PUBLISHED
UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT
No. 18-7030
CHRISTOPHER N. PAYNE, Plaintiff - Appellant,
v.
JAHAL TASLIMI, Medical Doctor at Armor Health Serv.; MS. SMITH, LPN, HAS Armor Health Serv.,
Defendant - Appellee.
Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Liam O’Grady, Senior District Judge. (1:18-cv-00587-LO-IDD)
Argued: September 9, 2020 Decided: May 27, 2021
Before THACKER, RICHARDSON, and QUATTLEBAUM, Circuit Judges.
Affirmed by published opinion. Judge Richardson wrote the opinion, in which Judge Thacker and Judge Quattlebaum joined.
ARGUED: Gilbert Charles Dickey, MCGUIREWOODS LLP, Washington, D.C., for Appellant. Christopher Fitzjames Quirk, SANDS ANDERSON, PC, Richmond, Virginia, for Appellee. ON BRIEF: Matthew A. Fitzgerald, MCGUIREWOODS LLP, Richmond, Virginia, for Appellant. Edward J. McNelis, III, SANDS ANDERSON, PC, Richmond, Virginia, for Appellees.
RICHARDSON, Circuit Judge:
While incarcerated in a prison medical unit, Christopher Payne’s doctor came to his bedside and reminded Payne, within the earshot of others, that he had not taken his human immunodeficiency virus (“HIV”) medication. Payne asserts that the doctor’s conduct violated his Fourteenth Amendment right to privacy and the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Pub. L. 104-191, 110 Stat. 1936 (codified at 29 U.S.C. § 1181 et seq.).
We first reject Payne’s claim that the doctor’s statement violated the Fourteenth Amendment because he lacks a reasonable expectation of privacy in this information while incarcerated in a prison medical center. We also reject Payne’s HIPAA claim because HIPAA does not create a private right of action that Payne may avail himself of. So we affirm the dismissal of his complaint. I. Background In 2018, Payne was incarcerated at Deep Meadow Correctional Center in State Farm, Virginia. Dr. Jahal Taslimi approached Payne’s bed in the medical unit and told Payne that he had “not take[n] [his] HIV medications” that day. J.A. 16. According to Payne, the medical unit is an “open dorm,” so other staff, offenders, and civilians were close enough to overhear Dr. Taslimi’s statement. J.A. 6. Payne alleges that some of those nearby “stopped talking and looked” at him. Id. Dr. Taslimi evidently apologized, but Payne alleges that the damage was done: other prison staff and inmates had learned that Payne was on HIV medication. Payne filed an array of grievances, which failed to provide relief.
3
Payne then turned to federal court, filing a pro se action against Dr. Taslimi. See 42 U.S.C. § 1983. 1 The district court dismissed Payne’s complaint under 28 U.S.C. § 1915A(b) for failure to state a claim. Payne timely appealed, and we have jurisdiction. See 28 U.S.C. § 1291. Exercising that jurisdiction, we review de novo the district court’s dismissal. Jehovah v. Clarke, 798 F.3d 169, 176 (4th Cir. 2015). II. Fourteenth Amendment Due Process Claim A. Stare decisis and precedent We do not address Payne’s Fourteenth Amendment privacy claim on a blank slate.
Instead, we write on the ever-present background of stare decisis.
At the Supreme Court, stare decisis “is a principle of policy” and neither “a mechanical formula of adherence” nor an “inexorable command.” Payne v. Tennessee, 501 U.S. 808, 828 (1991) (quoting Helvering v. Hallock, 309 U.S. 106, 119 (1940)). The Supreme Court balances various factors, including the quality of the precedent’s reasoning, the workability of the established rule, the reliance interests it has engendered, its consistency with related decisions, and the developments since its prior decision. See Janus v. Am. Fed’n of State, Cnty. & Mun. Emps., Council 31, 138 S. Ct. 2448, 2478–79 (2018). For the Supreme Court, the decision of whether to follow precedent is a difficult
1 Along with his Fourteenth Amendment and HIPAA claims, Payne raised various other claims that lack merit. Payne sued Ms. Smith, the nurse who took Payne’s complaint. But Payne alleged no facts about how Ms. Smith “‘acted personally in the deprivation of [his]’ rights,” so those claims are not cognizable under § 1983. Wilcox v. Brown, 877 F.3d 161, 170 (4th Cir. 2017) (quoting Vinnedge v. Gibbs, 550 F.2d 926, 928 (4th Cir. 1977)). Nor do Payne’s allegations that Dr. Taslimi failed to abide by the procedures of the Virginia Department of Corrections give rise to a claim under § 1983. See Wright v. Collins, 766 F.2d 841, 849 (4th Cir. 1985).
4
one, but they have “never felt constrained to” do so. Payne, 501 U.S. at 827 (quoting Smith v. Allwright, 321 U.S. 649, 665 (1944)).
But as an inferior court, the Supreme Court’s precedents do constrain us. See Agostini v. Felton, 521 U.S. 203, 237 (1997). In looking up to the Supreme Court, we may not weigh the same factors used by the Supreme Court to evaluate its own precedents in deciding whether to follow their guidance. We must simply apply their commands. So even were we to correctly conclude that a Supreme Court precedent contains many “infirmities” and rests on “wobbly, moth-eaten foundations,” it remains the Supreme Court’s “prerogative alone to overrule one of its precedents.” State Oil Co. v. Khan, 522 U.S. 3, 20 (1997) (quoting Khan v. State Oil Co., 93 F.3d 1358, 1363 (7th Cir. 1996) (Posner, J.)). It is beyond our power to disregard a Supreme Court decision, even if we are sure the Supreme Court is soon to overrule it.
Similarly, when a panel of our Court looks horizontally to our own precedents, we must apply their commands as a mechanical mandate. For even though a Fourth Circuit panel possesses the statutory and constitutional power to overrule another panel, we do not do so “as a matter of prudence.” McMellon v. United States, 387 F.3d 329, 334 (4th Cir. 2004) (en banc). And that prudential judgment is categorical, so a panel of judges “cannot overrule a decision issued by another panel.” Id. at 332–34 (emphasis added); see also id. at 333 (noting that where two panels conflict, we must “follow the earlier of the conflicting opinions”). Only by granting en banc review may we apply stare decisis balancing to overrule precedent set by a prior panel (or a prior en banc court). See id. at 334; see also id. at 333 (noting that most other circuits follow the same practice). Thus, unlike the
5
discretionary application of stare decisis by the Supreme Court, we are bound by prior panel decisions. 2 That is not to say that everything said in a panel opinion binds future panels. 3 We recognize that where we “assum[e] without deciding the validity of antecedent propositions” those assumptions “are not binding in future cases that directly raise the questions.” United States v. Norman, 935 F.3d 232, 241 (4th Cir. 2019) (quoting United States v. Verdugo-Urquidez, 494 U.S. 259, 272 (1990)); see also Webster v. Fall, 266 U.S. 507, 511 (1925). And we also recognize that dictum is not binding. See Pittston Co. v. United States, 199 F.3d 694, 703 (4th Cir. 1999). Dictum is a “statement in a judicial opinion that could have been deleted without seriously impairing the analytical foundations of the holding—that, being peripheral, may not have received the full and careful consideration of the court that uttered it.” Id. (quoting United States v. Crawley, 837 F.2d 291, 292 (7th Cir. 1988) (Posner, J.)); see also Cohens v. State of Virginia, 19 U.S. 264,
2 To state the obvious, this means we must follow a prior panel decision even if it had abysmal reasoning, put forward unworkable commands, engendered no reliance interests, lacked consistency with other decisions, and has been undermined by later developments. Indeed, for this principle to mean anything, we must do so in exactly those cases.
3 Determining the scope of this horizontal precedent often presents its own perplexing problems. See Charles W. Tyler, The Adjudicative Model of Precedent, 87 U. CHI. L. REV. 1551 (2020) (discussing different models for determining the scope of prior intra-circuit decisions). And similar problems exist when we look vertically to the Supreme Court’s precedents. See Richard M. Re, Narrowing Supreme Court Precedent from Below, 104 GEO. L.J. 921 (2016) (discussing how lower courts treat Supreme Court precedent).
6
399–400 (1821). If necessary to the outcome, a precedent’s reasoning must be followed; otherwise, we are not so bound. 4 B. Constitutional right to privacy Shepherded by these principles, we turn to Payne’s claimed constitutional right to privacy. The Supreme Court’s guidance is less than illuminating. In its most recent decision on the matter, the Court “assume[d], without deciding, that the Constitution protects a[n informational] privacy right of the sort mentioned in Whalen [v. Roe, 429 U.S. 589 (1977)] and Nixon [v. Administrator of General Services, 433 U.S. 425 (1977)].” NASA v. Nelson, 562 U.S. 134, 138 (2011) (emphasis added). The Court also recognized that this was its “approach in Whalen”: assume a constitutional right to privacy exists but find that any existing right was not violated. Id. at 147. 5
4 Of course, our own prudential decision to follow prior panel decisions (horizontal stare decisis) is overcome by our mandate as an inferior court to follow the Supreme Court’s commands (vertical stare decisis). Thus, we are not bound by previous panels where “the prior opinion has been overruled by an intervening opinion from . . . the Supreme Court.” McMellon, 387 F.3d at 333. So where subsequent Supreme Court decisions “clearly undermine[]” a panel precedent, we need not follow that panel precedent. United States v. Williams, 155 F.3d 418, 421 (4th Cir. 1998).
5 Nixon charted a similar course. There, the Court acknowledged that “public officials . . . are not wholly without constitutionally protected privacy rights.” Nixon, 433 U.S. at 457. It went on to “assume . . . for the purposes of [that] case” that the withholding personal or financial information from presidential libraries and congressional acquiescence to that practice “g[ave] rise to [President Nixon’s] legitimate expectation of privacy in such materials.” Id. at 457–58 (citing Katz v. United States, 389 U.S. 347, 351– 53 (1967)).
Some of our own cases have followed the same path. See Watson v. Lowcountry Red Cross, 974 F.2d 482, 487–88 (4th Cir. 1992) (assuming that a blood donor has a right to confidentiality in his identity but rejecting the argument that a mere possibility of public disclosure of private information could violate that right); Taylor v. Best, 746 F.2d 220, (Continued)
7
Although this Court’s guidance has not been the model of clarity, we have gone beyond assuming. In Walls v. City of Petersburg, Walls claimed that the information required by an employment questionnaire violated her right to privacy. 895 F.2d 188, 189– 90 (4th Cir. 1990). We first agreed that “[t]he constitutional right to privacy extends to . . . ‘the individual interest in avoiding disclosure of personal matters.’” Id. at 192 (citing Whalen, 429 U.S. at 599–600). But that “right to privacy” protected “only information with respect to which the individual has a reasonable expectation of privacy.” Id. at 193; see also id. at 192 (“Personal, private information in which an individual has a reasonable expectation of confidentiality is protected by one’s constitutional right to privacy.”).
Walls, we held, lacked a “reasonable expectation of privacy” in information that was “freely available in public records,” including marriages, divorces, children, and arrests or convictions of family members. Id. at 193–94. We suggested that she maintained a reasonable expectation of privacy in details that were “not part of the public record concerning a divorce, separation, annulment, or the birth of children.” Id. at 193. But those non-public details were not implicated in the case because they were not covered by the questionnaire. Id. at 193–94. 6
225 (4th Cir. 1984) (assuming that an inmate has a right to privacy in their family background, but finding that “the compelling public interests in assuring the security of prisons and in effective rehabilitation clearly outweigh[ed]” the inmates interest in keeping that information confidential).
6 We also found information about same-sex sexual relations unprotected because, at that time, “[t]he Court [had] explicitly rejected ‘the proposition that any kind of private sexual conduct between consenting adults is constitutionally insulated from state proscription.’” Walls, 895 F.2d at 193 (quoting Bowers v. Hardwick, 478 U.S. 186, 191 (Continued)
8
Turning to the “[f]inancial information [] requested in the questionnaire,” we held that it was “protected by a right to privacy.” Id. at 194. As Walls possessed a right to privacy in the financial information, we weighed her privacy interest against the government’s interest in disclosure to guard against potential corruption. We found that the government’s interest was compelling and determined that it outweighed her right to privacy. We thus concluded that the required disclosure of financial information did not violate her right to privacy.
Walls thus adopted a two-part inquiry, asking first whether “the information sought is entitled to privacy protection,” like the financial information from that case. Id. at 192, 194. And, if a right to privacy existed, then asking whether “a compelling governmental interest in disclosure outweighs the individual’s privacy interest.” Id. at 192. For the first inquiry, we explained that information is protected only where there is a “reasonable expectation of privacy” in it. Id. at 193. It is this inquiry that binds us today.
This “reasonable expectation of privacy” language emanates from Justice Harlan’s famous concurrence in Katz v. United States, 389 U.S. 347 (1967). There, Justice Harlan explained that the Fourth Amendment protects people where they have a “reasonable expectation of privacy,” that is, a place where the person has “an actual (subjective)
(1986)). Bowers has since been overturned by the Supreme Court. Lawrence v. Texas, 539 U.S. 558, 578 (2003). So to add some dictum to an opinion about dicta, this part of Walls is no longer good law.
9
expectation of privacy” and “the expectation [is] one that society is prepared to recognize as ‘reasonable.’” Id. at 360–61 (Harlan, J., concurring). 7 Since Walls, we have applied this “reasonable expectation of privacy” test to evaluate whether information is protected by a constitutional right to privacy. In Condon v. Reno, we found that drivers lacked any constitutionally protected right to privacy in their personal information stored in motor-vehicle records. 155 F.3d 453, 465 (4th Cir. 1998), rev’d on other grounds, Reno v. Condon, 528 U.S. 141, 148 (2000) (upholding the Driver's Privacy Protection Act of 1994 under Congress’s Commerce Clause power). We reasoned that driver’s records were “the very sort of information to which individuals do not have a reasonable expectation of privacy.” Id. at 464–65 (emphasis added). The existence of “‘pervasive schemes of regulation’ . . . must ‘necessarily lead to reduced expectations of privacy.’” Id. at 465 (quoting California v. Carney, 471 U.S. 386, 392 (1985), a Fourth Amendment case). And these motor-vehicle records are traditionally public and easily accessible. Id. As drivers lacked a “reasonable expectation of privacy,” we held they lacked a constitutionally protected right to privacy that Congress could enforce under Section 5 of the Fourteenth Amendment. Id.
7 We were not the first court to consider the Fourth Amendment in this area. The Supreme Court, in assuming that a right to privacy existed in Nixon, cited Katz. See Nixon, 433 U.S. at 458. And in determining whether the government had a sufficient interest in invading that right, the Court cited Terry v. Ohio, 392 U.S. 1 (1968), a seminal Fourth Amendment case, along with other Fourth Amendment cases. Nixon, 433 U.S. at 458–63. See also Walls, 895 F.2d at 192 (relying on Justice Brandeis’s dissent in Olmstead v. United States, 277 U.S. 438 (1928), another seminal Fourth Amendment opinion).
10
While Condon looked to the reasonable expectation of privacy to reject the claimed right to privacy, it also “note[d]” that “the Supreme Court has limited the ‘right to privacy’ to matters of reproduction, contraception, abortion, and marriage.” Id. at 464 (internal citations omitted). This descriptive statement was unnecessary to Condon’s holding, which turned on the lack of a reasonable expectation of privacy based on the pervasive regulation and public nature of the information. See id. at 464–65. It is thus dictum that does not control our analysis.
Even so, we later appeared to rely on this dictum from Condon. See Edwards v.
City of Goldsboro, 178 F.3d 231, 252 (4th Cir. 1999) (citing Condon, 155 F.3d at 464). In Edwards, the plaintiff brought seventeen causes of action against a city and its officials, claiming that they could not punish him for teaching a handgun safety class when he was not authorized to do so. Id. at 239–40. One of those causes of action invoked, without elaboration, his “right to privacy.” Id. at 240, 252. We rejected that claim because the case did not involve “matters of reproduction, contraception, abortion, and marriage.” Id. at 252. But this proposition conflicts with Walls’s holding that information within an individual’s reasonable expectations of privacy—including financial information—falls within the right to privacy. Walls, 895 F.2d at 192–94. So, under our rules of horizontal stare decisis, we are required “to follow the earlier of the conflicting opinions” rather than decide which precedent is correct. McMellon, 387 F.3d at 333. 8
8 In Greenville Women’s Clinic v. Comm’r, S.C. Dep’t of Health and Env’t Control, 317 F.3d 357 (4th Cir. 2002), we considered a South Carolina law that required abortion clinics to record certain information and report each abortion to the South Carolina (Continued)
11
Because no subsequent panel could overrule Walls and the Supreme Court has done little to clarify the scope of the constitutional right to privacy, we follow Walls. We must thus ask (1) whether a “reasonable expectation of privacy” in the information exists as to entitle it to privacy protection and, if so, (2) whether “a compelling governmental interest in disclosure outweighs the individual’s privacy interest.” Walls, 895 F.2d at 192. We decide that Payne lacked a reasonable expectation of privacy in his HIV medication and diagnosis. He thus lacked a right to privacy in that information and we need not consider part two of the Walls test.
C. As an inmate, Payne lacked a reasonable expectation of privacy in information about his HIV status
We first look to Payne’s claimed “reasonable expectation of privacy.” Id. at 193.
Dr. Taslimi disclosed Payne’s HIV status while Payne was a patient in a prison medical center. And a prisoner’s reasonable expectations of privacy are limited.
In Hudson v. Palmer, the Supreme Court held that a prison inmate lacked a reasonable expectation of privacy in his prison cell. 468 U.S. 517, 525–26 (1984). The Court found that “any subjective expectation of privacy that a prisoner might have in his prison cell” was not one that society would recognize as legitimate or reasonable. Id. at 526–27. Balancing the prisoner’s interest in privacy against “the interest of society in the security of its penal institutions,” the Court held that any subjective desire for privacy was
Department of Health and Environmental Control. Id. at 367–71. We found that because South Carolina had an adequate governmental interest in instituting this reporting requirement and provided safeguards to prevent the disclosure of this information, the rights of the clinic’s patients were not violated. Id. Like Whalen, Greenville Women’s Clinic assumed that the privacy right at interest in that case existed.
12
“incompatible” with the need to “ensure institutional security and internal order.” Id. at 527–28; see also id. (“[l]oss of freedom of choice and privacy are inherent incidents of confinement” (quoting Bell v. Wolfish, 441 U.S. 520, 537 (1979))).
Although Hudson discussed an inmate’s right to privacy based on the need for institutional safety, we have rejected the claim that the Government can only search a detainee’s cell where the search advances legitimate penological needs. In United States v. Jeffus, the plaintiff claimed that the government had searched his cell to obtain evidence against him and thus the search “had ‘nothing whatever to do with security, safety, or sanitation’ at the jail.” 22 F.3d 554, 559 (4th Cir. 1994). We rejected his claim, reasoning that the government’s rationale for conducting the search did not matter for Fourth Amendment purposes because the detainee lacked any reasonable expectation of privacy in his cell. Id. In other words, if a detainee does not have a reasonable expectation of privacy, the reason the detainee lacks it and the reason for the government’s search need not be the same.
That is not to say that prisoners have no “reasonable expectations of privacy” in prison. But those expectations are quite limited. For example, we found a “reasonable expectation of privacy” in “bodily privacy and integrity” to be violated by surgery to remove a cosmetic implant from an inmate’s genitals. King v. Rubenstein, 825 F.3d 206, 214–15 (4th Cir. 2016); but cf. Jones v. Murray, 962 F.2d 302, 306 (4th Cir. 1992) (permitting drawing blood from a pretrial detainee because detainees “lose a right of privacy from routine searches of the cavities of their bodies and their jail cells”). That interest in “bodily integrity involve[d] the ‘most personal and deep-rooted expectations of
13
privacy’” and many sexually invasive searches will involve an “objectively extreme” intrusion on those expectations of privacy. King, 825 F.3d at 215–16 (quoting Winston v. Lee, 470 U.S. 753, 760 (1985)).
As an inmate in a prison medical center, Payne lacked a reasonable expectation of privacy in his HIV status and his compliance with his treatment plan. Payne does not claim a reasonable expectation of privacy in the initial disclosure of his HIV diagnosis and medical records to prison officials. See Dunn v. White, 880 F.2d 1188, 1197 (10th Cir. 1989) (testing prison inmates for AIDS does not violate the Fourth Amendment); see also Jones, 962 F.2d at 307. Payne instead challenges the secondary disclosure from prison officials to prison guards and inmates in the medical ward. But just as he lacks a reasonable expectation of privacy in the initial disclosure of his communicable-disease diagnosis to the prison officials, so too does he lack a reasonable expectation of privacy in the secondary disclosure of his diagnosis. Where an inmate lacks a reasonable expectation of privacy, he lacks it for all purposes. Jeffus, 22 F.3d at 559. Whatever desire he may have to keep that information purely private is “incompatible” with the needs of an institution, and therefore not reasonable. Hudson, 468 U.S. at 527; see Anderson v. Romero, 72 F.3d 518, 524 (7th Cir. 1995) (Posner, J.) (Even if prisoners had a right to the confidentiality of their medical records in general, “it would not follow that a prisoner had a right to conceal his HIV status” because of the “great difference . . . between a communicable and a noncommunicable disease.”).
Information about an inmate’s HIV diagnosis and medication is unlike the expectations of privacy that we have found protected in prison. Unlike an inmate’s bodily
14
integrity, one’s communicable-disease diagnosis lacks any deep roots in the expectation of privacy and falls far from the most personal invasions into an inmate’s body. See King, 825 F.3d at 215. Disclosure of Payne’s diagnosis and medication information simply does not implicate the same Fourth Amendment concerns as forcing someone to, for example, undergo surgery or subject themselves to invasive medical procedures. 9 The limits on an inmate’s expectations of privacy are particularly strong where the information he seeks to protect relates to the institutional safety of the prison. See Hudson, 468 U.S. at 526. Here, both the location and the type of information reduces any possible expectation of privacy that Payne might have had in this information. First, Payne was told that he had not taken his medicine within the prison medical unit, the most relevant place for such information to be shared and where it might be difficult to ensure others would not hear. Second, the information Dr. Taslimi relayed to Payne dealt with his communicable disease and whether he was taking his medication, which is especially relevant in a prison where disease can spread rapidly (as seen by the COVID-19 pandemic). While HIV and its spread can be controlled by medicine, an inmate’s expectation of privacy in his diagnosis is still unreasonable during treatment because there remains a risk of transmission to prison workers and other inmates. For example, a prisoner might forgo
9 Nor is Payne’s communicable-disease status equivalent to an inmate’s expectation of privacy in legal mail, which “is widely recognized to be privileged and confidential.” Haze v. Harrison, 961 F.3d 654, 661 (4th Cir. 2020); see also Sarah A. Rana, Restricting the Attorney-Client Privilege: Necessary Limitations or Distorting the Privilege?, 32 SUFFOLK U. L. REV. 687, 689–93 (1999) (tracing the history of the attorney-client privilege to the common law and discussing its relationship to the Fifth Amendment).
15
taking the medicine and thus become contagious again, just as Payne apparently did here. So it is hard to see how Payne would have a reasonable expectation of privacy in his communicable-disease status within a medical unit.
In sum, Payne has a reduced expectation of privacy in prison and, as we conclude here, no reasonable expectation of privacy in his HIV diagnosis and treatment. No matter how much a prisoner subjectively would like to keep that information to himself, we must ask whether that expectation is “one that society is prepared to recognize as ‘reasonable.’” Katz, 389 U.S. at 361 (Harlan, J., concurring); accord Hudson, 468 U.S. at 525–26. And any subjective expectation of privacy in this information that Payne has is simply not reasonable. See Anderson, 72 F.3d at 522–23; Tokar v. Armontrout, 97 F.3d 1078, 1084 (8th Cir. 1996). 10 Because we decide that this information is not “within [Payne’s] reasonable expectations of confidentiality,” we need not go further to address whether Dr. Taslimi had a “compelling government interest in disclos[ing Payne’s HIV status that] outweigh[ed Payne’s] privacy interest.” Walls, 895 F.2d at 192.
D. HIPAA does not create a private cause of action Finally, Payne alleged that Dr. Taslimi violated HIPAA. HIPAA provides that “[a]
person who knowingly . . . discloses individually identifiable health information to another person” without authorization shall be fined, imprisoned, or both. 42 U.S.C. § 1320d-
10 The circuits that have found a right to privacy in this context have done so by finding that privacy right to be “completely different” than the rights “extinguished” by Hudson’s reasonable-expectation-of-privacy test. Doe v. Delie, 257 F.3d 309, 316–17 (3d Cir. 2001); accord Powell v. Schriver, 175 F.3d 107, 112 n.3 (2d Cir. 1999). Whatever the merits of that position, we are constrained to apply our holding in Walls to the contrary.
16
6(a)(3), (b). Even if Dr. Taslimi violated this provision, a plaintiff seeking a remedy under § 1983 “must assert the violation of a federal right, not merely a violation of federal law.” Planned Parenthood S. Atl. v. Baker, 941 F.3d 687, 696 (4th Cir. 2019) (quoting Blessing v. Freestone, 520 U.S. 329, 340 (1997)). Thus, for Payne to recover under HIPAA, the statute must create a private right to sue that may be enforced under § 1983. Every circuit court to consider whether HIPAA created a private right to sue has found that it does not. See Meadows v. United Servs., Inc., 963 F.3d 240, 244 (2d Cir. 2020); Stewart v. Parkview Hosp., 940 F.3d 1013, 1015 (7th Cir. 2019); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Wilkerson v. Shinseki, 606 F.3d 1256, 1267 n.4 (10th Cir. 2010); United States v. Streich, 560 F.3d 926, 935 (9th Cir. 2009); Acara v. Banks, 470 F.3d 569, 571–72 (5th Cir. 2006); see also Faber v. Ciox Health, LLC, 944 F.3d 593, 596–97 (6th Cir. 2019) (stating, in dictum, that HIPAA does not create a private right of action). This is because HIPAA does not expressly allow for a private cause of action but delegates enforcement authority to the Secretary of the Department of Health and Human Services, reflecting Congress’s intent to forgo creating a private remedy. Meadows, 963 F.3d at 244; see also Alexander v. Sandoval, 532 U.S. 275, 290 (2001) (disfavoring implied causes of action when Congress has provided other methods of enforcing the statute’s mandate). We see no reason to chart a different course from our sister circuits. Payne has no private right of action under HIPAA.
* * *
We limit our decision today to the question before us: Did Payne have a “reasonable expectation to privacy” in his HIV status while in a prison medical unit? We hold that he
17
did not. When Dr. Taslimi disclosed his HIV status, Payne was in prison, a place where individuals have a curtailed expectation of privacy. Whatever expectations remain fail to include the diagnosis of or medication for HIV, a communicable disease. The judgment below is therefore AFFIRMED.