NOT FOR PUBLICATION WITHOUT THE APPROVAL OF THE APPELLATE DIVISION This opinion shall not "constitute precedent or be binding upon any court." Although it is posted on the internet, this opinion is binding only on the parties in the case and its use in other cases is limited . R. 1:36-3.
SUPERIOR COURT OF NEW JERSEY APPELLATE DIVISION
DOCKET NO. A-1736-24
DEISY GRANADOS, Plaintiff-Appellant,
v.
PAN AMERICAN LIFE INSURANCE CO., HOLA DOCTOR INSURANCE & FINANCIAL SERVICES, JONATHAN RUEDE, INDIRA SHAKE, and KARLA HARDWICK,
Defendants-Respondents,
and
HORIZON BLUE CROSS BLUE SHIELD OF NEW JERSEY,
Defendant.
__________________________________
Argued December 15, 2025 – Decided April 30, 2026 Before Judges Natali and Bergman.
On appeal from the Superior Court of New Jersey, Law Division, Union County, Docket No. L-0724-24.
Ryan Linder argued the cause for appellant (Marin Linder, LLC, attorneys; Ryan Linder, on the briefs).
Alba V. Aviles argued the cause for respondents (Fisher Phillips LLP, attorneys; Alba V. Aviles, of counsel and on the brief; David J. Treibman, on the brief).
PER CURIAM Plaintiff appeals from the court's January 2, 2025 order granting the motions of defendants Pan American Life Insurance (Pan American), Hola Doctor Insurance & Financial Services (Hola Doctor), Horizon Blue Cross Blue Shield of New Jersey (Horizon), Jonathan Ruede, Indira Shake, and Karla Hardwick to dismiss her Conscientious Employee Protection Act, N.J.S.A. 34:19-1 to -14 (CEPA) and common law wrongful termination claims with prejudice under Rule 4:6-2(e). Having considered the parties' arguments in light of the record and permissive standard afforded to plaintiff in the pleading stage as enumerated in Printing Mart-Morristown v. Sharp Electronics Corp., 116 N.J. 739 (1989), we reverse and remand for further proceedings.
I.
Plaintiff began her employment with Pan American and Hola Doctor in 2018 as an insurance agent, a position that required her to sell and market health insurance products to customers and "handle highly confidential health
A-1736-24
3
information." Plaintiff explained Pan American and Hola Doctor market and sell health insurance products offered by Horizon and, accordingly, implemented several internal policies "to maintain client confidentiality and comply with [the Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. §§ 1320d-1 to -9]," including a policy that "prevented employees from bringing personal laptops and personal table computers into the office."
In April 2023, plaintiff contended her colleagues "began to bring their personal laptops" into the office, a behavior she was concerned would jeopardize client confidentiality. Because Indira Shake, plaintiff's direct supervisor, was "largely absent from the office," plaintiff reported this conduct to Francisco Rescio, who she alleges was "in management and [had] told her to contact him if she had any issues." After Rescio "failed to respond to the plaintiff's complaints," she contacted Karla Hardwick, who worked in the human resources department, to inform her about the alleged HIPAA violations. Plaintiff alleges Hardwick suggested she contact to Jonathan Ruede, who was "in upper management and worked out of the New Orleans office."
Following her unsuccessful attempt to contact Ruede directly, plaintiff maintains she left him a voicemail message and followed up additionally over email. In her July 25, 2023 email to him, plaintiff wrote:
A-1736-24
4
One of the things that is happening is that some employees are bringing their personal laptops to the office and using them during work hours, which is illegal. We only work with and sell products with Horizon Blue Cross & Blue Shield of New Jersey. We receive confidential information from Horizon members, and I do not know if these employees are sharing this information for another kind of business.
They spent their time making copies and copies that are not from work.
Plaintiff contends she also included in her email that "[a]n unauthorized person was permitted to enter the office, the workplace was dirty, the manager was absent, her colleagues were making improper photocopies of potentially confidential information, and the distribution of work was inequitable."
Following this email, plaintiff maintains "management" immediately responded the next day, emailed all employees a reminder of the internal policy against the use of personal computers during business hours , and later offered a training session to teach employees "to comply with guidelines that were in place to ensure the confidentiality of client information." The email also allegedly "warned" employees not to use company property for personal use. Plaintiff contends, although "she was promised that her complaint would be kept confidential," an angry colleague confronted her the same day the email was circulated. Plaintiff also maintains "violations of the company's client health
A-1736-24
5
information confidentiality policy continued," to which she reported to a hotline offered by Horizon that she learned about at the training session.
At this point, despite being an exemplary employee, plaintiff alleges she faced retaliation for her repeated attempts to report her perceived HIPAA violations. Among other pushback, she states defendants retaliated against her by not keeping her complaint confidential, filing a "false disciplinary complaint . . . to build a case for termination," rescinding her ability to work from home, and pretextually reprimanding and punishing her. She contended the retaliation culminated in her unexplained and sudden termination, denial of her final paycheck, and interference with her application for unemployment benefits.
After being terminated by her employer and filing her original complaint, 1 plaintiff re-filed an amended three-count complaint against defendants. In that pleading, plaintiff alleged retaliation under CEPA, wrongful termination contrary to public policy, and violation of her free speech under the New Jersey Civil Rights Act (NJCRA), N.J.S.A. 10:6-2.
1 We note plaintiff's initial complaint is not in the record before us , but it appears, after filing her first pleading, the court issued two deficiency notices to which plaintiff filed a deficiency correction and, ultimately, her first amended complaint.
A-1736-24
6
In her first CEPA-based claim, plaintiff contended defendants were aware of her reported violations of the confidential health information policy and retaliated against her by, as noted, terminating her employment, among other consequences. She next alleged her termination was "wrongful in that it was contrary to public policy and it was done in a manner that was contrary to the plaintiff's contractual and statutory rights." Finally, in her NJCRA-based cause of action, she asserted defendants terminated her because she "exercised her right to free speech."
In lieu of an answer, defendants moved under Rule 4:6-2(e) to dismiss plaintiffs' complaint for failing to state a claim, and the court issued a September 13, 2024 written decision and order dismissing all counts of plaintiff's amended complaint without prejudice. The order, however, dismissed all counts with prejudice with respect to Horizon and gave plaintiff twenty days from the date of the order to file a second amended complaint. 2 In its statement of reasons, the court concluded plaintiff failed to state her CEPA-based claim because she failed to "include any facts that suggest [she] reasonably believed her colleagues'
2 Plaintiff removed Horizon from their second amended complaint but included it as a named defendant before us. Plaintiff, however, clarified in her merits brief that "the present appeal does not seek to revive the plaintiff's complaint against Horizon."
A-1736-24
7
actions violated HIPAA," an element of a prima facie CEPA claim. The court similarly dismissed her wrongful discharge claim because she "does not state any facts that suggest her termination was contrary to public policy," as required under Pierce v. Ortho Pharm. Corp., 84 N.J. 58 (1980). Finally, the court dismissed plaintiff's third count pled under NJCRA because she failed to plead "any allegations that defendants acted under the color of law."
Plaintiff thereafter filed a second amended complaint, which provided, among other details, specific allegations of HIPPA violations she observed. Specifically, she asserted 45 C.F.R. § 164.102 establishes defendants Hola Doctor and Pan American are covered entities subject to HIPAA. She alleged 45 C.F.R. § 164.306 requires them to "[p]rotect against any reasonably anticipated threats or hazards to the security or integrity of [confidential] information," guard "against any reasonably anticipated uses or disclosures of such information that are not permitted," and "control and limited the ability to access private health information to only specifically authorized members of its workforce." She further claimed 45 C.F.R. § 164.316 bars defendants from "retaliating against employees who make good faith complaints alleging HIPAA violations."3
3 Additionally, plaintiff did not re-pled her dismissed NJCRA-based count.
A-1736-24
8
Accordingly, she contended the following conduct violated HIPAA, its related regulations, and company policy: (1) "non-employees . . . enter[ing] and remain[ing] in areas where private confidential health information was stored"; (2) "her colleagues making unauthorized copies of private confidential health information"; (3) her colleagues "using private confidential information for purposes that were not related to their employment"; (4) her colleagues "br[inging] non-authorized computers into the workplace"; and (5) the retaliation she faced for reporting this conduct.
Defendants again moved under Rule 4:6-2(e) to dismiss plaintiffs'
complaint for failing to state a claim. Defendants argued plaintiff's CEPA-based claim failed because she did not sufficiently plead an "objective reasonable belief and . . . nexus . . . to HIPAA." They specifically noted, and relied heavily upon, plaintiff's email where she explained she did not know to what end her colleagues were bringing in their personal laptops and making copies. Defendants asserted whether she engaged in statutorily protected activity necessary to sustain a CEPA claim is a "question of law, not of fact." Plaintiff argued she properly pled she had an "objective reasonable belief" of HIPAA violations and defendants are unfairly "relying on a figure of speech" in her email to suggest otherwise.
A-1736-24
9
After considering the parties' oral and written arguments, the court dismissed with prejudice plaintiff's second amended complaint in a January 2, 2025 order. In its written statement of reasons, the court concluded plaintiff failed to allege "she reasonably believed her colleagues' actions were violating the provisions of HIP[A]A" as required under N.J.S.A. 34:19-3(a) or a "clear mandate of public policy" under N.J.S.A. 34:19-3(c)(3). The court found the second amended complaint suffered from the same deficiencies as the first, namely "lacking in explicit references to any purported violations of HIP[A]A and instead only referred to violations of internal policies." Despite plaintiff's efforts to connect the internal policies to HIPAA, the court found the complaint lacked facts "evincing a reasonable belief that plaintiff's colleagues were using or distributing clients' confidential and protected health information."
The court also held plaintiff failed to sufficiently allege she engaged in whistleblowing activity, the second element of a prima facie CEPA claim. The court found "the facts surrounding the various complaints plaintiff made" as vague and conclusory. While acknowledging plaintiff alleged she communicated her complaints "via phone, email, in-person, and in voice messages" to Ruede, Harwick, and Rescio, the court explained she did not
A-1736-24
10
provide "any facts as to what was said in those complaints," except for the email to defendant Ruede.
Regarding plaintiff's Pierce-based retaliation claim, the court held her complaint failed for the same reasons and also dismissed it with prejudice. Specifically, the court held it "ha[d] already found the . . . [c]omplaint lacks concrete facts establishing that plaintiff's colleagues were compromising HIP[A]A's mandate against the unauthorized use and distribution of confidential private health information." This appeal followed.
II.
We begin with a discussion of the relevant standard of review. Our review of a dismissal for failure to state a claim pursuant to Rule 4:6-2(e) is plenary, and we owe no deference to the trial judge's conclusions. State v. Cherry Hill Mitsubishi, Inc., 439 N.J. Super. 462, 467 (App. Div. 2015). The inquiry is limited to "examining the legal sufficiency of the facts alleged on the face of the complaint," ibid. (quoting Printing Mart-Morristown, 116 N.J. at 746), giving the plaintiff the benefit of "every reasonable inference of fact," Baskin v. P.C. Richard & Son, LLC, 246 N.J. 157, 171 (2021) (quoting Dimitrakopoulos v. Borrus, Goldin, Foley, Vignuolo, Hyman & Stahl, P.C., 237 N.J. 91, 107 (2019)). Such motions require the complaint be searched in depth and with A-1736-24
11
liberality to determine if there is any "cause of action . . . 'suggested' by the facts," Cherry Hill Mitsubishi, 439 N.J. Super. at 467 (quoting Printing Mart- Morristown, 116 N.J. at 746), and "to ascertain whether the fundament of a cause of action may be gleaned even from an obscure statement of claim, opportunity being given to amend if necessary," Di Cristofaro v. Laurel Grove Mem'l Park, 43 N.J. Super. 244, 252 (App. Div. 1957).
At this preliminary stage of the litigation, the court is not concerned with the ability of the plaintiff to prove the allegations in the complaint. Printing Mart-Morristown, 116 N.J. at 746. Only where "'even a generous reading of the allegations does not reveal a legal basis for recovery'" should the motion be granted, Kieffer v. High Point Ins. Co., 422 N.J. Super. 38, 43 (App. Div. 2011) (quoting Edwards v. Prudential Prop. & Cas. Co., 357 N.J. Super. 196, 202 (App. Div. 2003)), and generally "without prejudice to a plaintiff's filing of an amended complaint," Printing Mart-Morristown, 116 N.J. at 772.
Nonetheless, a complaint should be dismissed where it "states no claim that supports relief, and discovery will not give rise to such a claim. " Dimitrakopoulos, 237 N.J. at 107. Indeed, "the essential facts supporting [the] plaintiff's cause of action must be presented in order for the claim to survive," and "conclusory allegations are insufficient in that regard." Scheidt v. DRS
A-1736-24
12
Techs., Inc., 424 N.J. Super. 188, 193 (App. Div. 2012). "[L]egal sufficiency requires allegation of all the facts that the cause of action requires." Cornett v. Johnson & Johnson, 414 N.J. Super. 365, 385 (App. Div. 2010), aff'd as modified, 211 N.J. 362 (2012), abrogated on other grounds by McCarrell v. Hoffmann-La Roche, Inc., 227 N.J. 569, 590-92 (2017). Thus, "a dismissal is mandated where the factual allegations are palpably insufficient to support a claim upon which relief can be granted." Rieder v. State, Dep't of Transp., 221 N.J. Super. 547, 552 (App. Div. 1987).
A.
Plaintiff contends she properly pled a cause of action under CEPA because she alleged "she had an objectively reasonable belief that the complained conduct violated a law or mandate of public policy." She explains defendants implemented policies designed to limit access to private client health information in compliance with HIPAA and its related federal regulations. In addition to 45 C.F.R. §§ 164.102, 164.306, and 164.316, as cited in her complaint, she argues 45 C.F.R. §§ 164.308 and 164.310 also impose affirmative obligations on defendant to "[i]mplement policies and procedures to limit physical access" to their client's confidential health information.
A-1736-24
13
She argues defendants were required to adopt and implement policies that established "a prohibition on non-employees in the workplace as well as a ban on personal laptops" pursuant to HIPAA "because of the nature of their business." Plaintiff asserts the internal company policies "prevented unauthorized persons from accessing private client health information," in compliance with HIPAA. She maintains she has met the low bar to defeat defendants' Rule 4:6-2(e) motions because her complaint alleges "her colleagues were copying private client health information for non-business purposes."
Plaintiff contends her email to Ruede, where she explained "she did not know if private client health information was being shared," was merely a "figure of speech." She argues the court's heavy reliance on this email was inappropriate because the objective of CEPA is to prevent retaliation against whistleblowers like herself and does not require "any magic words in communicating a reasonable belief of illegal activity." (quoting Mehlman v. Mobil Oil Corp., 153 N.J. 163, 193-94 (1998)) (internal quotation marks omitted).
Plaintiff further explains, by relying exclusively on one sentence in her email, the court ignored her other specific allegations detailed in her second amended complaint, which asserted she had a reasonable belief her colleagues'
A-1736-24
14
conduct violated the law. She maintains her complaint is "replete with instances wherein the plaintiff reported violations of HIPAA, its related regulations, and internal company rules." Specifically, she emphasizes her complaint alleged: (1) unauthorized personnel were permitted to enter the office where private confidential health information was stored; (2) employees were making unauthorized copies of confidential information without proper authorization; and (3) her colleagues were using private confidential health information for non-work-related purposes.
Further, plaintiff contends the court erred in ruling that she did not engage in whistleblowing activity, as required under a CEPA claim. Consistent with the CEPA definition of whistleblowing activity, N.J.S.A. 34:19-3, plaintiff contends her complaint alleges she verbally reported violations of HIPAA and "related company policies." She claims her actions "fall[] squarely within the ambit of whistleblowing activity contemplated by the controlling statute." For the reasons that follow, we agree with plaintiff's arguments and are satisfied she sufficiently pled her CEPA-based claim to preclude dismissal under Rule 4:6- 2(e).
CEPA is remedial legislation designed "to protect and encourage employees to report illegal or unethical workplace activities and to discourage
A-1736-24
15
public and private sector employers from engaging in such conduct." Sauter v. Colts Neck Volunteer Fire Co. No. 2, 451 N.J. Super. 581, 588 (App. Div. 2017) (internal quotation marks omitted) (quoting Mehlman v. Mobil Oil Corp., 153 N.J. 163, 179 (1998)). Thus, the statute "shields an employee who objects to, or reports, employer conduct that the employee reasonably believes to contravene the legal and ethical standards that govern the employer's activities." Hitesman v. Bridgeway, Inc., 218 N.J. 8, 27 (2014); see also N.J.S.A. 34:19-3(a), (c).
CEPA prohibits an employer from retaliating "against an employee who discloses, threatens to disclose, or refuses to participate in an activity of the employer 'that the employee reasonably believes is in violation of a law, or a rule or regulation promulgated pursuant to law.'" Sauter, 451 N.J. Super. at 587 (quoting N.J.S.A. 34:19-2 to -3). The statute does not require that the activity actually violates a law or regulation; it is sufficient if the employee reasonably believes such a violation occurred. Dzwonar, 177 N.J. at 464.
To state a prima facie claim for unlawful retaliation under CEPA, a plaintiff must plead facts establishing that:
1. The employee reasonably believed that the employer's conduct was in violation of a law, rule, regulation promulgated pursuant to law, or a clear mandate of public policy;
A-1736-24
16
2. The employee performed a "whistle-blowing"
activity described in N.J.S.A. 34:19-3(c);
3. An adverse employment action was taken against the employee; and
4. A causal connection exists between the whistle-
blowing activity and the adverse employment action.
[Lippman v. Ethicon, Inc., 222 N.J. 362, 380 (2015)
(quoting Dzwonar, 177 N.J. at 462).]
To satisfy the first element, as noted, a plaintiff is not required to prove their employer actually violated any law, rule, regulation, or clear mandate of public policy to be successful; the plaintiff must merely "show that he or she 'reasonably believes this to be the case.'" Dzwonar, 177 N.J. at 462 (quoting Estate of Roach v. TRW, Inc., 164 N.J. 598, 613 (2000) (internal quotation marks omitted)); see also Mehlman v. Mobil Corp., 153 N.J. 163, 193-94 (1998) (CEPA is not intended "to make lawyers out of conscientious employees but rather to prevent retaliation against those employes who object to employer conduct that they reasonably believe to be unlawful or indisputably dangerous to the public health, safety[,] or welfare.").
To be sure, plaintiff must "set forth facts that would support an objectively reasonable belief that a violation has occurred." Dzwonar, 177 N.J. at 464; see also Chiofalo v. State, 238 N.J. 527, 543 (2019). This requires a trial court, A-1736-24
17
considering a motion to dismiss a plaintiff's CEPA claim pursuant to Rule 4:6- 2(e) to "make a threshold determination that there is a substantial nexus between the complained-of conduct and a law or public policy identified by the court or the plaintiff." Dzwonar, 177 N.J. at 464. Therefore, "the trial court must identify a statute, regulation, rule, or public policy that closely relates to the complained-of conduct," and "should enter judgment for a defendant when no such law or policy is forthcoming." Id. at 463.
The statutory elements and the analytical framework set forth in Dzwonar, however, distinguish an employee's objection to, or reporting of, an employer's illegal or unethical conduct from a routine dispute in the workplace regarding the relative merits of internal policies and procedures. See Dzwonar, 177 N.J. at 467–69; see also Maw v. Advanced Clinical Commc'ns, 179 N.J. 439, 443 (2004).
As our Supreme Court observed in Estate of Roach, when noting the importance of the plaintiff's reasonable belief that the defendant's conduct contravened an authority recognized in CEPA:
[I]f an employee were to complain about a co-employee who takes an extended lunch break or makes a personal telephone call to a spouse or friend, we would be hard pressed to conclude that the complaining employee could have "reasonably believed" that such minor infractions represented unlawful conduct as
A-1736-24
18
contemplated by CEPA. CEPA is intended to protect those employees whose disclosures fall sensibly within the statute; it is not intended to spawn litigation concerning the most trivial or benign employee complaints.
[164 N.J. at 613–14.]
Under prong two, a "whistle-blowing" activity "refers to notification, or threatened notification, to an outside agency or supervisor . . . and also permits a claim to be supported by evidence that the employee objected to or refused to participate in the employer's conduct." Tartaglia v. UBS PaineWebber Inc., 197 N.J. 81, 106 (2008). The whistle-blowing activity must reflect a "threat of public harm, not merely a private harm or harm only to the aggrieved employee." Maw, 179 N.J. at 445. "Vague and conclusory complaints, complaints about trivial or minor matters, or generalized workplace unhappiness are not the sort of things that the Legislature intended to be protected by CEPA." Battaglia v. United Parcel Serv., Inc., 214 N.J. 518, 529-31. 546 (2013).
HIPAA "concerns the protection of personal medical information and regulates its use and disclosure." N.J. Transit PBA Local 304 v. N.J. Transit Corp., 384 N.J. Super. 512, 516-17 (App. Div. 2006). "HIPAA requires health care providers and health care facilities to protect personal medical information from unauthorized disclosure." Smith v. Datla, 451 N.J. Super. 82, 102 (App.
A-1736-24
19
Div. 2017) (citing 42 U.S.C.A. § 1320d–6(a)(3)). The HIPAA privacy restrictions govern only covered entities and their business associates. 45 C.F.R. § 160.102; Michelson v. Wyatt, 379 N.J. Super. 611, 622-23 (App. Div. 2005). There are three covered entities under HIPAA: (1) a health plan; (2) a health care clearinghouse; and (3) a health care provider that transmits any health information in electronic form in connection with a covered transaction. See 42 U.S.C.A. § 1320d–1(a); 45 C.F.R. § 160.103; Michelson, 379 N.J. Super. at 622- 23.
Under HIPAA, Congress has directed the Secretary of Health and Human Services to establish standards for the electronic exchange of medical information and to ensure the privacy of that information. See Michelson, 379 N.J. Super. at 622-23 (citing 42 U.S.C.A. § 1320d-2(a)). "These regulations, collectively known as the Privacy Rule, set forth standards and procedures for the collection, maintenance and disclosure of certain health care information. " Ibid. (citing 42 U.S.C.A. § 1320d-1; 45 C.F.R. § 160.102). "The Privacy Rule prohibits covered entities from using or disclosing personal health information except as permitted by regulation." Ibid. (citing 45 C.F.R. § 164.502(a); Smith
A-1736-24
20
v. Am. Home Prods. Corp. Wyeth-Ayerst Pharm., 372 N.J. Super. 105, 111 (Law. Div. 2003)). 4 Against these principles, we conclude plaintiff has sufficiently alleged a prima facie case under CEPA, especially in light of the liberality in which we address claims at the pleading stage and conclude the court read the pleading too narrowly. First, we are convinced plaintiff's complaint sufficiently pled allegations of whistleblowing activities to satisfy the second prong of a prima facie CEPA claim. Indeed, plaintiff's complaint is replete with numerous allegations of reported grievances of perceived HIPAA violations to several supervisors, including Ruede, Hardwick, and Rescio, and her final attempt to
4 As noted, in addition to the Privacy Rule, plaintiff identifies 45 C.F.R. §§ 164.306, 164.308, 164.310, and 164.316 as related federal regulations that she contends require defendants to implement internal policies to comply with HIPAA and protect confidential health information. In pertinent part, 45 C.F.R. § 164.306 requires covered entities to "protect against any reasonably anticipated threats or hazards to the security or integrity of [confidential] information" and "protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required . . . ." We further note 45 C.F.R. § 164.308 provides covered entities must "prevent those workforce members who do not have access . . . from obtaining access to electronic protected health information"; 45 C.F.R. § 164.310 provides, in relevant part, covered entities must "[i]mplement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed"; and finally, 45 C.F.R. § 164.316 "[i] Implement reasonable and appropriate policies and procedures to comply with the[se] standards."
A-1736-24
21
report alleged violations to the hotline operated by Horizon. We reject the court's decision that plaintiff did not sufficiently plea whistle-blowing activity because she did "not provide any facts as to what was said in those complaints, except for the complaints she made in an email to . . . Ruede." We determine such a conclusion not only expressly ignores plaintiff's alleged email with Ruede, but also misapplies the lenient pleading standard to require plaintiff to plea exactly what she said to each of her supervisors. Rather, we are satisfied plaintiff's complaint, which alleges she attempted to report perceived HIPAA violations to several managers, is sufficient at this stage.
Next, we are satisfied, and the parties seemingly do not dispute, plaintiff's complaint contains sufficient allegations of adverse employment actions to satisfy the third prong of a prima facie CEPA claim. Notably, these allegations culminate with plaintiff's eventual termination but also include allegations of pretextual complaints and consequences before her termination. Further, plaintiff's assertions that she was quickly terminated following the communications of her grievances to defendants, sufficiently pled a causal connection between her whistleblowing activity and alleged adverse employment action to satisfy the fourth prong of a CEPA claim.
A-1736-24
22
Finally, plaintiff's complaint sufficiently alleges that she held a reasonable objective belief defendants were "violating either a law, rule, or regulation promulgated pursuant to law, or a clear mandate of public policy" to satisfy the first prong of a prima facie claim under CEPA, in light of her allegations that defendants had violated HIPAA and its related federal regulations. Plaintiff's allegations, namely that she observed "non-employees . . . enter[ing] and remain[ing] in areas where private confidential health information was stored" and her colleagues "making unauthorized copies [and] . . . using private confidential information for purposes that were not related to their employment," may arguably violate HIPAA and suggests a "fundament of a cause of action" likely to be assisted by further discovery, worthy of surviving the pleading stage. See Printing Mart-Morristown, 116 N.J. at 746.
We readily acknowledge defendants' and the court's heavy consideration of her email to Ruede as evidence she did not possess a reasonable objective belief and conclude whether her colleagues shared the information with anyone, as discussed in the email, is not dispositive. We find such a conclusion, however, ignores the totality of plaintiff's complaint, which, as noted, expressly contains allegations she observed: (1) "non-employees . . . enter[ing] and remain[ing] in areas where private confidential health information was stored";
A-1736-24
23
(2) "her colleagues making unauthorized copies of private confidential health information"; (3) her colleagues "using private confidential information for purposes that were not related to their employment"; (4) her colleagues "br[inging] non-authorized computers into the workplace"; and (5) the retaliation she experienced for reporting "what she reasonably believed to be conduct that violated HIPAA . . . ."
We agree, however, with defendants' argument that certain allegations in the complaint would not be sufficient to satisfy the first prong of a prima facie CEPA claim. For example, we recognize plaintiff's allegations of a "dirty workplace" and general displeasure with unrelated management decisions bear no relevance to the sufficiency of her CEPA-based claim. While we pass no judgment as to the merits of plaintiff's CEPA-based claim, we are satisfied plaintiff's additional allegations of unauthorized breaches of confidential health information as pled in her second amended complaint do, indeed, satisfy the element when viewed through lenient and appropriate standard.
B.
Plaintiff contends she also properly pled her Pierce cause of action. She claims, despite her employer's concerted efforts to keep client information confidential in compliance with HIPAA by implementing and enforcing internal A-1736-24
24
policies, she faced retaliation "within less th[a]n [forty-eight] hours as . . . plaintiff was outed to her co-workers for simply reporting violations of company policy." Because these retaliatory acts, including termination, "violated a clear mandate of public policy," she claims the court erred in dismissing her wrongful termination claim.
In response, defendants contend her second cause of action fails because plaintiff waived her right to pursue a common law claim in light of her CEPA claim. They argue "CEPA functions as replacement of common law Pierce claims" because "'the institution of an action'" under CEPA, N.J.S.A. 34:19 -8, is a "'waiver of the rights and remedies available under . . . the common law.'" Defendants acknowledge the "confusion in the courts as to when an action is 'instituted' for the purposes'" of the CEPA waiver provision, N.J.S.A. 34:19-8, but claim to cite to a long list of New Jersey federal and state cases who adopted the view that CEPA claims preclude common law claims. For the reasons that follow, we disagree and are satisfied plaintiff properly pled her common-law wrongful termination claim.
A common law cause of action for retaliatory discharge was first recognized in the seminal Supreme Court case of Pierce v. Ortho Pharmaceutical Corp., 84 N.J. 58 (1980). Pierce provides a plaintiff with "a cause of action for
A-1736-24
25
wrongful discharge when the discharge is contrary to a clear mandate of public policy." 84 N.J. at 72. "The sources of public policy include legislation; administrative rules, regulations or decisions; and judicial decisions." Ibid. "However, not all such sources express a clear mandate of public policy." Ibid.; see also Macdougall v. Weichert, 144 N.J. 380, 391 (1996) ("A basic requirement of the wrongful discharge cause of action is that the mandate of public policy [must] be clearly identified and firmly grounded.").
"Like the CEPA remedy to which it gave rise, [common law wrongful discharge claims] require[] . . . an expression by the employee of a disagreement with a corporate policy, directive, or decision based on a clear mandate of public policy derived from [legislation, administrative rules, or judicial decisions]." Tartaglia, 197 N.J. at 109. A plaintiff must show "a sufficient expression of that disagreement to support the conclusion that the resulting discharge violates the mandate of public policy and is wrongful." Ibid.
Unless a plaintiff can sufficiently show their discharge was contrary to a clear mandate of public policy, "[a]n employer remains free to terminate an at - will employee who engages in grousing or complaining about matters falling short of [this standard] or who otherwise interferes with the ordinary operation of the workplace by expressions of personal views on matters of no real
A-1736-24
26
substance." Ibid.; see also Pierce, 84 N.J. at 72 ("[U]nless an employee at will identifies a specific expression of public policy, he may be discharged with or without cause."). Likewise, "[b]aseless [grievances] or expressions of purely personal views about the meaning of public policies will not meet the test for a clear mandate regardless of the manner or mode in which they are voiced." Id. at 110 (internal quotation marks omitted).
Although CEPA and Pierce "ha[ve] continued to exist side by side with"
one another, Tartaglia, 197 N.J. at 103, CEPA includes a waiver provision which precludes a plaintiff from bringing a common law action for wrongful discharge if the plaintiff institutes a CEPA claim challenging the discharge, see N.J.S.A. 34:19-8; Young v. Schering Corp., 141 N.J. 16, 27-31 (1995). The waiver provision provides, in relevant part, that "the institution of an action in accordance with [CEPA] shall be deemed a waiver of the rights and remedies available under any other contract, collective bargaining agreement, State law, rule or regulation or under the common law." N.J.S.A. 34:19-8. Our court has, however, interpreted this rule to apply only after the plaintiff has had the opportunity to complete discovery when she is "in a position to make a knowing and meaningful election" of remedies. Maw v. Advanced Clinical Commc'ns, Inc., 359 N.J. Super. 420, 441 (App. Div. 2003), rev'd on other grounds, 179
A-1736-24
27
N.J. 439 (2004); see also Young, 141 N.J. at 32 ("The meaning of 'institution of an action' could conceivably contemplate an election of remedies with restrictions in which the election is not considered to have been made until discovery is complete or the time of a pretrial conference.").
We find plaintiff sufficiently pled that she was discharged in violation of a "clear mandate of public policy" pursuant to Pierce and are satisfied the court did not adequately apply the liberal pleading standard. As noted, plaintiff's complaint, at the least, alleges she observed "non-employees . . . enter[ing] and remain[ing] in areas where private confidential health information was stored" and her colleagues "making unauthorized copies [and] . . . using private confidential information for purposes that were not related to their employment," which are potential violations of HIPAA, and for which she contends she was terminated. We find violations of HIPAA and its related regulations, namely 45 C.F.R. §§ 164.102, 164.306, 164.308, 164.310, and 164.316, would be violations of a "clear mandate of public policy," pursuant to Pierce, as these provisions establish minimum standards to ensure confidentiality and privacy for covered entities, of which plaintiff alleges defendants are and trained employees accordingly. We further reject defendants' argument that she has waived her right to a common-law wrongful termination,
A-1736-24
28
in light the well-established principle in our case law that litigants pursuing a CEPA-based claim and common-law wrongful termination claim need not waive their rights at the pleading stage.
Therefore, we reverse the court's dismissal of both counts as plaintiff adequately stated claims upon which relief may be granted pursuant to CEPA and the common law. We reinstate her complaint and, as noted take no position as to the merits of any of her claims.
To the extent we have not specifically addressed any of the parties'
remaining arguments, it is because we have determined they lack sufficient merit to warrant discussion in a written opinion. See R. 2:11-3(e)(1)(E).
Reversed and remanded. The complaint is reinstated. We do not retain jurisdiction.
A-1736-24