MURPHY, Circuit Judge.

Scott Michelman, Public Citizen Litigation Group, Washington, D.C. (Taylor B. Ayres, Ayres Law Firm, Draper, Utah; Scott C. Borison, Legg Law Firm LLC, San Mateo, California; and Scott L. Nelson, Public Citizen Litigation Group, Washington, D.C., with him on the briefs), for Appellants.

J. Michael Hansen, Nelson Jones, PLLC, Sandy, Utah (David C. Richards and Sarah Elizabeth Spencer, Christensen & Jensen, P.C., Salt Lake City, Utah, with him on the brief), for Appellees.

Nathan Freed Wessler, American Civil Liberties Union Foundation, New York, New York; Leah Farrell and John Mejia, ACLU of Utah Foundation, Inc., Salt Lake City Utah; Mark Silverstein and Sara R. Neel, American Civil Liberties Union Foundation of Colorado, Denver, Colorado; Stephen Douglas Bonney, ACLU Foundation of Kansas, Overland Park, Kansas; Alexandra Freedman Smith, ACLU of New Mexico Foundation, Albuquerque, New Mexico; Brady R. Henderson, ACLU of Oklahoma Foundation, Oklahoma City, Oklahoma; and Courtney A. Bowie, American Civil Liberties Union of Wyoming, Cheyenne, Wyoming, on the brief for Amici Curiae in support of Appellants.

Before BRISCOE, MURPHY, and PHILLIPS, Circuit Judges.

MURPHY, Circuit Judge.

I. Introduction

After Detective James Woods accessed a state database containing the prescription drug records of Plaintiffs Ryan Pyle and Marlon Jones, Pyle and Jones brought separate lawsuits pursuant to 42 U.S.C. § 1983, each challenging Defendants' conduct as violative of the Fourth Amendment and the Fair Credit Reporting Act ("FCRA"). In both suits, the district court dismissed the claims against Defendant Woods, concluding Woods was entitled to qualified immunity because the law governing warrantless access to prescription drug information by law enforcement was not clearly established. The district court also dismissed the FCRA claims because Defendants' actions fit within an exemption set out in the Act.

In Jones's suit, the district court dismissed the constitutional claims against the city of Cottonwood Heights with prejudice because Jones's complaint failed to state a claim for municipal liability plausible on its face. In Pyle's suit, the district court dismissed the constitutional claims against Cottonwood Heights without prejudice, concluding Pyle failed to notify the Utah Attorney General of those claims as required by Rule 5.1 of the Federal Rules of Civil Procedure.

Pyle and Jones each appealed. Exercising jurisdiction pursuant to 28 U.S.C. § 1291, we affirm the district court's judgments.

II. Factual Background

The Utah Controlled Substance Database (the "Database") was created in 1995 pursuant to the Utah Controlled Substance Database Act (the "Database Act"). Utah Code Ann. §§ 58-37f-101, -201. The Database is administered by the Utah Department of Occupational and Professional Licensing ("DOPL") and contains data "regarding every prescription for a controlled substance dispensed in the state [of Utah] to any individual other than an inpatient in a licensed health care facility." Id . § 201(5). At the time of the events giving rise to this appeal, the Database Act permitted "local law enforcement authorities" to access the Database without a warrant. Id . § 58-37f-301(2)(i) (2013).

Defendant James Woods is a detective in the Cottonwood Heights Police Department. In April 2013, Woods was informed by Utah's Unified Fire Authority ("UFA") that medications, including opioids and sedatives, were missing from several UFA ambulances. Detective Woods received a list of 480 UFA employees with access to the ambulances from Robbie Russo, the Cottonwood Heights Chief of Police. Russo had obtained the list from Defendant Kelvyn Cullimore, the Mayor of Cottonwood Heights. Detective Woods accessed the Database and searched the prescription drug records of 480 UFA employees in an effort to "develop suspect leads of those who have the appearance of Opioid dependencies." Consistent with Utah law at the time, Woods did not obtain a search warrant before accessing the Database. Based on the information Woods obtained from the Database search, he developed suspicions about Plaintiffs Pyle and Jones. Neither Plaintiff, however, was ever prosecuted for the thefts from the ambulances.

Pyle and Jones filed separate, but substantially similar, suits against Detective Woods, Mayor Cullimore, and the city of Cottonwood Heights, alleging, inter alia , violations of their Fourth Amendment rights because Woods did not obtain a search warrant before accessing the Database. Plaintiffs also alleged violations of the FCRA. Defendants filed motions to dismiss both matters, arguing, inter alia , (1) Plaintiffs' constitutional rights were not violated, (2) the individual defendants were entitled to qualified immunity, and (3) the FCRA does not prohibit a search of the Database under the facts at issue.

Defendants' motion to dismiss was granted in the Pyle matter. As to Pyle's Fourth Amendment claims against Woods and Cullimore, the district court concluded those defendants were entitled to qualified immunity because the law on the constitutionality of a warrantless search of the Database was not clearly established. The court dismissed Pyle's municipal liability claim against the city of Cottonwood Heights without prejudice, concluding the claim implicated the constitutionality of the Database Act and Pyle failed to notify the Utah Attorney General of the claim, as required by Rule 5.1(a)(1) of the Federal Rules of Civil Procedure. Finally, the district court dismissed the FCRA claim because Defendants' conduct fell within an exception to the definition of "consumer report."

Defendants' motion to dismiss Jones's lawsuit was also granted. As in the Pyle matter, the district court concluded Detective Woods and Mayor Cullimore were entitled to qualified immunity because the constitutional right at issue was not clearly established. The court dismissed the municipal liability claim against the city of Cottonwood Heights on the ground that Jones did not identify any municipal policy or show a link between a policy or custom and any injury caused by the alleged Fourth Amendment violation. The district court concluded Defendants' actions were exempt under the FCRA and dismissed that claim also.

The two cases have been consolidated for purposes of appeal. Neither Plaintiff appeals from the dismissal of the Fourth Amendment claims against Mayor Cullimore.

III. Discussion

A. Qualified Immunity

Qualified immunity is a defense that shields "governmental officials performing discretionary functions ... from liability for civil damages insofar as their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known." Harlow v. Fitzgerald , 457 U.S. 800, 818, 102 S.Ct. 2727, 73 L.Ed.2d 396 (1982). Detective Woods raised a qualified immunity defense to the Fourth Amendment claims asserted against him by Pyle and Jones and sought dismissal of the claims. "When a defendant raises a claim of qualified immunity, the burden shifts to the plaintiff to show that the defendant is not entitled to that immunity." Douglas v. Dobbs , 419 F.3d 1097, 1100 (10th Cir. 2005).

The qualified immunity test is a two-part inquiry involving the questions of whether the defendant violated the constitutional rights of the plaintiff and whether such rights were clearly established at the time of the defendant's conduct. Pearson v. Callahan , 555 U.S. 223, 232, 236, 129 S.Ct. 808, 172 L.Ed.2d 565 (2009). In each case, the district court addressed only the second prong, concluding the constitutionality of a warrantless search of a prescription drug database was not clearly established and, thus, Woods was entitled to qualified immunity. This court has the discretion to determine "which of the two prongs of the qualified immunity analysis should be addressed first in light of the circumstances in the particular case at hand." Id . at 236, 129 S.Ct. 808. The matters before this court involve a situation "in which it is plain that a constitutional right is not clearly established but far from obvious whether in fact there is such a right." Id . at 237, 129 S.Ct. 808. Accordingly, under the circumstances, we will also address only the second prong of the qualified immunity test.

Whether a constitutional right is clearly established is a question of law which we review de novo. Johnson v. Martin , 195 F.3d 1208, 1215-16 (10th Cir. 1999). Our analysis focuses on whether, at the time of the incident, "every reasonable official would have understood that what he is doing violates" the constitutional right at issue. Reichle v. Howards , 566 U.S. 658, 132 S.Ct. 2088, 2093, 182 L.Ed.2d 985 (2012) (quotations and alteration omitted). A reasonable official possesses this understanding if "courts have previously ruled that materially similar conduct was unconstitutional, or if a general constitutional rule already identified in the decisional law applies with obvious clarity to the specific conduct at issue." Buck v. City of Albuquerque , 549 F.3d 1269, 1290 (10th Cir. 2008) (quotation and alternation omitted). To resolve the question, therefore, we must determine whether "a Supreme Court or Tenth Circuit decision on point, or the clearly established weight of authority from other courts ... have found the law to be as the plaintiff maintains." Clark v. Wilson , 625 F.3d 686, 690 (10th Cir. 2010) (quotation omitted). The law is not clearly established unless this precedent "place[s] the statutory or constitutional question beyond debate." Ashcroft v. al-Kidd , 563 U.S. 731, 741, 131 S.Ct. 2074, 179 L.Ed.2d 1149 (2011).

"The touchstone of Fourth Amendment analysis is whether a person has a constitutionally protected reasonable expectation of privacy." California v. Ciraolo , 476 U.S. 207, 211, 106 S.Ct. 1809, 90 L.Ed.2d 210 (1986) (quotation omitted). Both Plaintiffs assert they had a reasonable expectation of privacy in their prescription drug records and, thus, the warrantless search of the Database conducted by Detective Woods necessarily violated their Fourth Amendment rights. According to Plaintiffs, the issue of whether they had a reasonable expectation of privacy is beyond debate because it was definitively decided by this court in Douglas. 419 F.3d at 1099.

In Douglas , the plaintiff brought suit under 42 U.S.C. § 1983, alleging her civil rights were violated when defendants conducted a search of her pharmacy records pursuant to a warrant issued by a magistrate. Id . at 1099–1100. The Douglas plaintiff claimed the Assistant District Attorney violated her Fourth Amendment rights "by authorizing the submission of the Motion and proposed Order to the magistrate judge to obtain approval" to conduct the search. Id . at 1100. Relying on the Supreme Court's opinion in Whalen v. Roe , this court held that the right to privacy protecting the disclosure of medical information extended to an individual's prescription drug records. Id . at 1102 ; see also Whalen v. Roe , 429 U.S. 589, 599–600, 97 S.Ct. 869, 51 L.Ed.2d 64 (1977) (considering whether a state's assembling of prescription information into a database violated the privacy rights of doctors and patients). The Douglas court, however, made it clear that a plaintiff alleging a Fourth Amendment violation is not entitled to relief "merely upon identifying an abstract right to privacy protected by the Fourth Amendment." Douglas , 419 F.3d at 1103. A plaintiff must also show that the defendant's actions violated the right at issue. Id . at 1102-03.

Here, Plaintiffs allege Detective Woods violated their Fourth Amendment rights by searching the Database for their prescription drug information without a warrant. Plaintiffs concede that this court has never directly addressed whether a warrantless search by law enforcement of a patient's prescription records in a state database violates the Fourth Amendment but they are correct that "a case directly on point" is not required. Al-Kidd , 563 U.S. at 741, 131 S.Ct. 2074. Plaintiffs must only identify existing precedent that "place[s] the ... constitutional question beyond debate." Id . They assert two legal propositions, taken together, provided a clear answer to the Fourth Amendment question at the time Woods conducted the warrantless search of the Database, namely: (1) individuals have a constitutionally protected privacy right in their prescription drug records and (2) warrantless searches violate the Fourth Amendment absent an exception. This argument is unavailing.

In Douglas , this court stated that any right to privacy in prescription drug records "is not absolute ... as it is well settled that the State has broad police powers in regulating the administration of drugs by the health professions." 419 F.3d at 1102 n.3 (quotation omitted). It is uncontested that Detective Woods accessed the Database as part of an investigation into the theft of narcotics from UFA vehicles. More than ten years ago, this court recognized that "[w]hether a warrant is required to conduct an investigatory search of prescription records ... is an issue that has not been settled." Id . at 1103. Because, as we have held, the right to privacy in prescription drug records is not absolute, Plaintiffs' two-part paradigm does not provide an answer to the constitutional question. Instead, resolution of the issue will involve a determination of the scope of the constitutionally protected privacy right. At the time Detective Woods accessed the Database to search Plaintiffs' records, no court had conducted the necessary analysis and no judicial opinion held that a warrantless search of a prescription drug database by state law enforcement officials is unconstitutional.

Our precedent makes clear that any right to privacy in prescription drug records is not absolute under the circumstances present here. Neither Plaintiffs' two-part paradigm nor existing precedent places the Fourth Amendment question beyond debate. Accordingly, Plaintiffs cannot show Detective Woods acted contrary to clearly established law and Woods is entitled to qualified immunity on the claim he violated Plaintiffs' Fourth Amendment rights by accessing the Database without a warrant.

B. Municipal Liability

Qualified immunity is not available as a defense to municipal liability. Owen v. City of Independence , 445 U.S. 622, 637-38, 100 S.Ct. 1398, 63 L.Ed.2d 673 (1980) ; Mocek v. City of Albuquerque , 813 F.3d 912, 933 (10th Cir. 2015). Thus, our conclusion the law was not clearly established at the time Detective Woods accessed the Database without a warrant does not resolve the claims against the city of Cottonwood Heights. Those claims were resolved in two different ways by the two different district court judges.

In the Pyle matter, the district court refused to address the issue of whether Cottonwood Heights violated Pyle's constitutional rights. The court, instead, dismissed the claims without prejudice because Pyle failed to notify the Utah Attorney General of the lawsuit as required by Rule 5.1 of the Federal Rules of Civil Procedure.

Rule 5.1 requires a party "drawing into question the constitutionality of a ... state statute" to "promptly" notify the state attorney general of the lawsuit and the question raised. Fed. R. Civ. P. 5.1(a)(2). Pyle argues he was not required to file a Rule 5.1 notice because he is only challenging the actions of the Defendants, not the constitutionality of the Database Act. The district court considered and rejected this argument, noting that allegations in Pyle's complaint and arguments he made in opposition to Defendants' Rule 12(b)(6) motion left "no doubt" Pyle was challenging the constitutionality of the Database Act. The district court is correct. Because Detective Woods acted in reliance on the Database Act when he accessed the Database without a warrant, if his actions are unconstitutional then the Database Act, which permitted him to do so, is also unconstitutional. Accordingly, Pyle was required by Rule 5.1 to notify the Utah Attorney General of his lawsuit and the district court did not err by dismissing his claims against Cottonwood Heights without prejudice.

Jones filed the required Rule 5.1 notice on October 29, 2015, two months after briefing was completed on Defendants' Rule 12(b)(6) motion to dismiss. Rule 5.1(c) requires that a district court give a state attorney general sixty days to intervene in the matter before "enter[ing] a final judgment holding the statute unconstitutional." Fed. R. Civ. P. 5.1(c). If the court "reject[s] the constitutional challenge," however, it may act within the sixty-day period. Id . Here, the Utah Attorney General received the Rule 5.1 notice via certified mail on November 9, 2015, less than one week before the district court ruled on Defendants' motion to dismiss. Cottonwood Heights argues the notice was not "promptly" filed, as required by Rule 5.1(a). Any delay in filing the Rule 5.1 notice, however, did not hinder Utah's ability to defend the statute at that time because the district court granted the motion to dismiss, concluding the allegations in Jones's complaint did not satisfy the pleading requirements for municipal liability.

On appeal, Jones challenges the dismissal of his municipal liability claims with prejudice, arguing the dismissal can be affirmed only if it is both "patently obvious" that he cannot prevail on the allegations contained in the complaint and that amendment of the complaint would be futile. See McKinney v. Okla. Dep't of Human Servs. , 925 F.2d 363, 366 (10th Cir. 1991). "[A] complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ " Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id ."Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements" are not sufficient to state a claim for relief. Id .

Municipalities can be liable under 42 U.S.C. § 1983 only for their own unlawful acts. Connick v. Thompson , 563 U.S. 51, 60, 131 S.Ct. 1350, 179 L.Ed.2d 417 (2011). Accordingly, to prove a § 1983 claim against a municipality, a plaintiff must show the existence of a municipal policy or custom which directly caused the alleged injury. City of Canton v. Harris , 489 U.S. 378, 385, 109 S.Ct. 1197, 103 L.Ed.2d 412 (1989). A policy or custom includes a formal regulation or policy statement, an informal custom that amounts to a widespread practice, decisions of municipal employees with final policymaking authority, ratification by final policymakers of the decisions of subordinates to whom authority was delegated, and the deliberately indifferent failure to adequately train or supervise employees. Brammer-Hoelter v. Twin Peaks Charter Academy , 602 F.3d 1175, 1189 (10th Cir. 2010).

Here, the district court concluded Jones's complaint failed to adequately allege either a municipal policy, or a link between a policy or custom and the alleged injury. Jones argues his complaint is sufficient because it contains an allegation it was the policy of Cottonwood Heights to query employees' prescription drug records without a warrant. It is true Jones's complaint does so allege, but this allegation is the type of "formulaic recitation of the elements of a cause of action" that is insufficient to meet the Twombly pleading standard. 550 U.S. at 555, 127 S.Ct. 1955.

Jones's complaint contains insufficient factual allegations to support an inference that Detective Woods was following a policy or custom when he accessed Jones's information in the Database. Jones's assertion Chief Russo and Mayor Cullimore were personally involved in supplying the list of UFA employees to Woods is unavailing because the complaint does not allege that those acts, or any other acts Chief Russo or Mayor Cullimore purportedly took in relation to Detective Woods's search of the Database, were taken pursuant to a policy or custom. Accordingly, we agree with the district court that Jones's complaint does not contain factual allegations sufficient to support a plausible inference that a municipal policy directly caused the injuries Jones allegedly suffered.

Jones is correct that the district court sua sponte dismissed his claims against Cottonwood Heights as inadequately pled without first giving him an opportunity to amend the complaint. He asks this court to remand the matter to the district court so he may be given that opportunity. We deny the request.

After the district court issued its memorandum decision but before judgment was entered, Jones had an opportunity to file a motion seeking to amend his complaint to clarify his factual allegations against Cottonwood Heights. See Fed. R. Civ. P. 15(a)(2) (providing a party may move to amend his complaint at any time before judgment is entered); Ideal Steel Supply Corp. v. Anza , 652 F.3d 310, 325 (2nd Cir. 2011) ("Prior to trial, after the time to amend as of right has passed, the court should freely give leave to amend when justice so requires...." (quotation and alterations omitted)). Jones, however, did not file a Rule 15(a)(2) motion. Instead, he filed a notice of appeal, presumably choosing to stand on his complaint rather than amend it. As we have concluded, that litigation strategy has not produced the result Jones hoped for. The courts of appeals are not second-chance forums where litigants, whose appellate arguments are deemed unavailing, are given the opportunity to relitigate their cases in ways previously available to them. Jones's request for a remand to provide him an opportunity to amend his complaint is denied because, rather than seek that relief from the district court when it was available to him, he instead chose to appeal the dismissal of his original complaint.

C. The Fair Credit Reporting Act

In addition to their constitutional claims, Jones and Pyle alleged Defendants violated their rights under the FCRA. Both Plaintiffs asserted Defendants' actions failed to comply with the requirements of 15 U.S.C. § 1681b, which permits a consumer reporting agency to furnish a consumer report only under specifically delineated circumstances. The district court assumed, without deciding, that the DOPL is a consumer reporting agency and the information in the Database is a consumer report. It nevertheless dismissed the FCRA causes of action for failure to state a claim, concluding the communications from the Database were exempt under the Database Act because they were made in connection with an investigation of suspected misconduct relating to employment. See 15 U.S.C. § 1681a(y)(1)(B)(ii).

On appeal, Plaintiffs argue the 15 U.S.C. § 1681a(y) exception is inapplicable because the term "investigation" as used in that section should be read to incorporate a requirement of individualized suspicion. They assert any investigation must involve a preexisting suspicion of a particular individual. This argument finds no support in either the FCRA or the case law. And Plaintiffs' "fishing expedition" argument rings hollow in this situation where Detective Woods narrowed his search to those UFA employees who had access to the ambulances from which the drugs were stolen. Accordingly, we can find no reversible error in the district court's dismissal of Plaintiffs' FCRA claims and that dismissal is affirmed for substantially the reasons stated by the court in its orders dated October 1, 2015, and November 16, 2015.

IV. Conclusion

In Pyle's appeal (Appeal No. 15-4163), the district court's October 2, 2015, judgment granting qualified immunity to Detective Woods, dismissing the Fourth Amendment claims against Cottonwood Heights without prejudice, and dismissing the FCRA claims with prejudice is affirmed. In Jones's appeal (Appeal No. 15-4187), the district court's December 16, 2015, judgment granting qualified immunity to Detective Woods, dismissing the Fourth Amendment claims against Cottonwood Heights for failure to state a claim, and dismissing the FCRA claims with prejudice is also affirmed.