon himself to ensure compliance by reviewing the
matter.
Koos contends the hearing panel and appeal board “failed
to consider the Sentinel Event Policy, only concluding that Dr.
Koos believed there to be a sentinel event. However, the facts are
clear. This was a sentinel event. He had spoken with Dr. Janzen
and Dr. Krakow. This sentinel event was not going to be
investigated further. Not only does HIPAA explicitly permit the
8 Koos also cites to UCLA policy HS-0328, which he asserts
“mirrors much of the Sentinel Event Policy.” This policy was
never mentioned during the administrative proceedings and is
not in the appellate record.
28
type of activity undertaken by Dr. Koos, it was indeed required by
the policies of the Joint Commission.”
The hearing panel found that “Dr. Koos testified at the
hearing that the records of Patient A and Patient B constituted a
‘sentinel event’ for which a root cause analysis was needed.
Although Dr. Koos did not previously report this as a Sentinel
Event to any committee [sic].” The appeal board found this
testimony by Koos was not credible due to his failure to invoke
the policy prior to the hearing or report the alleged sentinel event
to anyone at the university. The board thus did not fail to
consider the policy, the provisions of which Koos himself cited
only in conclusory fashion.
D. Medical Staff Bylaws
Koos was charged with violating and was found to have
violated Articles 3.2.1 and 3.3.1(d) of the Medical Staff Bylaws by
improperly obtaining “PHI of patients (and access to the medical
records) with whom [he] had no treatment relationship and no
authorized purpose.” Article 3.2.1 provides, “The Code of Ethics
of the American Medical Association, the American College of
Surgeons, and the University Of California Code Of Conduct, as
outlined in the UCLA Health System Compliance Handbook,
shall govern the professional conduct of members of the Medical
Staff. Each applicant to the Medical Staff shall agree to abide by
this code of ethics by execution of the application.” Article
3.3.1(d) provides, “Disruptive and inappropriate medical staff
member conduct affects or could affect the quality of patient care
at the hospital and includes . . . [i]nappropriate access and
unauthorized release of protected health information and patient
information.” Koos argues these bylaws “simply repeat the
allegations and charges Respondents have already made against
29
Dr. Koos. With respect to Section 3.2.1, there is no indication
anywhere in record [sic] or any evidence set forth by Respondents
of what provision or aspect of the ‘Code of Ethics’ or ‘Code of
Conduct’ Dr. Koos is alleged to have violated. From the Appeal
Board Decision, it would appear that it believes Dr. Koos violated
the ‘Compliance Handbook’ by ‘disclosing confidential patient
information.’ In response to this, and to the allegation that Dr.
Koos violated Section 3.3.1(d), the argument that the disclosure
of PHI was permitted under HIPAA, its healthcare operations
exception, and by authorization applies.” Koos’s argument here
mirrors his earlier contentions that his conduct did not violate
HIPAA. As we have found those arguments unpersuasive above,
we equally reject them here. We also note that the appeal board
expressly considered and rejected Koos’s argument that the
hearing panel “failed to ‘stat[e] what portion or how’ Dr. Koos
violated UCLA policy, HIPAA, or the Bylaws.” It found that the
relevant “rules and policies were . . . exchanged between the
parties and presented to the [hearing panel] as exhibits,” “counsel
for Dr. Koos described, in detail, each of the charges levied
against Dr. Koos in his opening statement,” and “several
witnesses, including Dr. Koos, testified at length about these
specific rules and polices during the hearing.” These findings are
supported by the evidence.
E. Visitor Access
Koos briefly contends that UCLA policy HS-1352,
Family/Visitor Access, applies only to visitors of hospital patients.
He contends the hearing panel and appeal board “simply fail[ed]
to address this issue altogether in their respective Decisions,
which instead erroneously conclude that Dr. Koos violated this
policy by virtue of Dr. Schifrin’s presence.”
30
HS-1352 states that its purpose is “to provide a safe and
welcoming environment for patients, visitors and staff.” It
continues, “Our patient’s [sic] preferences and well being will
determine who visits, when the visits occur and how long the
visits last.” The policy does not define the term “visitors.” It
does, however, “request[ ] that visitors wear a visitors badge”
indicating “the destination in the hospital, the date of the visit
and the name of the person who issued the badge.”
The hearing panel found that Koos violated HS-1352 by
providing Schifrin “unauthorized access to the Labor and
Delivery Floor and the Resident Work Room where confidential
patient information is continuously displayed.” The appeal board
found that Schifrin “was not wearing a visitor badge and Dr.
Koos did not provide any explanation why Dr. Schifrin was in the
resident work room.” It further found that HS-1352 “prohibits
visitors without a legitimate reason for being at the hospital from
entering.” Both bodies thus clearly addressed the issue. Koos did
not elaborate on or support his interpretation of the policy, so
there was no basis for the panel or board to address it further.
Moreover, the only charge that invoked this policy, Charge No. 3,
also alleged that Koos violated HIPAA, HS-9401, and HS-9412.
Thus, even if HS-1352 is inapplicable, the ultimate finding on the
charge is supported by substantial evidence.
31
DISPOSITION
The judgment of the superior court is affirmed.
Respondents are awarded their costs on appeal.
NOT TO BE PUBLISHED IN THE OFFICIAL REPORTS
COLLINS, J.
We concur:
MANELLA, P. J.
CURREY, J.
32