Opinion
8:07cv141.
May 29, 2007
MEMORANDUM AND ORDER
This matter is before the court on Filing No. 8, the Motion to Clarify Order filed by the plaintiff, Donald J. Dockery, who seeks clarification of the Order on Initial Review (Filing No. 7) entered on May 5, 2007. The plaintiff brings this action against the Douglas County Correctional Center ("DCCC"), where he is incarcerated, and Correctional Medical Services ("CMS"), a company which provides medical services to inmates at the DCCC. According to the complaint, the defendants improperly disclosed private medical information about the plaintiff, in violation of the Health Insurance Portability and Accountability Act ("HIPPA" or "HIPAA").
As discussed in the Order on Initial Review, HIPAA does not authorize a private right of action. In Filing No. 8, the plaintiff poses the question: What does it mean and what are the consequences when Congress has not provided for a private right of action in a statutory scheme such as HIPAA? Because the Order on Initial Review only briefly addressed that matter, this Memorandum and Order will explain the applicable legal principles in greater detail.
In Doe v. Board of Trustees of University of Illinois, 429 F. Supp.2d 930, 944 (N.D. Ill. 2006), the plaintiff argued that the defendants had violated his constitutional and statutory privacy rights by unlawfully disclosing the plaintiff's medical records. The court agreed with the defendants that the plaintiff had failed to state a claim on which relief could be granted, stating: "First, [the plaintiff] contends that defendants have violated the federal Health Insurance Portability and Accountability Act. Every court to have considered the issue, however, has concluded that HIPAA does not authorize a private right of action. See, e.g., Runkle v. Gonzales, 391 F. Supp.2d 210, 237 (D. D.C. 2005); Dominick J. v. Wyoming Valley West High Sch., 362 F. Supp.2d 560, 572 (M.D. Pa. 2005). The Court agrees with these decisions; HIPAA provides civil and criminal penalties for improper disclosures of medical information, but it does not create a private cause of action, leaving enforcement to the Department of Health and Human Services alone."
In Community Hosp. Group, Inc. v. Blume Goldfaden Berkowitz Donnelly Fried Forte, P.C., 885 A.2d 18, 22 (N.J.Super. A.D. 2005), the court explained:
But "the fact that a federal statute has been violated and some person harmed does not automatically give rise to a private cause of action in favor of that person." Touche Ross Co. v. Redington, 442 U.S. 560, 568 . . . (1979) (citation omitted). The question is "whether Congress expressly or by implication, intended to create a private cause of action." Sonnenfeld v. City County of Denver, 100 F.3d 744, 747 (10th Cir. 1996) (citation omitted). Neither § 1320-6, nor any other section of HIPPA, contains any language expressly creating a private cause of action. Univ. of Colo. Hosp. v. Denver Pub. Co., 340 F. Supp.2d 1142, 1144-45 (D. Colo. 2004). Moreover, "[t]he express provision of one method of enforcing a substantive rule suggests that Congress intended to preclude others. . . ." Alexander v. Sandoval, 532 U.S. 275, 290 . . . (2001).
HIPAA "provides for both civil and criminal penalties for individuals who improperly handle or disclose individually identifiable health information." Johnson v. Quander, 370 F. Supp.2d 79, 99 (D. D.C. 2005). However, HIPAA "specifically indicates that the Secretary of [Health and Human Services] shall pursue the action against an alleged offender, not a private individual." Logan v. Dep't of Veteran Affairs, 357 F. Supp.2d 149, 155 (D. D.C. 2004).
When Congress enacts a statutory scheme which leaves enforcement only to federal regulators and does not create a remedy, such as damages, in favor of individuals wronged by violation of the statute, the statute "does not authorize a private right of action." That is the case with HIPAA. Thus, the plaintiff has no right to bring an action under, or based on, the statute, as the enforcement of HIPAA is left to a federal agency. There simply may be no remedy in this court for the wrong alleged by the plaintiff.
THEREFORE, IT IS ORDERED:
1. That Filing No. 8, the plaintiff's Motion to Clarify Order, is granted insofar as the Order on Initial Review is explained in greater detail above;
2. That the deadline for an Amended Complaint is extended an additional twenty (20) days from the date of this Memorandum and Order;
3. That in the absence of a timely Amended Complaint, this case will be subject, without further notice, to dismissal without prejudice; and
4. That if the plaintiff files a timely Amended Complaint, the court will conduct initial review and will either order service of process or, if the Amended Complaint fails to state a claim on which relief may be granted, the court may, without further notice, dismiss the case without prejudice.