Opinion
No. 06-00897-CV-W-FJG.
December 6, 2007
ORDER
Currently pending before the Court is defendants' Motion to Dismiss (Doc. No. 17) and plaintiffs' Motion to Amend the Complaint (Doc. No. 19). Each motion will be considered below.
I. BACKGROUND
This is a pro se action brought by Timothy G. Cain and Doreen K. Cain. Plaintiffs sued Steven Mitchell ("Mitchell") of the Office for Civil Rights ("OCR") within the Department of Health and Human Services ("HHS"), and the Department of Veteran's Affairs (Doc. No. 1). Other persons are named in the Complaint as "other persons involved," but those individuals are not named as defendants. Plaintiffs' Complaint asserts defendants violated the Health Insurance Portability and Accountability Act ("HIPAA") arising out of the alleged improper disclosure of Timothy Cain's medical information. Plaintiffs allege that Timothy Cain's "personal medical file was accessed and psychiatric content dealing with suicidal intent was disclosed and discussed with the entire nursing staff in [the] emergency room" by Kansas City Veterans Administration Medical Center ("Medical Center") on November 3, 2004. (Doc. No. 1).
On April 26, 2005, Doreen Cain filed a complaint with OCR on behalf of her husband alleging that the Department of Veterans Affairs violated the Privacy Rule because a medical staff member impermissibly accessed her husband's psychotherapy notes and read them in a loud voice to others in the area. Doreen Cain also requested that this matter be investigated. Originally, their request was denied on May 27, 2005, but after Doreen Cain sent a letter objecting to the decision not to investigate, OCR reopened the matter and conducted an investigation. After an investigation, OCR informed the parties in a September 6, 2006 letter that it had determined that the Medical Center had not violated the Privacy Rule as alleged.
Plaintiffs then filed this action on October 30, 2006. Specifically, plaintiffs allege in their Complaint that Mitchell, the OCR investigator assigned to plaintiffs' case, did not investigate the case fully and his conclusions do not follow the law. Plaintiffs claim that Mitchell asked for "exact" wording from Timothy Cain's psychiatric file and this is not permitted during a legal investigation.
II. STANDARD OF REVIEW
Under Fed.R.Civ.P. 12(b)(1), a party may move to dismiss a complaint for lack of subject matter jurisdiction. In a "facial challenge to jurisdiction, all of the factual allegations concerning jurisdiction are presumed to be true and the motion is successful if the plaintiff fails to allege an element necessary for subject matter jurisdiction." Titus v. Sullivan, 4 F.3d 590, 593 (8th Cir. 1993).
Rule 12 further provides that a party may move to dismiss a complaint for failure to state a claim upon which relief can be granted. Fed.R.Civ.P. 12(b)(6). In considering a motion to dismiss, the pleadings are construed in the light most favorable to the nonmoving party, and the facts alleged in the complaint must be taken as true. Hamm v. Groose, 15 F.3d 110, 112 (8th Cir. 1994); Ossman v. Diana Corp., 825 F. Supp. 870, 879-80 (D. Minn. 1993). Any ambiguities concerning the sufficiency of the claims must be resolved in favor of the nonmoving party. Ossman, 825 F. Supp. At 880. "A motion to dismiss should be granted as a practical matter . . . only in the unusual case in which the plaintiff includes allegations that show on the face of the complaint that there is some insuperable bar to relief." Frey v. City of Herculaneum, 44 F.3d 667, 671 (8th Cir. 1995).
III. DISCUSSION
A. Defendants' Motion to Dismiss (Doc. No. 17)
Defendants seek to dismiss plaintiffs' Complaint pursuant to Fed.R.Civ.P. 12(b)(6) for failure to state a claim upon which relief could be granted and 12(b)(1), for lack of subject matter jurisdiction. Defendants argue this action should be dismissed for three reasons: (1) HIPAA does not provide for a private cause of action; (2) there is no statutory waiver of sovereign immunity and that Congress had not mandated compensation by the government for the alleged damage sustained by plaintiffs; and (3) even if this action were to be construed as being brought pursuant to the Administrative Procedure Act, discretionary action is not subject to judicial review.
Defendants contend Congress did not provide for a private right of action in the HIPAA Administrative Simplification provisions. 42 U.S.C. §§ 1320d-1320-8. Thus, defendants argue the Privacy Rule does not provide a basis under which plaintiffs may pursue their claims against HHS.
Plaintiffs respond that HIPAA may form the basis of a lawsuit by a patient notwithstanding the absence of a private right of action created by Congress. Plaintiffs refer the Court to a North Carolina appellate court decision to support this argument. In Acosta v. Byrum, 638 S.E.2d 246, 253 (N.C.Ct.App. 2006), the court reinstated a claim for intentional infliction of emotional distress against a psychiatrist who allegedly allowed an office manager to have access to psychiatric records that were used to cause harm to the patient. Plaintiffs state the North Carolina Court of Appeals held that the plaintiffs' HIPAA claim may form the basis of a lawsuit by a patient.
However, the Court disagrees with plaintiffs that this case is applicable. First, in the Acosta case, the plaintiffs were suing the psychiatrist, not a federal agency. Second, the plaintiffs cited to HIPAA as evidence of the appropriate standard of care to be used in support of their intentional infliction of emotional distress claim. Thus, the court found that plaintiffs made no HIPAA claim. Here, plaintiffs are not suing the medical staff who disclosed the information. Rather, plaintiffs are suing the individual investigator and the agency who investigated plaintiffs' administrative complaint. Plaintiffs here do not allege any claim sounding in tort. Further, the Court agrees with defendants that if plaintiffs are alleging a HIPAA violation in support of a tort claim, any tort claims would fail as a matter of law for failure to exhaust administrative remedies. Plaintiffs never presented any tort claims to HHS or the Department of Veteran's Affairs arising from the incident on November 3, 2004. Rather, plaintiffs only complained of a HIPAA violation in their administrative complaint. In addition, the Acosta decision is not binding on this Court.
"[T]he fact that a federal statute has been violated and some person harmed does not automatically give rise to a private cause of action in favor of that person." Touche Ross Co. v. Redington, 442 U.S. 560, 568, 99 S. Ct. 2479, 61 L. Ed. 2d 82 (1979). Rather, "private rights of action to enforce federal law must be created by Congress." Alexander v. Sandoval, 532 U.S. 275, 286, 121 S. Ct. 1511, 149 L. Ed. 2d 517 (2001). HIPAA imposes requirements on the Department of Health and Human Services, health plans, and healthcare providers involved in the exchange of health information to protect the confidentiality of such information. It provides for both civil and criminal penalties for individuals who improperly handle or disclose individually identifiable health information. Johnson v. Quander, 370 F. Supp. 2d 79, 99 (D.D.C. 2005). However, district courts have universally held that HIPAA does not create a private right of action. Fast v. Fast, 2007 U.S. Dist. LEXIS 63079, *3-4 (D. Neb. Aug. 23, 2007); Acara v. Banks, 470 F.3d 569, 571 (5th Cir. 2006) (collecting cases and explaining that although no other circuit has specifically addressed the issue, "[e]very district court that has considered this issue is in agreement that the statute does not support a private right of action"); Mufioz v. Island Fin. Corp., 364 F.Supp. 2d 131, 136 (D. Puerto Rico 2005); Univ. of Co. Hosp. Auth v. Denver Publ'g Co., 340 F. Supp. 2d 1142, 1145-46 (D. Colo. 2004); O'Donnell v. Blue Cross Blue Shield of Wyo., 173 F. Supp. 2d 1176, 1179-80 (D. Wyo. 2001).
In this case, plaintiffs assert that Timothy Cain's personal medical file was disclosed in violation of HIPAA and requests that this Court review the investigation of the Office of Civil Rights conducted by Steven Mitchell. First, plaintiffs have no jurisdiction here as HIPAA creates no private cause of action as stated above. Second, the Court has no authority to review the investigator's decision not to enforce any penalties against the hospital under the Administrative Procedure Act ("APA"). 5 U.S.C. § 702(a)(2). Even if the Court could review Mitchell's investigation, plaintiffs have not exhausted administrative remedies below by filing a complaint regarding the inadequacy of Mitchell's investigation and then following the channels to appeal that decision thereafter. Thus, the Court concludes plaintiffs' complaint should be dismissed for lack of subject matter jurisdiction and for failure to state a claim upon which relief can be granted. Therefore, the Court hereby GRANTS defendants' motion to dismiss.
Because the Court dismisses plaintiffs' complaint on the basis that there is no private right of action under HIPAA and that the APA provides for no review of discretionary action in this case, the Court will not address defendants' other arguments regarding sovereign immunity.
B. Plaintiffs' Motion to Amend Complaint (Doc. No. 19)
Plaintiffs seek to amend their Complaint in order to: (1) to seek relief from Mitchell individually and (2) to join a new defendant, James Glynn. Plaintiffs do not assert any specific allegations against James Glynn. Because the Court finds that dismissal of plaintiffs' Complaint is proper, plaintiffs' Motion to Amend Complaint (Doc. No. 19) is DENIED AS MOOT.
IV. CONCLUSION
IT IS SO ORDERED.
GRANTED DENIED AS MOOT.