Opinion
Civil Action No. 3:11-CV-00533-L
02-18-2014
AARON KOBIE BABATU, formerly known as Aaron Anthony Sheppard, Plaintiff, v. DALLAS VETERANS AFFAIRS MEDICAL CENTER and REBEAKH JACKSON, Defendants.
MEMORANDUM OPINION AND ORDER
Before the court is Defendant Dallas Veterans Affairs Medical Center's Motion for Summary Judgment (Doc. 44), filed June 17, 2013. After considering the motion, response, reply, summary judgment evidence, record, and applicable law, the court denies Defendant Dallas Veterans Affairs Medical Center's Motion for Summary Judgment (Doc. 44) but sua sponte dismisses with prejudice Plaintiff's privacy claim against Defendant Dallas Veterans Affairs Medical Center under the Texas Occupations Code for lack of subject matter jurisdiction.
I. Factual and Procedural Background
Plaintiff Aaron Kobie Babatu ("Plaintiff" or "Babatu"), formerly known as Aaron Kobie Sheppard, originally brought this action against the Dallas Veterans Affairs Medical Center ("DVAMC") and Rebeakh Jackson ("Jackson") on February 16, 2011, in the 298th District Court, Dallas County, Texas. After the case was removed to federal court, Plaintiff filed an Amended Complaint ("Complaint") alleging claims against DVAMC for disclosure violations under the Privacy Act of 1974 ("Privacy Act" or "Act"), 5 U.S.C. § 552a(b), and section 159.009(b) of the Texas Occupations Code. The Complaint also includes Texas common law claims against Jackson for invasion of privacy by intentional intrusion on seclusion, invasion of privacy by public disclosure of private facts, and intentional infliction of emotional distress. Plaintiff states in his Complaint that his claim for intentional infliction of emotional distress "is brought in the alternative in the event that there is no other claim available against Defendant Jackson for her actions." Pl.'s Am. Compl. 11.
The basis for Babatu's privacy claims against DVAMC is that his private information contained in DVAMC's computer database and Patient Inquiry Menu ("PIM") was accessed, viewed, and disclosed by Jackson to DVAMC police officers although Jackson and the DVAMC police officers did not need the information, including information regarding his participation in drug treatment, to perform their job duties. Babatu alleges that, as a result of Jackson's accessing his records, he has:
suffered both emotional and economic damage. To this day Plaintiff is depressed, paranoid, and anxious about who might know confidential information about him and what they might do with that information. Additionally, Plaintiff was forced to withdraw from the DVAMC work study program as a result of Defendants['] actions, and this incident has impaired Plaintiffs' ability to find permanent, full-time employment.Id. 5.
On June 17, 2013, DVAMC moved for summary judgment on Babatu's two privacy claims against it under the Privacy Act and the Texas Occupations Code. No dispositive motion was filed by Jackson, who is represented by separate counsel. The court's analysis is therefore limited to the factual and legal issues that are relevant to and dispositive of DVAMC's summary judgment motion.
II. Summary Judgment Standard
Summary judgment shall be granted when the record shows that there is no genuine dispute as to any material fact and that the moving party is entitled to judgment as a matter of law. Fed. R. Civ. P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317, 323-25 (1986); Ragas v. Tennessee Gas Pipeline Co., 136 F.3d 455, 458 (5th Cir. 1998). A dispute regarding a material fact is "genuine" if the evidence is such that a reasonable jury could return a verdict in favor of the nonmoving party. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). When ruling on a motion for summary judgment, the court is required to view all facts and inferences in the light most favorable to the nonmoving party and resolve all disputed facts in favor of the nonmoving party. Boudreaux v. Swift Transp. Co., Inc., 402 F.3d 536, 540 (5th Cir. 2005). Further, a court "may not make credibility determinations or weigh the evidence" in ruling on a motion for summary judgment. Reeves v. Sanderson Plumbing Prods., Inc., 530 U.S. 133, 150 (2000); Anderson, 477 U.S. at 254-55.
Once the moving party has made an initial showing that there is no evidence to support the nonmoving party's case, the party opposing the motion must come forward with competent summary judgment evidence of the existence of a genuine dispute of material fact. Matsushita Elec. Indus. Co. v. Zenith Radio, 475 U.S. 574, 586 (1986). On the other hand, "if the movant bears the burden of proof on an issue, either because he is the plaintiff or as a defendant he is asserting an affirmative defense, he must establish beyond peradventure all of the essential elements of the claim or defense to warrant judgment in his favor." Fontenot v. Upjohn Co., 780 F.2d 1190, 1194 (5th Cir. 1986) (emphasis in original). "[When] the record taken as a whole could not lead a rational trier of fact to find for the nonmoving party, there is no 'genuine [dispute] for trial.'" Matsushita Elec. Indus. Co., 475 U.S. at 587 (citation omitted). Mere conclusory allegations are not competent summary judgment evidence, and thus are insufficient to defeat a motion for summary judgment. Eason v. Thaler, 73 F.3d 1322, 1325 (5th Cir. 1996). Unsubstantiated assertions, improbable inferences, and unsupported speculation are not competent summary judgment evidence. See Forsyth v. Barr, 19 F.3d 1527, 1533 (5th Cir.), cert. denied, 513 U.S. 871 (1994).
The party opposing summary judgment is required to identify specific evidence in the record and to articulate the precise manner in which that evidence supports his or her claim. Ragas, 136 F.3d at 458. Rule 56 does not impose a duty on the court to "sift through the record in search of evidence" to support the nonmovant's opposition to the motion for summary judgment. Id.; see also Skotak v. Tenneco Resins, Inc., 953 F.2d 909, 915-16 & n.7 (5th Cir.), cert. denied, 506 U.S. 832 (1992). "Only disputes over facts that might affect the outcome of the suit under the governing laws will properly preclude the entry of summary judgment." Anderson, 477 U.S. at 248. Disputed fact issues that are "irrelevant and unnecessary" will not be considered by a court in ruling on a summary judgment motion. Id. If the nonmoving party fails to make a showing sufficient to establish the existence of an element essential to its case and on which it will bear the burden of proof at trial, summary judgment must be granted. Celotex, 477 U.S. at 322-23. III. Undisputed Facts
Unless otherwise stated, the facts set forth herein are undisputed.
Babatu is a United States veteran who obtained medical treatment at DVAMC and was a patient at DVAMC at the time of events that gave rise to this lawsuit. From October 2007 to February 2009, Babatu participated in a work-study program and worked as a volunteer at DVAMC. At the time of the events that gave rise to this litigation, Jackson was employed by DVAMC's police department as a communications operator. In this position, Jackson acted as a police dispatcher and had a number of duties, including receiving and screening all routine and emergency phone calls requesting police assistance or service and directing calls to the appropriate office, ward, or patient's room. Pl.'s App. 231-33. Jackson was required to immediately advise her shift supervisor of any "non-routine and recurring problems that develop[ed] during the tour of duty and require[d] police attention." Id. at 233. In addition, Jackson provided support to DVAMC's Police Service and Medical Center by retrieving and furnishing patient or personnel information in DVAMC's computer database when requested by DVAMC police officers in the performance of their job duties. As a communications operator or police dispatcher, Jackson's computer access to patient information was limited to basic information that could be retrieved via the PIM, including a patient's name, next of kin, demographic information, address, social security number, and current appointments with physicians. The PIM also includes codes to identify, for example, whether a particular patient was a participant in a drug treatment program, as well as brief flags such as "Call VA police, escort necessary, violent tendencies." Pl.'s App. 54. The PIM, however, does not provide DVAMC employees with the ability to access and view sensitive patient medical records. On, December 5, 2008, Jackson used the PIM during a work shift to access and view information about Babatu in the PIM.
The court's brief summary of Jackson's duties as a communications operator merely highlights some of the pertinent duties of a DVAMC communications operator or police dispatcher. The parties do not discuss at any length the duties of a DVAMC communications operator; however, the full job description for this position is included in Plaintiff's Appendix at pages 213 to 233.
In November 2008, approximately one month before Jackson accessed and viewed information regarding Babatu in the PIM, Jackson and Babatu met at a dinner party given by Don Lewis. Babatu asserts that he and Jackson developed a social relationship beginning in November 2008 and dated. Pl.'s Am. Compl. 2; Pl.'s App. 353, 356. Jackson, on the other hand, maintains that Babatu attempted to develop a personal relationship with her but that she repeatedly rejected his sexual advances, which according to Jackson, were unwelcome, annoying, and harassing.
Regardless of the nature of their relationship, it apparently ended after Babatu and Jackson exchanged the following text messages on February 17, 2009, which led Babatu to believe that Jackson had not only accessed his confidential information in DVAMC's database but also disclosed the information to some of her friends in DVAMC's police department:
Based on information provided by Babatu, Dr. Ignacio Valdes reached the conclusion that the relationship between Babatu and Jackson "apparently ended when Ms. Jackson accessed Mr. Babatu's medical record and found details about his personal life that included treatment for drug use." Pl.'s App. 356.
Jackson: u a time of day. Then u act a fool over $2.00 man forget u. "Ms. Beakh"Pl.'s App. 246-49.
Babatu: THIS IS KOBIE WHAT R U TALKING ABOUT BABYGIRL?:-(
Jackson: Take my number out of your phone. Don't ever call me again or come my way. "Ms. Beakh"
Babatu: WHO THE HECK R U TALKING TO? THIS IS KOBIE FROM THE VA. I have not called you in sometime. WHAT IS GOING ON YOU?;-)
Jackson: Don't send me another text. I didn't want to hear from u back then and don't want hear from u now. No respond needed. "Ms. Beakh"
Babatu: MS. Beca u r off the beam baby
Jackson: Call my phone again, and I will tell my DPD friend about you. "Ms. Beakh"
Babatu: TELL WHO U WANT. I have all the text messages u sent me. I THINK U NEED TO GO SEE A PSYCHIATRIST OR SPIRITUAL ADVISOR. I will also alert don and his wife.
Jackson: I will also go to my service officers at the job and tell them. U make sure u save all your text. They already know about u at the job. "Ms. Beakh"
Babatu: MS. Becah u r about to lose your job. By harassing me. I have nothing to hide I am in the system already.
Jackson: U [won't] be able cause me to lose nothing because u ain't nothing. U in the system as recovery drug addict. "Ms. Beakh"
Babatu: HMMM? Why r u looking at sensitive data that u have no business viewing w/O) DUE CAUSE OR AUTHORIZATION? You work for law enforcement, BUT YOU ARE NOT THE LAW.
Jackson: I'm not a fool u can look at u and tell what u about. Leave me alone. I told the officers when u first came to my area that I didn't want to have nothing . . . to do with you. "Ms. Beakh"
Babatu: HMMM? You are really hurting inside. I WILL DO WHAT IS RIGHT AND JUST/FAIR
Babatu's reference to "don and his wife" appears to be to Don Lewis. It is not entirely clear, but it also appears from the summary judgment record that Jackson's aunt Seretha may be Don Lewis's wife. Pl.'s App. 129. Because of the shorthand nature of text messages in general, the court does not attempt to correct the majority of grammatically incorrect statements, spelling, or typographical errors contained in Babatu's and Jackson's text messages.
On February 18, 2009, Babatu submitted a complaint in the form of a "Point of Contact Report" to DVAMC. Based on text messages he exchanged with Jackson, Babatu stated in his complaint that he believed Jackson had accessed and disclosed confidential information in his DVAMC records without his permission and that his privacy rights had been violated as a result. Pl.'s App. 199. In response to Babatu's complaint, DVAMC privacy officer Cheryl Johnson ("Johnson") conducted an investigation and issued a report on February 25, 2009. Pl.'s App. 200. In the report, Johnson confirmed that Jackson had accessed Babatu's record on December 5, 2008, using the PIM. Id. at 202. Because Jackson was unable to give a reason for accessing and viewing Babatu's records and Jackson's supervisor Louise Lloyd ("Lloyd") indicated that Jackson did not have any reason to access and view Babatu's records, Johnson concluded that Jackson's accessing and viewing Babatu's records was an inappropriate, unauthorized privacy violation. Id. at 166, 202.
During the course of her investigation, Johnson also discovered that there were several other instances in which Jackson had accessed DVAMC patient and personnel records, other than Babatu's, without authorization. Id. at 216. On April 9, 2009, Jackson was placed on administrative leave. On April 10, 2009, DVAMC's chief of police notified Jackson via letter that DVAMC was considering terminating her employment as a result of her unauthorized access of records from 2001 to 2009, including her access of Babatu's records on December 5, 2008, and that she had the right to reply to the termination of employment notice. Id. at 211, 213. In considering whether to terminate her employment, an internal DVAMC "Douglas Factors" report was prepared, which states: Jackson had received "numerous counseling" in the past; she was a difficult employee who was "always in some feud with other co-workers"; she "has little or no cooperation with her supervisor" and her supervisor has "no confidence" in her; and the offense committed by Jackson in accessing Babatu's records on December 5, 2008, "appeared to be intentional and was committed maliciously" and was committed despite Jackson being provided privacy training Pl.'s App. 227-29. It is unclear who authored the report, but it appears to have been prepared by Jackson's supervisor.
By letter dated April 13, 2009, Jackson attempted in writing to address each instance of access that, according to DVAMC, was unauthorized. Regarding the several instances when she accessed records of persons, other than Babatu, Jackson stated that she believed she accessed the records in response to requests by DVAMC officers or in connection with her job-related duties. As to Babatu, Jackson explained that she "felt harassed" by Babatu because she had told him that she was not interested in a personal relationship with him, but he nevertheless continued to visit her work area on a daily basis and would wait in DVAMC's parking area to talk to her. Id. Regarding her decision to retrieve and review Babatu's records on December 5, 2008, Jackson further stated:
Although it has been several months, I believe that on December 5, 2008, Mr. [Babatu] was again in my work area and I complained to Sgt. Jones. Mr. [Babatu] explained to Sgt. Jones he was there for an appointment. I think I pulled Mr. [Babatu's] appointment record to demonstrate this was not true.Id.
In response to an interrogatory submitted by Babatu, Jackson similarly explained the circumstances that prompted her to access Babatu's DVAMC records on December 5, 2008, as follows:
[Babatu] was showing up in [my] work area on a daily basis. [My] supervisor informed [me] that [Babatu] could not keep showing up in [my] work area. [Babatu] stated that he was in [my] work area because he had an appointment. [I] checked to verify the veracity of [Babatu's] statement and learned that [he] did not have an appointment and did not have a legitimate reason for being in [my] work area, other than to harass and annoy [me].Pl.'s App. 317-18.
On June 12, 2009, DVAMC director Joseph M. Dalpiaz ("Dalpiaz") notified Jackson that DVAMC would delay terminating her employment for twenty-four months if she agreed to and abided by the terms of a Last Chance Agreement ("Agreement"). Pursuant to the Agreement, which was executed between Jackson and DVAMC on July 6, 2009, Jackson acknowledged that she had accessed the records of DVAMC beneficiaries and that she was not authorized to access such records, that such misconduct constituted disciplinary grounds for DVAMC to terminate her employment, and that her employment would be terminated if she failed to maintain satisfactory conduct or performance during the term of the Agreement. Id. at 205-06. Jackson also agreed to accept a position in DVAMC's Nursing Service department as a clerk where she would not have access to patient records.
For the reasons herein explained, the court concludes that it lacks subject matter jurisdiction to hear Plaintiff's privacy claim against DVAMC under the Texas Occupations Code and genuine disputes of material fact preclude summary judgment on Plaintiff's claim under the Privacy Act.
IV. Privacy Claim under Texas Occupations Code
Section 159.009(b) of the Texas Occupations Code permits an aggrieved person to bring a civil action for damages for the unauthorized release of confidential information. Tex. Occ. Code Ann. 159.009(b) (West 2012). Section 159.002(b) provides that a record is confidential and privileged and may not be disclosed if it is "[a] record of the identity, diagnosis, evaluation, or treatment of a patient by a physician that is created or maintained by a physician." Id. 159.002(b). DVAMC contends that it is entitled to judgment on Plaintiff's privacy claim under the Texas Occupations Code for a number of reasons; however, the court does not address the parties' arguments in this regard because it concludes sua sponte that it lacks subject matter jurisdiction over Plaintiff's claim against the DVAMC under section 159.009(b) of the Texas Occupations Code.
"It has long been established . . . that the United States, as sovereign, is immune from suit save as it consents to be sued . . . and the terms of its consent to be sued in any court define that court's jurisdiction to entertain the suit." United States v. Testan, 424 U.S. 392, 399 (1976) (internal quotation marks and citation omitted). Thus, unless Congress has consented to a cause of action against the United States, no court, whether state or federal, has jurisdiction over such claim. Id. Here, there is no indication or evidence that Congress has consented to a cause of action against the United States in any capacity under section 159.009(b) of the Texas Occupations Code. The court therefore lacks subject matter jurisdiction over the claim. Rather than granting judgment in favor of DVAMC on this claim, the court sua sponte dismisses it with prejudice for lack of subject matter jurisdiction. See Broussard v. United States, 989 F.2d 171, 177 (5th Cir. 1993) (explaining that when the United States has not waived its sovereign immunity, the claim should be dismissed for lack of subject matter jurisdiction rather than granting a motion for summary judgment).
Dismissal with prejudice of Plaintiff's privacy claim against the United States under the Texas Occupations Code is proper because the United States has not waived its sovereign immunity to be sued under section 159.009(b) of the Texas Occupations Code for alleged privacy violations and, as a result, no state or federal court would have jurisdiction to hear such claim.
V. Claim under Privacy Act of 1974
The Privacy Act, 5 U.S.C. § 552a (1996), was enacted to "safeguard[] the public from unwarranted collection, maintenance, use and dissemination of personal information contained in agency records." Jacobs v. National Drug Intelligence Ctr., 423 F.3d 512, 515 (5th Cir. 2005) (citation omitted). Under the Privacy Act, a plaintiff may bring a cause of action for an agency's: (1) "failure to amend an individual's record pursuant to his request"; (2) "denial of access to an individual's records"; (3) "failure to maintain an individual's records with 'accuracy, relevance, timeliness, and completeness'"; and (4) "failure to comply with other Privacy Act provision." Babatu contends that the DVAMC violated section 552a of the Privacy Act claim: (1) when it allowed Jackson to access and view his information on December 5, 2008, in DVAMC's computer database using the PIM; and (2) when Jackson subsequently showed DVAMC police officers her texts messages with Babatu that included information regarding his participation in drug treatment that she learned from using the PIM. Babatu's claim against DVAMC for alleged Privacy Act violations therefore falls under the fourth category of claims that a plaintiff may bring against an agency under the Privacy Act.
Regarding the Act's purpose, the court in Jacobs also noted, based on legislative history:
[A] primary purpose of 5 U.S.C. § 552a(b) is to [ ] "require employees to refrain from disclosing records or personal data in them, within the agency .... This section is designed to prevent the office gossip, interoffice and interbureau leaks of information about persons of interest in the agency or in the community, or such actions as the publicizing of information of a sensational or salacious nature or of that detrimental to character reputation."
Id. (citing 5 U.S.C. § 552a(g)(1)(A)).
Jacobs, 423 F.3d at 515 (citing 5 U.S.C. § 552a(d)(1), (g)(1)(B)).
Jacobs, 423 F.3d at 515 (citing 5 U.S.C. § 552a(g)(1)(C)).
Jacobs, 423 F.3d at 515 (citing 5 U.S.C. § 552a(g)(1)(D)).
Section 552a(b) of the Privacy Act prohibits disclosure of "any record which is contained in a system of records by any means of communication to any person, or to another agency" unless it has written consent from the individual to whom the record pertains or the disclosure falls within an enumerated exception. 5 U.S.C. § 552a(b). One such exception is when disclosure is made to the agency's employees "who have a need for the record in the performance of their duties." 5 U.S.C. § 552a(b)(1). The Privacy Act defines the term "record" as:
any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph;Id. § 552a(4). If an agency fails to comply with section 552a(b) or any of the Act's other requirements "in such a way as to have an adverse effect on an individual," an aggrieved individual may bring a civil action against the agency for "actual damages" for violations that are found to be "intentional or willful." Federal Aviation Admin. v. Cooper, 132 S. Ct. 1441, 1446 (2012) (quoting 5 U.S.C. §§ 552a(g)(4)(A), 552a(g)(1)(D)). Section 552a(g)(4) of the Privacy Act provides that if the court determines that the agency intentionally or willfully violated subsection (g)(1)(D) of the Act:
the United States shall be liable to the individual in an amount equal to the sum of-5 U.S.C. §§ 552a(g)(4)(A)-(B). The term "actual damages," as used in the Privacy Act, does not include damages for mental or emotional distress. Cooper, 132 S. Ct. at 1446. Actual damages under the Act are instead limited to those based on actual pecuniary loss and must be specifically pleaded. Id. at 1451. Because "the Privacy Act does not unequivocally authorize an award of damages for mental or emotional distress[,] . . . the Act does not waive the Federal Government's sovereign immunity from liability for such harms." Id.
(A) actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1,000; and
(B) the costs of the action together with reasonable attorney fees as determined by the court.
Thus, a plaintiff asserting a cause of action for violation of section 552a(b) of the Privacy Act must prove: (1) the information disclosed is a "record" in a "system of records"; (2) the agency failed to comply with the Act by disclosing protected information; (3) the disclosure had an adverse effect on the plaintiff; and (4) the agency's failure to comply with the Act was intentional or willful. Cooper, 132 S. Ct. at 1446; Jacobs, 423 F.3d 512 at 515. Additionally, as a result of the holding in Cooper, a plaintiff must also establish that he suffered "actual damages" in the form of actual pecuniary harm as a result of the agency's intentional or willful violation. Cooper, 132 S. Ct. at 1451.
To establish that an agency acted intentionally or willfully within the meaning of the Privacy Act, the plaintiff must show that the agency acted grossly negligent. See Chapman v. National Aeronautics & Space Admin., 736 F. 2d 238, 243 (5th Cir.) (per curiam), cert. denied, 469 U.S. 1038 (1984). Regarding the gross negligence standard, the court in Carrington v. United States, 46 F.3d 66, 1995 WL 29316 (5th Cir. Jan. 17, 1995) (per curiam) (unpublished) noted:
In stating that the standard for recovery is gross negligence, the Chapman court relied on Edison v. Department of the Army, 672 F.2d 840 (11th Cir. 1982). In Edison, the court found that the standard for recovery is "somewhat greater than gross negligence." Id. at 846. Because we agree with the district court that the government's conduct does not amount to gross negligence, much less anything greater than gross negligence, we do not take this opportunity to clarify this point of law.Id. at *1 n.1. A review of Edison, reveals that the Eleventh Circuit's determination that the standard for recovery of damages is "somewhat greater than gross negligence term" was based on the Act's legislative history:
The standard for recovery of damages under the House bill was a determination by a court that the agency acted in a manner which was willful, arbitrary, or capricious. The Senate bill would have permitted recovery against an agency on a finding that the agency had erred in handling his records. On a continuum between negligence and the very high standard of willful, arbitrary, or capricious conduct, willful or deliberate is viewed as somewhat greater than gross negligence. Analysis of House and Senate Compromise Amendments to the Federal Privacy Act, reprinted in 120 Cong. Rec. S 40405, 40406 (1974); 120 Cong. Rec. H. 40881, 40882 (1974).Edison, 672 F.2d at 846 n.12.
The court in Doe v. Chao, 540 U.S. 614 (2004), similarly concluded, based on the Act's legislative history, that section 552a(g)(4)'s "intentional or willful" culpability standard "represent[s] a compromise between the House and Senate versions," which "affords the Government some insulation against excessive liability." Id. at 637-38 (footnote omitted) ("The text of § 552a(g)(4), it is undisputed, accommodates two concerns. Congress sought to give the Privacy Act teeth by deterring violations and providing remedies when violations occur. At the same time, Congress did not want to saddle the Government with disproportionate liability."); 5 U.S.C. §§ 552a(g)(4)). Based on the foregoing, the court concludes that for Babatu to establish that DVAMC intentionally or willfully violated the Privacy Act in disclosing his information, he must show that DVAMC's conduct amounted to something "somewhat greater than gross negligence." Id.; Edison, 672 F.2d at 846 n.12; Carrington, 1995 WL 29316, at *1 n.1.
For purposes of its summary judgment, DVAMC focuses only on the third and fourth elements of Babatu's claim under the Privacy Act, that is, whether the disclosure adversely affected Babatu and whether the disclosure was intentional or willful. After carefully reviewing the parties' briefing and the summary judgment record, the court concludes that genuine disputes of material fact exist as to both issues.
DVAMC states in its motion and reply brief that it does not dispute that the information Jackson accessed on December 5, 2008, qualifies as a "record" for purposes of the first element. DVAMC also does not dispute that a disclosure occurred; however, the parties disagree regarding the extent of the disclosure. DVAMC contends that the disclosure was limited to Jackson, whereas Babatu asserts that the disclosure was not limited to Jackson because she shared confidential information in his records pertaining to his participation in drug treatment with a handful of DVAMC police officers.
A. Whether Babatu was Adversely Affected by Disclosure of His Information
Babatu contends:
In February of 2009, [he] was working in the VA's work-study program under a contract that would have allowed him to earn $2,685.50 in exchange for working 410 hours between January 14, 2009 and May 14, 2009. P App. 242. However, as a result of the depression, fear, and paranoia [he] felt in the aftermath of the privacy violation, [he] was forced to drop below the minimum number of academic credit hours required for participation in the work-study program in April of 2009.Pl.'s Resp. 26. Babatu therefore contends that he was adversely affected and suffered actual pecuniary harm in the form of lost work-study wages as a result of the disclosures of his information. For support, Babatu relies on his own declaration; the declaration of Dr. Joel Feiner, a former DVAMC staff physician who provided psychiatric services to Babatu from May 2006 to May 2010; and his DVAMC medical records.
DVAMC, on the other hand, contends that Babatu left the work-study program because his supervisor was unhappy with his performance, not because Jackson accessed his information in DVAMC's database. DVAMC also points to evidence that Babatu had difficulty maintaining his studies before the disclosure incident. There is conflicting evidence in the summary judgment record regarding Babatu's reasons for leaving the work-study program and whether he was required to leave due to the reduction in his academic credit hours. Despite DVAMC's contention and evidence regarding Plaintiff's performance issues, Babatu has presented letters of reference and other evidence indicating that he received favorable performance reviews as a DVAMC volunteer. Genuine disputes of material fact therefore exist as to whether Babatu suffered pecuniary loss in the form of lost work-study wages as a result of the disclosure of his information.
B. Whether the Disclosures were Intentional or Willful
1. The Parties' Contentions
Based on evidence of the following measures taken by it to ensure privacy, DVAMC contends that it did not act willfully or intentionally: (1) Jackson, as a police dispatcher, needed to access information in the PIM because her job sometimes demanded it; (2) the information she was given access to was limited to "low-level" information that did not contain any medical information other than Babatu's list of doctor appointments; (3) Jackson's access to the PIM was password-protected and limited to information that her supervisor decided was necessary for Jackson to perform her job; and (4) "Babatu's expert explained that the VA's record system, like most medical record systems, prioritizes patient health over 'infeasible access restriction'"; (5) "The VA's computers have physical privacy screens, and the VA sends its employees email reminders about the Privacy Act"; (6) "The agency requires its employees to complete annual Privacy Act training as a condition for maintaining access to patient information, and Jackson had completed the training numerous times before she accessed Babatu's record"; (7) "The agency has regulations pertaining to the Privacy Act, and the Fifth Circuit has found that such regulations also support a finding that an agency was not grossly negligent. See 38 C.F.R. §§ 1.460-1.527." Def.'s Mot. 10-11 (citations omitted). DVAMC also relies on evidence that it periodically and randomly conducts audits to monitor employee access of information in DVAMC's database. Finally, DVAMC asserts that "An assessment team and the Department of Health and Human Services both found that the VA complied with the Privacy Act." Def.'s Mot. 11 (citing Def.'s App. 199, 372 - Johnson's declaration and July 13, 2011 letter from the Department of Health and Human Services ("HHS") to DVAMC).
Babatu counters that the disclosures were intentional and willful because DVAMC failed to take adequate measures to protect against disclosure by Jackson. Babatu asserts that DVAMC could have but never monitored or checked Jackson's access of information and if it had done so it would have discovered that she had a history of inappropriately accessing and viewing records for various persons before she accessed and disclosed his information to third parties. Babatu maintains that "DVAMC's willful ignorance about Ms. Jackson's actions" is sufficient to raise a fact issue as to whether it acted intentionally or willfully particularly given that DVAMC knew Jackson was a problem employee. Pl.'s Resp. 19.
Babatu contends that while DVAMC points to evidence that it had privacy policies and training in place regarding employees' responsibilities under the Privacy Act, "there is no evidence to indicate that Ms. Jackson was specifically trained on proper use of the Patient Inquiry Menu in her role as a Police Dispatcher." Id. In addition, Babatu points to testimony by DVAMC employees that DVAMC's annual training in 2009 was a "'very, very, very basic course' focusing on password protection, reporting violations, and a general overview of how to treat sensitive patient information." Id. Babatu further asserts that there is no evidence whether the training provided to Jackson or the regulations relied on by DVAMC deal specifically with the issue of when it is appropriate for employees to access patient information using the PIM. Babatu contends that Johnson's declaration and the HHS letter relied on by DVAMC is not evidence it complied with the Privacy Act, and this evidence does not resolve whether DVAMC's conduct was willful because both are vague and simply state that unidentified "policies and procedures" comply with DVAMC's Privacy and Security Rules. Pl.'s Resp. 21 n.9. Babatu also objects to any reference to an assessment because it is not included in the summary judgment record and is hearsay.
In addition, Babatu argues that DVAMC is liable for Jackson's conduct in intentionally and willfully accessing and disclosing his information. According to Babatu, Jackson's access and disclosure of his information to DVAMC police officers is sufficient alone to create a genuine dispute as to whether she acted willfully because neither Jackson nor DVAMC police needed information regarding his status as a recovering drug addict to perform their job duties. To show that Jackson acted intentionally and willfully, Babatu also relies on evidence of DVAMC's investigation into the incident in which DVAMC concluded that Jackson's access of his information on December 5, 2008, appeared to be intentional and malicious. Babatu contends that Jackson's reason for accessing his information - "wanting to show her colleagues in the police service that [he] did not have an appointment in that area of the hospital" on December 5, 2008 - is evidence that she acted intentionally and willfully. Pl.'s Supplemental Br. 8. Babatu further asserts that Jackson's separate disclosure to DVAMC police officers was intentional and willful because, even if she wanted him to stay out of her work area, this does not explain why it was necessary for her to disclose that he was a recovering drug addict or to threaten him with police intervention. According to Babatu, the only explanation for Jackson's conduct is that she wanted to spread gossip among her coworkers about him.
For support, Babatu cites Reed v. Department of the Navy, 899 F. Supp. 2d. 25, 35 (D.D.C. 2012), for the proposition that when a government employee discloses information, but it is unclear whether the employee had ultimate authority to authorize or release information that was potentially covered by the Privacy Act, a genuine dispute exists that precludes summary judgment.
2. Discussion Regarding Intentional, Willfulness Requirement
The parties focus throughout their briefing on the issue of whether Jackson was acting outside the scope of her employment when she accessed and shared information in Babatu's DVAMC records. DVAMC contends that it is not liable for any disclosure because Jackson was not authorized to access Babatu's records on December 5, 2008, and she was therefore acting outside the scope of her employment. Babatu, on the other hand, contends that, although Jackson had no need to view his information on the day in question, DVAMC is liable under the Privacy Act, because Jackson used the security access she was given by DVAMC to do her job and used that same security access to view information in his records. Alternatively or in addition, Babatu contends in a supplemental briefing requested by the court that the issue of whether Jackson was acting within the scope of her employment is irrelevant for purposes of determining whether the disclosure was intentional or willful.
The parties' contentions in this regard are somewhat perplexing. DVAMC has not provided the court with any legal authority to support its position that a government employee's conduct outside the scope of her employment is a valid defense to a Privacy Act violation. The court recognizes that such a defense is frequently asserted in response to claims brought under the Federal Tort Claims Act ("FTCA") that are governed by state law. Babatu, however, has not asserted a claim under the FTCA, and, unlike claims under the FTCA, Privacy Act claims are governed by federal law. Furthermore, the court has been unable to locate any case in which an agency has asserted, as a defense to a Privacy Act claim, that it was not liable for its employee's violation of the Privacy Act because the employee acted outside the scope of her employment.
The Privacy Act lists twelve exemptions to disclosure by an agency that are frequently relied on by federal agencies in defending against Privacy Act claims. An employee acting outside the scope of her employment is not one of the exemptions. The issue of whether an employee acted outside the scope of her employment or was authorized to access and disclose protected information frequently arises in Privacy Act cases, but the issue in these cases is not whether the federal agency is absolved from liability because the employee acted outside the scope of her employment.
The issue instead arises in the context of whether the agency can take advantage of the "need to know" exemption under section 552a(b)(1) of the Act, which allows an agency to disclose protected information to its employees "who have a need for the record in the performance of their duties." 5 U.S.C. § 552a(b)(1). If the employee needed the information to perform her job, the disclosure is exempted and the agency is not liable. On the other hand, some courts have held that, when an employee has access to information that is not necessary for the performance of her job and there is evidence that the employee's disclosure was intentional or willful, the agency may be liable under the Privacy Act if the aggrieved individual can satisfy all of the requirements for a Privacy Act disclosure violation. Thus, DVAMC's argument that Jackson acted outside the scope of her employment does not appear to advance its defense to Jackson's claim under the Privacy Act.
Although DVAMC has not sought protection under the "need to know" exemption, its argument that Jackson acted outside the scope of her employment would nevertheless seem to preclude a finding that disclosure in this case was exempt under the "need to know" exception even though Jackson has taken the position that she was acting within the scope of her employment when she accessed Babatu's records and shared their text messages because, according to Jackson, she was requested by a DVAMC police officer to verify whether Babatu had an appointment. Jackson also maintains that she had previously complained to certain DVAMC police officers about the situation with Babatu in an effort to stop what she perceived to be harassment and stalking by him in and outside of the workplace.
Moreover, such a defense would conceivably allow an agency to always avoid liability. For example, an agency could claim, on one hand, that it is exempt from liability under the "need to know" exception to disclosure, that is, the employee needed the information to perform her job and the persons she disclosed the information to also needed it to perform their jobs. At the same time, an agency could argue in the alternative that it is not liable because its employee acted outside the scope of her employment when she accessed and disclosed information that was not necessary for her or other to perform their jobs. This way, the agency would be able to escape liability regardless of whether the employee acted within or outside the scope of her employment in accessing and disclosing information. Because DVAMC does not claim that disclosure was exempt under section 552a(b)(1) and the court has been unable to find any case in which a federal agency has asserted, as a defense to a Privacy Act claim, that its employee acted outside the scope of her authority or employment, the court does not address the scope of employment issue except to the extent that it may be probative of whether Jackson acted intentionally or willfully in accessing and disclosing Babatu's information in DVAMC's database.
In supplemental briefing requested by the court, the parties agree that an agency can be held liable for the acts of its employees. DVAMC, however, contends that the court should focus only on its conduct in making a determination regarding willfulness. Babatu, on the other hand, asserts that the court should consider the conduct of DVAMC and Jackson.
DVAMC cites the Fifth Circuit's opinion in Carrington to support its position that the court should only consider its conduct. DVAMC is correct that Carrington only considered the agency's conduct in considering whether a disclosure by an employee was intentional or willful. It is unclear from Carrington, however, whether the employee's reason or motive for disclosing the information was even raised by the parties. Thus, at most, Carrington merely supports the conclusion that it is proper for a court to consider an agency's conduct, including any measures undertaken by it to safeguard information. It does not support the conclusion, however, that a court should only consider the agency's conduct. Moreover, the court was unable to find any case in which the Fifth Circuit has addressed this specific issue.
Babatu cites a handful of cases in other jurisdictions in which courts considered the employee's conduct in determining whether a disclosure was intentional or willful. The court disagrees with Babatu's contention that evidence of an unauthorized disclosure, without more, is sufficient to support a finding of willfulness because an unauthorized disclosure could also support a finding of negligence, which is insufficient under the Privacy Act. As Babatu acknowledges, a finding of willfulness may be supported if there is evidence that the person who disclosed the information knew that the information was protected and that disclosure of the information would constitute a violation under the Privacy Act. Pl.'s Supplemental Br. 5 (citing and quoting Brooks v. Veterans Admin., 773 F. Supp. 1483, 1486 (D. Kan. 1991), for the proposition that the willful or intentional standard is satisfied when conduct "is so patently egregious and unlawful that anyone undertaking the conduct should have known it [was] unlawful" or the conduct was committed "without grounds for believing it to be lawful or action flagrantly disregarding others' rights under the Act."). Absent Fifth Circuit authority to the contrary, the court nevertheless finds the cases cited by Babatu, in which courts considered the employee's conduct, to be persuasive. See, e.g., Wilborn v. Department of Health and Human Servs., 49 F.3d 597 (9th Cir. 1995), overruled on other grounds by Chao, 540 U.S. 614. The court therefore concludes that an employee's conduct, as well as the agency's conduct, is relevant to the determination of whether a violation was intentional or willful.
In Wilborn, the plaintiff was employed as a staff attorney for the Department of Health and Human Resources ("DHHR"). Wilborn, 49 F.3d at 599. Wilborn's primary responsibility was to write decisions in Social Security benefit cases. Id. His supervisor was administrative law judge Stephen P. Kramer (the "ALJ"). Id. In May 1987, the ALJ informed Wilborn that the agency was not happy with his performance and the number of decisions he was writing, and Wilborn was placed on a Performance Improvement Plan ("PIP"). Id. Wilborn filed a grievance over the PIP, which was granted by management, and the PIP was rescinded and ordered expunged together with all related records. Id. The ALJ complied and removed the PIP records from Wilborn's personnel file and deposited them in Wilborn's wastebasket. Id. Subsequently, Wilborn left DHHR and went into private practice representing Social Security benefit claimants. Id. One of the claims he handled was adjudicated by the ALJ. Wilborn objected to the way in which the ALJ handled the claim and wrote a letter accusing the ALJ of acting as an advocate rather than an impartial decision maker. Id. The ALJ retaliated by revising his decision in the case to include information regarding Wilborn's PIP and poor performance while under his supervision at the agency. The ALJ later issued an errata sheet removing the reference to the PIP and revised the decision to state that Wilborn's animus towards him as his former supervisor was "astounding," given that he left the agency as a "disgruntled employee." Id. Because the errata sheet did not disclose that the PIP had been rescinded in full and removed from the agency's records, and the Appeals Council and Wilborn's client had already received copies of the decision referring to the PIP, the Ninth Circuit concluded that the agency's conduct was an intentional or willful violation of the Privacy Act (as a result of the ALJ's conduct) and entered judgment in favor of Wilborn on his claim under the Privacy Act against the agency. Id. at 602-03. In concluding that the ALJ's conduct was intentional, the court reasoned that the ALJ was the highest ranking agency official in the Eugene, Oregon Office of Hearings and Appeals; he was personally familiar with the Privacy Act; he had even noted in a meeting that the Privacy Act prevented the agency from disclosing information in claimant files; and he was informed by a staff attorney before publishing the decision that the language at issue was inappropriate and should not be included. Wilborn and other cases were cited favorably by the Fifth Circuit in Jacobs for the proposition that disclosures under the Privacy Act include oral disclosures and other types of disclosures. Jacobs, 423 F.3d at 518 n.7.
Viewing all of the evidence in the light most favorable to Babatu, the court determines that a genuine dispute of material fact exists as to whether disclosure here was intentional or willful. The Privacy Act requires agencies to establish "appropriate safeguards" to protect against "reasonably foreseeable or anticipated threats" to security. S. Rep. No. 93-1183, at 35-36 (1974), reprinted in 1974 U.S.C.C.A.N. 6916, 6968-69). In establishing safeguards, agencies have reasonable discretion to choose among alternative methods for securing their records based on their needs, objectives, and resources. Id. The Act therefore provides:
reasonable leeway for agency allotment of resources to implement this subsection. At the agency level, it allows for a certain amount of "risk management" whereby administrators weigh the importance and likelihood of the threats against the availability of security measures and the consideration of cost. The Act makes theId. Accordingly, to the extent Babatu contends that DVAMC's chosen method for securing information is inadequate or DVAMC could have done more, the court declines his invitation to second guess DVAMC's decision regarding the appropriate level of security needed for information available through the PIM. See Kostyu v. United States, 742 F. Supp. 413, 418 (E.D. Mich. 1990). That Plaintiff or the court might have made a different decision or evaluated the risks involved differently is of no moment. Id. Neither the language nor the legislative history of the Act suggests that Congress intended to place such an onerous burden on administrative agencies. Id.
wisdom and legality of these decisions reviewable by the Commission and Congress where they involve major changes in computerization and file management of data on people. It thus makes Congress, with the advice of the Commission, the final arbiter of the decision weighing cost, economy, technological feasibility against privacy and other civil liberties.
The court nevertheless concludes that DVAMC is not entitled to judgment as a matter of law on Babatu's claim under the Privacy Act. Regarding DVAMC's safeguards, the July 13, 2011 HHS letter relied on by it merely states: "[t]he VA Privacy Office provided OCR [Office for Civil Rights] evidence of Privacy and Security training provided to Ms. Jackson and a copy of its policies and procedures concerning the matter. OCR reviewed the policies and procedures and they appear to comply with the requirements of the Privacy and Security Rules." Def.'s App. 372 (emphasis added). There is little or no evidence in the summary judgment record, however, regarding DVAMC's "policies and procedures" as referenced in HHS's July 13, 2011 letter. Thus, there is no way for the court to determine whether DVAMC complied with its "policies and procedures."
Moreover, there is conflicting evidence as to Jackson's reason and motive for accessing, viewing, and disclosing Babatu's information. Despite Jackson's assertion that she did nothing wrong and her belief that her conduct was authorized, the tone of her text messages indicates that she may have been motivated to use and disclose Babatu's information regarding his drug addition in retaliation for what she perceived as harassment by him. Having determined that genuine disputes of material fact exist as to whether Babatu suffered pecuniary harm as a result of the disclosure and whether the disclosure was intentional or willful, the court will deny DVAMC's summary judgment motion as to Babatu's claim under the Privacy Act.
As previously noted, Babatu also contends that DVAMC acted recklessly in providing Jackson with access to information in the PIM because she was a problem employee; however, there is no evidence that DVAMC was aware that Jackson presented a safety risk for purposes of the Privacy Act before Babatu complained about Jackson. There is also no evidence to support Babatu's theory that Jackson used another employee's password to access information in the PIM or that DVAMC was aware of any such conduct.
--------
VI. Babatu's Objections to Evidence
The court has only considered evidence that is admissible pursuant to the summary judgment standard herein enunciated, Rule 56 of Federal Rules of Civil Procedure, and the rules and Fifth Circuit authority regarding expert testimony. Accordingly, to the extent the court has not explicitly addressed all of Babatu's arguments regarding objections to evidence, they are overruled as moot.
VII. Conclusion
For the reasons explained, the court determines that genuine disputes of material fact exist as to Plaintiff's Privacy Act claim. The court therefore denies DVAMC's Motion for Summary Judgment (Doc. 44). Rather than grant DVAMC's Motion for Summary Judgment as to Plaintiff's privacy claim under the Texas Occupations Code, the court sua sponte dismisses it with prejudice for lack of subject matter jurisdiction. Plaintiff's claims that remain for trial are those against DVAMC under the Privacy Act and those against Jackson for invasion of privacy by intentional intrusion on seclusion, invasion of privacy by public disclosure of private facts, and intentional infliction of emotional distress. The court will reschedule the pretrial conference and the parties' pretrial deadlines by separate order.
_______________
Sam A. Lindsay
United States District Judge
Jacobs, 423 F.3d at 518 (quoting Pippinger v. Rubin, 129 F.3d 519, 529 (10th Cir. 1997); and S. Rep. No. 93-1183; H. R. Rep. No. 93-1416, at 51 (1974), reprinted in 1974 U.S.C.C.A.N. 6916, 6966).