Shands Jacksonville Medical Center, Inc. seeks a writ of certiorari to review an order denying its motion to dismiss Eartha Pusha's medical malpractice complaint. Pusha alleged that Shands' negligent treatment of Pusha's mother, Regina Freeman, resulted in Freeman's death. Shands argued that Pusha's suit should be dismissed because of her failure to comply with the Medical Malpractice Act by obtaining a verified written medical expert opinion corroborating her claims before she filed suit. Pusha countered that Shands waived this presuit requirement when it failed to respond to her requests for Freeman's medical records. Shands argued that no waiver occurred because the hospital did not refuse to produce Freeman's records, but rather asked for additional information to ensure that the persons seeking Freeman's confidential medical records were legally authorized to receive the records. The trial court denied Shands' motion to dismiss, concluding that Shands waived its entitlement to an expert opinion by failing to produce Freeman's medical records in response to Pusha's requests.
The question before this Court is: During the course of the presuit investigation authorized under the Medical Malpractice Act, may a hospital seek verification that a person requesting confidential medical records is legally authorized to obtain those records? For the reasons that follow, we answer the question in the affirmative, and grant the petition.
I. BACKGROUND
In September 2010, Regina Freeman was experiencing heart problems, which led to her admission to Shands for mitral valve replacement surgery. After the surgery, Freeman was transferred to the cardiovascular intensive care unit for post-surgical monitoring. While in the ICU, she experienced ventral fibrillation and was returned to the operating room. Freeman never regained consciousness and remained on life support for several days following the surgery. She died on October 5, 2010.
A. Pre-Suit Actions
Shortly after Freeman's death, Eartha Pusha, Freeman's mother, and/or Takara Teague, Freeman's daughter, contacted the law firm of Fenster & Cohen, P.A. about representing the family in a medical malpractice suit against Shands.
*10791. December 23, 2010 Request for Medical Records
On December 23, 2010, an attorney from the Fenster law firm sent a letter to Shands requesting Freeman's medical records. The letter identified Pusha as Freeman's personal representative.1 The letter expressly provided that "this firm represents the above-named individual," referring only to Pusha and did not reflect that the firm represented anyone else. The letter did not indicate that Freeman was deceased or that Pusha was Freeman's mother. And the letter contained no reference to the Medical Malpractice Act.
A form purporting to authorize the release of Freeman's confidential medical records was attached to the letter. The stated purpose for requesting the records was "at the request of the individual." But the form was not signed by Pusha, the client identified in the letter. Rather, it was signed by Teague, who was identified on the form as Freeman's personal representative and daughter. Nothing on the form allowed Shands to verify that Teague was in fact Freeman's daughter or to determine whether any relationship existed between Pusha and Teague. Further, it is undisputed that neither Pusha nor Teague was a personal representative of Freeman's estate at the time the letter was sent.
Iron Mountain, Shands' contracted copy service, responded to the request on January 8, 2011. Iron Mountain informed Pusha's counsel that Shands could not provide the requested records because the authorization form enclosed with her letter did not comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as it did not include a valid power of attorney authorizing the release of Freeman's medical records.
Jeffery Fenster, in his deposition, asserted that his staff "probably" contacted Shands after receipt of the response to his records request and "probably explained to them" that Freeman was deceased and thus no power of attorney was necessary. But Fenster failed to maintain a paper file for Pusha's case, so he could not recall what actually transpired. Instead, he testified only to his firm's general practice.
2. April 6, 2011 Request for Medical Records
On April 6, 2011, the Fenster law firm sent Shands a second letter requesting Freeman's medical records. The letter included a request that Freeman's medical records be produced within ten days pursuant to section 766.204(1), Florida Statutes. Otherwise, the April letter was virtually identical to the December letter. Pusha was identified as the client and personal representative of Freeman's estate. Attached to the letter was an authorization form signed by Teague, who purported to be the personal representative and daughter of Freeman. Again, nowhere in the letter was Teague identified as a client. The letter did not explain the relationship between Pusha (identified in the letter as the client) and Teague (identified on the form as the personal representative and daughter of Freeman). Nor did either the letter or form indicate that Freeman was deceased.
Shands' director of health information management, Annette Wrabel, testified that a letter was sent in response to this request informing Pusha that no records could be released without an authorization signed by the patient or a valid power of *1080attorney. Wrabel was unable to produce a copy of the letter, but she did produce a record from their log system showing a letter was sent in response to the request.
3. July 2011 Requests for Medical Records
On July 6, 2011, the Fenster law firm sent Shands a third letter requesting Freeman's medical records. Five days later, the law firm faxed the same authorization form attached to the two prior letters, but this time he also included a copy of Freeman's death certificate. Two days later, on July 11, 2011, after Shands was able to verify that Freeman was deceased and that Teague was Freeman's daughter, the hospital produced the requested medical records to the Fenster law firm.
Fenster requested additional records on July 21, 2011, which Shands produced within ten business days.
B. Complaint
On June 15, 2011, the law firm mailed a "Notice of Intent to Initiate Litigation" to Shands. The notice identified Pusha and Teague as personal representatives of Freeman's estate. Shands responded by letter dated September 26, 2011, stating that the notice was deficient because it did not contain a written medical expert opinion corroborating Pusha's claim as required by section 766.203(2), Florida Statutes (2011).
On May 24, 2012, Pusha, as personal representative of Freeman's estate, filed a complaint alleging that Shands' negligence directly led to Freeman's death. Pusha did not obtain a written medical expert opinion before she filed suit.
In 2015, Shands moved to dismiss the complaint on grounds that Pusha failed to comply with the presuit requirements of section 766.203(2) because she never obtained a written medical expert opinion corroborating her medical malpractice claims. Pusha argued that Shands waived this presuit requirement because Shands failed to produce Freeman's medical records during presuit discovery as required by section 766.204(2), Florida Statutes. Shands replied that it was not required to produce the records because the hospital could not produce Freeman's confidential medical records until it had a valid authorization to release the records.
After an evidentiary hearing, the trial court denied the motion to dismiss.
II. STANDARD OF REVIEW
A petitioner seeking certiorari relief from the denial of a motion to dismiss must demonstrate a departure from the essential requirements of the law that would result in irreparable harm that could not be corrected on direct appeal. Williams v. Oken , 62 So.3d 1129, 1132 (Fla. 2011). When a petitioner seeks certiorari relief on grounds that a plaintiff has not complied with the presuit requirements of the Medical Malpractice Act, the latter two prongs of the certiorari standard are satisfied as "[t]he statutes requiring presuit notice and screening cannot be meaningfully enforced postjudgment because the purpose of the presuit screening is to avoid the filing of the lawsuit in the first instance." St. Joseph's Hosp., Inc. v. Doe , 208 So.3d 1200, 1201-02 (Fla. 2d DCA 2017) (citations omitted). Thus, for certiorari relief to be granted, Shands was required to show that the order denying its motion to dismiss departed from the essential requirements of the law. If no competent, substantial evidence supports the order, then the trial court has departed from the essential requirements of the law. See C.O. v. State , 203 So.3d 200, 200 (Fla. 5th DCA 2016) (holding that when competent, substantial evidence fails to support the trial court's finding regarding competency, the trial court has departed from the essential requirements of the law);
*1081In re Commitment of Reilly , 970 So.2d 453, 455 (Fla. 2d DCA 2007) ("Where competent, substantial evidence does not support the trial court's finding regarding competency or involuntary commitment, the trial court has departed from the essential requirements of the law.").
Here, we must determine whether competent, substantial evidence supports the trial court's order denying the motion to dismiss. Specifically, we must determine whether Pusha was permitted to proceed with her lawsuit without obtaining a presuit written expert report corroborating her claims based on a finding that Shands waived entitlement to the report by not immediately producing Freeman's medical records in response to Pusha's requests. Although the trial court did not make specific findings, we conclude that the trial court found that at least one of the records requests made by Pusha before July 2011 was adequate to trigger Shands' obligation to produce Freeman's medical records.
Pusha made two concessions that narrow the scope of our review. First, she conceded that the December 2010 letter was not a formal request for medical records under the Medical Malpractice Act because it did not reference chapter 766. Second, she conceded that Shands timely responded to her July 2011 request for records. Consequently, our review centers on the April 2011 request for medical records and whether the request was sufficient to require Shands to produce the records.
III. THE MEDICAL MALPRACTICE ACT
Before filing a medical negligence action, a claimant must comply with the presuit requirements of the Medical Malpractice Act. See Gordon v. Shield , 41 So.3d 931, 933 (Fla. 4th DCA 2010) (recognizing that the Act creates a complex presuit investigation procedure that both claimants and defendants must follow). One of the requirements is for the claimant to investigate whether there are reasonable grounds to believe that a defendant named in the suit provided negligent care or treatment and that such negligence resulted in an injury to the claimant. § 766.203(2), Fla. Stat. (2011). In order to assist a claimant with reviewing the merits of her potential claim, section 766.204(1), Florida Statutes (2011), requires copies of medical records to be turned over to "a claimant or a defendant, or to the attorney therefore."
Once a claimant has undertaken the investigation required by the Act and before filing suit, the claimant must submit a verified written medical expert opinion to corroborate that there are reasonable grounds to support the claim of medical negligence. § 766.203(2), Fla. Stat. (2011). However, this requirement may be waived if a defendant fails to timely comply with a claimant's request for medical records. See § 766.204(2), Fla. Stat. (2011) ; Martin Mem'l Med. Ctr., Inc. v. Herber , 984 So.2d 661, 664 (Fla. 4th DCA 2008) (holding that the failure of a hospital to timely comply with a request for medical records results in a waiver of the requirement for a claimant to file a corroborating medical affidavit); Watson v. Beckman , 695 So.2d 436, 437 (Fla. 3d DCA 1997) (holding that the requirement to file a verified corroborating expert opinion was waived by the defendant's failure to comply with a records request); Escobar v. Olortegui, DDS , 662 So.2d 1361 (Fla. 4th DCA 1995) (holding that failure to provide copies of a plaintiff's medical records waived the necessity of filing a corroborating affidavit). Although Florida courts construing section 766.204(2) in some cases have found waiver of the right to the presuit written corroborating expert opinion, it has done so only where the defendant has wholly failed to produce records in response to a claimant's request. See, e.g., Watson , 695 So.2d at 437 (healthcare provider completely failed to *1082produce records, but plaintiff cured the presuit deficiency by obtaining the corroborating expert affidavit before the statute of limitations ran); Escobar , 662 So.2d at 1364 (healthcare provider's failure to produce medical records waived right to the corroborating expert affidavit).
Here, Shands did not refuse to produce Freeman's medical records, rather it sought to verify that Pusha and/or Teague were claimants or were otherwise legally authorized to receive Freeman's records before producing them. A claimant is defined as "any person who has a cause of action for damages based on personal injury or wrongful death arising from medical negligence." § 766.202(1), Fla. Stat. (2011). And pursuant to Florida's Wrongful Death Act, only a properly designated personal representative may bring a lawsuit for wrongful death. § 768.20 Fla. Stat. (2011). The April 2011 letter requesting Freeman's medical records did not clearly identify Pusha or Teague as claimants or as persons legally authorized to receive Freeman's medical records. In fact, the letter only served to confuse the issue. The letter did not identify Pusha as Freeman's mother or next of kin. Further, although records may be released to an attorney for a claimant, the letter did not clearly identify that the person who was requesting the records was Fenster's client. Pusha was identified as a client of the firm, but Teague, who signed the authorization form, was not so identified. In response, Shands did not refuse to produce the records. Instead, Shands sought to determine whether Pusha and/or Teague were authorized to receive Freeman's medical records, and asked for a copy of a power of attorney or a copy of Freeman's death certificate before producing the records.
Pusha argues that the plain language of section 766.204 contains no requirement that a person requesting records demonstrate their legal authority to receive the records. Nor does the statute expressly authorize a hospital to seek to verify that the person requesting confidential medical records is legally authorized to receive the records before producing them. Thus, Pusha argues that the statute requires only that a person requesting a patient's medical records make a request, and without more, the hospital is obligated to produce the records. We reject this argument for two reasons: first, this construction of section 766.204 is inconsistent with the high degree of protection given to confidential medical records under Florida law; and second, to the extent that Florida's protection of confidential medical records under section 766.204 is less stringent than HIPAA, section 766.204 is preempted.
A. Florida's Laws Protecting the Privacy of Medical Records
Florida law prohibits the disclosure of confidential medical records without valid authorization. An authorization for the release of a person's confidential medical records is valid only if made by the patient or his or her legal representative. § 395.3025(4), Fla. Stat. (2011). Section 395.3025(1), Florida Statutes (2011), provides the following guidelines for obtaining medical records:
Any licensed facility shall, upon written request, and only after discharge of the patient, furnish, in a timely manner, without delays for legal review, to any person admitted therein for care and treatment or treated thereat, or to any such person's guardian, curator, or personal representative, or in the absence of one of those persons, to the next of kin of a decedent or the parent of a minor, or to anyone designated by such person in writing , a true and correct copy of all patient records, including X rays, and insurance information concerning such person, which records are in the possession of the licensed facility, *1083provided the person requesting such records agrees to pay a charge.
(emphasis added).
Pusha's request for Freeman's medical records is deficient under section 395.3025(1) because it does not demonstrate that Pusha and/or Teague were legally authorized to act as Freeman's guardian, curator, or personal representative.2 The request was not accompanied by a copy of Freeman's death certificate, so it was unclear that Teague, who was identified as Freeman's daughter, could request the records as Freeman's next of kin. Instead, the request served to create confusion about the identity of the firm's client(s). On the one hand, the caption of the letter indicated that it was seeking Freeman's records on behalf of its client, Pusha. On the other hand, the enclosed authorization form to release the medical records was signed by Teague, a person not identified in the letter as a client of the firm. Because the request for Freeman's medical records did not include a valid authorization for their release, the request failed to comply with section 395.3025(1), and Shands was prohibited from releasing the records.
The protection for confidential medical records is not provided only by statute; the Florida Constitution also extends additional protections in connection with the right to privacy. Weaver v. Myers , 229 So.3d 1118, 1126 (Fla. 2017) (recognizing that the right to privacy in the Florida Constitution applies to medical records). The supreme court recently held that the right to privacy provides protection for a patient's medical records even after the patient's death:
Death does not retroactively abolish the constitutional protections for privacy that existed at the moment of death. To hold otherwise would be ironic because it would afford greater privacy rights to plaintiffs who survived alleged medical malpractice while depriving plaintiffs of the same protections where the alleged medical malpractice was egregious enough to end the lives of those plaintiffs.
Id. at 1127-28. In light of this strong protection for the confidentiality of medical records under other provisions of Florida law, a hospital cannot be deemed to have failed to comply with section 766.204(2) simply by seeking to verify that the person requesting disclosure of another's confidential medical records is the legal representative of the person whose records have been requested. A contrary rule would allow any person to identify themselves as a "claimant" or the patient's legal representative and thereby demand and receive records from a hospital. Such a rule would undermine Florida's statutory and constitutional protections for the privacy of confidential medical records.
B. HIPAA
But even if Pusha's request for Freeman's medical records was sufficient under section 766.204(1), and complied with Florida's laws protecting the confidentiality of medical records, Shands was also required to comply with HIPAA and could not produce Freeman's confidential medical records without a valid authorization form.
The disclosure of confidential medical records by healthcare providers is heavily regulated by HIPAA. See *1084Murphy v. Dulay , 768 F.3d 1360, 1368-69 (11th Cir. 2014). HIPAA was enacted in recognition of the strong privacy interest a patient has in her personal health information. OPIS Mgmt. Res., LLC v. Sec'y, Fla. Agency for Health Care Admin. , 713 F.3d 1291, 1294-95 (11th Cir. 2013). Subject to certain exceptions not applicable here, HIPAA expressly prohibits the disclosure of medical records without valid written authorization. 45 C.F.R. § 164.508(a)(1). To be valid, the authorization must be completed by someone legally authorized to receive the records. OPIS Mgmt. Res. , 713 F.3d at 1295.
The April 2011 letter does not comply with the requirements of HIPAA. Nothing in the letter identifies Pusha and/or Teague as persons legally authorized to receive the records and no power of attorney was attached. The letter merely asserts that they are Freeman's personal representatives. It is never asserted that Freeman is deceased, and her death certificate was not attached to the letter. Neither Teague nor Pusha had been appointed personal representatives of Freeman's estate. Thus, the authorization form signed by Teague was not valid authorization under HIPAA. 45 C.F.R. § 164.508(c)(1)(vi) ("If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided.").
Pusha brushes away Shands' arguments that it was required to comply with HIPAA before disclosing Freeman's medical records, arguing that the hospital could not be held liable for improper disclosure of medical records pursuant to section 766.204(3), Florida Statutes (2011). That statute contains the following hold harmless provision purporting to release a hospital from civil damages for claims for releasing medical records required by the statute: "A hospital shall not be held liable for any civil damages as a result of complying with this section." But Pusha's argument misses the point. Even if section 766.204(3) could immunize a hospital that improperly released confidential medical records from a lawsuit filed under state law seeking civil damages , nothing in that provision would shield a hospital from federal prosecution if the hospital released the records in violation of HIPAA. See 42 U.S.C. § 1320d-6(b) (authorizing up to ten years' imprisonment for the wrongful disclosure of individually identifiable health information).
Further, to the extent that section 766.204(3) could be construed to permit disclosure of confidential medical records without a valid authorization, it would be preempted by HIPAA. Although HIPAA does not preempt all state laws relating to the privacy of personal health information and medical records, it does preempt those state laws "which are less stringent than HIPAA's privacy protections." Paylan v. Fitzgerald , 223 So.3d 431, 434 (Fla. 2d DCA 2017). An interpretation of section 766.204(3) that would permit disclosure of confidential medical records without a valid authorization necessarily affords less stringent protections to a patient's privacy than does HIPAA.
Under Pusha's construction of section 766.204(3), a hospital would be forced to navigate between Scylla and Charybdis in deciding whether to produce records in a presuit investigation or to comply with state and federal laws governing the privacy of confidential medical records. If the hospital attempted to verify the legal status of the person requesting the medical records, it would forfeit its right to require a potential claimant to seek an expert medical opinion to corroborate her claim. If the hospital produced the medical records without verifying the legal status of the requestor, it could face criminal prosecution under HIPAA. We hold *1085that section 766.204 does not require Shands to face such a dilemma. When a hospital receives a request to produce medical records in a presuit investigation, it may verify the legal status of the person requesting the records to determine whether they are a claimant under section 766.206, and also take those steps necessary to comply with the requirements of HIPAA and state laws limiting disclosure of confidential medical records.
IV. CONCLUSION
The trial court departed from the essential requirements of law when it concluded that Shands was required to produce Freeman's confidential medical records in response to Pusha's incomplete and conflicting requests. Shands did not receive a valid authorization for the release of the records, so it was not required to produce the records. Because Shands did not wholly refuse to produce the records, Pusha was required to obtain a written medical expert opinion corroborating her claim before she filed suit. But because Pusha never obtained such an opinion and the statute of limitations has expired, her complaint must be dismissed with prejudice.3 Accordingly, we grant Shands' petition for writ of certiorari and quash the order below.
GRANTED .
B.L. Thomas, C.J., and M.K. Thomas, J., concur.