Opinion
Case No. 2:17-cv-01201-RDP
02-14-2018
JORDAN BOCAGE, et al., Plaintiffs, v. ACTON CORPORATION, et al., Defendants.
MEMORANDUM OPINION
This matter is before the court on Defendant IM Records, Inc.'s Motion to Dismiss or, in the Alternative, to Strike the Class Definition (Docs. # 13; 14) and Defendant Acton Corporation's Motion to Dismiss (Doc. # 37). The Motions are fully briefed. (Docs. # 13; 14; 27; 33; 37; 43; 44). On December 14, 2017, the court held a hearing on these Motions. For the reasons explained below, both Motions (Docs. # 13; 37) are due to be granted.
I. Background
Plaintiffs allege that they requested medical records from Defendants and were charged improper search and retrieval fees in violation of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"). (Doc. # 1). Plaintiff Joel Kelly ("Kelly") alleges that he requested his medical records from Defendant Acton Corporation ("Acton") six different times and was charged and paid a $5.00 retrieval fee to Acton for each of his requests. (Id. at ¶ 31-36). Plaintiff Sheila Garrett ("Garrett") alleges that she requested her medical records from Acton and was charged and paid a $5.00 retrieval fee to Acton for this request. (Id. at ¶ 40). Plaintiff Jordan Bocage ("Bocage") alleges that she requested her medical records from Defendant IM Records, Inc. ("IM Records") two different times and was charged and paid a $5.00 search and retrieval fee to IM Records for each of her requests. (Id. at ¶ 42-43).
On July 18, 2017, Plaintiffs filed this action, seeking damages under Alabama state law claims of unjust enrichment, negligent misrepresentation, fraudulent misrepresentation, breach of implied contract, and conversion. (Doc. # 1). Plaintiffs also seek declaratory and injunctive relief. (Id.). Plaintiffs brought this action on behalf of themselves and a class of similarly situated individuals "who were assessed a 'retrieval' or 'search fee' from 2013 to the present from Defendants for the procurement and/or purchase of the protected health information." (Id. at ¶ 45). IM Records filed its Motion to Dismiss or, in the Alternative, to Strike the Class Definition on October 11, 2017. (Doc. # 13). Acton filed its Motion to Dismiss on November 20, 2017. (Doc. # 37). As appendixes to their motions to dismiss, Defendants Acton and IM Records included copies of each of Plaintiffs' medical records requests, which show that these requests were made by Plaintiffs' attorneys, not by Plaintiffs themselves. (Docs. # 13-1; 37-1).
II. The Documents Defendants Attached to their Complaint Are Central to Plaintiffs' Claims and Undisputed
"The district court generally must convert a motion to dismiss into a motion for summary judgment if it considers materials outside the complaint." Day v. Taylor, 400 F.3d 1272, 1275-76 (11th Cir. 2005) (citing Fed. R. Civ. P. 12(b)). However, a "court may consider a document attached to a motion to dismiss without converting the motion into one for summary judgment if the attached document is (1) central to the plaintiff's claim and (2) undisputed. Id. at 1276. Both of these elements are met here.
The documents are central to Plaintiffs' claims for at least two reasons. First, Plaintiffs explicitly reference these documents and thereby incorporate these requests and invoices into their Complaint. (Doc. # 1 at ¶ 31-36, 40, 42-43); see Taylor, 400 F.3d at 1276 (explaining that if a "document's contents are alleged in a complaint and no party questions those contents," the court may consider the attached document if it is central to the plaintiff's claim). Second, the documents are "at the very heart of" Plaintiffs' claims because Plaintiffs' claims center on whether Plaintiffs were improperly charged (via the referenced invoices attached to Defendants' motions to dismiss) for their medical records requests. See Taylor, 400 F.3d at 1276.
Plaintiffs do not dispute that Defendants' attached documents are central to Plaintiffs' claims nor do they dispute the authenticity of the documents. Moreover, the documents are accompanied by authenticating affidavits that attest to their accuracy. See id. (noting that an attached document is "undisputed" if "the authenticity of the document is not challenged"). Rather than directly challenging the centrality and/or authenticity of the documents at issue, Plaintiffs argue that the court must accept the allegations in the Complaint that "each of the individual Plaintiffs requested their [medical records]" as true. (Docs. # 27 at p. 3; 43 at ¶ 3). But, this argument misses the mark. The court need not accept the conclusory allegation that Plaintiffs' individually requested their medical records from Defendants if, in fact, Defendants have put forth undisputed documents -- that are both referenced in Plaintiffs' Complaint and are central to their claims -- showing otherwise. As such, the court may consider these appendixes without converting Defendants' motions to dismiss into motions for summary judgment. See Taylor, 400 F.3d at 1275.
III. Standard of Review
The Federal Rules of Civil Procedure require only that the complaint provide "a short and plain statement of the claim showing that the pleaser is entitled to relief." Fed. R. Civ. P. 8(a)(2). However, the complaint must include enough facts "to raise a right to relief above the speculative level." Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). Pleadings that contain nothing more than "a formulaic recitation of the elements of a cause of action" do not meet Rule 8 standards, nor do pleadings suffice that are based merely upon "labels and conclusions" or "naked assertion[s]" without supporting factual allegations. Twombly, 550 U.S. at 555, 557. In deciding a Rule 12(b)(6) motion to dismiss, courts view the allegations in the complaint in the light most favorable to the non-moving party. Watts v. Fla. Int'l. Univ., 495 F.3d 1289, 1295 (11th Cir. 2007).
To survive a motion to dismiss, a complaint must "state a claim to relief that is plausible on its face." Twombly, 550 U.S. at 570. "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Although "[t]he plausibility standard is not akin to a 'probability requirement,'" the complaint must demonstrate "more than a sheer possibility that a defendant has acted unlawfully." Id. A plausible claim for relief requires "enough fact[s] to raise a reasonable expectation that discovery will reveal evidence" to support the claim. Twombly, 550 U.S. at 556.
In considering a motion to dismiss, a court should "1) eliminate any allegations in the complaint that are merely legal conclusions; and 2) where there are well-pleaded factual allegations, 'assume their veracity and then determine whether they plausibly give rise to an entitlement to relief.'" Kivisto v. Miller, Candield, Paddock & Stone, PLC, 413 Fed. App'x 136, 138 (11th Cir. 2011) (quoting Am. Dental Assn. v. Cigna Corp., 605 F.3d 1283, 1290 (11th Cir. 2010)). That task is context specific and, to survive the motion, the allegations must permit the court based on its "judicial experience and common sense . . . to infer more than the mere possibility of misconduct." Twombly, 550 U.S. at 556. Further, "courts may infer from the factual allegations in the complaint 'obvious alternative explanation[s],' which suggest lawful conduct rather than the unlawful conduct the plaintiff would ask the court to infer." Am. Dental, 605 F.3d at 1290 (quoting Iqbal, 556 U.S. at 682). If the court determines that well-pleaded facts, accepted as true, do not state a claim that is plausible, the claims are due to be dismissed. Twombly, 550 U.S. at 556.
IV. Analysis
Both Defendant Acton and Defendant IM Records argue that (1) all of Plaintiffs' claims are due to be dismissed because medical record requests by attorneys are not subject to the fee restrictions imposed by HIPAA and the HITECH Act and (2) Plaintiffs' misrepresentation claims, in particular, are due to be dismissed because (a) Defendants never made an actionable representation to Plaintiffs and (b) Plaintiffs have not plausibly alleged their reliance on any such representations. (Docs. # 14, 37). Defendant IM Records also contends that Plaintiffs' claims are improperly repackaged HIPAA claims for which no private right of action exists. (Doc. # 14). The court evaluates each of these arguments, in turn.
Defendant IM Records also alleges that "Plaintiffs lack standing to bring and/or have failed to sufficiently allege claims for negligent and fraudulent misrepresentation" and move to dismiss these claims under Rule 12(b)(1). (Doc. # 14). Because the court finds that Plaintiffs have not plausibly alleged violations of HIPAA and the HITECH Act, it need not address Defendant IM Records' standing arguments.
If the court does not dismiss this action, Defendant IM Records asks the court to strike the class definition because -- as IM Records argues -- the court lacks personal jurisdiction over the putative class claims of requestors who are not residents of Alabama. (Doc. # 14). Because the court finds that this action is due to be dismissed on other grounds, the court finds it unnecessary to decide Defendant IM Records' Motion to Strike.
A. HIPAA and the HITECH Act Restrictions on Charges for Medical Records Apply to Individuals and Individuals' Personal Representatives
Ultimately, the parties' disagreement about Plaintiffs' claims centers on whether a medical record request by an individual's attorney may be subject to the fee restrictions imposed by HIPAA and the HITECH Act. To answer this question, the court first examines "the statutory text, and proceed[s] from the understanding that [u]nless otherwise defined, statutory terms are generally interpreted in accordance with their ordinary meaning." Sebelius v. Cloer, 569 U.S. 369, 376 (2013) (internal quotations omitted); see also Hallstrom v. Tillamook Cty., 493 U.S. 20, 25 (1989) ("'[T]he starting point for interpreting a statute is the language of the statute itself.'"). The court has a duty to refrain from reading words or elements into a statutory or regulatory text. See Dean v. United States, 556 U.S. 568, 572 (2009). Likewise, the court construes "'[r]egulations with a common sense regard for regulatory purposes and plain meaning.'" Bivens v. Bank of Am., N.A., 868 F.3d 915, 920 (11th Cir. 2017) (quoting United States v. Fuentes-Coba, 738 F.2d 1191, 1195 (11th Cir. 1984)). "[A]gency interpretations are 'entitled to respect . . . to the extent that those interpretations have the power to persuade.'" United States v. R&F Properties of Lake Cty., Inc., 433 F.3d 1349, 1357 (11th Cir. 2005) (quoting Christensen v. Harris Cty., 529 U.S. 576, 587 (2000)).
Congress enacted HIPAA to improve "the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information." HIPAA § 261, Pub. L. No. 104-191, 110 Stat. 1936. HIPAA directs the Secretary of the U.S. Department of Health and Human Services ("HHS") to develop regulations to achieve HIPAA's purpose. See 42 U.S.C. § 1320d-2. In doing so, HHS published the HIPAA Privacy Rule, which provides that "an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set." 45 C.F.R. § 164.524(a)(1) (emphasis added).
HIPAA further specifies as follows:
If the individual requests a copy of the protected health information or agrees to a summary or explanation of such information, the covered entity may impose a reasonable, cost-based fee, provided that the fee includes only the cost of: (i) Labor for copying the protected health information requested by the individual, whether in paper or electronic form; (ii) Supplies for creating the paper copy or electronic media if the individual requests that the electronic copy be provided on portable media; (iii) Postage, when the individual has requested the copy, or the summary or explanation, be mailed; and (iv) Preparing an explanation or summary of the protected health information, if agreed to by the individual as required by paragraph (c)(2)(iii) of this section.45 C.F.R. § 164.524(c)(4) (emphasis added). HHS has clarified that § 164.524(c)(4) "limits only the fees that may be charged to individuals, or to their personal representatives in accordance with § 164.502(g), when the request is to obtain a copy of protected health information about the individual in accordance with the right of access. The fee limitations in § 164.524(c)(4) do not apply to any other permissible disclosures by the covered entity, including . . . disclosures that are based on an individual's authorization . . . ." 67 Fed. Reg. 53182, 53254 (Aug. 14, 2002).
Application of this regulation to the facts of this case centers on the definition of the term "individual" as used in HIPAA. "Individual" is defined as "the person who is the subject of the protected health information." 45 C.F.R. § 160.103. A personal representative (and that term is defined as a person who "under applicable law . . . has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care") must be treated as the individual. Id. at §§ 164.502(g)(1), (2).
In Webb v. Smart Document Solutions, LLC, the Ninth Circuit held that the definition of "individual," as used in HIPAA does not encompass designated agents, such as personal attorneys. Webb v. Smart Document Sols., LLC, 499 F.3d 1078 (9th Cir. 2007). As the Ninth Circuit explained, "the regulations restrict the fee limitations to requests made by the individual and concretely define 'individual' in a way that excludes others acting on that individual's behalf." Id. at 1084. Using the statutory canon "expressio unius est exclusio alterius, which 'creates a presumption that when a statute designates certain persons, things, or manners of operation, all omissions should be understood as exclusions,'" the Webb court noted that HHS explicitly provided for one situation in which persons other than the individual may be treated as the individual and that situation only occurs "when a 'personal representative' is authorized to make healthcare-related decisions for an individual." Id. (citing Silvers v. Sony Pictures Entm't, Inc., 402 F.3d 881, 885 (9th Cir. 2005) (en banc) and 45 C.F.R. § 164.502(g)). Of course, HHS was "fully capable of writing in an even broader definition" of the term "individual," and HHS "considered adopting a broader definition of 'individual' that would have included legal representatives, but in the final rule ultimately decided against it." Id. at 1085 (citing 65 Fed. Reg. 82492). Ultimately, HHS eliminated from the final rule the provisions designating a legal representative as an "individual" and instead chose to include a separate standard for personal representatives. Id. (citing 65 Fed. Reg. 82492).
The court finds the Ninth Circuit's analysis of HIPAA requirements (or, at least, the HIPPA requirements in place before 2009) persuasive. However, after the Ninth Circuit ruled on Webb v. Smart Document Solutions, LLC, Congress enacted the HITECH Act. See Pub. L. No. 111-5, Title XIII, 123 Stat. 226 (2009). Plaintiffs argue that the enactment of the HITECH Act makes Webb inapplicable to the facts of this case. The HITECH Act expanded HIPAA to include individuals' rights to obtain electronic health records and added stronger privacy and security requirements to protect health information. See id. Specifically (and of particular relevance to this case), the HITECH Act provides as follows:
In applying section 164.524 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic health record with respect to protected health information of an individual-- (1) the individual shall have a right to obtain from such covered entity a copy of such information in an electronic format and, if the individual chooses, to direct the covered entity to transmit such copy directly to an entity or person designated by the individual, provided that any such choice is clear, conspicuous, and specific; (2) if the individual makes a request to a business associate for access to, or a copy of, protected health information about the individual, or if an individual makes a request to a business associate to grant such access to, or transmit such copy directly to, a person or entity designated by the individual, a business associate may provide the individual with such access or copy, which may be in an electronic form, or grant or transmit such access or copy to such person or entity designated by the individual; and (3) notwithstanding paragraph (c)(4) of such section, any fee that the covered entity may impose for providing such individual with a copy of such information (or a summary or explanation of such information) if such copy (or summary or explanation) is in an electronic form shall not be greater than the entity's labor costs in responding to the request for the copy (or summary or explanation).42 U.S.C. § 17935(e).
In January 2013, HHS published a final rule modifying the Privacy, Security, and Enforcement Rules of HIPAA in order to implement the statutory amendments under the HITECH Act. See 78 Fed. Reg. 5566, 5566. Under the Final Rule, HSS amended the HIPAA Privacy Rule to include the following provision:
If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information.45 C.F.R. § 164.524(c)(3)(ii); see also 78 Fed. Reg. 5566, 5702. Plaintiffs argue that § 164.524(c)(3)(ii) in combination with § 164.524(c)(4) establishes that Defendants improperly charged Plaintiffs' legal representatives retrieval fees because Plaintiffs provided Defendants with written requests, signed by the individuals, that clearly identified their attorneys as their designees for the transmissions of their protected health information. (Doc. # 27). Defendants counter that Plaintiffs' requests do not qualify as patient directives because Plaintiffs' attorneys, rather than the individuals themselves, requested the Plaintiffs' protected health information from Defendants. (Docs. # 33, 37, 44).
The court agrees with Defendants that the language of the regulation suggests that, in order for the HIPAA fee restrictions under 45 C.F.R. § 164.524(c)(4) to apply, the overarching requirement is that the individual, or a personal representative of the individual, must request his or her protected health information. Section 164.524(c)(3)(ii) does not alter this requirement; rather, it plainly provides three requirements that must be met for an individual to request a covered entity to transmit that individual's protected health information directly to another person: (1) the request must be in writing, (2) the request must be signed by the individual, and (3) the request must clearly identify the designated person and where the individual's personal health information is to be sent. 45 C.F.R. § 164.524(c)(3)(ii). Furthermore, it is reasonable to understand that, in order for §§ 164.524(c)(3)(ii) and 164.524(c)(4) to apply, an "individual" must request the covered entity to transmit his or her protected health information, not merely authorize his or her protected health information to be disclosed.
However, the fee restriction language in HIPAA leaves room for confusion, especially when applied to the facts of this case. At first glance, Plaintiffs' interpretation that, following the HITECH Act, the fee limitations in 45 C.F.R. § 164.524(c)(4) applied to attorneys requesting personal health information on behalf of their clients and with their clients' authorizations presents a decent argument. See Young v. Cmty. Nutrition Inst., 476 U.S. 974, 988 (1986) (Stevens, J., dissenting) ("The task of interpreting a statute requires more than merely inventing an ambiguity and invoking administrative deference. A statute is not 'unclear unless we think there are decent arguments for each of two competing interpretations of it.'") (quoting R. DWORKIN, LAW'S EMPIRE 352 (1986)). These conflicting reasonable interpretations arguably create ambiguity and, therefore, the court turns to administrative guidance. See Scialabba v. Cuellar de Osorio, 134 S. Ct. 2191, 2195 (2014) ("When an agency thus resolves statutory tension, ordinary principles of administrative deference require this Court to defer."). Plaintiffs and Defendants agree that, in this case, the court should defer to HHS guidance. Unfortunately for Plaintiffs, this guidance does not support their positions.
HHS guidance on when HIPAA fee limitations apply establishes that an individual or an individual's personal representative -- not merely the individual's attorney -- must directly request the protected health information. See Individuals' Rights under HIPAA to Access Their Health Information 45 CFR § 164 .524, U.S. Dep't of Health & Human Services (Feb. 25, 2016), https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index. html#newlyreleasedfaqs (last visited Dec. 13, 2017). HHS explains,
The fee limits apply when an individual directs a covered entity to send the PHI to the third party. . . . [W]ritten access requests by individuals to have a copy of their PHI sent to a third party that include [the] minimal elements [of 45 CFR 164.524(c)(3)(ii)] are subject to the same fee limitations in the Privacy Rule that apply to requests by individuals to have a copy of their PHI sent to themselves. This is true regardless of whether the access request was submitted to the covered entity by the individual directly or forwarded to the covered entity by a third party on behalf and at the direction of the individual (such as by an app being used by the individual). Further, these same limitations apply when the individual's personal representative, rather than the individual herself, has made the request to send a copy of the individual's PHI to a third party.Id. (emphasis added). HHS's explicit statement that a third party initiating a request for PHI on its own behalf with the individual's HIPAA authorization (as was done in this case) is not subject to the HIPAA fee limitations confirms Defendants' legal and factual position in this case and runs directly contrary to Plaintiffs' proposed construction of 45 C.F.R. §§ 164.524(c)(3)(ii) and 164.524(c)(4). See id. After examining guidance from HHS, the court holds that a legal representative who requests an individual's protected health information (and is not a personal representative of the individual) is not entitled to the fee limitations imposed under HIPAA by 45 C.F.R. § 164.524(c)(4). See Auer v. Robbins, 519 U.S. 452, 457 (1997) ("Because Congress has not 'directly spoken to the precise question at issue,' we must sustain the Secretary's approach so long as it is 'based on a permissible construction of the statute.'") (quoting Chevron, U.S.A., Inc. v. Nat. Res. Def. Council, Inc., 467 U.S. 837, 842-43 (1984)).
In contrast, third parties often will directly request PHI from a covered entity and submit a written HIPAA authorization from the individual (or rely on another permission in the Privacy Rule) for that disclosure. Where the third party is initiating a request for PHI on its own behalf , with the individual's HIPAA authorization (or pursuant to another permissible disclosure provision in the Privacy Rule), the access fee limitations do not apply. However, as described above, where the third party is forwarding - on behalf and at the direction of the individual - the individual's access request for a covered entity to direct a copy of the individual's PHI to the third party, the fee limitations apply.
All of Plaintiffs' claims are premised on the allegation that Defendants improperly charged Plaintiffs fees in violation of HIPAA and the HITECH Act. (Doc. # 1). The court finds that Plaintiffs have not plausibly alleged that Defendants charged Plaintiffs improper fees because attorneys are not subject to the HIPAA and HITECH Act fee limitations. Therefore, Plaintiffs' Complaint is due to be dismissed. See Twombly, 550 U.S. at 570.
B. Plaintiffs' Misrepresentation Claims Fail Because Plaintiffs Do Not Allege Reliance on Defendants' Representations
Counts II and III of Plaintiffs' Complaint allege that Defendants made negligent and fraudulent misrepresentations to Plaintiffs by collecting search and retrieval fees from Plaintiffs. (Doc. # 1 at ¶¶ 61- 68). Neither count states a claim.
In order to establish a negligent misrepresentation claim under Alabama law, a plaintiff must establish the following:
(a) a false representation of an existing material fact; (b) a representation (1) that the speaker knew was false when made, (2) that was made recklessly and without regard to its truth or falsity, or (3) that was made by telling the listener that the speaker had knowledge that the representation was true while having no such knowledge; (c) reliance by the listener on the representation, coupled with deception by it; (d) the reasonableness of that reliance under the circumstances; and (e) damage to the listener proximately resulting from his or her reasonable reliance.Pace v. Alfa Mut. Ins. Co., 178 F. Supp. 3d 1201, 1220 (M.D. Ala. 2016) (internal quotations omitted) (quoting City of Prattville v. Post, 831 So.2d 622, 628 (Ala. Civ. App. 2002)). To establish a fraudulent misrepresentation claim under Alabama law, "a plaintiff must show: '(1) a false representation (2) concerning a material existing fact (3) [reasonably] relied upon by the plaintiff (4) who was damaged as a proximate result.'" Id. at 1216 (quoting Fisher v. Comer Plantation, Inc., 772 So.2d 455, 463 (Ala. 2000)).
The court agrees with Defendants that Plaintiffs do not plausibly plead negligent and fraudulent misrepresentation claims under Alabama law because Plaintiffs have not plausibly alleged that Defendants made a representation to Plaintiffs or that Plaintiffs relied on any representation that Defendants made. When requesting Plaintiffs' protected health information from Defendants, Plaintiffs' attorneys communicated directly with Defendants. (Docs. # 13-1; 37-1). Plaintiffs and Defendants were never in contact with one another. As a result, Plaintiffs cannot plausibly allege that any misrepresentation was made to them by Defendants.
Furthermore, a misrepresentation claim requires the establishment of a false representation. See Pace, 178 F. Supp. 3d at 1216, 1220. As discussed above, the court finds that the fees Defendants charged were not improper under HIPAA and the HITECT Act. Accordingly, based on the facts alleged, Plaintiff cannot establish the false statement element of a misrepresentation claim.
Additionally, at best, Plaintiffs have presented a misrepresentation of law, not fact. "Alabama law on fraud . . . generally requires a misrepresentation of a material fact." Randolph Cty. v. Ala. Power Co., 784 F.2d 1067, 1070 (11th Cir. 1986); see Johnson v. Sorensen, 914 So. 2d 830, 839 (Ala. 2005) ("'It has been said that misrepresentation or concealment as to matter of law cannot constitute remedial fraud, because everyone is presumed to know the law, and therefore cannot in legal contemplation be deceived by erroneous statements of law, and such representations are ordinarily regarded as mere expressions of opinion on which the hearer has no right to rely.'") (quoting Best v. Best, 25 So.2d 723, 725 (1946)). Exceptions to this general rule arise when the speaker of an alleged misrepresentation was an attorney or "where to hold to the contrary would be against public policy." Randolph Cty., 784 F.2d at 1070. Plaintiffs do not argue that either exception applies in this case. Indeed, even if viewed as a misrepresentation of law claim, the misrepresentation was made to Plaintiffs' attorneys. Therefore, regardless of whether HIPAA fee limitations apply to attorneys requesting an individual's protected health information, Plaintiffs' misrepresentations claims are due to be dismissed.
C. The Court Declines to Decide Whether Plaintiffs' Other State Law Claims Based on Alleged HIPAA Violations Are Improper
In addition to Plaintiffs' misrepresentation claims against Defendants, Plaintiffs also allege state law claims of unjust enrichment, breach of implied contract, and conversion. (Doc. # 1). Defendant IM Record argues that Plaintiffs' claims are improperly repackaged HIPAA claims for which no private right of action exists. (Doc. # 14, 33). In reply, Plaintiffs contend that, because a violation of a federal or state statute may support state law claims and because Plaintiffs have only pleaded Alabama state law claims seeking damages for Defendants' alleged violations of HIPAA and the HITECH Act, Plaintiffs are not foreclosed from pleading state law claims based on alleged HIPAA violations. (Doc. # 27).
"[P]rivate rights of action to enforce federal law must be created by Congress." Alexander v. Sandoval, 532 U.S. 275, 286 (2001). The Eleventh Circuit has "decline[d] to hold that HIPAA creates a private cause of action." Sneed v. Pan Am. Hosp., 370 F. App'x 47, 50 (11th Cir. 2010); see Crawford v. City of Tampa, 397 F. App'x 621, 623 (11th Cir. 2010) ("[N]o private right of action exists under the Health Insurance Portability and Accountability Act."). Although the Eleventh Circuit has not ruled on whether an alleged HIPAA violation may support a state law claim, it has held that HIPAA does not create a private cause of action or an enforceable right in the context of § 1983. See Sneed, 370 F. App'x at 50. In dicta, the Eleventh Circuit has also noted that "the Fifth Circuit and numerous district courts have concluded that there is no private right of action for a violation of HIPAA's confidentiality provisions." Bradley v. Pfizer, Inc., 440 F. App'x 805, 809 (11th Cir. 2011) (finding that an invasion of privacy claim that was based on a HIPAA violation was not actionable).
Plaintiffs argue that the fact that no private right of action exists under HIPAA does not preclude a cause of action based on an alleged HIPAA violation under Alabama law. (Doc. # 27 at p. 10-13). In support of their argument, Plaintiffs point to the Middle District of Alabama's ruling in Smith v. Triad of Alabama, No. 1:14-CV-324-WKW, 2015 WL 5793318, at *11-13 (M.D. Ala. Sept. 29, 2015). In Smith, the court allowed a negligence per se action that was based on a violation of HIPAA to proceed past the motion to dismiss stage because (1) "no binding precedent [exists] holding that a HIPAA violation is not a proper basis for a negligence per se claim under Alabama law," and (2) Alabama case law allows negligence per se claims to be based on both federal and state statutes even when a private right of action is not contemplated by the statute in question. See Smith, 2015 WL 5793318, at *11-12 ("In light of Defendant's failure to provide precedent binding on this court holding that HIPAA cannot serve as the basis of a negligence per se claim, coupled with the Allen [v. Delchamps, Inc., 624 So.2d 1065 (Ala. 1993)] decision, which indicates Alabama court's willingness to allow statutes that do not otherwise provide private causes of action to serve as the basis for a negligence per se claim, Plaintiffs' negligence per se claim is not due to be dismissed on the basis that it is not cognizable as a matter of law.").
The ruling in Smith regarding a negligence per se claim does not necessarily apply to Plaintiffs' unjust enrichment, breach of implied contract, and conversion claims. In a negligence per se claim, a plaintiff points to a law and argues that the law creates a duty and establishes a statutory standard of care. See Emery v. Talladega Coll., 688 F. App'x 727, 730 (11th Cir. 2017). But the existence of a duty is not an element necessary to establish unjust enrichment, breach of implied contract, and conversion claims. See, e.g., Portofino Seaport Vill., LLC v. Welch, 4 So. 3d 1095, 1098 (Ala. 2008) ("To prevail on a claim of unjust enrichment under Alabama law, a plaintiff must show that: (1) the defendant knowingly accepted and retained a benefit, (2) provided by another, (3) who has a reasonable expectation of compensation."); Ellis v. City of Birmingham, 576 So. 2d 156, 157 (Ala. 1991) (explaining that a breach of implied contract claims involves the same elements as an express contract and differs only in the method of expressing mutual assent); Schaeffer v. Poellnitz, 154 So. 3d 979, 988 (Ala. 2014) ("For a conversion claim to stand, there must be a wrongful taking or a wrongful detention or interference, an illegal assumption of ownership, or an illegal use or misuse of another's property.") (internal quotations omitted). Accordingly, the court is not convinced that an alleged HIPAA violation creates actionable unjust enrichment, breach of implied contract, and conversion claims under Alabama law. But, in any event, because the court holds that Defendants did not violate HIPAA or the HITECH Act and all of Plaintiffs' claims are based on Defendants alleged violations of these Acts, the court finds it unnecessary to explore whether, and to what extent, a state law claim may be based on alleged HIPAA violations.
V. Conclusion
For the reasons outlined above, Defendants' Motions to Dismiss are due to be granted. As such, this action is due to be dismissed without prejudice. An Order consistent with this Memorandum Opinion will be entered.
DONE and ORDERED this February 14, 2018.
/s/_________
R. DAVID PROCTOR
UNITED STATES DISTRICT JUDGE