PER CURIAM

[DO NOT PUBLISH] Non-Argument Calendar D.C. Docket No. 1:20-cv-00137-LAG Appeal from the United States District Court for the Middle District of Georgia Before MARTIN, ROSENBAUM, and BRANCH, Circuit Judges. PER CURIAM:

Justin Laster, proceeding pro se, filed a lawsuit alleging the unlawful disclosure of his protected health information. According to Laster's complaint, he suffered an injury in May 2019 while working for the Georgia Department of Corrections ("DOC"). In the months that followed, he sought medical care at various healthcare facilities, and he filed a workers' compensation claim and a release authorizing the disclosure of medical records related to that claim. The DOC contested the claim, and the Georgia Department of Administrative Services denied it in September 2019. At that point, in Laster's view, his medical release terminated. But according to Laster, after the denial of his claim, his medical providers unlawfully disclosed his medical records to a law firm acting on behalf of the State of Georgia and the Department of Administrative Services. It appears that the law firm sought his medical records after he requested a hearing on his workers' compensation claim before an Administrative Law Judge.

Based on these facts, Laster alleged violations of Georgia state law and his federal rights under 18 U.S.C. §§ 241, 245, and 246; the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 42 U.S.C. § 1320d-6; the Public Health Service Act, 42 U.S.C. § 290dd-2, and accompanying regulations, 42 C.F.R. §§ 2.13 and 2.31; and 42 U.S.C. § 1983.

Because Laster requested leave to proceed in forma pauperis, the district court screened Laster's complaint under 28 U.S.C. § 1915(e)(2) and sua sponte dismissed it without prejudice for failure to state a viable claim. The court found that Laster failed to state a claim under Title 18, HIPAA, and the Public Health Service Act because those statutes did not create a private cause of action. As for the § 1983 claims, the court concluded that the defendants were private actors not subject to liability under § 1983. Finally, the court declined to exercise supplemental jurisdiction over the state-law claims. The court gave Laster thirty days to file an amended complaint.

Laster chose to appeal instead of filing an amended complaint. See Briehler v. City of Miami, 926 F.2d 1001, 1002 (11th Cir. 1991) ("[A] plaintiff has the choice either of pursuing a permissive right to amend a complaint after dismissal or of treating the order as final and filing for appeal." (quotation marks omitted)). On appeal, he largely restates his allegations and contends that the defendants are not immune from liability because they are subject to Georgia state law and federal law.

We review de novo the sua sponte dismissal of an action for failure to state a claim, accepting the allegations in the complaint as true. Brown v. Johnson, 387 F.3d 1344, 1347 (11th Cir. 2004). And because Laster is proceeding pro se, we liberally construe his filings. See Erickson v. Pardus, 551 U.S. 89, 94 (2007).

Dismissal for failure to state a claim under 28 U.S.C. § 1915(e)(2) is governed by the same standard as dismissal for failure to state a claim under Rule 12(b)(6), Fed. R. Civ. P. Mitchell v. Farcass, 112 F.3d 1483, 1490 (11th Cir. 1997). To survive a motion to dismiss under Rule 12(b)(6), the complaint must "contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Am. Dental Ass'n v. Cigna Corp., 605 F.3d 1283, 1289 (11th Cir. 2010) (quotation marks omitted). That means the complaint's factual allegations, accepted as true, "must be enough to raise a right to relief above the speculative level." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007).

Here, the district court correctly dismissed Laster's claims under Title 18, the Public Health Service Act, and HIPAA because these statutes do not create private rights of action. "[P]rivate rights of action to enforce federal law must be created by Congress." Alexander v. Sandoval, 532 U.S. 275, 286 (2001). The critical question is whether the statute "displays an intent to create not just a private right but also a private remedy." Id. Without such Congressional intent, "a cause of action does not exist and courts may not create one, no matter how desirable that might be as a policy matter, or how compatible with the statute." Id. at 286-87.

For starters, Laster cannot rely on 18 U.S.C. §§ 241, 245, and 246 because these sections pertain to criminal law and do not provide a civil cause of action or any civil remedies. See Hanna v. Home Ins. Co., 281 F.2d 298, 303 (5th Cir. 1960) ("The sections of Title 18 may be disregarded in this suit. They are criminal in nature and provide no civil remedies).

Nor is a private right of action created by 42 U.S.C. § 290dd-2, under which 42 C.F.R. §§ 2.13 and 2.31 were promulgated. Section 290dd-2 limits the disclosure of records of substance-abuse programs and provides for criminal penalties for those who violate the act. But nothing in the language of that statute "suggests that Congress intended to create a private right of action for violations of the confidentiality provision." Ellison v. Cocke Cnty., Tenn., 63 F.3d 467, 470 (6th Cir. 1995). Rather, the language reflects that "Congress intended the statute to be enforced through the imposition of criminal penalties." Id.; see also Doe v. Broderick, 225 F.3d 440, 446-49 (4th Cir. 2000) (holding that § 290dd-2 does not create a federally-enforceable private right); Chapa v. Adams, 168 F.3d 1036, 1038 (7th Cir. 1999) (holding that § 290dd-2 does not create a private cause of action for damages).

Likewise, every circuit to have considered the issue has also held that no private right of action exists under HIPAA. See Meadows v. United Servs., Inc., 963 F.3d 240, 244 (2d Cir. 2020); Faber v. Ciox Health, LLC, 944 F.3d 593, 596-97 (6th Cir. 2019); Stewart v. Parkview Hosp., 940 F.3d 1013, 1015 (7th Cir. 2019); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Wilkerson v. Shinseki, 606 F.3d 1256, 1267 n.4 (10th Cir. 2010); United States v. Streich, 560 F.3d 926, 935 (9th Cir. 2009); Acara v. Banks, 470 F.3d 569, 570-71 (5th Cir. 2006). HIPAA generally prohibits the disclosure of medical records without a patient's consent. See 42 U.S.C. §§ 1320d-1 to 1320d-7. While it provides civil penalties for improper disclosures of medical information, it does not expressly create a private cause of action to enforce the prohibition on disclosure. Instead, it limits enforcement of the statute to the Secretary of the Department of Health and Human Services. See 42 U.S.C. § 1320d-5. For that reason, no private right of action can be implied. "By delegating enforcement authority to the Secretary of the Department of Health and Human Services, the statute clearly reflects that Congress did not intend for HIPAA to create a private remedy." Meadows, 963 F.3d at 244; see Alexander, 532 U.S. at 290 ("The express provision of one method of enforcing a substantive rule suggests that Congress intended to preclude others."). Accordingly, Laster cannot state a claim to relief under HIPAA.

We also affirm the district court's dismissal of Laster's § 1983 claims for violations of his rights under the Fourteenth Amendment. Section 1983 allows claims against any person who, acting under color of state law, deprives another of a constitutional or federal statutory right. 42 U.S.C. § 1983.

To establish a § 1983 claim, the plaintiff must show that he was (1) deprived of a federal right (b) by a "state actor." Harvey v. Harvey, 949 F.2d 1127, 1130 (11th Cir. 1992). "Only in rare circumstances can a private party be viewed as a 'state actor' for section 1983 purposes." Id. To be considered a state actor for purposes of § 1983, a private party must have exercised a traditionally exclusive public function, acted in concert with public officials, or engaged in conduct compelled by the state. Id. at 1130-31; see Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d 1263, 1277 (11th Cir. 2003); Bendiburg v. Dempsey, 909 F.2d 463, 468 (11th Cir. 1990).

The district court concluded that the defendants were private parties who could not be considered "state actors" based on the allegations in Laster's complaint. Laster responds that the defendants are subject to suit under § 1983 "because they are for profit corporations, non-profit corporations, limited liability corporations, limited liability partnerships, etc. and are subject to Georgia State Law and United States Federal Law as private individuals are." But that the defendants are regulated by and subject to state and federal law is not enough on its own to show that they acted "under color of law"—that is, that their conduct "may be fairly treated as that of the State itself." See Jackson v. Metro. Edison Co., 419 U.S. 345, 350-51 (1974) ("The mere fact that a business is subject to state regulation does not by itself convert its action into that of the State for purposes of the Fourteenth Amendment."). Accordingly, we affirm the district court's conclusion that Laster failed to plausibly establish that he was harmed by a "state actor" subject to suit under § 1983.

Finally, the district court did not abuse its discretion by declining to exercise supplemental jurisdiction over Laster's state-law claims after dismissing all his federal claims early in the case. See Parker v. Scrap Metal Processors, Inc., 468 F.3d 733, 738 (11th Cir. 2006) ("We review the district court's decision not to exercise supplemental jurisdiction for abuse of discretion."). A district court has "supplemental jurisdiction" over state-law claims that are closely related to a claim over which the court has original jurisdiction. 28 U.S.C. § 1367(a). But the court may decline to exercise supplemental jurisdiction if it "has dismissed all claims over which it has original jurisdiction." Id. § 1367(c).

Here, the district court properly declined to exercise supplemental jurisdiction over Laster's state-law claims. Laster does not suggest any independent basis for exercising federal jurisdiction over the state-law claims, and "[w]e have encouraged district courts to dismiss any remaining state claims when, as here, the federal claims have been dismissed prior to trial." Raney v. Allstate Ins. Co., 370 F.3d 1086, 1088-89 (11th Cir. 2004). Accordingly, the district court did not abuse its discretion in declining to exercise supplemental jurisdiction over the remaining claims.

AFFIRMED.