Opinion
2024-1305
06-04-2024
ALFONSO G. RAMIREZ, Petitioner v. DEPARTMENT OF VETERANS AFFAIRS, Respondent
ALFONSO G. RAMIREZ, Tucson, AZ, pro se. STEPHEN J. SMITH, Commercial Litigation Branch, Civil Division, United States Department of Justice, Washington, DC, for respondent. Also represented by REGINALD THOMAS BLADES, JR., BRIAN M. BOYNTON, PATRICIA M. MCCARTHY.
This disposition is nonprecedential.
Petition for review of the Merit Systems Protection Board in No. DE-0752-14-0482-I-1.
ALFONSO G. RAMIREZ, Tucson, AZ, pro se.
STEPHEN J. SMITH, Commercial Litigation Branch, Civil Division, United States Department of Justice, Washington, DC, for respondent. Also represented by REGINALD THOMAS BLADES, JR., BRIAN M. BOYNTON, PATRICIA M. MCCARTHY.
Before LOURIE, BRYSON, and REYNA, Circuit Judges.
PER CURIAM.
Alfonso G. Ramirez appeals pro se a final order of the Merit Systems Protection Board denying his petition for review of the administrative judge's initial decision. We affirm.
BACKGROUND
Mr. Ramirez was employed as a Program Support Assistant at the Southern Arizona Veterans Administration Health Care System. SAppx2. On three separate occasions during his employment, Mr. Ramirez sent documents to the U.S. Department of Veterans Affairs' ("VA") Office of Resolution Management ("ORM") that contained sensitive patient information such as patient names, addresses, full or partial social security numbers, and medical diagnoses. SAppx2-3. After Mr. Ramirez sent the first set of documents to ORM, ORM sent Mr. Ramirez a letter informing him that his submission may be a privacy violation and instructing him to not mention any veteran's sensitive patient information in future submissions. SAppx24. ORM also forwarded the first set of documents to Mr. Ramirez's employer and instructed it to send the documents to its privacy officer for "appropriate action." Id. Before Mr. Ramirez received ORM's letter, he sent documents containing sensitive patient information to ORM a second time. Id. Then, after Mr. Ramirez received ORM's letter, Mr. Ramirez sent documents containing sensitive patient information to ORM a third time. Id. ORM again notified both Mr. Ramirez and his employer that each submission was a potential privacy violation. SAppx24-25.
"SAppx" refers to the appendix accompanying the government's responsive brief.
A privacy officer met with Mr. Ramirez shortly after the third submission and confirmed that Mr. Ramirez had released sensitive patient information to ORM on three separate occasions. SAppx26. Separately, the VA Network Security Operations Center conducted a risk assessment ("Risk Assessment") of Mr. Ramirez's disclosures to determine whether the VA was required under Subpart D of the Health Insurance Portability and Accountability Act, Pub. L. 104-191, 110 Stat. 1936 (1996) ("HIPAA") to provide notice to affected veterans. SAppx5. The Risk Assessment concluded that Mr. Ramirez's disclosures did not amount to a data breach requiring notice to affected veterans. Id.
The VA then issued to Mr. Ramirez a notice of proposed removal based on two charges: that Mr. Ramirez violated HIPAA Subpart E and that he violated the Privacy Act, 5 U.S.C. § 552a. SAppx22. Mr. Ramirez responded to the VA's proposed notice of removal. Id. The VA's deciding official sustained both charges and imposed a penalty removing Mr. Ramirez from federal service. Id.
Mr. Ramirez appealed the VA's decision to remove him to the Merit Systems Protection Board ("Board"), and an administrative judge affirmed the removal. Ramirez v. Dep't of Veterans Affs., 2016 WL 4417576 (M.S.P.B. Aug. 19, 2016) (SAppx21-51) ("Initial Decision"). Mr. Ramirez filed a petition for review of the administrative judge's initial decision by the full Board. SAppx1. The Board denied the petition, modified the initial decision in part, and otherwise affirmed. Ramirez v. Dep't of Veterans Affs., 2023 WL 8543051 (M.S.P.B. Dec. 8, 2023) (SAppx1-20) ("Final Order"). Mr. Ramirez appeals. We have jurisdiction under 28 U.S.C. § 1295(a)(9).
The electronic version of the Initial Decision at 2016 WL 4417576 does not have page designations. Therefore, we cite to the Initial Decision found at SAppx21-51.
STANDARD OF REVIEW
Our review of Board decisions is limited. 5 U.S.C. § 7703(c). We set aside a Board decision only when it is "(1) arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law; (2) obtained without procedures required by law, rule, or regulation having been followed; or (3) unsupported by substantial evidence." Id. We review the Board's legal determinations de novo and its factual findings for substantial evidence. Bryant v. Dep't of Veterans Affs., 26 F.4th 1344, 1346 (Fed. Cir. 2022).
DISCUSSION
Mr. Ramirez's arguments on appeal boil down to his contention that the Board erred in affirming his removal when it ignored the Risk Assessment's finding that his disclosure of sensitive patient information did not amount to a data breach under HIPAA Subpart D. Appellant Informal Br. 1-2. According to Mr. Ramirez, he should not have been removed because he did not cause a data breach. Id. We are not persuaded.
When an employee challenges an adverse employment action, such as termination of employment, the agency must prove by a preponderance of the evidence that it had a "rational basis" for the adverse employment action. Mitchum v. Tenn. Valley Auth., 756 F.2d 82, 84-85 (Fed. Cir. 1985). Among other things, the agency must show that the employee engaged in "charged conduct." Pope v. U.S. Postal Serv., 114 F.3d 1144, 1147 (Fed. Cir. 1997). Here, the VA charged Mr. Ramirez with a violation of HIPAA Subpart E. Subpart E prohibits the use or disclosure of protected health information by "covered entities," such as Mr. Ramirez's former employer. 45 C.F.R. § 164.502(a). The Board affirmed the VA's finding that Mr. Ramirez violated Subpart E. Mr. Ramirez provides no basis as to why the Board's determination was legally erroneous, arbitrary, capricious, or unsupported by substantial evidence.
The definition of "covered entities" is found at 45 C.F.R. § 160.103 and includes VA hospitals such as Mr. Ramirez's former employer. See Final Order, 2023 WL 8543051, at *2 n.4. Mr. Ramirez does not challenge on appeal that his former employer is a covered entity.
We see no error with the Board's determination. The record shows that Mr. Ramirez violated Subpart E, a finding that Mr. Ramirez does not challenge on appeal. Instead, Mr. Ramirez's argument only relates to Subpart D. As for Subpart D, the Board rejected Mr. Ramirez's argument as immaterial because the VA removed Mr. Ramirez for violating HIPAA Subpart E, not D. Final Order, 2023 WL 8543051, at *3. While Subpart E prohibits the disclosure of protected health information, Subpart D asks the additional question of whether a disclosure of protected health information amounts to a data breach, thereby requiring notice to affected individuals. 45 C.F.R. §§ 164.402, 404. Thus, whether Mr. Ramirez violated Subpart D is irrelevant to the Board's determination at issue.
Assuming Mr. Ramirez did not violate any portion of HIPAA, his appeal still falls short. The Board affirmed the VA's removal of Mr. Ramirez based on two separate charges-violating HIPAA Subpart E and violating the Privacy Act. Final Order, 2023 WL 8543051, at *1-4. The Privacy Act prohibits agency disclosure of any record contained in a system of records without prior written consent of the individual to whom the record pertains, subject to several exceptions. 5 U.S.C. § 552a(b). Mr. Ramirez's argument on appeal regarding the Risk Assessment has no bearing on his violation of the Privacy Act. Mr. Ramirez provides no basis as to why the Board's Privacy Act determination was erroneous or why the penalty of removal would be unreasonable based on a violation of the Privacy Act alone. We find that the Board's Privacy Act determination was not legally erroneous and that the Board's factual findings are supported by substantial evidence.
CONCLUSION
We have considered Mr. Ramirez's remaining arguments and find them unpersuasive. For the reasons stated, we affirm the Board's denial of Mr. Ramirez's petition for review.
AFFIRMED
COSTS
No costs.