NOT FOR PUBLICATION WITHOUT THE APPROVAL OF THE APPELLATE DIVISION This opinion shall not "constitute precedent or be binding upon any court." Although it is posted on the internet, this opinion is binding only on the parties in the case and its use in other cases is limited . R. 1:36-3.
SUPERIOR COURT OF NEW JERSEY APPELLATE DIVISION DOCKET NO. A-1736-24
DEISY GRANADOS,
Plaintiff-Appellant,
v.
PAN AMERICAN LIFE INSURANCE CO., HOLA DOCTOR INSURANCE & FINANCIAL SERVICES, JONATHAN RUEDE, INDIRA SHAKE, and KARLA HARDWICK,
Defendants-Respondents,
and
HORIZON BLUE CROSS BLUE SHIELD OF NEW JERSEY,
Defendant. __________________________________
Argued December 15, 2025 – Decided April 30, 2026
Before Judges Natali and Bergman.
On appeal from the Superior Court of New Jersey, Law Division, Union County, Docket No. L-0724-24. Ryan Linder argued the cause for appellant (Marin Linder, LLC, attorneys; Ryan Linder, on the briefs).
Alba V. Aviles argued the cause for respondents (Fisher Phillips LLP, attorneys; Alba V. Aviles, of counsel and on the brief; David J. Treibman, on the brief).
PER CURIAM
Plaintiff appeals from the court's January 2, 2025 order granting the
motions of defendants Pan American Life Insurance (Pan American), Hola
Doctor Insurance & Financial Services (Hola Doctor), Horizon Blue Cross Blue
Shield of New Jersey (Horizon), Jonathan Ruede, Indira Shake, and Karla
Hardwick to dismiss her Conscientious Employee Protection Act, N.J.S.A.
34:19-1 to -14 (CEPA) and common law wrongful termination claims with
prejudice under Rule 4:6-2(e). Having considered the parties' arguments in light
of the record and permissive standard afforded to plaintiff in the pleading stage
as enumerated in Printing Mart-Morristown v. Sharp Electronics Corp., 116 N.J.
739 (1989), we reverse and remand for further proceedings.
I.
Plaintiff began her employment with Pan American and Hola Doctor in
2018 as an insurance agent, a position that required her to sell and market health
insurance products to customers and "handle highly confidential health
A-1736-24 2 information." Plaintiff explained Pan American and Hola Doctor market and
sell health insurance products offered by Horizon and, accordingly,
implemented several internal policies "to maintain client confidentiality and
comply with [the Health Insurance Portability and Accountability Act (HIPAA),
42 U.S.C. §§ 1320d-1 to -9]," including a policy that "prevented employees from
bringing personal laptops and personal table computers into the office."
In April 2023, plaintiff contended her colleagues "began to bring their
personal laptops" into the office, a behavior she was concerned would jeopardize
client confidentiality. Because Indira Shake, plaintiff's direct supervisor, was
"largely absent from the office," plaintiff reported this conduct to Francisco
Rescio, who she alleges was "in management and [had] told her to contact him
if she had any issues." After Rescio "failed to respond to the plaintiff's
complaints," she contacted Karla Hardwick, who worked in the human resources
department, to inform her about the alleged HIPAA violations. Plaintiff alleges
Hardwick suggested she contact to Jonathan Ruede, who was "in upper
management and worked out of the New Orleans office."
Following her unsuccessful attempt to contact Ruede directly, plaintiff
maintains she left him a voicemail message and followed up additionally over
email. In her July 25, 2023 email to him, plaintiff wrote:
A-1736-24 3 One of the things that is happening is that some employees are bringing their personal laptops to the office and using them during work hours, which is illegal. We only work with and sell products with Horizon Blue Cross & Blue Shield of New Jersey. We receive confidential information from Horizon members, and I do not know if these employees are sharing this information for another kind of business. They spent their time making copies and copies that are not from work.
Plaintiff contends she also included in her email that "[a]n unauthorized person
was permitted to enter the office, the workplace was dirty, the manager was
absent, her colleagues were making improper photocopies of potentially
confidential information, and the distribution of work was inequitable."
Following this email, plaintiff maintains "management" immediately
responded the next day, emailed all employees a reminder of the internal policy
against the use of personal computers during business hours , and later offered a
training session to teach employees "to comply with guidelines that were in
place to ensure the confidentiality of client information." The email also
allegedly "warned" employees not to use company property for personal use.
Plaintiff contends, although "she was promised that her complaint would be kept
confidential," an angry colleague confronted her the same day the email was
circulated. Plaintiff also maintains "violations of the company's client health
A-1736-24 4 information confidentiality policy continued," to which she reported to a hotline
offered by Horizon that she learned about at the training session.
At this point, despite being an exemplary employee, plaintiff alleges she
faced retaliation for her repeated attempts to report her perceived HIPAA
violations. Among other pushback, she states defendants retaliated against her
by not keeping her complaint confidential, filing a "false disciplinary complaint
. . . to build a case for termination," rescinding her ability to work from home,
and pretextually reprimanding and punishing her. She contended the retaliation
culminated in her unexplained and sudden termination, denial of her final
paycheck, and interference with her application for unemployment benefits.
After being terminated by her employer and filing her original complaint, 1
plaintiff re-filed an amended three-count complaint against defendants. In that
pleading, plaintiff alleged retaliation under CEPA, wrongful termination
contrary to public policy, and violation of her free speech under the New Jersey
Civil Rights Act (NJCRA), N.J.S.A. 10:6-2.
1 We note plaintiff's initial complaint is not in the record before us , but it appears, after filing her first pleading, the court issued two deficiency notices to which plaintiff filed a deficiency correction and, ultimately, her first amended complaint.
A-1736-24 5 In her first CEPA-based claim, plaintiff contended defendants were aware
of her reported violations of the confidential health information policy and
retaliated against her by, as noted, terminating her employment, among other
consequences. She next alleged her termination was "wrongful in that it was
contrary to public policy and it was done in a manner that was contrary to the
plaintiff's contractual and statutory rights." Finally, in her NJCRA-based cause
of action, she asserted defendants terminated her because she "exercised her
right to free speech."
In lieu of an answer, defendants moved under Rule 4:6-2(e) to dismiss
plaintiffs' complaint for failing to state a claim, and the court issued a September
13, 2024 written decision and order dismissing all counts of plaintiff's amended
complaint without prejudice. The order, however, dismissed all counts with
prejudice with respect to Horizon and gave plaintiff twenty days from the date
of the order to file a second amended complaint. 2 In its statement of reasons,
the court concluded plaintiff failed to state her CEPA-based claim because she
failed to "include any facts that suggest [she] reasonably believed her colleagues'
2 Plaintiff removed Horizon from their second amended complaint but included it as a named defendant before us. Plaintiff, however, clarified in her merits brief that "the present appeal does not seek to revive the plaintiff's complaint against Horizon."
A-1736-24 6 actions violated HIPAA," an element of a prima facie CEPA claim. The court
similarly dismissed her wrongful discharge claim because she "does not state
any facts that suggest her termination was contrary to public policy," as required
under Pierce v. Ortho Pharm. Corp., 84 N.J. 58 (1980). Finally, the court
dismissed plaintiff's third count pled under NJCRA because she failed to plead
"any allegations that defendants acted under the color of law."
Plaintiff thereafter filed a second amended complaint, which provided,
among other details, specific allegations of HIPPA violations she observed.
Specifically, she asserted 45 C.F.R. § 164.102 establishes defendants Hola
Doctor and Pan American are covered entities subject to HIPAA. She alleged
45 C.F.R. § 164.306 requires them to "[p]rotect against any reasonably
anticipated threats or hazards to the security or integrity of [confidential]
information," guard "against any reasonably anticipated uses or disclosures of
such information that are not permitted," and "control and limited the ability to
access private health information to only specifically authorized members of its
workforce." She further claimed 45 C.F.R. § 164.316 bars defendants from
"retaliating against employees who make good faith complaints alleging HIPAA
violations."3
3 Additionally, plaintiff did not re-pled her dismissed NJCRA-based count. A-1736-24 7 Accordingly, she contended the following conduct violated HIPAA, its
related regulations, and company policy: (1) "non-employees . . . enter[ing]
and remain[ing] in areas where private confidential health information was
stored"; (2) "her colleagues making unauthorized copies of private confidential
health information"; (3) her colleagues "using private confidential information
for purposes that were not related to their employment"; (4) her colleagues
"br[inging] non-authorized computers into the workplace"; and (5) the
retaliation she faced for reporting this conduct.
Defendants again moved under Rule 4:6-2(e) to dismiss plaintiffs'
complaint for failing to state a claim. Defendants argued plaintiff's CEPA-based
claim failed because she did not sufficiently plead an "objective reasonable
belief and . . . nexus . . . to HIPAA." They specifically noted, and relied heavily
upon, plaintiff's email where she explained she did not know to what end her
colleagues were bringing in their personal laptops and making copies.
Defendants asserted whether she engaged in statutorily protected activity
necessary to sustain a CEPA claim is a "question of law, not of fact." Plaintiff
argued she properly pled she had an "objective reasonable belief" of HIPAA
violations and defendants are unfairly "relying on a figure of speech" in her
email to suggest otherwise.
A-1736-24 8 After considering the parties' oral and written arguments, the court
dismissed with prejudice plaintiff's second amended complaint in a January 2,
2025 order. In its written statement of reasons, the court concluded plaintiff
failed to allege "she reasonably believed her colleagues' actions were violating
the provisions of HIP[A]A" as required under N.J.S.A. 34:19-3(a) or a "clear
mandate of public policy" under N.J.S.A. 34:19-3(c)(3). The court found the
second amended complaint suffered from the same deficiencies as the first,
namely "lacking in explicit references to any purported violations of HIP[A]A
and instead only referred to violations of internal policies." Despite plaintiff's
efforts to connect the internal policies to HIPAA, the court found the complaint
lacked facts "evincing a reasonable belief that plaintiff's colleagues were using
or distributing clients' confidential and protected health information."
The court also held plaintiff failed to sufficiently allege she engaged in
whistleblowing activity, the second element of a prima facie CEPA claim. The
court found "the facts surrounding the various complaints plaintiff made" as
vague and conclusory. While acknowledging plaintiff alleged she
communicated her complaints "via phone, email, in-person, and in voice
messages" to Ruede, Harwick, and Rescio, the court explained she did not
A-1736-24 9 provide "any facts as to what was said in those complaints," except for the email
to defendant Ruede.
Regarding plaintiff's Pierce-based retaliation claim, the court held her
complaint failed for the same reasons and also dismissed it with prejudice.
Specifically, the court held it "ha[d] already found the . . . [c]omplaint lacks
concrete facts establishing that plaintiff's colleagues were compromising
HIP[A]A's mandate against the unauthorized use and distribution of confidential
private health information." This appeal followed.
II.
We begin with a discussion of the relevant standard of review. Our review
of a dismissal for failure to state a claim pursuant to Rule 4:6-2(e) is plenary,
and we owe no deference to the trial judge's conclusions. State v. Cherry Hill
Mitsubishi, Inc., 439 N.J. Super. 462, 467 (App. Div. 2015). The inquiry is
limited to "examining the legal sufficiency of the facts alleged on the face of the
complaint," ibid. (quoting Printing Mart-Morristown, 116 N.J. at 746), giving
the plaintiff the benefit of "every reasonable inference of fact," Baskin v. P.C.
Richard & Son, LLC, 246 N.J. 157, 171 (2021) (quoting Dimitrakopoulos v.
Borrus, Goldin, Foley, Vignuolo, Hyman & Stahl, P.C., 237 N.J. 91, 107
(2019)). Such motions require the complaint be searched in depth and with
A-1736-24 10 liberality to determine if there is any "cause of action . . . 'suggested' by the
facts," Cherry Hill Mitsubishi, 439 N.J. Super. at 467 (quoting Printing Mart-
Morristown, 116 N.J. at 746), and "to ascertain whether the fundament of a cause
of action may be gleaned even from an obscure statement of claim, opportunity
being given to amend if necessary," Di Cristofaro v. Laurel Grove Mem'l Park,
43 N.J. Super. 244, 252 (App. Div. 1957).
At this preliminary stage of the litigation, the court is not concerned with
the ability of the plaintiff to prove the allegations in the complaint. Printing
Mart-Morristown, 116 N.J. at 746. Only where "'even a generous reading of the
allegations does not reveal a legal basis for recovery'" should the motion be
granted, Kieffer v. High Point Ins. Co., 422 N.J. Super. 38, 43 (App. Div. 2011)
(quoting Edwards v. Prudential Prop. & Cas. Co., 357 N.J. Super. 196, 202 (App.
Div. 2003)), and generally "without prejudice to a plaintiff's filing of an
amended complaint," Printing Mart-Morristown, 116 N.J. at 772.
Nonetheless, a complaint should be dismissed where it "states no claim
that supports relief, and discovery will not give rise to such a claim. "
Dimitrakopoulos, 237 N.J. at 107. Indeed, "the essential facts supporting [the]
plaintiff's cause of action must be presented in order for the claim to survive,"
and "conclusory allegations are insufficient in that regard." Scheidt v. DRS
A-1736-24 11 Techs., Inc., 424 N.J. Super. 188, 193 (App. Div. 2012). "[L]egal sufficiency
requires allegation of all the facts that the cause of action requires." Cornett v.
Johnson & Johnson, 414 N.J. Super. 365, 385 (App. Div. 2010), aff'd as
modified, 211 N.J. 362 (2012), abrogated on other grounds by McCarrell v.
Hoffmann-La Roche, Inc., 227 N.J. 569, 590-92 (2017). Thus, "a dismissal is
mandated where the factual allegations are palpably insufficient to support a
claim upon which relief can be granted." Rieder v. State, Dep't of Transp., 221
N.J. Super. 547, 552 (App. Div. 1987).
A.
Plaintiff contends she properly pled a cause of action under CEPA because
she alleged "she had an objectively reasonable belief that the complained
conduct violated a law or mandate of public policy." She explains defendants
implemented policies designed to limit access to private client health
information in compliance with HIPAA and its related federal regulations. In
addition to 45 C.F.R. §§ 164.102, 164.306, and 164.316, as cited in her
complaint, she argues 45 C.F.R. §§ 164.308 and 164.310 also impose affirmative
obligations on defendant to "[i]mplement policies and procedures to limit
physical access" to their client's confidential health information.
A-1736-24 12 She argues defendants were required to adopt and implement policies that
established "a prohibition on non-employees in the workplace as well as a ban
on personal laptops" pursuant to HIPAA "because of the nature of their
business." Plaintiff asserts the internal company policies "prevented
unauthorized persons from accessing private client health information," in
compliance with HIPAA. She maintains she has met the low bar to defeat
defendants' Rule 4:6-2(e) motions because her complaint alleges "her colleagues
were copying private client health information for non-business purposes."
Plaintiff contends her email to Ruede, where she explained "she did not
know if private client health information was being shared," was merely a
"figure of speech." She argues the court's heavy reliance on this email was
inappropriate because the objective of CEPA is to prevent retaliation against
whistleblowers like herself and does not require "any magic words in
communicating a reasonable belief of illegal activity." (quoting Mehlman v.
Mobil Oil Corp., 153 N.J. 163, 193-94 (1998)) (internal quotation marks
omitted).
Plaintiff further explains, by relying exclusively on one sentence in her
email, the court ignored her other specific allegations detailed in her second
amended complaint, which asserted she had a reasonable belief her colleagues'
A-1736-24 13 conduct violated the law. She maintains her complaint is "replete with instances
wherein the plaintiff reported violations of HIPAA, its related regulations, and
internal company rules." Specifically, she emphasizes her complaint alleged:
(1) unauthorized personnel were permitted to enter the office where private
confidential health information was stored; (2) employees were making
unauthorized copies of confidential information without proper authorization;
and (3) her colleagues were using private confidential health information for
non-work-related purposes.
Further, plaintiff contends the court erred in ruling that she did not engage
in whistleblowing activity, as required under a CEPA claim. Consistent with
the CEPA definition of whistleblowing activity, N.J.S.A. 34:19-3, plaintiff
contends her complaint alleges she verbally reported violations of HIPAA and
"related company policies." She claims her actions "fall[] squarely within the
ambit of whistleblowing activity contemplated by the controlling statute." For
the reasons that follow, we agree with plaintiff's arguments and are satisfied she
sufficiently pled her CEPA-based claim to preclude dismissal under Rule 4:6-
2(e).
CEPA is remedial legislation designed "to protect and encourage
employees to report illegal or unethical workplace activities and to discourage
A-1736-24 14 public and private sector employers from engaging in such conduct." Sauter v.
Colts Neck Volunteer Fire Co. No. 2, 451 N.J. Super. 581, 588 (App. Div. 2017)
(internal quotation marks omitted) (quoting Mehlman v. Mobil Oil Corp., 153
N.J. 163, 179 (1998)). Thus, the statute "shields an employee who objects to,
or reports, employer conduct that the employee reasonably believes to
contravene the legal and ethical standards that govern the employer's
activities." Hitesman v. Bridgeway, Inc., 218 N.J. 8, 27 (2014); see also
N.J.S.A. 34:19-3(a), (c).
CEPA prohibits an employer from retaliating "against an employee who
discloses, threatens to disclose, or refuses to participate in an activity of the
employer 'that the employee reasonably believes is in violation of a law, or a
rule or regulation promulgated pursuant to law.'" Sauter, 451 N.J. Super. at 587
(quoting N.J.S.A. 34:19-2 to -3). The statute does not require that the activity
actually violates a law or regulation; it is sufficient if the employee reasonably
believes such a violation occurred. Dzwonar, 177 N.J. at 464.
To state a prima facie claim for unlawful retaliation under CEPA, a
plaintiff must plead facts establishing that:
1. The employee reasonably believed that the employer's conduct was in violation of a law, rule, regulation promulgated pursuant to law, or a clear mandate of public policy;
A-1736-24 15 2. The employee performed a "whistle-blowing" activity described in N.J.S.A. 34:19-3(c);
3. An adverse employment action was taken against the employee; and
4. A causal connection exists between the whistle- blowing activity and the adverse employment action.
[Lippman v. Ethicon, Inc., 222 N.J. 362, 380 (2015) (quoting Dzwonar, 177 N.J. at 462).]
To satisfy the first element, as noted, a plaintiff is not required to prove
their employer actually violated any law, rule, regulation, or clear mandate of
public policy to be successful; the plaintiff must merely "show that he or she
'reasonably believes this to be the case.'" Dzwonar, 177 N.J. at 462 (quoting
Estate of Roach v. TRW, Inc., 164 N.J. 598, 613 (2000) (internal quotation
marks omitted)); see also Mehlman v. Mobil Corp., 153 N.J. 163, 193-94 (1998)
(CEPA is not intended "to make lawyers out of conscientious employees but
rather to prevent retaliation against those employes who object to employer
conduct that they reasonably believe to be unlawful or indisputably dangerous
to the public health, safety[,] or welfare.").
To be sure, plaintiff must "set forth facts that would support an objectively
reasonable belief that a violation has occurred." Dzwonar, 177 N.J. at 464; see
also Chiofalo v. State, 238 N.J. 527, 543 (2019). This requires a trial court,
A-1736-24 16 considering a motion to dismiss a plaintiff's CEPA claim pursuant to Rule 4:6-
2(e) to "make a threshold determination that there is a substantial nexus between
the complained-of conduct and a law or public policy identified by the court or
the plaintiff." Dzwonar, 177 N.J. at 464. Therefore, "the trial court must
identify a statute, regulation, rule, or public policy that closely relates to the
complained-of conduct," and "should enter judgment for a defendant when no
such law or policy is forthcoming." Id. at 463.
The statutory elements and the analytical framework set forth in Dzwonar,
however, distinguish an employee's objection to, or reporting of, an employer's
illegal or unethical conduct from a routine dispute in the workplace regarding
the relative merits of internal policies and procedures. See Dzwonar, 177 N.J.
at 467–69; see also Maw v. Advanced Clinical Commc'ns, 179 N.J. 439, 443
(2004).
As our Supreme Court observed in Estate of Roach, when noting the
importance of the plaintiff's reasonable belief that the defendant's conduct
contravened an authority recognized in CEPA:
[I]f an employee were to complain about a co-employee who takes an extended lunch break or makes a personal telephone call to a spouse or friend, we would be hard pressed to conclude that the complaining employee could have "reasonably believed" that such minor infractions represented unlawful conduct as
A-1736-24 17 contemplated by CEPA. CEPA is intended to protect those employees whose disclosures fall sensibly within the statute; it is not intended to spawn litigation concerning the most trivial or benign employee complaints.
[164 N.J. at 613–14.]
Under prong two, a "whistle-blowing" activity "refers to notification, or
threatened notification, to an outside agency or supervisor . . . and also permits
a claim to be supported by evidence that the employee objected to or refused to
participate in the employer's conduct." Tartaglia v. UBS PaineWebber Inc., 197
N.J. 81, 106 (2008). The whistle-blowing activity must reflect a "threat of
public harm, not merely a private harm or harm only to the aggrieved employee."
Maw, 179 N.J. at 445. "Vague and conclusory complaints, complaints about
trivial or minor matters, or generalized workplace unhappiness are not the sort
of things that the Legislature intended to be protected by CEPA." Battaglia v.
United Parcel Serv., Inc., 214 N.J. 518, 529-31. 546 (2013).
HIPAA "concerns the protection of personal medical information and
regulates its use and disclosure." N.J. Transit PBA Local 304 v. N.J. Transit
Corp., 384 N.J. Super. 512, 516-17 (App. Div. 2006). "HIPAA requires health
care providers and health care facilities to protect personal medical information
from unauthorized disclosure." Smith v. Datla, 451 N.J. Super. 82, 102 (App.
A-1736-24 18 Div. 2017) (citing 42 U.S.C.A. § 1320d–6(a)(3)). The HIPAA privacy
restrictions govern only covered entities and their business associates. 45 C.F.R.
§ 160.102; Michelson v. Wyatt, 379 N.J. Super. 611, 622-23 (App. Div. 2005).
There are three covered entities under HIPAA: (1) a health plan; (2) a health
care clearinghouse; and (3) a health care provider that transmits any health
information in electronic form in connection with a covered transaction. See 42
U.S.C.A. § 1320d–1(a); 45 C.F.R. § 160.103; Michelson, 379 N.J. Super. at 622-
23.
Under HIPAA, Congress has directed the Secretary of Health and Human
Services to establish standards for the electronic exchange of medical
information and to ensure the privacy of that information. See Michelson, 379
N.J. Super. at 622-23 (citing 42 U.S.C.A. § 1320d-2(a)). "These regulations,
collectively known as the Privacy Rule, set forth standards and procedures for
the collection, maintenance and disclosure of certain health care information. "
Ibid. (citing 42 U.S.C.A. § 1320d-1; 45 C.F.R. § 160.102). "The Privacy Rule
prohibits covered entities from using or disclosing personal health information
except as permitted by regulation." Ibid. (citing 45 C.F.R. § 164.502(a); Smith
A-1736-24 19 v. Am. Home Prods. Corp. Wyeth-Ayerst Pharm., 372 N.J. Super. 105, 111
(Law. Div. 2003)). 4
Against these principles, we conclude plaintiff has sufficiently alleged a
prima facie case under CEPA, especially in light of the liberality in which we
address claims at the pleading stage and conclude the court read the pleading
too narrowly. First, we are convinced plaintiff's complaint sufficiently pled
allegations of whistleblowing activities to satisfy the second prong of a prima
facie CEPA claim. Indeed, plaintiff's complaint is replete with numerous
allegations of reported grievances of perceived HIPAA violations to several
supervisors, including Ruede, Hardwick, and Rescio, and her final attempt to
4 As noted, in addition to the Privacy Rule, plaintiff identifies 45 C.F.R. §§ 164.306, 164.308, 164.310, and 164.316 as related federal regulations that she contends require defendants to implement internal policies to comply with HIPAA and protect confidential health information. In pertinent part, 45 C.F.R. § 164.306 requires covered entities to "protect against any reasonably anticipated threats or hazards to the security or integrity of [confidential] information" and "protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required . . . ." We further note 45 C.F.R. § 164.308 provides covered entities must "prevent those workforce members who do not have access . . . from obtaining access to electronic protected health information"; 45 C.F.R. § 164.310 provides, in relevant part, covered entities must "[i]mplement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed"; and finally, 45 C.F.R. § 164.316 "[i] Implement reasonable and appropriate policies and procedures to comply with the[se] standards."
A-1736-24 20 report alleged violations to the hotline operated by Horizon. We reject the
court's decision that plaintiff did not sufficiently plea whistle-blowing activity
because she did "not provide any facts as to what was said in those complaints,
except for the complaints she made in an email to . . . Ruede." We determine
such a conclusion not only expressly ignores plaintiff's alleged email with
Ruede, but also misapplies the lenient pleading standard to require plaintiff to
plea exactly what she said to each of her supervisors. Rather, we are satisfied
plaintiff's complaint, which alleges she attempted to report perceived HIPAA
violations to several managers, is sufficient at this stage.
Next, we are satisfied, and the parties seemingly do not dispute, plaintiff's
complaint contains sufficient allegations of adverse employment actions to
satisfy the third prong of a prima facie CEPA claim. Notably, these allegations
culminate with plaintiff's eventual termination but also include allegations of
pretextual complaints and consequences before her termination. Further,
plaintiff's assertions that she was quickly terminated following the
communications of her grievances to defendants, sufficiently pled a causal
connection between her whistleblowing activity and alleged adverse
employment action to satisfy the fourth prong of a CEPA claim.
A-1736-24 21 Finally, plaintiff's complaint sufficiently alleges that she held a reasonable
objective belief defendants were "violating either a law, rule, or regulation
promulgated pursuant to law, or a clear mandate of public policy" to satisfy the
first prong of a prima facie claim under CEPA, in light of her allegations that
defendants had violated HIPAA and its related federal regulations. Plaintiff's
allegations, namely that she observed "non-employees . . . enter[ing] and
remain[ing] in areas where private confidential health information was stored"
and her colleagues "making unauthorized copies [and] . . . using private
confidential information for purposes that were not related to their
employment," may arguably violate HIPAA and suggests a "fundament of a
cause of action" likely to be assisted by further discovery, worthy of surviving
the pleading stage. See Printing Mart-Morristown, 116 N.J. at 746.
We readily acknowledge defendants' and the court's heavy consideration
of her email to Ruede as evidence she did not possess a reasonable objective
belief and conclude whether her colleagues shared the information with anyone,
as discussed in the email, is not dispositive. We find such a conclusion,
however, ignores the totality of plaintiff's complaint, which, as noted, expressly
contains allegations she observed: (1) "non-employees . . . enter[ing] and
remain[ing] in areas where private confidential health information was stored";
A-1736-24 22 (2) "her colleagues making unauthorized copies of private confidential health
information"; (3) her colleagues "using private confidential information for
purposes that were not related to their employment"; (4) her colleagues
"br[inging] non-authorized computers into the workplace"; and (5) the
retaliation she experienced for reporting "what she reasonably believed to be
conduct that violated HIPAA . . . ."
We agree, however, with defendants' argument that certain allegations in
the complaint would not be sufficient to satisfy the first prong of a prima facie
CEPA claim. For example, we recognize plaintiff's allegations of a "dirty
workplace" and general displeasure with unrelated management decisions bear
no relevance to the sufficiency of her CEPA-based claim. While we pass no
judgment as to the merits of plaintiff's CEPA-based claim, we are satisfied
plaintiff's additional allegations of unauthorized breaches of confidential health
information as pled in her second amended complaint do, indeed, satisfy the
element when viewed through lenient and appropriate standard.
B.
Plaintiff contends she also properly pled her Pierce cause of action. She
claims, despite her employer's concerted efforts to keep client information
confidential in compliance with HIPAA by implementing and enforcing internal
A-1736-24 23 policies, she faced retaliation "within less th[a]n [forty-eight] hours as . . .
plaintiff was outed to her co-workers for simply reporting violations of company
policy." Because these retaliatory acts, including termination, "violated a clear
mandate of public policy," she claims the court erred in dismissing her wrongful
termination claim.
In response, defendants contend her second cause of action fails because
plaintiff waived her right to pursue a common law claim in light of her CEPA
claim. They argue "CEPA functions as replacement of common law Pierce
claims" because "'the institution of an action'" under CEPA, N.J.S.A. 34:19 -8,
is a "'waiver of the rights and remedies available under . . . the common law.'"
Defendants acknowledge the "confusion in the courts as to when an action is
'instituted' for the purposes'" of the CEPA waiver provision, N.J.S.A. 34:19-8,
but claim to cite to a long list of New Jersey federal and state cases who adopted
the view that CEPA claims preclude common law claims. For the reasons that
follow, we disagree and are satisfied plaintiff properly pled her common-law
wrongful termination claim.
A common law cause of action for retaliatory discharge was first
recognized in the seminal Supreme Court case of Pierce v. Ortho Pharmaceutical
Corp., 84 N.J. 58 (1980). Pierce provides a plaintiff with "a cause of action for
A-1736-24 24 wrongful discharge when the discharge is contrary to a clear mandate of public
policy." 84 N.J. at 72. "The sources of public policy include legislation;
administrative rules, regulations or decisions; and judicial decisions." Ibid.
"However, not all such sources express a clear mandate of public policy." Ibid.;
see also Macdougall v. Weichert, 144 N.J. 380, 391 (1996) ("A basic
requirement of the wrongful discharge cause of action is that the mandate of
public policy [must] be clearly identified and firmly grounded.").
"Like the CEPA remedy to which it gave rise, [common law wrongful
discharge claims] require[] . . . an expression by the employee of a disagreement
with a corporate policy, directive, or decision based on a clear mandate of public
policy derived from [legislation, administrative rules, or judicial decisions]."
Tartaglia, 197 N.J. at 109. A plaintiff must show "a sufficient expression of that
disagreement to support the conclusion that the resulting discharge violates the
mandate of public policy and is wrongful." Ibid.
Unless a plaintiff can sufficiently show their discharge was contrary to a
clear mandate of public policy, "[a]n employer remains free to terminate an at -
will employee who engages in grousing or complaining about matters falling
short of [this standard] or who otherwise interferes with the ordinary operation
of the workplace by expressions of personal views on matters of no real
A-1736-24 25 substance." Ibid.; see also Pierce, 84 N.J. at 72 ("[U]nless an employee at will
identifies a specific expression of public policy, he may be discharged with or
without cause."). Likewise, "[b]aseless [grievances] or expressions of purely
personal views about the meaning of public policies will not meet the test for a
clear mandate regardless of the manner or mode in which they are voiced." Id.
at 110 (internal quotation marks omitted).
Although CEPA and Pierce "ha[ve] continued to exist side by side with"
one another, Tartaglia, 197 N.J. at 103, CEPA includes a waiver provision which
precludes a plaintiff from bringing a common law action for wrongful discharge
if the plaintiff institutes a CEPA claim challenging the discharge, see N.J.S.A.
34:19-8; Young v. Schering Corp., 141 N.J. 16, 27-31 (1995). The waiver
provision provides, in relevant part, that "the institution of an action in
accordance with [CEPA] shall be deemed a waiver of the rights and remedies
available under any other contract, collective bargaining agreement, State law,
rule or regulation or under the common law." N.J.S.A. 34:19-8. Our court has,
however, interpreted this rule to apply only after the plaintiff has had the
opportunity to complete discovery when she is "in a position to make a knowing
and meaningful election" of remedies. Maw v. Advanced Clinical Commc'ns,
Inc., 359 N.J. Super. 420, 441 (App. Div. 2003), rev'd on other grounds, 179
A-1736-24 26 N.J. 439 (2004); see also Young, 141 N.J. at 32 ("The meaning of 'institution of
an action' could conceivably contemplate an election of remedies with
restrictions in which the election is not considered to have been made until
discovery is complete or the time of a pretrial conference.").
We find plaintiff sufficiently pled that she was discharged in violation of
a "clear mandate of public policy" pursuant to Pierce and are satisfied the court
did not adequately apply the liberal pleading standard. As noted, plaintiff's
complaint, at the least, alleges she observed "non-employees . . . enter[ing] and
remain[ing] in areas where private confidential health information was stored"
and her colleagues "making unauthorized copies [and] . . . using private
confidential information for purposes that were not related to their
employment," which are potential violations of HIPAA, and for which she
contends she was terminated. We find violations of HIPAA and its related
regulations, namely 45 C.F.R. §§ 164.102, 164.306, 164.308, 164.310, and
164.316, would be violations of a "clear mandate of public policy," pursuant to
Pierce, as these provisions establish minimum standards to ensure
confidentiality and privacy for covered entities, of which plaintiff alleges
defendants are and trained employees accordingly. We further reject defendants'
argument that she has waived her right to a common-law wrongful termination,
A-1736-24 27 in light the well-established principle in our case law that litigants pursuing a
CEPA-based claim and common-law wrongful termination claim need not waive
their rights at the pleading stage.
Therefore, we reverse the court's dismissal of both counts as plaintiff
adequately stated claims upon which relief may be granted pursuant to CEPA
and the common law. We reinstate her complaint and, as noted take no position
as to the merits of any of her claims.
To the extent we have not specifically addressed any of the parties'
remaining arguments, it is because we have determined they lack sufficient merit
to warrant discussion in a written opinion. See R. 2:11-3(e)(1)(E).
Reversed and remanded. The complaint is reinstated. We do not retain
jurisdiction.
A-1736-24 28