Summary
holding a 2009 amendment to HIPAA did not create a right of action
Summary of this case from Hasenbank v. GronnigerOpinion
No. 19-1347
02-14-2020
CASSANDRA FREIER, Plaintiff - Appellant, v. THE STATE OF COLORADO; NORTHEAST HEALTH PARTNERS, LLC; BEACON HEALTH OPTIONS, INC.; DOES 1-100, Defendants - Appellees.
(D.C. No. 1:19-CV-00702-LTB-GPG)
(D. Colo.) ORDER AND JUDGMENT Before LUCERO, PHILLIPS, and EID, Circuit Judges.
After examining the briefs and appellate record, this panel has determined unanimously that oral argument would not materially assist in the determination of this appeal. See Fed. R. App. P. 34(a)(2); 10th Cir. R. 34.1(G). The case is therefore ordered submitted without oral argument. This order and judgment is not binding precedent, except under the doctrines of law of the case, res judicata, and collateral estoppel. It may be cited, however, for its persuasive value consistent with Fed. R. App. P. 32.1 and 10th Cir. R. 32.1.
Cassandra Freier appeals the district court's dismissal of her claim that defendants improperly disclosed her personal health information. Exercising jurisdiction under 28 U.S.C. § 1291, we affirm.
I
After Freier's health insurance company requested her medical files from her healthcare provider to review the claims for payment, Freier sued. She alleged that the request violated the Health Insurance Portability and Accountability Act ("HIPAA"), 42 U.S.C. § 1320d-6, and constituted professional negligence and deceptive business practices. Adopting the magistrate judge's report and recommendation, the district court dismissed Freier's HIPAA claim with prejudice under 28 U.S.C. § 1915(e)(2)(B)(ii). It concluded the claim was legally frivolous because HIPAA does not authorize a private right of action. The court declined to exercise supplemental jurisdiction over Freier's two state-law claims. Freier timely appealed.
II
We review the district court's dismissal under § 1915(e)(2)(B)(ii) de novo, "look[ing] to the specific allegations in the complaint to determine whether they plausibly support a legal claim for relief." Kay v. Bemis, 500 F.3d 1214, 1218 (10th Cir. 2007) (quotation omitted). Our review of the court's dismissal of Freier's state-law claims is for abuse of discretion. See Nielander v. Bd. of Cty. Comm'rs, 582 F.3d 1155, 1172 (10th Cir. 2009). Because Freier proceeds pro se, we "liberally construe [her] pleadings," Requena v. Roberts, 893 F.3d 1195, 1205 (10th Cir. 2018), but "do not assume the role of advocate," Yang v. Archuleta, 525 F.3d 925, 927 n.1 (10th Cir. 2008) (quotation omitted).
As an initial matter, Freier failed to submit timely and specific objections to the magistrate judge's report and recommendation. Parties who do so generally waive appellate review of factual and legal questions. Moore v. United States, 950 F.2d 656, 659 (10th Cir. 1991). This firm-waiver rule does not apply, however, "when (1) a pro se litigant has not been informed of the time period for objecting and the consequences of failing to object, or when (2) the 'interests of justice' require review." Morales-Fernandez v. I.N.S., 418 F.3d 1116, 1119 (10th Cir. 2005). Freier argues that the second exception applies because the district court committed plain error in its interpretation of HIPAA and dismissal of her state-law claims. We hold the district court did not err.
Because the magistrate judge notified Freier that failure to object in writing to the report and recommendation within fourteen days may bar any appeal, the first exception does not apply.
We have previously concluded that HIPAA does not confer a private right of action. Wilkerson v. Shinseki, 606 F.3d 1256, 1267 n.4 (10th Cir. 2010) ("HIPAA does not create a private right of action for alleged disclosures of confidential medical information."). This holding is consistent with those of our sibling circuits to have considered the issue. See Stewart v. Parkview Hosp., 940 F.3d 1013, 1015 (7th Cir. 2019); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Seaton v. Mayberg, 610 F.3d 530, 533 (9th Cir. 2010); Acara v. Banks, 470 F.3d 569, 571 (5th Cir. 2006). "Those courts have reasoned that Congress, by delegating enforcement authority to the Secretary of Health and Human Services, did not intend for HIPAA to include or create a private remedy." Stewart, 940 F.3d at 1015. Moreover, "HIPAA's focus on the conduct of those with access to medical information—as opposed to the rights of individual patients—also weighs against finding an implied private right of action." Id.
Freier argues that Wilkerson is no longer good law following a 2009 amendment to HIPAA, contending that the amended version of § 1320d-6 creates a right of action because it sets forth an "offense." We disagree. The amendment added the following sentence to § 1320d-6:
For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1180(b)(3)) and the individual obtained or disclosed such information without authorization.See Am. Recovery & Reinvestment Act of 2009, Pub. L. No. 111-5, § 13409, 123 Stat. 115, 271 (2009) (codified at § 1320d-6(a)). The amendment merely adds language specifying what constitutes a HIPAA violation. It does not add any "rights-creating language." Boswell v. Skywest Airlines, Inc., 361 F.3d 1263, 1267 (10th Cir. 2004) (citation omitted). And contrary to Freier's argument that the provision creates a private right of action because it sets forth an offense, the use of the word "offense" predates the amendment. See HIPAA, Pub. L. No. 104-191, § 1177, 110 Stat. 1936, 2029 (1996) (codified as amended at § 1320d-6).
The amendment took effect in February 2010, id. § 13423, 123 Stat. at 276, after the events that gave rise to the suit in Wilkerson, 606 F.3d at 1260-61.
Moreover, the amendment provides that state attorneys general, in addition to the Secretary, can enforce HIPAA violations. See Am. Recovery & Reinvestment Act, § 13410(e)(1), 123 Stat. at 274-75 (codified at § 1320d-5(d)). This broadening of enforcement authority underscores Congress' intent to limit HIPAA enforcement as specified in the statute. See Alexander v. Sandoval, 532 U.S. 275, 290 (2001) ("The express provision of one method of enforcing a substantive rule suggests that Congress intended to preclude others."). Thus, the amendment does not change our conclusion that HIPAA does not provide a private right of action for the alleged disclosure of confidential medical information.
Although HIPAA does not provide a private right of action, an individual may file a complaint with the Department of Health and Human Services ("HHS") alleging a HIPAA violation. 45 C.F.R. § 160.306. If HHS finds the complaint meritorious after an investigation, it may refer the case to the Department of Justice for prosecution under HIPAA's criminal provisions; obtain voluntary compliance, corrective action, or a resolution agreement; or issue a formal finding of a violation and impose a civil penalty. § 160.312(a); HHS, Enforcement Process, https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html (last visited Jan. 31, 2020). If civil penalties are imposed, the entity on which they are imposed may request a hearing before an administrative law judge. § 160.504. --------
We also affirm the district court's dismissal of Freier's two state-law claims for lack of jurisdiction. Neither of these claims presents a federal question. Because Freier and defendant Northeast Health Partners are both citizens of Colorado, the case does not satisfy the requirements of diversity jurisdiction. See Grynberg v. Kinder Morgan Energy Partners, L.P., 805 F.3d 901, 905 (10th Cir. 2015) ("Diversity jurisdiction requires complete diversity—no plaintiff may be a citizen of the same state as any defendant."). Given its dismissal of Freier's HIPAA claim, the district court did not abuse its discretion in declining to exercise supplemental jurisdiction over the remaining state-law claims. See Smith v. City of Enid ex rel. Enid City Comm'n, 149 F.3d 1151, 1156 (10th Cir. 1998) ("When all federal claims have been dismissed, the court may, and usually should, decline to exercise jurisdiction over any remaining state claims.").
III
AFFIRMED. Freier's motion to proceed in forma pauperis is GRANTED.
Entered for the Court
Carlos F. Lucero
Circuit Judge