UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
V.C., et al.,
Plaintiffs, v. Civil Action No. 23-1139 (CKK) DISTRICT OF COLUMBIA,
Defendant.
MEMORANDUM OPINION (May 4, 2026)
This matter comes before the Court on Plaintiffs’ [64] Motion to Strike Defendant’s [62]
Sealed Opposition to Plaintiffs’ [8] Motion to Certify Class and accompanying [57] Motion for
Leave to File a Supplemental Brief in support thereof. Plaintiffs argue that the Court should strike
Defendant’s Opposition because it discloses protected health information in violation of the Health
Insurance Portability and Accountability Act of 1996 (“HIPAA”). Upon consideration of the
parties’ submissions, the relevant legal authority, and the entire record, the Court determines that
Defendant’s use of protected health information in its sealed filing does not violate HIPAA and
shall therefore DENY Plaintiffs’ [64] Motion to Strike.
I.
Plaintiffs are individuals incarcerated at facilities operated by the District of Columbia
Department of Corrections (“DOC”). See Compl., Dkt. No. 1. They bring this action against the
District of Columbia (the “District”) alleging that DOC provides constitutionally inadequate
healthcare. Id. Plaintiffs did not sue DOC directly because DOC is “not an entity capable of being
sued separate from the District of Columbia.” Carter-El v. D.C. Dep’t of Corr., 893 F. Supp. 2d
243, 247 (D.D.C. 2012) (RBW), aff’d, No. 12-5357, 2013 WL 3367416 (D.C. Cir. July 5, 2013);
1 D.C. Code § 1-603.01 (providing that DOC is a subordinate agency of the District of Columbia
Government, which means it is “under the direct administrative control of the Mayor”).
In April 2023, Plaintiffs moved to certify this action as a class action on behalf of “all
people who are or will be incarcerated in [DOC] facilities who have serious medical needs.” Pls.’
Mot. for Certification, Dkt. No. 8. This matter was then stayed at the parties’ joint request to allow
the parties to engage in mediation.
In March 2026, the parties informed the Court that they had reached an impasse in their
mediation discussions and asked that the stay be lifted. Joint Status Report, Dkt. No. 55. Plaintiffs
then moved for leave to file a supplemental brief in support of their motion for class certification.
Pls.’ Supp. Mot., Dkt. No. 57. Through their supplemental brief, Plaintiffs seek to add seven new
proposed class representatives and submit five additional declarations in support of their motion
to certify a class. Id.
The District opposes Plaintiffs’ motion for class certification and their motion for leave to
file a supplemental brief. In its opposition to Plaintiffs’ motion for class certification, the District
filed a sealed brief and supporting papers that contained the protected health information of
Plaintiffs’ proposed class representatives and other members of the putative class. See Dkt. No.
62. These sealed filings were accompanied by redacted filings on the public docket. See Dkt. No.
63. The District indicated that it had asked Plaintiffs’ consent to file and reference this protected
health information and that Plaintiffs had not consented to the District doing so.
Plaintiffs quickly moved to strike the District’s filings. See Dkt. No. 64. Plaintiffs argue
that the Court should strike the District’s filings because they disclose protected health information
in violation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).
2 II. LEGAL STANDARD
A. The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)
HIPAA regulates persons and entities “that have access to individually identifiable medical
information and who conduct certain electronic health care transactions.” Hill v. Smoot, 308 F.
Supp. 3d 14, 23 (D.D.C. 2018) (RBW) (quoting Acara v. Banks, 470 F.3d 569, 571 (5th Cir. 2006))
(explaining that HIPAA does not confer a private right of action). HIPAA generally prohibits
covered entities from using or disclosing protected health information. See Murphy v. Dulay, 768
F.3d 1360, 1368-69 (11th Cir. 2014) (quoting 45 C.F.R. § 164.508(a)(1)). But there are a variety
of exceptions to this general rule.
When a covered entity is a party to a litigation, for instance, it may use or disclose protected
health information for purposes of that litigation. Under the HIPAA regulations, a covered entity
“may use or disclose protected health information for its own . . . health care operations.” 45
C.F.R. § 164.506(c)(1). The regulations define the term “health care operations” to include
“[c]onducting or arranging for . . . legal services.” 45 C.F.R. § 164.501(4). Accordingly, guidance
from the Department of Health and Human Services provides that “[w]here a covered entity is a
party to a legal proceeding, such as a plaintiff or defendant, the covered entity may use or disclose
protected health information for purposes of the litigation as part of its health care operations.” 1
In doing so, however, the covered entity must make reasonable efforts to limit such uses and
1 U.S. Dep’t of Health and Hum. Serv.’s, FAQ’s, May a covered entity that is a plaintiff or defendant in a legal proceeding use or disclose protected health information for the litigation?, https://perma.cc/NKD8-8YYU; see also Bedard v. LeBlanc, No. 5:20-CV-161-GWC-KJD, 2022 WL 22972442, at *2 (D. Vt. Nov. 8, 2022) (quoting Givens v. Saint Louis Cnty., No. 4:18-CV-1732 SPM, 2020 WL 4334942, at *3 (E.D. Mo. July 28, 2020)) (“. . . a health care provider ‘can use or disclose patient medical records for their own legal services, such as [the provider's] defense in ... litigation.’”); id. at *3 (“. . . HIPAA permits a health care provider—without first obtaining a patient's consent—to disclose a patient's private information to its counsel in defending against a patient's claims of improper or inadequate care.”); McDowell v. United States, Case No. EDCV 19-631 JBG, 2019 WL 8750360, at *1 (C.D. Cal. Dec. 11, 2019) (observing that “a covered entity may disclose health records to defend itself in litigation as part of “health care operations”); Kraft v. Essentia Health, No. 3:20-CV-121, 2021 WL 12326274, at *4 (D.N.D. July 16, 2021).
3 disclosures to the minimum necessary to accomplish the intended purpose. Id. (citing 45 CFR §§
164.502(b), 164.514(d)).
If a covered entity is not a party to a litigation, then the HIPAA regulations permit
disclosure for litigation purposes in two scenarios. First, the covered entity may disclose protected
health information in response to an order of the court, so long as the covered entity discloses only
the protected health information expressly authorized by such order. 45 C.F.R. § 164.512(e)(1)(i).
Second, the covered entity may disclose protected health information in response to lawful process
that is not accompanied by an order of the court, so long as the covered entity receives satisfactory
assurance from the party seeking the information that (a) the subject of the protected health
Free access — add to your briefcase to read the full text and ask questions with AI
UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
V.C., et al.,
Plaintiffs, v. Civil Action No. 23-1139 (CKK) DISTRICT OF COLUMBIA,
Defendant.
MEMORANDUM OPINION (May 4, 2026)
This matter comes before the Court on Plaintiffs’ [64] Motion to Strike Defendant’s [62]
Sealed Opposition to Plaintiffs’ [8] Motion to Certify Class and accompanying [57] Motion for
Leave to File a Supplemental Brief in support thereof. Plaintiffs argue that the Court should strike
Defendant’s Opposition because it discloses protected health information in violation of the Health
Insurance Portability and Accountability Act of 1996 (“HIPAA”). Upon consideration of the
parties’ submissions, the relevant legal authority, and the entire record, the Court determines that
Defendant’s use of protected health information in its sealed filing does not violate HIPAA and
shall therefore DENY Plaintiffs’ [64] Motion to Strike.
I.
Plaintiffs are individuals incarcerated at facilities operated by the District of Columbia
Department of Corrections (“DOC”). See Compl., Dkt. No. 1. They bring this action against the
District of Columbia (the “District”) alleging that DOC provides constitutionally inadequate
healthcare. Id. Plaintiffs did not sue DOC directly because DOC is “not an entity capable of being
sued separate from the District of Columbia.” Carter-El v. D.C. Dep’t of Corr., 893 F. Supp. 2d
243, 247 (D.D.C. 2012) (RBW), aff’d, No. 12-5357, 2013 WL 3367416 (D.C. Cir. July 5, 2013);
1 D.C. Code § 1-603.01 (providing that DOC is a subordinate agency of the District of Columbia
Government, which means it is “under the direct administrative control of the Mayor”).
In April 2023, Plaintiffs moved to certify this action as a class action on behalf of “all
people who are or will be incarcerated in [DOC] facilities who have serious medical needs.” Pls.’
Mot. for Certification, Dkt. No. 8. This matter was then stayed at the parties’ joint request to allow
the parties to engage in mediation.
In March 2026, the parties informed the Court that they had reached an impasse in their
mediation discussions and asked that the stay be lifted. Joint Status Report, Dkt. No. 55. Plaintiffs
then moved for leave to file a supplemental brief in support of their motion for class certification.
Pls.’ Supp. Mot., Dkt. No. 57. Through their supplemental brief, Plaintiffs seek to add seven new
proposed class representatives and submit five additional declarations in support of their motion
to certify a class. Id.
The District opposes Plaintiffs’ motion for class certification and their motion for leave to
file a supplemental brief. In its opposition to Plaintiffs’ motion for class certification, the District
filed a sealed brief and supporting papers that contained the protected health information of
Plaintiffs’ proposed class representatives and other members of the putative class. See Dkt. No.
62. These sealed filings were accompanied by redacted filings on the public docket. See Dkt. No.
63. The District indicated that it had asked Plaintiffs’ consent to file and reference this protected
health information and that Plaintiffs had not consented to the District doing so.
Plaintiffs quickly moved to strike the District’s filings. See Dkt. No. 64. Plaintiffs argue
that the Court should strike the District’s filings because they disclose protected health information
in violation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).
2 II. LEGAL STANDARD
A. The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)
HIPAA regulates persons and entities “that have access to individually identifiable medical
information and who conduct certain electronic health care transactions.” Hill v. Smoot, 308 F.
Supp. 3d 14, 23 (D.D.C. 2018) (RBW) (quoting Acara v. Banks, 470 F.3d 569, 571 (5th Cir. 2006))
(explaining that HIPAA does not confer a private right of action). HIPAA generally prohibits
covered entities from using or disclosing protected health information. See Murphy v. Dulay, 768
F.3d 1360, 1368-69 (11th Cir. 2014) (quoting 45 C.F.R. § 164.508(a)(1)). But there are a variety
of exceptions to this general rule.
When a covered entity is a party to a litigation, for instance, it may use or disclose protected
health information for purposes of that litigation. Under the HIPAA regulations, a covered entity
“may use or disclose protected health information for its own . . . health care operations.” 45
C.F.R. § 164.506(c)(1). The regulations define the term “health care operations” to include
“[c]onducting or arranging for . . . legal services.” 45 C.F.R. § 164.501(4). Accordingly, guidance
from the Department of Health and Human Services provides that “[w]here a covered entity is a
party to a legal proceeding, such as a plaintiff or defendant, the covered entity may use or disclose
protected health information for purposes of the litigation as part of its health care operations.” 1
In doing so, however, the covered entity must make reasonable efforts to limit such uses and
1 U.S. Dep’t of Health and Hum. Serv.’s, FAQ’s, May a covered entity that is a plaintiff or defendant in a legal proceeding use or disclose protected health information for the litigation?, https://perma.cc/NKD8-8YYU; see also Bedard v. LeBlanc, No. 5:20-CV-161-GWC-KJD, 2022 WL 22972442, at *2 (D. Vt. Nov. 8, 2022) (quoting Givens v. Saint Louis Cnty., No. 4:18-CV-1732 SPM, 2020 WL 4334942, at *3 (E.D. Mo. July 28, 2020)) (“. . . a health care provider ‘can use or disclose patient medical records for their own legal services, such as [the provider's] defense in ... litigation.’”); id. at *3 (“. . . HIPAA permits a health care provider—without first obtaining a patient's consent—to disclose a patient's private information to its counsel in defending against a patient's claims of improper or inadequate care.”); McDowell v. United States, Case No. EDCV 19-631 JBG, 2019 WL 8750360, at *1 (C.D. Cal. Dec. 11, 2019) (observing that “a covered entity may disclose health records to defend itself in litigation as part of “health care operations”); Kraft v. Essentia Health, No. 3:20-CV-121, 2021 WL 12326274, at *4 (D.N.D. July 16, 2021).
3 disclosures to the minimum necessary to accomplish the intended purpose. Id. (citing 45 CFR §§
164.502(b), 164.514(d)).
If a covered entity is not a party to a litigation, then the HIPAA regulations permit
disclosure for litigation purposes in two scenarios. First, the covered entity may disclose protected
health information in response to an order of the court, so long as the covered entity discloses only
the protected health information expressly authorized by such order. 45 C.F.R. § 164.512(e)(1)(i).
Second, the covered entity may disclose protected health information in response to lawful process
that is not accompanied by an order of the court, so long as the covered entity receives satisfactory
assurance from the party seeking the information that (a) the subject of the protected health
information that has been requested has been given notice of the request, or (b) reasonable efforts
have been made by such party to secure a qualified protective order from the court. Id. at §
164.512(e)(1)(ii). A covered entity disclosing protected health information in either scenario must
make “efforts to limit” the disclosure “to the minimum necessary.” 45 C.F.R. § 164.502(b).
B. Motions to Strike
“[M]otions to strike, as a general rule, are disfavored.” Stabilisierungsfonds Fur Wein v.
Kaiser Stuhl Wine Distribs. Pty. Ltd., 647 F.2d 200, 201 (D.C. Cir. 1981). Striking a filing or a
portion thereof is an “extreme remedy” that is reserved for filings that are “indefensible, harassing,
or detract from the dignity of the Court.” Brigida v. Chao, No. CV 16-2227 (DLF), 2018 WL
11389503, at *3 (D.D.C. May 31, 2018) (quoting Fay v. Perles, 59 F. Supp. 3d 128, 134 (D.D.C.
2014) (CRC)). The moving party bears the burden of showing that a motion to strike is justified,
and courts will “resolve all doubts in favor of denying the motion to strike.” Bond v. U.S. Dep’t
of Just., 828 F. Supp. 2d 60, 71–72 (D.D.C. 2011) (RCL) (quoting Nwachukwu v. Karl, 216 F.R.D.
176, 178 (D.D.C. 2003) (RMU)).
4 III. ANALYSIS
Plaintiffs argue that the District violated HIPAA by disclosing protected health information
in its opposition filings “(i) without authorization of the subject individual, (ii) in the absence of a
Court order, (iii) in the absence of a subpoena, discovery request, or other lawful process, (iv)
without providing any notice, much less reasonable notice, to the individuals whose health
information they disclosed, and (v) in the absence of any protective order, much less a HIPAA-
qualified protective order.” Pls.’ Mem., Dkt. No. 64-1 at 4. Plaintiffs also argue that the District
failed to limit the disclosure to the “minimum necessary.” Id.
The District argues that its disclosure of the protected health information at issue was
permissible because HIPAA allows a covered entity to use or disclose protected health information
to defend itself in litigation. And it maintains that it has limited the use of this protected health
information to the “minimum necessary” by filing the information under seal.
The parties’ dispute therefore centers on whether the relevant records in question belong
to the District or DOC. If they belong to the District, then the District may use them in this
litigation without a prior court order or other lawful process, so long as that use is reasonable. If
they do not belong to the District, then the District may only use them if they first obtain a court
order or some other lawful process. For the following reasons, the Court determines that the
records at issue belong to the District and that the District’s use of those records was reasonable.
***
The Court determines that the records in question belong to the District. Under D.C. law,
DOC is a subordinate agency to the D.C. Government. D.C. Code § 1-603.01. This means that
DOC is “under the direct administrative control” of the D.C. Government. Id. It also means that
DOC is “not an entity capable of being sued separate from the District of Columbia.” Carter-El,
893 F. Supp. 2d at 247. Accordingly, for purposes of this litigation, DOC is not treated as a 5 separate entity from the District of Columbia. The District can therefore use the relevant records
to defend itself in this litigation.
Plaintiffs appear to suggest that allowing the District to use the records in question when
they were originally created by DOC equates to a finding that “all other facets of the District of
Columbia government are entitled to open access to an incarcerated individual’s protected health
information unbridled by the protections of HIPAA.” Pls.’ Mem., Dkt. No. 64-1 at 5 n. 5 (arguing
that this result “strains credulity”). But this is not the case. The D.C. Government is designated
as a “hybrid entity” under HIPAA because its activities and components include both covered and
non-covered activities and components. 45 C.F.R. § 164.103. As a hybrid entity, the D.C.
Government must ensure that its health care components—like DOC—comply with HIPAA,
which includes ensuring that its health care components “do[] not disclose protected health
information to another component” of the D.C. Government. 45 C.F.R. § 164.105(a)(2)(ii).
Accordingly, the Court’s ruling here in no way undermines the HIPPA’s protections for Plaintiffs’
protected health information.
The District’s use of the records in question was also reasonable under HIPAA. As the
District explains, Plaintiffs’ claims put their medical histories at issue. The records of Plaintiffs’
medical histories are therefore directly relevant to the issues involved in this litigation.
Furthermore, the District took steps to limit the disclosure of Plaintiffs’ protected health
information to the minimum necessary. The District moved to file Plaintiffs’ protected health
information under seal and has requested that the Court further direct the parties to maintain the
information filed under seal confidential, not to use or disclose it for any purpose other than this
proceeding, and to return or destroy the material at the conclusion of this proceeding. The District
also took the step of filing redacted versions of its filings on the public docket. See Dkt. No. 63.
6 Finally, before filing the protected health information, the District reached out to Plaintiffs'
counsel to ask if they had a position on how the protected health information should be filed. See
Dkt. No. 64-2.
IV. CONCLUSION
In sum, the District's use of Plaintiffs' protected health information did not violate HIPAA
because it involved the District's reasonable use of its own records to defend itself in litigation.
The Court, however, is not blind to the privacy concerns implicated by the disclosure of sensitive
health information, even when that disclosure complies with HIPAA. Accordingly, while the
Court shall DENY Plaintiffs' [64] Motion to Strike, it will also ORDER the parties to confer and
file a joint proposed protective order to govern the handling of the health information disclosed by
the District. The details of this joint proposal along with the entirety of the Court's ruling are
contained in the accompanying Order.
Dated: May 4, 2026
COLL�46L��E� United States District Judge