Coles v. Howard University

• Court: District Court, District of Columbia
• Decided: October 31, 2023
• Docket: Civil Action No. 2023-2508
• Status: Published

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

KATRICE COLES,

Plaintiff,

v. Civil Action No. 23-2508 (TJK) HOWARD UNIVERSITY et al.,

Defendants.

MEMORANDUM OPINION

Plaintiff sued in the Superior Court of the District of Columbia, asserting several statutory

and common law claims against a hospital and her employer relating to the alleged improper dis-

closure of her medical records. Defendants removed. To justify removal, the hospital argued—

and Plaintiff did not contest—that this Court has federal-question jurisdiction, and it is true that

one claim in the complaint invokes a federal law: the Health Insurance Portability and Accounta-

bility Act of 1996, or HIPAA. But just a few days later, the hospital moved to dismiss and argued

that—again, with no opposition from Plaintiff—the HIPAA claim must be dismissed because the

statute provides no cause of action to establish subject-matter jurisdiction. The Court agrees that

the HIPAA claim must be dismissed for that reason. Moreover, that claim is the only possible

basis for the Court’s subject-matter jurisdiction over this case. Thus, because the Court will grant

the motion to dismiss the HIPAA claim, it must remand the rest of the case for lack of subject-

matter jurisdiction.

I. Factual and Procedural Background

Plaintiff alleges that she was terminated from her job as a ramp agent for Piedmont Airlines

in April 2023. ECF No. 1-1 at 6. She had submitted a medical note from Howard University Hospital to cover a 27-day period of absences from work, but a hospital staffer advised Piedmont

that no patient with Plaintiff’s name had been seen there since January 2019. Id. Piedmont then

fired Plaintiff for falsifying her medical records. Id.

In July 2023, Plaintiff sued Howard University Hospital Corporation and Howard Univer-

sity Hospital (collectively, “Howard”) and Piedmont in the Superior Court of the District of Co-

lumbia. She alleged (1) violations of HIPAA and D.C. Code § 31–3426; (2) violations of the

District of Columbia Consumer Protection Procedures Act and the Notification of Security Breach

Obligation; (3) common law invasion of privacy; (4) breach of contract; (5) negligence and negli-

gence per se; and (6) negligent supervision. She brought all six counts against Howard but only

the latter two against Piedmont.

Both Howard and Piedmont removed the case based on federal-question jurisdiction. How-

ard claimed that removal was proper because the first count alleges a violation of federal law under

HIPAA and because the remaining claims are “contingent upon whether there was a violation of

HIPAA.” ECF No. 1 at 4–5. And according to Piedmont, the negligence claims against it arise

under federal law because they are completely pre-empted by the Railway Labor Act (RLA). ECF

No. 7 at 1. Now Howard and Piedmont move to dismiss. Howard argues that dismissal of all

claims against it—including the HIPAA claim—is warranted for lack of subject-matter jurisdiction

under Federal Rule of Civil Procedure 12(b)(1) and for failure to state a claim under Federal Rule

of Civil Procedure 12(b)(6). ECF No. 6-1 at 7–8. Piedmont argues that the Court lacks subject-

matter jurisdiction over the negligence claims against it because of RLA preemption. ECF No. 12

at 1.

II. Legal Standards

“When confronted with [] a motion to dismiss under both Rule 12(b)(1) and Rule 12(b)(6),

the Court must first consider whether it has subject-matter jurisdiction.” Hamilton v. United States,

2 502 F. Supp. 3d 266, 272 (D.D.C. 2020) (citing Steel Co. v. Citizens for a Better Env't, 523 U.S.

83, 94–95 (1998)). If subject-matter jurisdiction is lacking, the Court need not reach any remaining

12(b)(6) arguments. Schmidt v. U.S. Capitol Police Bd., 826 F. Supp. 2d 59, 64 (D.D.C. 2011).

Moreover, under Rule 12(b)(1), the plaintiff has the burden to establish the Court’s subject-matter

jurisdiction. DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 342 (2006). In evaluating a Rule

12(b)(1) motion, the Court must “assume the truth of all material factual allegations in the com-

plaint and . . . grant[ Plaintiff] the benefit of all inferences that can be derived from the facts al-

leged.” Am. Nat’l Ins. Co. v. FDIC, 642 F.3d 1137, 1139 (D.C. Cir. 2011) (citation omitted).

The Court has an independent duty to ensure it has proper jurisdiction at all times because

federal courts have limited jurisdiction and “possess only that power authorized by [the] Constitu-

tion and statute.” Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). After a

case is removed, if a federal court determines that it lacks subject-matter jurisdiction, then it must

remand the case back to state court. 28 U.S.C. § 1447(c); see also Merkulov v. U.S. Park Police,

75 F. Supp. 3d 126, 129 (D.D.C. 2014) (“[T]he Court must satisfy itself that it maintains jurisdic-

tion over the removed proceeding.”). Because of federalism concerns, “[t]he Court must resolve

any ambiguities concerning the propriety of removal in favor of remand.” US Airways Master

Exec., Council, Air Line Pilots Assoc., Int’l. v. Am. W. Master Exec. Council, Air Line Pilots As-

soc., Int’l., 525 F. Supp. 2d 127, 132 (D.D.C. 2007).

III. Analysis

A. HIPAA Claim

1. The HIPPA Claim Must be Dismissed for Lack of Subject-Matter Ju- risdiction

Howard argues that the HIPAA claim must be dismissed because HIPAA lacks a private

right of action. ECF No. 6-1 at 13–14. In response, Plaintiff expressly concedes that Howard is

3 correct and even notes that she plans to drop the claim entirely. ECF No. 13 at 5. The Court

concurs with the parties. There is “clear consensus among courts” that no private action exists

under HIPAA. Lee-Thomas v. LabCorp, 316 F. Supp. 3d 471, 474 (D.D.C. 2018); Hudes v. Aetna

Life Ins. Co., 806 F. Supp. 2d 180, 195–196 (D.D.C. 2011), aff'd, 493 F. App’x 107 (D.C. Cir.

2012) (collecting cases). Rather, the statute explicitly provides that the Secretary of Health and

Human Services is charged with imposing penalties for HIPAA violations. See 42 U.S.C.

§ 1320d–5. And multiple courts, including within this Circuit, have dismissed HIPAA claims for

lack of subject-matter jurisdiction because a private right of action is absent. See, e.g., Johnson v.

Quander, 370 F. Supp. 2d 79, 100 (D.D.C. 2005), aff'd, 440 F.3d 489 (D.C. Cir. 2006); Logan v.

Dep't of Veterans Affs., 357 F. Supp. 2d 149, 155 (D.D.C. 2004); Acara v. Banks, 470 F.3d 569,

572 (5th Cir. 2006). Thus, the Court will dismiss the HIPAA claim under Rule 12(b)(1).1

2. The HIPAA Claim Does Not Support Removal

Sections 1331 and 1441 together authorize removal to federal court for federal questions.

Section 1441 permits removal for “any civil action brought in a State court of which the district

courts of the United States have original jurisdiction.” 28 U.S.C. § 1441(a). And Section 1331

creates original jurisdiction in federal district courts for “all civil actions arising under the

1 Some authority suggests, despite the parties’ positions, that the HIPAA claim should in- stead be dismissed for failure to state a claim. See John Doe v. Metro. Police Dep't of D.C., 445 F.3d 460, 466–67 (D.C. Cir. 2006) (explaining that a statute’s failure to provide a cause of action should ordinarily be considered under 12(b)(6)). But even if the Court dismissed the claim on those grounds, that would not affect its disposition of the case. With no federal claims remaining, the Court would still exercise its discretion to remand the state claims. See Bunch v. District of Columbia, 151 F. Supp. 3d 148, 153 (D.D.C. 2015) (“When a case involving state and federal claims is removed from state court, and subsequently the federal claims are dismissed before trial, the district court has discretion to remand to state court . . . [the] pendent claims upon a proper determination that retaining jurisdiction over the case would be inappropriate . . . The D.C. Circuit has repeatedly expressed its preference for remand in these circumstances.”) (citations omitted); see also D.C. Pro. Taxicab Drivers Ass'n v. District of Columbia, 880 F. Supp. 2d 67, 76 (D.D.C. 2012).

4 Constitution, laws, or treaties of the United States.” 28 U.S.C. § 1331. Thus, a claim can only

support removal under Section 1441 if it first establishes subject-matter jurisdiction under Section

1331.2

The HIPAA claim does not arise under the Constitution, laws, or treaties of the United

States for purposes of Section 1331. Indeed, it must be dismissed under Rule 12(b)(1) precisely

because, absent a private right of action, it presents no federal question that establishes subject-

matter jurisdiction. Thus, despite its invocation of a federal statute, the HIPAA claim does not

provide the Court with original jurisdiction over this suit and cannot serve as the basis for removal

under Section 1441. See Moses v. SunTrust Mortg., Inc., No. 11-CV-00822 (BJR), ECF No. 23 at

3 (D.D.C. Jan. 13, 2012) (“Regardless of whether removal [appears] initially proper, a district

court should dismiss an action for lack of subject matter jurisdiction when the facts and allegations

before the court belie any averment that federal jurisdiction exists.”).

B. The Remaining Claims Do Not Create Federal-Question Jurisdiction, and So They Also Do Not Support Removal

In its notice of removal, Howard contends that the remaining state law claims create fed-

eral-question jurisdiction because they “are contingent upon whether there was a violation of

HIPAA.” ECF 1 at 5. Howard is right that in a “special and small category” of cases, a state law

claim can create federal-question jurisdiction. See Gunn v. Minton, 568 U.S. 251, 258 (2013). But

that is so only when a federal issue is: “(1) necessarily raised, (2) actually disputed, (3) substantial,

and (4) capable of resolution in federal court without disrupting the federal-state balance approved

2 Of course, subject-matter jurisdiction can also be established under Section 1332 for di- versity of citizenship. But here, Plaintiff and Piedmont are both citizens of Maryland, so no party argues for jurisdiction on that ground. See ECF No. 1-1 at 4–5.

5 by Congress.” Id. Here, the remaining state law claims do not come close to meeting those de-

manding requirements.

To begin, a violation of HIPAA is not “necessarily raised” in the remaining claims. The

complaint cites several state statutes that could serve as an independent basis for state liability

irrespective of any HIPAA violation. See ECF 1-1 at 10, 12–13 (citing D.C. Code §§ 31-3426 et

seq., 28-3901 to 28-3913, 28-3851 et seq.). And even if the same disclosure of personal health

information that allegedly violated those state laws also allegedly violated HIPAA, that does not

transform HIPAA into an “essential element” of those state claims. See D.C. Ass'n of Chartered

Pub. Schs. v. District of Columbia, 930 F.3d 487, 491 (D.C. Cir. 2019) (quoting Grable & Sons

Metal Prods., Inc. v. Darue Eng'g & Mfg., 545 U.S. 308, 315 (2005)). Nor is the complaint’s

“[p]assing reference[] to [a] federal statute[]” while discussing its state claims sufficient to estab-

lish federal jurisdiction. Hayman v. Bldg Metro Cap. LLC, No. 22-CV-2092 (TJK), ECF No. 15

at 8 (D.D.C. Sept. 13, 2023).

Moreover, whether Defendants violated HIPAA is not a “substantial” issue in the remain-

ing claims. Substantial issues of federal law are those that “present a nearly pure issue of law”

rather than “fact-bound and situation-specific” cases. Bender v. Jordan, 623 F.3d 1128, 1130

(D.C. Cir. 2010) (citation omitted). There is no pure issue of HIPAA law here. The remaining

state claims revolve around detailed factual questions about the information disclosed, the steps

that were taken to protect it, and the nature of the parties’ agreement to protect it—none of which

depends on “a legal question that call[s] for the interpretation of federal statutes.” District of Co-

lumbia v. Elevate Credit, Inc., 554 F. Supp. 3d 125, 146 (D.D.C. 2021).3

3 Even negligence per se, which may appear to rest on an interpretation of HIPAA, has been consistently held not to create federal-question jurisdiction when it is brought alongside a

6 Finally, even if the remaining claims did necessarily depend on a violation of HIPAA, that

still would not create federal-question jurisdiction. As already explained, HIPAA does not create

a private cause of action, and when “a complaint alleg[es] a violation of a federal statute as an

element of a state cause of action, when Congress has determined that there should be no private,

federal cause of action for the violation, [the complaint] does not state a claim ‘arising under the

Constitution, laws, or treaties of the United States.’” Merrell Dow Pharms. Inc. v. Thompson, 478

U.S. 804, 817 (1986). Thus, none of Plaintiff’s state claims raise an issue of federal law sufficient

to create federal jurisdiction, or a basis for removal.

Piedmont advances a different but also flawed basis for federal-question jurisdiction. Pied-

mont argues that removal is warranted because Plaintiff’s claims against them “are completely

pre-empted by the Railway Labor Act.” ECF No. 7 at 1. But a federal defense of preemption does

not normally suffice to create federal-question jurisdiction. See Organic Consumers Ass’n v. Gen.

Mills, Inc., 235 F. Supp. 3d 226, 230 (D.D.C. 2017) (citing Caterpillar, Inc. v. Williams, 482 U.S.

386, 392 (1987)). Only in rare cases, when the preemptive force is “extraordinary,” can a federal

statute operate to completely preempt a state law claim and transform it into an issue of federal

law. Metro. Life Ins. Co. v. Taylor, 481 U.S. 58, 65 (1987). Not so here.

In Beneficial National Bank v. Anderson, the Supreme Court explained that complete

preemption only applies to statutes that provide “the exclusive cause of action for the claim as-

serted.” 539 U.S. 1, 8 (2003). In that case, the Court identified the National Bank Act as one of

regular negligence claim, as is the case here. See Harding-Wright v. D.C. Water & Sewer Auth., 350 F. Supp. 2d 102, 105–06 (D.D.C. 2005) (“If negligence and negligence per se are merely alternative theories under which [Plaintiff] may be found liable for the same underlying conduct, then the presence of the negligence per se claim cannot support this court’s continued jurisdic- tion.”); see also Green v. Wachovia Bank N.A., No. 06-CV-1929 (EGS), ECF No. 17 at 5–6 (D.D.C. May 2, 2007).

7 those rare statutes. It also referenced the only two other statutes it had ever recognized as creating

complete preemption—neither of which was the RLA. Id. Before Beneficial National Bank, a

few circuits had concluded that the RLA created complete preemption. But soon after, one of

those circuits reversed course after finding that the RLA does not provide an exclusive cause of

action, and because the Supreme Court had explicitly identified only two qualifying statutes. Sul-

livan v. Am. Airlines, Inc., 424 F.3d 267, 276 (2d Cir. 2005) (reconsidering Shafii v. British Air-

ways, PLC, 83 F.3d 566 (2d Cir. 1996)). Similarly, several other circuits that had previously found

that the RLA provided complete preemption changed their tune. See Moore-Thomas v. Alaska

Airlines, Inc., 553 F.3d 1241, 1246 (9th Cir. 2009) (overruling Grote v. Trans World Airlines, Inc.,

905 F.2d 1307 (9th Cir. 1990)); Hughes v. United Air Lines, Inc., 634 F.3d 391, 395 (7th Cir. 2011)

(overruling Graf v. Elgin, Joliet and E. Ry Co., 790 F.2d 1341 (7th Cir. 1986)). Thus, the “emerg-

ing trend” is that “the RLA does not provide for complete preemption.” US Airways, 525 F. Supp.

2d at 134.4 And while the D.C. Circuit has not directly addressed this issue, at least one of its

members has suggested that complete preemption should be limited to only those statutes explic-

itly recognized by the Supreme Court. See Republic of Venezuela v. Philip Morris Inc., 287 F.3d

192, 201 (D.C. Cir. 2002) (Williams, J., concurring) (noting a lack of “an analytical basis for ex-

tending the complete preemption doctrine beyond the two statutes that the Supreme Court has held

effected such a preemption.”). The Court finds the reasoning of these circuits persuasive and

agrees that the RLA does not create complete preemption. Thus, the RLA does not establish fed-

eral-question jurisdiction for removal purposes.

4 The lone holdout against this trend appears to be the Eighth Circuit. Yet even that court has only “expressed doubts” as to whether Beneficial National Bank definitively established that the RLA does not create complete preemption. See Richardson v. BNSF Ry. Co., 2 F.4th 1063, 1070 (8th Cir. 2021).

8 * * *

After dismissing Plaintiff’s HIPAA claim for lack of subject-matter jurisdiction, no claims

remain that support this Court’s exercise of federal-question jurisdiction over this suit. Thus, re-

mand is required. See 28 U.S.C. § 1447(c) (“[i]f at any time before final judgment it appears that

the district court lacks subject matter jurisdiction, the case shall be remanded.”); see also Republic

of Venezuela, 287 F.3d at 196 (“When it appears that a district court lacks subject matter jurisdic-

tion over a case that has been removed from a state court, the district court must remand the case.”).

IV. Conclusion

For all the above reasons, the Court will grant in part Howard’s motion to dismiss as to the

HIPAA claim and remand the case to the Superior Court of the District of Columbia under 28

U.S.C. § 1447(c) for lack of subject-matter jurisdiction.

/s/ Timothy J. Kelly TIMOTHY J. KELLY United States District Judge Date: October 31, 2023