Opinion
CIVIL ACTION NO. 2:20-cv-305
2020-11-12
Christopher WELLS, Plaintiff, v. ENTERPRISE LEASING CO. OF NORFOLK/RICHMOND, LLC, Defendants.
Wayne Barry Montgomery, Kalbaugh Pfund & Messersmith PC, Richmond, VA, for Plaintiff. Scott Andrew Siegner, Alexander Tevis Marshall, Ogletree Deakins Nash Smoak & Stewart PC, Richmond, VA, for Defendants.
Wayne Barry Montgomery, Kalbaugh Pfund & Messersmith PC, Richmond, VA, for Plaintiff.
Scott Andrew Siegner, Alexander Tevis Marshall, Ogletree Deakins Nash Smoak & Stewart PC, Richmond, VA, for Defendants.
MEMORANDUM OPINION AND ORDER
RAYMOND A. JACKSON, United States District Judge Before the Court is Defendant's Motion to Dismiss under Federal Rule of Civil Procedure 12(b)(6). ECF No. 6. The Court finds that a hearing is not necessary. Having reviewed the parties' filings, this matter is ripe for judicial determination. For the following reasons, Defendant's Motion to Dismiss is GRANTED.
I. FACTUAL AND PROCEDURAL HISTORY
The following facts taken from Christopher Well's ("Wells" or "Plaintiff") Complaint are considered true and cast in the light most favorable to Wells. ECF No. 1 at Exhibit 4; see also, Adams v. Bain , 697 F.2d 1213, 1219 (4th Cir. 1982).
Wells was employed by Enterprise Leasing Co. of Norfolk/Richmond, LLC ("Enterprise" or "Defendant"). On March 28, 2020, Andrea Mann ("Mann"), the Group Human Resource Manager at Enterprise, called Wells and advised him that she had been informed by an anonymous complaint that Wells had been exposed to a family member who had tested positive for COVID-19. ECF No. 1 at Exhibit 4 at ¶ 6. During the same phone conversation, Wells advised Mann that he planned to see a doctor the following week while he was not scheduled to work. Id. at ¶ 7. On the call, Mann asked Wells to keep Enterprise informed about his medical results and the medical test results for his family member. Id. at ¶ 8. Wells' family member is not an employee at Enterprise. Wells "refused to provide the medical test results of his family member nor would he provide Enterprise with information regarding his family member's medical status." Id. at ¶ 9. On April 2, 2020, Enterprise fired Wells. Mann and Enterprise advised Wells that "his refusal to get tested and refusal to provide Enterprise with medical tests results and medical information related to his family member was ‘gross insubordination’ and that his insubordination was the grounds for the termination of his employment." Id. at ¶ 11.
On May 11, 2020, Wells initiated a suit seeking $250,000 in compensatory damages and $200,000 in punitive damages in the Circuit Court for the City of Norfolk. Id.; see also, Christopher Wells v. Enterprise Leasing Co. of Norfolk/Richmond, LLC and Andrea Mann , Case No. 20-4595. Count I alleges Wrongful Termination in violation of Virginia common law, pursuant to Mitchem v. Counts , 259 Va. 179, 523 S.E.2d 246 (2000). Id. at ¶ 18. On June 18, 2020, Enterprise removed the case to the United States District Court for the Eastern District of Virginia, Norfolk Division. ECF No. 1. On June 25, 2020, Enterprise filed a Motion to Dismiss Wells' Complaint for failure to state a claim. ECF Nos. 6, 7. Wells opposed the motion on July 9, 2020. ECF No. 8. On July 15, 2020, Enterprise filed a reply. ECF No. 9.
II. LEGAL STANDARD
Federal Rule of Civil Procedure 12(b)(6) provides for dismissal of actions that fail to state a claim upon which relief can be granted. The United States Supreme Court has stated that in order "[t]o survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ " Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). Specifically, "[a] claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. at 678, 129 S.Ct. 1937. Moreover, at the motion to dismiss stage, the court is bound to accept all of the factual allegations in the complaint as true. Id. However, "[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Id. Assessing the claim is a "context-specific task that requires the reviewing court to draw on its judicial experience and common sense." Id. at 679, 129 S.Ct. 1937. In considering a Rule 12(b)(6) motion to dismiss, the Court cannot consider "matters outside the pleadings" without converting the motion to a summary judgment. Fed. R. Civ. P. 12(d). Nonetheless, the Court may still "consider documents attached to the complaint ... as well as those attached to the motion to dismiss, so long as they are integral to the complaint and authentic." Sec'y of State for Defence v. Trimble Navigation Ltd. , 484 F.3d 700, 705 (4th Cir. 2007) ; see also Fed. R. Civ. P. 10(c).
III. DISCUSSION
A. Subject Matter Jurisdiction and Choice of Law
As an initial matter, the Court has jurisdiction over this action pursuant to 28 U.S.C. § 1332. Wells alleges wrongful termination based on Virginia Law. ECF No. 1 at Exhibit 1 at ¶ 12-20. However, Wells wrongful termination claim is that Wells allegedly refused to engage in a criminal violation of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Accordingly, Wells wrongful termination claim necessarily turns on the Court's construction and interpretation of HIPAA. The law is well-established that "[r]egardless of the allegations of a state law claim, ‘where the vindication of a right under state law necessarily turn[s] on some construction of federal law,’ the claim arises under federal law and thus supports federal question jurisdiction under 28 U.S.C. § 1331." North Carolina v. Alcoa Power Generating, Inc. , 853 F.3d 140, 146 (4th Cir. 2017) (quoting Franchise Tax Bd. v. Constr. Laborers Vacation Tr. for S. Cal. , 463 U.S. 1, 9, 103 S. Ct. 2841, 77 L. Ed. 2d 420 (1983) ). Therefore, the Court has sufficient basis for federal question jurisdiction.
Additionally, there is diversity jurisdiction under 28 U.S.C. § 1332. Enterprise is a Delaware limited liability company that is licensed to conduct business in the Commonwealth of Virginia. ECF No. 1 at Exhibit 1 at ¶ 4. No member of Enterprise is a citizen of the Commonwealth of Virginia. Id. at ¶ 5-6. Wells is citizen of the Commonwealth of Virginia with residence in Virginia Beach, Virginia. The amount in controversy exceeds $75,000. Id. Exhibit 4 at ¶ 11. In a diversity action, district courts apply federal procedural law and state substantive law. See Gasperini v. Ctr. for Humanities, Inc. , 518 U.S. 415, 427, 116 S.Ct. 2211, 135 L.Ed.2d 659 (1996). Federal courts sitting in diversity jurisdiction apply the choice of law rules in the state in which it sits. Klaxon v. Stentor Elec. Mfg. Co. , 313 U.S. 487, 496, 61 S.Ct. 1020, 85 L.Ed. 1477 (1941) (noting that forum state's choice of law rules is substantive).
Here, Federal Law is applicable to Count I in the Complaint as it pertains to HIPAA and State Law is applicable as it pertains to Wells' allegation that he was wrongly terminated.
B. Plaintiff Would Not Face Direct or Indirect Criminal Liability Under HIPAA
1. Covered Entities are Liable
First, Plaintiff alleges a cause of action under HIPAA. 42 U.S.C. § 1320d-6 (2018). Specifically, Plaintiff alleges that HIPAA makes it a criminal act for the plaintiff to disclose "it is a federal crime to disclose individually identifiable health information of another." ECF No. at Exhibit 1 at ¶ 15.
Section 1320d-6(a) provides as follows:
(a) A person who knowingly and in violation of this part—
(1) uses or causes to be used a unique health identifier;
(2) obtains individually identifiable health information relating to an individual; or
(3) discloses individually identifiable health information to another person, shall be punished as provided in subsection (b) of this section [setting forth criminal penalties]. For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1320d–9(b)(3) of this title) and the individual obtained or disclosed such information without authorization.
42 USC § 1320d-1(a) states that this provision [42 USCS §§ 1320d et seq. ] only applies to the following persons:
(1) A health plan.
(2) A health care clearinghouse.
(3) A health care provider who transmits any health information in electronic form in connection with a transaction referred to in section 1173(a)(1) [42 USCS § 1320d-2(a)(1) ].
42 USC § 1320d(6) defines "individually identifiable health information" as any information, including demographic information collected from an individual, that—(A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and—(i) identifies the individual; or (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.
Section 1320d-6(b) provides that a person in subsection (a) shall—
(1) be fined not more than $50,000, imprisoned not more than 1 year, or both;
(2) if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and
(3) if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both.
42 U.S.C. § 1320d-6 (2018). As a general matter, "HIPAA governs the confidentiality of medical records and regulates how and under what circumstances ‘covered entities’ may use or disclose ‘protected health information’ about an individual." United States v. Elliott , 676 F. Supp. 2d 431, 436 (D. Md. 2009) (emphasis added ); see also, Miesegaes v. Allenby , 2020 WL 2542064, at *4, 2020 U.S. Dist. LEXIS 89806, at *11 (C. D Cal. March 13, 2020) ("HIPAA prohibits disclosure of identifiable protected health information by ‘covered entities,’ including health care providers, except as specifically permitted or required by HIPAA.") (emphasis added ). The term "covered entities" is narrowly defined to include health care plans, health care clearinghouses, and health care providers. See 42 U.S.C. § 1320d1(a)(1)-(3) ("Any standard adopted under this part [ 42 U.S.C. §§ 1320d, et seq. ] shall apply, in whole or in part, to the following persons: (1) a health plan; (2) a health clearing house; (3) a health care provider who transmits any information in electronic form in connection with a transaction referred to in section 1173(a)(1)"); see also, Richard v. Tallant , 2020 WL 3035223, at *3, 2020 U.S. Dist. LEXIS 98981, at *6 (4th Cir. June 5, 2020) (holding that HIPAA only extends to "covered entities ," such as health plans, health clearing house, or healthcare provider, and cannot be "validly asserted" against individuals.) (emphasis added ).
Stated simply, if a health plan, health clearing house, or a healthcare provider disclose identifiable protected health information, without authorization, then the covered entity is subject to criminal liability. Here, the Court finds that Plaintiff is not a covered entity and therefore he would not be held directly liable under the statute.
The second question is whether HIPAA also prohibits an individual from directly disclosing another individual's identifiable protected health information, without authorization. In Richard , the United States Court of Appeals for the Fourth Circuit dismissed a Section 1320d-6 counterclaim brought by an individual defendant against an individual plaintiff, noting that "[p]laintiff is plainly none of these [covered] entities; therefore, this statute cannot be validly asserted in this action." Richard, at *3, 2020 U.S. Dist. LEXIS 98981, at *7. Similarly, in the instant matter, the Court finds that Plaintiff is not a covered entity, and, therefore, Plaintiff would not be subject to criminal liability under HIPAA for disclosing his family member's identifiable protected information.
2. Aiding and Abetting Liability
Plaintiff then argues that even if he is not a "covered entity" under HIPAA, he "certainly could be held indirectly criminally liable for disclosing his protective medical information or for aiding and abetting in such a violation had he complied with Enterprises directive to obtain and disclose his mother (sic ) health care records." ECF No. 9 at 7. Plaintiff argues that HIPAA prohibits an "employee or other individual" from obtaining or disclosing "individually identifiable health information in violation of this part if the information is maintained by a covered entity ... and the individual obtained or disclosed such information without authorization." 42 U.S.C. § 1320d-6(3)(b) (emphasis added). Accordingly, Plaintiff argues that if he had obtained and disclosed his own identifiable health information, and those of his family, as they pertain to COVID-19 results, without authorization, then he would have violated HIPAA and be subject to criminal liabilities. ECF No. 9 at 7.
As an initial matter, the Court finds that disclosing a COVID-19 test result with the patient information would qualify as "individually identifiable health information" because it is information that "(A) is created or received by a health care provider; and (B) relates to the past, present, or future physical or mental health or condition of an individual, and—(i) identifies the individual; or (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual." 42 USC § 1320d(6).
However, Plaintiff fails to state a claim upon which relief can be granted under the aiding and abetting liability theory for three reasons.
First, Plaintiff would not be subject to criminal liabilities for voluntarily disclosing his own medical information to Enterprise. Moreover, Plaintiff did not state that Enterprise commanded or coerced Plaintiff to disclose his own medical records without his own consent. Rather, Plaintiff stated Enterprise asked Plaintiff to "keep Enterprise posted on his status" pertaining to COVID-19. ECF No. 1 at Exhibit 4 at ¶ 8. Similarly, Enterprise did not ask Plaintiff to disclose his family members test results without the family member's consent.
Second, HIPAA imposes criminal liability on employees or other individuals who directly obtain, from a covered entity, individually identifiable health information of a third-party and then disclose this information, without the third-party's authorization. See 42 U.S.C. § 1320d-6(3)(b). In such circumstances, the individual or employee could be held liable of aiding and abetting liability and of conspiracy liability. See United States v. Luthra , 970 F.3d 8 (1st Cir. 2020) (holding a doctor liable for aiding and abetting wrongful disclosure of individually identifiable health information because the doctor knew that a pharmaceutical sales representative accessed protected patient information, where representative and defendant's medical assistant collectively testified that defendant witnessed representative help assistant complete prior authorization forms, which included protected patient information, and that defendant instructed assistant not to tell federal law enforcement agents that they showed patient records to representative.). Here, Plaintiff is not an employee of a covered entity and thus could not be held liable of aiding and abetting a covered entity. Also, Defendant is not a covered entity and, so, Plaintiff cannot be held liable of aiding and abetting there. Finally, Plaintiff has not stated facts in his complaint showing that Enterprise asked him to aid and abet Enterprise in obtaining and disclosing the protected medical information of Plaintiff's family member directly from a covered entity.
Third, the Court finds that Plaintiff has not pleaded sufficient facts to support the claim that he would be held indirectly liable under aiding and abetting liability theory. On June 1, 2005, the General Counsel of the Department of Health and Human Services ("HHS") considered whether "other persons" or individuals could be held indirectly liable under HIPAA for obtaining, from a covered entity, and disclosing protected health information of a third-party. HHS Memo at ¶ 1; see also ECF No. 6 at Exhibit 1. Consistent with the Court's finding, HHS concluded that such "other persons" could not be directly liable under HIPAA because only "health plans, health care clearinghouses, those health care providers specified in the statute, and Medicare prescription drug card sponsors may be prosecuted for violations of section 1320d-6." Id. Moreover, the HHS Memo concluded that "certain directors, officers, and employees of these entities may be liable directly under section 1320d-6." Id. As mentioned above, Plaintiff is neither a covered entity nor an employee or director at a covered entity. Finally, the HHS Memo concluded that "other persons may not be liable directly under this provision [but their liability may] be determined by principles of aiding and abetting liability and of conspiracy liability." Id. (emphasis added).
U.S. Dep't of Health and Hum. Serv's & The Senior Counsel to the Deputy Attorney General. Memorandum Opinion on Scope of Criminal Enforcement Under 42 U.S.C. § 1320d-6 (June 1, 2005). https://www.justice.gov/sites/default/files/olc/opinions/attachments/2014/11/17/hipaa final.htm ("HHS Memo")
--------
Under aiding and abetting or of conspiracy liability, a principle is liable if they "aid [ ], abet[ ], counsel[ ], command[ ], induce[ ] or procure[ ]" the commission of a crime. 18 U.S.C. § 2 (2000). The statute also punishes anyone who "willfully causes an act to be done which if directly performed by him or another would be an offense against the United States." Id. The conspiracy statute prescribes punishment "if two or more persons conspire ... to commit any offense against the United States ... and one or more of such persons do any act to effect the object of the conspiracy." 18 U.S.C. § 371 (2000). Accordingly, a plain reading of 42 U.S.C. § 1320d-6(a), shows that someone could be guilty of aiding and abetting if he or she "knowingly" agreed to help another person "disclose individually identifiable health information" of a third-party, without the third-party's authorization, in willful violation of HIPAA. Id. Here, however, Plaintiff has not pled any facts that support this claim. Rather, Enterprise asked Plaintiff to "keep Enterprise posted on his status" pertaining to COVID-19. ECF No. 1 at Exhibit 4 at ¶ 8. Then, Plaintiff "refused to provide the medical test results of his family member nor would he provide Enterprise with information regarding his family member's medical status." Id. at ¶ 9. Plaintiff also stated that he "refus[ed] to get tested and refus[ed] to provide Enterprise with medical test results and medical information related to his family member." Id. at ¶ 11. Thus, Plaintiff has not satisfied the element of showing that Enterprise and Plaintiff together conspired to obtain protected medical records of Plaintiff's family members with the intent to violate HIPAA. Similarly, Plaintiff did not allege that Enterprise coerced Plaintiff into obtaining and disclosing the protected medical information to knowingly and willingly violate HIPAA. Rather, Enterprise wanted an update on Plaintiff and his family members COVID-19 condition.
Still, Plaintiff argues that he could not disclose his family members medical records without their consent because it would subject him to criminal liability on a theory of aiding and abetting the commission of a crime by a covered entity (i.e. his mother's healthcare provider). However, Enterprise did not ask him to do so. Based on his own complaint, Plaintiff was merely asked by Enterprise to keep them updated about his and his family member's COVID-19 status for the safety of other employees. That is, Enterprise did not require, command, nor conspire with Petitioner to unlawfully disclose individually identifiable health information in violation of HIPAA. Plaintiff was only asked to inform Enterprise about whether he and his family member were positive/negative for COVID-19, without needing to identify his family member specifically or disclose a record. Also, Petitioner was not asked to share this information without the consent or authorization of his family member.
Stated differently, Plaintiff has not pled or provided any evidence supporting that he was "asked or directed by his employer to commit a crime" with respect to HIPAA. Weidman v. Exxon Mobil Corp. , 2016 WL 4051277, at *6, 2016 U.S. Dist. LEXIS 98059, at *17 (E.D. Va. July 26, 2016), aff'd, 717 F. App'x 214 (4th Cir. 2018) (citing McFarland v. Virginia Ret. Servs. of Chesterfield, L.L.C. , 477 F. Supp. 2d 727, 736 n.4 (E.D. Va. 2007) ) (dismissing wrongful discharge claim because plaintiff cannot establish that she was "asked to break the law"); Scates v. Shenandoah Mem'l Hosp. , 2015 WL 6143457, at *11, 2015 U.S. Dist. LEXIS 141526, at *26 (W.D. Va. Oct. 16, 2015) (dismissing wrongful discharge claim because plaintiff "fails to allege any facts to show that [the defendant] asked or directed her to commit criminal acts"); Dunn v. Millirons , 176 F. Supp. 3d 591, 600 (W.D. Va. 2016) (dismissing wrongful discharge claim where plaintiff "cites to no evidence suggesting that he was asked to participate in the alleged criminal conduct").
Therefore, the Court finds that since Plaintiff was not asked to obtain and disclose individually identifiable health information in violation of HIPAA, Plaintiff was not subject to criminal liability. Accordingly, Plaintiff's claim is dismissed. C. Wells' Claim for Wrongful Termination Fails Because He Did Not Violate State Law.
Plaintiff alleges that "Enterprise and Mann specifically demanded that Wells divulge" his own "individually identifiable health information" and that of his family member, in violation of 42 U.S.C. § 1320 (d)(6). ECF No. 1 at Exhibit 4 at ¶ 14-15. Plaintiff then claims that he "refused to engage in the disclosure" and that, then, "Enterprise and Mann knowingly and intentionally terminated Wells' employment because he refused to engage in criminal activity in that Wells refused to violate HIPAA and refuses to engage in the aiding and abetting of a criminal violation of HIPP." Id. at ¶ 14-15.
In Virginia, employment is presumed to be at-will, "meaning employment lasts for an indefinite term and can be terminated for almost any reason." Carmack v. Virginia , 2019 WL 1510333, at *9, 2019 U.S. Dist. LEXIS 58816, at *29 (W.D. Va. April 5, 2019) (citing Lockhart v. Commonwealth Educ. Sys. Corp. , 247 Va. 98, 102, 439 S.E.2d 328 (1994) ). However, Virginia courts have created a narrow exception to this doctrine for at-will employees who "claim to have been discharged in violation of public policy." Id. at *9, 2019 U.S. Dist. LEXIS 58816, at *29-30 (citing Bowman v. State Bank of Keysville , 229 Va. 534, 331 S.E.2d 797 (1985) ). The Supreme Court of Virginia has recognized only three situations in which "a litigant may show [his] discharge violated public policy." Id. at *9, 2019 U.S. Dist. LEXIS 58816, at *30; see also, City of Virginia Beach v. Harris , 259 Va. 220, 523 S.E.2d 239, 245 (2000).
The first is a statute stating explicitly that it expresses a public policy of the Commonwealth. The second, and far more common category, consists of statutes that do not explicitly state a public policy, but rather "are designed to protect the property rights, personal freedoms, health, safety or welfare of the people in general," and thereby further an underlying, established public policy that is violated by the discharge at issue. Anderson v. ITT Indus. Corp. , 92 F. Supp. 2d 516, 521 (E.D. Va. 2000) (citing Harris , 523 S.E.2d at 245 ) (internal quotation marks omitted); Bowman , 331 S.E.2d at 801. Yet, even if a statute falls within one of these categories, it may not serve as the basis of a Bowman claim, unless the aggrieved employee also shows that he or she is a member of the class of individuals the public policy is intended to benefit. See Mitchem ; Dray v. New Market Poultry Products, Inc. , 258 Va. 187, 518 S.E.2d 312, 313 (1999). In other words, to state a Bowman claim, the discharged employee must show that he or she "fell within the protective reach of the statute which supplied the public policy component of his or her claim." Leverton v. AlliedSignal, Inc. , 991 F.Supp. 486, 493 (E.D. Va. 1998).
The Third is, "where the discharge was based on the employee's refusal to engage in a criminal act." Carmack, at *9, 2019 U.S. Dist. LEXIS 58816, at *30 (quoting Rowan v. Tractor Supply Co. , 263 Va. 209, 559 S.E. 2d 709, 711 (2002) ); see also, Mitchem v. Counts , 259 Va. 179, 190, 523 S.E.2d 246, 251 (2000) (holding that the employment-at-will doctrine "serve[s] as a shield for employers who seek to force their employees, under the threat of discharge, to engage in criminal activity" which would violate a public policy).
The public policy on which a plaintiff must rely to qualify for the first and second Bowman exceptions must be expressed in an existing Virginia statute. Lawrence Chrysler Plymouth Corp. v. Brooks , 251 Va. 94, 98–99, 465 S.E.2d 806 (1996) ("[Plaintiff] does not have a cause of action for wrongful discharge because he is unable to identify any Virginia statute establishing a public policy that [defendant] violated...."); See Oakley v. May Dep't Stores, Co. , 17 F.Supp.2d 533, 536 (E.D. Va. 1998) ; Wenig v. Hecht Co. , 47 Va. Cir. 290, 1998 WL 972350, at *3 (Fairfax Cty. 1998) ("Wenig [the plaintiff] argues that a federal statute can serve as the basis for her wrongful termination action. This argument fails in that Wenig is obliged to cite a Virginia statute to support her claim."); See Anderson v. ITT Indus. Corp. , 92 F.Supp.2d 516, 523 n. 18 (E.D. Va. 2000) ("[P]laintiff will have to prove ... that all of the elements of [the] statute were met"). Here, Plaintiff has not alleged any Virginia state law to qualify for the first or second Bowman exception.
Similarly, and most relevant to the instant case, to meet the third exception of Rowan , Plaintiff must show that he could have been prosecuted under Virginia criminal law had he engaged in the conduct demanded by his employer. See Twigg v. Triple Canopy, Inc. , No. 1:10CV122 (JCC), 2010 WL 2245511, at *3 (E.D. Va. June 2, 2010) ; see also, Scates v. Shenandoah Mem'l Hosp. , No. 5:15-CV-00032, 2015 WL 6143457 (W.D. Va. Oct. 19, 2015)
The statute upon which Plaintiff relies is a federal statute. As mentioned above in Section III.B, Plaintiff has not pleaded sufficient facts to show that he would have been criminally liable for violating HIPAA. Similarly, Wells fails to allege any facts to show that Enterprise "asked or directed [him] to commit criminal acts, [his] termination could not be related to [his] refusal to commit a crime" under Virginia criminal law. Scates at *11 (citing Storey v. Patient First Corp. , 207 F.Supp.2d 431, 453 (E.D. Va. 2002) ). As such, Wells cannot meet the third Rowan exception to Virginia's employment-at-will doctrine. Since Wells fails to state a plausible claim for wrongful termination claim under any of the three exceptions provided by Virginia law, Enterprise's motion to dismiss this claim is GRANTED.
IV. CONCLUSION
Based on the foregoing reasons, Defendant's Motion to Dismiss is GRANTED.