PUBLISHED
UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT
No. 18-7030
CHRISTOPHER N. PAYNE,
Plaintiff - Appellant,
v.
JAHAL TASLIMI, Medical Doctor at Armor Health Serv.; MS. SMITH, LPN, HAS Armor Health Serv.,
Defendant - Appellee.
Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Liam O’Grady, Senior District Judge. (1:18-cv-00587-LO-IDD)
Argued: September 9, 2020 Decided: May 27, 2021
Before THACKER, RICHARDSON, and QUATTLEBAUM, Circuit Judges.
Affirmed by published opinion. Judge Richardson wrote the opinion, in which Judge Thacker and Judge Quattlebaum joined.
ARGUED: Gilbert Charles Dickey, MCGUIREWOODS LLP, Washington, D.C., for Appellant. Christopher Fitzjames Quirk, SANDS ANDERSON, PC, Richmond, Virginia, for Appellee. ON BRIEF: Matthew A. Fitzgerald, MCGUIREWOODS LLP, Richmond, Virginia, for Appellant. Edward J. McNelis, III, SANDS ANDERSON, PC, Richmond, Virginia, for Appellees. RICHARDSON, Circuit Judge:
While incarcerated in a prison medical unit, Christopher Payne’s doctor came to his
bedside and reminded Payne, within the earshot of others, that he had not taken his human
immunodeficiency virus (“HIV”) medication. Payne asserts that the doctor’s conduct
violated his Fourteenth Amendment right to privacy and the Health Insurance Portability
and Accountability Act of 1996 (“HIPAA”), Pub. L. 104-191, 110 Stat. 1936 (codified at
29 U.S.C. § 1181 et seq.).
We first reject Payne’s claim that the doctor’s statement violated the Fourteenth
Amendment because he lacks a reasonable expectation of privacy in this information while
incarcerated in a prison medical center. We also reject Payne’s HIPAA claim because
HIPAA does not create a private right of action that Payne may avail himself of. So we
affirm the dismissal of his complaint.
I. Background
In 2018, Payne was incarcerated at Deep Meadow Correctional Center in State
Farm, Virginia. Dr. Jahal Taslimi approached Payne’s bed in the medical unit and told
Payne that he had “not take[n] [his] HIV medications” that day. J.A. 16. According to
Payne, the medical unit is an “open dorm,” so other staff, offenders, and civilians were
close enough to overhear Dr. Taslimi’s statement. J.A. 6. Payne alleges that some of those
nearby “stopped talking and looked” at him. Id. Dr. Taslimi evidently apologized, but
Payne alleges that the damage was done: other prison staff and inmates had learned that
Payne was on HIV medication. Payne filed an array of grievances, which failed to provide
relief.
2 Payne then turned to federal court, filing a pro se action against Dr. Taslimi. See 42
U.S.C. § 1983. 1 The district court dismissed Payne’s complaint under 28 U.S.C.
§ 1915A(b) for failure to state a claim. Payne timely appealed, and we have jurisdiction.
See 28 U.S.C. § 1291. Exercising that jurisdiction, we review de novo the district court’s
dismissal. Jehovah v. Clarke, 798 F.3d 169, 176 (4th Cir. 2015).
II. Fourteenth Amendment Due Process Claim
A. Stare decisis and precedent
We do not address Payne’s Fourteenth Amendment privacy claim on a blank slate.
Instead, we write on the ever-present background of stare decisis.
At the Supreme Court, stare decisis “is a principle of policy” and neither “a
mechanical formula of adherence” nor an “inexorable command.” Payne v. Tennessee,
501 U.S. 808, 828 (1991) (quoting Helvering v. Hallock, 309 U.S. 106, 119 (1940)). The
Supreme Court balances various factors, including the quality of the precedent’s reasoning,
the workability of the established rule, the reliance interests it has engendered, its
consistency with related decisions, and the developments since its prior decision. See
Janus v. Am. Fed’n of State, Cnty. & Mun. Emps., Council 31, 138 S. Ct. 2448, 2478–79
(2018). For the Supreme Court, the decision of whether to follow precedent is a difficult
1 Along with his Fourteenth Amendment and HIPAA claims, Payne raised various other claims that lack merit. Payne sued Ms. Smith, the nurse who took Payne’s complaint. But Payne alleged no facts about how Ms. Smith “‘acted personally in the deprivation of [his]’ rights,” so those claims are not cognizable under § 1983. Wilcox v. Brown, 877 F.3d 161, 170 (4th Cir. 2017) (quoting Vinnedge v. Gibbs, 550 F.2d 926, 928 (4th Cir. 1977)). Nor do Payne’s allegations that Dr. Taslimi failed to abide by the procedures of the Virginia Department of Corrections give rise to a claim under § 1983. See Wright v. Collins, 766 F.2d 841, 849 (4th Cir. 1985). 3 one, but they have “never felt constrained to” do so. Payne, 501 U.S. at 827 (quoting Smith
v. Allwright, 321 U.S. 649, 665 (1944)).
But as an inferior court, the Supreme Court’s precedents do constrain us. See
Agostini v. Felton, 521 U.S. 203, 237 (1997). In looking up to the Supreme Court, we may
not weigh the same factors used by the Supreme Court to evaluate its own precedents in
deciding whether to follow their guidance. We must simply apply their commands. So
even were we to correctly conclude that a Supreme Court precedent contains many
“infirmities” and rests on “wobbly, moth-eaten foundations,” it remains the Supreme
Court’s “prerogative alone to overrule one of its precedents.” State Oil Co. v. Khan, 522
U.S. 3, 20 (1997) (quoting Khan v. State Oil Co., 93 F.3d 1358, 1363 (7th Cir. 1996)
(Posner, J.)). It is beyond our power to disregard a Supreme Court decision, even if we are
sure the Supreme Court is soon to overrule it.
Similarly, when a panel of our Court looks horizontally to our own precedents, we
must apply their commands as a mechanical mandate. For even though a Fourth Circuit
panel possesses the statutory and constitutional power to overrule another panel, we do not
do so “as a matter of prudence.” McMellon v. United States, 387 F.3d 329, 334 (4th Cir.
2004) (en banc). And that prudential judgment is categorical, so a panel of judges “cannot
overrule a decision issued by another panel.” Id. at 332–34 (emphasis added); see also id.
at 333 (noting that where two panels conflict, we must “follow the earlier of the conflicting
opinions”). Only by granting en banc review may we apply stare decisis balancing to
overrule precedent set by a prior panel (or a prior en banc court). See id. at 334; see also
id. at 333 (noting that most other circuits follow the same practice). Thus, unlike the
4 discretionary application of stare decisis by the Supreme Court, we are bound by prior
panel decisions. 2
That is not to say that everything said in a panel opinion binds future panels. 3 We
recognize that where we “assum[e] without deciding the validity of antecedent
propositions” those assumptions “are not binding in future cases that directly raise the
questions.” United States v. Norman, 935 F.3d 232, 241 (4th Cir. 2019) (quoting United
States v. Verdugo-Urquidez, 494 U.S. 259, 272 (1990)); see also Webster v. Fall, 266 U.S.
507, 511 (1925). And we also recognize that dictum is not binding. See Pittston Co. v.
United States, 199 F.3d 694, 703 (4th Cir. 1999). Dictum is a “statement in a judicial
opinion that could have been deleted without seriously impairing the analytical foundations
of the holding—that, being peripheral, may not have received the full and careful
consideration of the court that uttered it.” Id. (quoting United States v. Crawley, 837 F.2d
291, 292 (7th Cir. 1988) (Posner, J.)); see also Cohens v. State of Virginia, 19 U.S. 264,
2 To state the obvious, this means we must follow a prior panel decision even if it had abysmal reasoning, put forward unworkable commands, engendered no reliance interests, lacked consistency with other decisions, and has been undermined by later developments. Indeed, for this principle to mean anything, we must do so in exactly those cases. 3 Determining the scope of this horizontal precedent often presents its own perplexing problems. See Charles W. Tyler, The Adjudicative Model of Precedent, 87 U. CHI. L. REV. 1551 (2020) (discussing different models for determining the scope of prior intra-circuit decisions). And similar problems exist when we look vertically to the Supreme Court’s precedents. See Richard M. Re, Narrowing Supreme Court Precedent from Below, 104 GEO. L.J. 921 (2016) (discussing how lower courts treat Supreme Court precedent). 5 399–400 (1821). If necessary to the outcome, a precedent’s reasoning must be followed;
otherwise, we are not so bound. 4
B. Constitutional right to privacy
Shepherded by these principles, we turn to Payne’s claimed constitutional right to
privacy. The Supreme Court’s guidance is less than illuminating. In its most recent
decision on the matter, the Court “assume[d], without deciding, that the Constitution
protects a[n informational] privacy right of the sort mentioned in Whalen [v. Roe, 429 U.S.
589 (1977)] and Nixon [v. Administrator of General Services, 433 U.S. 425 (1977)].”
NASA v. Nelson, 562 U.S. 134, 138 (2011) (emphasis added). The Court also recognized
that this was its “approach in Whalen”: assume a constitutional right to privacy exists but
find that any existing right was not violated. Id. at 147. 5
4 Of course, our own prudential decision to follow prior panel decisions (horizontal stare decisis) is overcome by our mandate as an inferior court to follow the Supreme Court’s commands (vertical stare decisis). Thus, we are not bound by previous panels where “the prior opinion has been overruled by an intervening opinion from . . . the Supreme Court.” McMellon, 387 F.3d at 333. So where subsequent Supreme Court decisions “clearly undermine[]” a panel precedent, we need not follow that panel precedent. United States v. Williams, 155 F.3d 418, 421 (4th Cir. 1998). 5 Nixon charted a similar course. There, the Court acknowledged that “public officials . . . are not wholly without constitutionally protected privacy rights.” Nixon, 433 U.S. at 457. It went on to “assume . . . for the purposes of [that] case” that the withholding personal or financial information from presidential libraries and congressional acquiescence to that practice “g[ave] rise to [President Nixon’s] legitimate expectation of privacy in such materials.” Id. at 457–58 (citing Katz v. United States, 389 U.S. 347, 351– 53 (1967)). Some of our own cases have followed the same path. See Watson v. Lowcountry Red Cross, 974 F.2d 482, 487–88 (4th Cir. 1992) (assuming that a blood donor has a right to confidentiality in his identity but rejecting the argument that a mere possibility of public disclosure of private information could violate that right); Taylor v. Best, 746 F.2d 220, (Continued) 6 Although this Court’s guidance has not been the model of clarity, we have gone
beyond assuming. In Walls v. City of Petersburg, Walls claimed that the information
required by an employment questionnaire violated her right to privacy. 895 F.2d 188, 189–
90 (4th Cir. 1990). We first agreed that “[t]he constitutional right to privacy extends
to . . . ‘the individual interest in avoiding disclosure of personal matters.’” Id. at 192 (citing
Whalen, 429 U.S. at 599–600). But that “right to privacy” protected “only information
with respect to which the individual has a reasonable expectation of privacy.” Id. at 193;
see also id. at 192 (“Personal, private information in which an individual has a reasonable
expectation of confidentiality is protected by one’s constitutional right to privacy.”).
Walls, we held, lacked a “reasonable expectation of privacy” in information that
was “freely available in public records,” including marriages, divorces, children, and
arrests or convictions of family members. Id. at 193–94. We suggested that she maintained
a reasonable expectation of privacy in details that were “not part of the public record
concerning a divorce, separation, annulment, or the birth of children.” Id. at 193. But
those non-public details were not implicated in the case because they were not covered by
the questionnaire. Id. at 193–94. 6
225 (4th Cir. 1984) (assuming that an inmate has a right to privacy in their family background, but finding that “the compelling public interests in assuring the security of prisons and in effective rehabilitation clearly outweigh[ed]” the inmates interest in keeping that information confidential). 6 We also found information about same-sex sexual relations unprotected because, at that time, “[t]he Court [had] explicitly rejected ‘the proposition that any kind of private sexual conduct between consenting adults is constitutionally insulated from state proscription.’” Walls, 895 F.2d at 193 (quoting Bowers v. Hardwick, 478 U.S. 186, 191 (Continued) 7 Turning to the “[f]inancial information [] requested in the questionnaire,” we held
that it was “protected by a right to privacy.” Id. at 194. As Walls possessed a right to
privacy in the financial information, we weighed her privacy interest against the
government’s interest in disclosure to guard against potential corruption. We found that
the government’s interest was compelling and determined that it outweighed her right to
privacy. We thus concluded that the required disclosure of financial information did not
violate her right to privacy.
Walls thus adopted a two-part inquiry, asking first whether “the information sought
is entitled to privacy protection,” like the financial information from that case. Id. at 192,
194. And, if a right to privacy existed, then asking whether “a compelling governmental
interest in disclosure outweighs the individual’s privacy interest.” Id. at 192. For the first
inquiry, we explained that information is protected only where there is a “reasonable
expectation of privacy” in it. Id. at 193. It is this inquiry that binds us today.
This “reasonable expectation of privacy” language emanates from Justice Harlan’s
famous concurrence in Katz v. United States, 389 U.S. 347 (1967). There, Justice Harlan
explained that the Fourth Amendment protects people where they have a “reasonable
expectation of privacy,” that is, a place where the person has “an actual (subjective)
(1986)). Bowers has since been overturned by the Supreme Court. Lawrence v. Texas, 539 U.S. 558, 578 (2003). So to add some dictum to an opinion about dicta, this part of Walls is no longer good law. 8 expectation of privacy” and “the expectation [is] one that society is prepared to recognize
as ‘reasonable.’” Id. at 360–61 (Harlan, J., concurring). 7
Since Walls, we have applied this “reasonable expectation of privacy” test to
evaluate whether information is protected by a constitutional right to privacy. In Condon
v. Reno, we found that drivers lacked any constitutionally protected right to privacy in their
personal information stored in motor-vehicle records. 155 F.3d 453, 465 (4th Cir. 1998),
rev’d on other grounds, Reno v. Condon, 528 U.S. 141, 148 (2000) (upholding the Driver's
Privacy Protection Act of 1994 under Congress’s Commerce Clause power). We reasoned
that driver’s records were “the very sort of information to which individuals do not have a
reasonable expectation of privacy.” Id. at 464–65 (emphasis added). The existence of
“‘pervasive schemes of regulation’ . . . must ‘necessarily lead to reduced expectations of
privacy.’” Id. at 465 (quoting California v. Carney, 471 U.S. 386, 392 (1985), a Fourth
Amendment case). And these motor-vehicle records are traditionally public and easily
accessible. Id. As drivers lacked a “reasonable expectation of privacy,” we held they
lacked a constitutionally protected right to privacy that Congress could enforce under
Section 5 of the Fourteenth Amendment. Id.
7 We were not the first court to consider the Fourth Amendment in this area. The Supreme Court, in assuming that a right to privacy existed in Nixon, cited Katz. See Nixon, 433 U.S. at 458. And in determining whether the government had a sufficient interest in invading that right, the Court cited Terry v. Ohio, 392 U.S. 1 (1968), a seminal Fourth Amendment case, along with other Fourth Amendment cases. Nixon, 433 U.S. at 458–63. See also Walls, 895 F.2d at 192 (relying on Justice Brandeis’s dissent in Olmstead v. United States, 277 U.S. 438 (1928), another seminal Fourth Amendment opinion). 9 While Condon looked to the reasonable expectation of privacy to reject the claimed
right to privacy, it also “note[d]” that “the Supreme Court has limited the ‘right to privacy’
to matters of reproduction, contraception, abortion, and marriage.” Id. at 464 (internal
citations omitted). This descriptive statement was unnecessary to Condon’s holding, which
turned on the lack of a reasonable expectation of privacy based on the pervasive regulation
and public nature of the information. See id. at 464–65. It is thus dictum that does not
control our analysis.
Even so, we later appeared to rely on this dictum from Condon. See Edwards v.
City of Goldsboro, 178 F.3d 231, 252 (4th Cir. 1999) (citing Condon, 155 F.3d at 464). In
Edwards, the plaintiff brought seventeen causes of action against a city and its officials,
claiming that they could not punish him for teaching a handgun safety class when he was
not authorized to do so. Id. at 239–40. One of those causes of action invoked, without
elaboration, his “right to privacy.” Id. at 240, 252. We rejected that claim because the case
did not involve “matters of reproduction, contraception, abortion, and marriage.” Id. at
252. But this proposition conflicts with Walls’s holding that information within an
individual’s reasonable expectations of privacy—including financial information—falls
within the right to privacy. Walls, 895 F.2d at 192–94. So, under our rules of horizontal
stare decisis, we are required “to follow the earlier of the conflicting opinions” rather than
decide which precedent is correct. McMellon, 387 F.3d at 333. 8
8 In Greenville Women’s Clinic v. Comm’r, S.C. Dep’t of Health and Env’t Control, 317 F.3d 357 (4th Cir. 2002), we considered a South Carolina law that required abortion clinics to record certain information and report each abortion to the South Carolina (Continued) 10 Because no subsequent panel could overrule Walls and the Supreme Court has done
little to clarify the scope of the constitutional right to privacy, we follow Walls. We must
thus ask (1) whether a “reasonable expectation of privacy” in the information exists as to
entitle it to privacy protection and, if so, (2) whether “a compelling governmental interest
in disclosure outweighs the individual’s privacy interest.” Walls, 895 F.2d at 192. We
decide that Payne lacked a reasonable expectation of privacy in his HIV medication and
diagnosis. He thus lacked a right to privacy in that information and we need not consider
part two of the Walls test.
C. As an inmate, Payne lacked a reasonable expectation of privacy in information about his HIV status
We first look to Payne’s claimed “reasonable expectation of privacy.” Id. at 193.
Dr. Taslimi disclosed Payne’s HIV status while Payne was a patient in a prison medical
center. And a prisoner’s reasonable expectations of privacy are limited.
In Hudson v. Palmer, the Supreme Court held that a prison inmate lacked a
reasonable expectation of privacy in his prison cell. 468 U.S. 517, 525–26 (1984). The
Court found that “any subjective expectation of privacy that a prisoner might have in his
prison cell” was not one that society would recognize as legitimate or reasonable. Id. at
526–27. Balancing the prisoner’s interest in privacy against “the interest of society in the
security of its penal institutions,” the Court held that any subjective desire for privacy was
Department of Health and Environmental Control. Id. at 367–71. We found that because South Carolina had an adequate governmental interest in instituting this reporting requirement and provided safeguards to prevent the disclosure of this information, the rights of the clinic’s patients were not violated. Id. Like Whalen, Greenville Women’s Clinic assumed that the privacy right at interest in that case existed. 11 “incompatible” with the need to “ensure institutional security and internal order.” Id. at
527–28; see also id. (“[l]oss of freedom of choice and privacy are inherent incidents of
confinement” (quoting Bell v. Wolfish, 441 U.S. 520, 537 (1979))).
Although Hudson discussed an inmate’s right to privacy based on the need for
institutional safety, we have rejected the claim that the Government can only search a
detainee’s cell where the search advances legitimate penological needs. In United States
v. Jeffus, the plaintiff claimed that the government had searched his cell to obtain evidence
against him and thus the search “had ‘nothing whatever to do with security, safety, or
sanitation’ at the jail.” 22 F.3d 554, 559 (4th Cir. 1994). We rejected his claim, reasoning
that the government’s rationale for conducting the search did not matter for Fourth
Amendment purposes because the detainee lacked any reasonable expectation of privacy
in his cell. Id. In other words, if a detainee does not have a reasonable expectation of
privacy, the reason the detainee lacks it and the reason for the government’s search need
not be the same.
That is not to say that prisoners have no “reasonable expectations of privacy” in
prison. But those expectations are quite limited. For example, we found a “reasonable
expectation of privacy” in “bodily privacy and integrity” to be violated by surgery to
remove a cosmetic implant from an inmate’s genitals. King v. Rubenstein, 825 F.3d 206,
214–15 (4th Cir. 2016); but cf. Jones v. Murray, 962 F.2d 302, 306 (4th Cir. 1992)
(permitting drawing blood from a pretrial detainee because detainees “lose a right of
privacy from routine searches of the cavities of their bodies and their jail cells”). That
interest in “bodily integrity involve[d] the ‘most personal and deep-rooted expectations of
12 privacy’” and many sexually invasive searches will involve an “objectively extreme”
intrusion on those expectations of privacy. King, 825 F.3d at 215–16 (quoting Winston v.
Lee, 470 U.S. 753, 760 (1985)).
As an inmate in a prison medical center, Payne lacked a reasonable expectation of
privacy in his HIV status and his compliance with his treatment plan. Payne does not claim
a reasonable expectation of privacy in the initial disclosure of his HIV diagnosis and
medical records to prison officials. See Dunn v. White, 880 F.2d 1188, 1197 (10th Cir.
1989) (testing prison inmates for AIDS does not violate the Fourth Amendment); see also
Jones, 962 F.2d at 307. Payne instead challenges the secondary disclosure from prison
officials to prison guards and inmates in the medical ward. But just as he lacks a reasonable
expectation of privacy in the initial disclosure of his communicable-disease diagnosis to
the prison officials, so too does he lack a reasonable expectation of privacy in the secondary
disclosure of his diagnosis. Where an inmate lacks a reasonable expectation of privacy, he
lacks it for all purposes. Jeffus, 22 F.3d at 559. Whatever desire he may have to keep that
information purely private is “incompatible” with the needs of an institution, and therefore
not reasonable. Hudson, 468 U.S. at 527; see Anderson v. Romero, 72 F.3d 518, 524 (7th
Cir. 1995) (Posner, J.) (Even if prisoners had a right to the confidentiality of their medical
records in general, “it would not follow that a prisoner had a right to conceal his HIV
status” because of the “great difference . . . between a communicable and a
noncommunicable disease.”).
Information about an inmate’s HIV diagnosis and medication is unlike the
expectations of privacy that we have found protected in prison. Unlike an inmate’s bodily
13 integrity, one’s communicable-disease diagnosis lacks any deep roots in the expectation of
privacy and falls far from the most personal invasions into an inmate’s body. See King,
825 F.3d at 215. Disclosure of Payne’s diagnosis and medication information simply does
not implicate the same Fourth Amendment concerns as forcing someone to, for example,
undergo surgery or subject themselves to invasive medical procedures. 9
The limits on an inmate’s expectations of privacy are particularly strong where the
information he seeks to protect relates to the institutional safety of the prison. See Hudson,
468 U.S. at 526. Here, both the location and the type of information reduces any possible
expectation of privacy that Payne might have had in this information. First, Payne was
told that he had not taken his medicine within the prison medical unit, the most relevant
place for such information to be shared and where it might be difficult to ensure others
would not hear. Second, the information Dr. Taslimi relayed to Payne dealt with his
communicable disease and whether he was taking his medication, which is especially
relevant in a prison where disease can spread rapidly (as seen by the COVID-19 pandemic).
While HIV and its spread can be controlled by medicine, an inmate’s expectation of privacy
in his diagnosis is still unreasonable during treatment because there remains a risk of
transmission to prison workers and other inmates. For example, a prisoner might forgo
9 Nor is Payne’s communicable-disease status equivalent to an inmate’s expectation of privacy in legal mail, which “is widely recognized to be privileged and confidential.” Haze v. Harrison, 961 F.3d 654, 661 (4th Cir. 2020); see also Sarah A. Rana, Restricting the Attorney-Client Privilege: Necessary Limitations or Distorting the Privilege?, 32 SUFFOLK U. L. REV. 687, 689–93 (1999) (tracing the history of the attorney-client privilege to the common law and discussing its relationship to the Fifth Amendment).
14 taking the medicine and thus become contagious again, just as Payne apparently did here.
So it is hard to see how Payne would have a reasonable expectation of privacy in his
communicable-disease status within a medical unit.
In sum, Payne has a reduced expectation of privacy in prison and, as we conclude
here, no reasonable expectation of privacy in his HIV diagnosis and treatment. No matter
how much a prisoner subjectively would like to keep that information to himself, we must
ask whether that expectation is “one that society is prepared to recognize as ‘reasonable.’”
Katz, 389 U.S. at 361 (Harlan, J., concurring); accord Hudson, 468 U.S. at 525–26. And
any subjective expectation of privacy in this information that Payne has is simply not
reasonable. See Anderson, 72 F.3d at 522–23; Tokar v. Armontrout, 97 F.3d 1078, 1084
(8th Cir. 1996). 10 Because we decide that this information is not “within [Payne’s]
reasonable expectations of confidentiality,” we need not go further to address whether Dr.
Taslimi had a “compelling government interest in disclos[ing Payne’s HIV status that]
outweigh[ed Payne’s] privacy interest.” Walls, 895 F.2d at 192.
D. HIPAA does not create a private cause of action
Finally, Payne alleged that Dr. Taslimi violated HIPAA. HIPAA provides that “[a]
person who knowingly . . . discloses individually identifiable health information to another
person” without authorization shall be fined, imprisoned, or both. 42 U.S.C. § 1320d-
10 The circuits that have found a right to privacy in this context have done so by finding that privacy right to be “completely different” than the rights “extinguished” by Hudson’s reasonable-expectation-of-privacy test. Doe v. Delie, 257 F.3d 309, 316–17 (3d Cir. 2001); accord Powell v. Schriver, 175 F.3d 107, 112 n.3 (2d Cir. 1999). Whatever the merits of that position, we are constrained to apply our holding in Walls to the contrary. 15 6(a)(3), (b). Even if Dr. Taslimi violated this provision, a plaintiff seeking a remedy under
§ 1983 “must assert the violation of a federal right, not merely a violation of federal law.”
Planned Parenthood S. Atl. v. Baker, 941 F.3d 687, 696 (4th Cir. 2019) (quoting Blessing
v. Freestone, 520 U.S. 329, 340 (1997)). Thus, for Payne to recover under HIPAA, the
statute must create a private right to sue that may be enforced under § 1983. Every circuit
court to consider whether HIPAA created a private right to sue has found that it does not.
See Meadows v. United Servs., Inc., 963 F.3d 240, 244 (2d Cir. 2020); Stewart v. Parkview
Hosp., 940 F.3d 1013, 1015 (7th Cir. 2019); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir.
2010); Wilkerson v. Shinseki, 606 F.3d 1256, 1267 n.4 (10th Cir. 2010); United States v.
Streich, 560 F.3d 926, 935 (9th Cir. 2009); Acara v. Banks, 470 F.3d 569, 571–72 (5th Cir.
2006); see also Faber v. Ciox Health, LLC, 944 F.3d 593, 596–97 (6th Cir. 2019) (stating,
in dictum, that HIPAA does not create a private right of action). This is because HIPAA
does not expressly allow for a private cause of action but delegates enforcement authority
to the Secretary of the Department of Health and Human Services, reflecting Congress’s
intent to forgo creating a private remedy. Meadows, 963 F.3d at 244; see also Alexander
v. Sandoval, 532 U.S. 275, 290 (2001) (disfavoring implied causes of action when
Congress has provided other methods of enforcing the statute’s mandate). We see no
reason to chart a different course from our sister circuits. Payne has no private right of
action under HIPAA.
* * *
We limit our decision today to the question before us: Did Payne have a “reasonable
expectation to privacy” in his HIV status while in a prison medical unit? We hold that he
16 did not. When Dr. Taslimi disclosed his HIV status, Payne was in prison, a place where
individuals have a curtailed expectation of privacy. Whatever expectations remain fail to
include the diagnosis of or medication for HIV, a communicable disease. The judgment
below is therefore
AFFIRMED.