Dunbar v. Biedlingmaier

• Court: District Court, D. Maryland
• Decided: July 23, 2021
• Docket: 8:20-cv-00738
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND

: TILMAN DUNBAR, JR., et al. :

v. : Civil Action No. DKC 20-0738

:

BIEDLINGMAIER, et al. :

MEMORANDUM OPINION Presently pending and ready for resolution in this civil rights action is a partial motion to dismiss filed by Defendants Kaiser Foundation Health Plan, Inc. (“KFHP”), Kaiser Foundation Health Plan of the Mid-Atlantic States, Inc. (“KFHP-Mid”), and “John Doe Kaiser Employee” collectively (“Kaiser”). (ECF No. 47). The issues have been fully briefed, and the court now rules, no hearing being deemed necessary. Local Rule 105.6. For the following reasons, Kaiser’s motion to dismiss will be granted. I. Factual Background1 Plaintiff Tilman Dunbar, Jr. is a licensed attorney residing in Virginia with his wife and co-Plaintiff, Bindu M. Dunbar (“Mrs. Dunbar”). Defendants KFHP and its subsidiary, KFHP-Mid, are corporate entities engaged in the business of providing health

1 The following facts are set forth in the second amended complaint (ECF No. 45), and construed in the light most favorable to the nonmoving party. insurance. Kaiser was Plaintiffs’ health insurance provider, and as such, was privy to Plaintiffs’ personal health information. Tilman Dunbar, Jr. shares a nearly identical name with his nephew, Tilman Dunbar. At the time of the relevant events, Tilman Dunbar was employed by Kaiser as an independent contractor. Tilman

Dunbar, along with two other Kaiser employees, is believed to have stolen computers from Kaiser’s technology facility in Silver Spring, Maryland on multiple occasions throughout January 2017. The computers were collectively worth approximately $175,400.00. The thefts were captured on Kaiser’s video surveillance cameras and were subsequently reviewed by Kaiser personnel. A Kaiser employee, identified by Plaintiffs as John Doe, attempted to obtain Tilman Dunbar’s information through Kaiser’s employee database. Due to Tilman Dunbar’s classification as an independent contractor, however, his information was not contained in Kaiser’s employee database. Thus, John Doe accessed Kaiser’s subscriber database in search of Tilman Dunbar’s information. The subscriber

database did not contain any information on Tilman Dunbar, leading John Doe to access Tilman Dunbar, Jr.’s personal information instead. John Doe then reported the thefts to the Montgomery County Police Department (“MCPD”) and disclosed Tilman Dunbar, Jr.’s personal information to Corporal Ryan Biedlingmaier (“Corporal Biedlingmaier”), an officer with the MCPD. Acting upon the information obtained from Kaiser and his personal viewing of the survelliance footage, Corporal Biedlingmaier procured a search warrant for Tilman Dunbar, Jr. and his Woodbridge, Virginia residence rather than for Tilman Dunbar and his Reston, Virginia residence. On the morning of January 25, 2017, Tilman Dunbar, Jr. was arrested outside his home in public view of his neighbors. II. Procedural Background

Plaintiffs originally filed suit against Kaiser Permanente Insurance Company (“KPIC”), Corporal Biedlingmaier, the MCPD, and Montgomery County in the Circuit Court for Montgomery County, Maryland. (ECF No. 3). The case was subsequently removed to the United States District Court for the District of Maryland. (ECF No. 1). Plaintiffs filed a first amended complaint on December 11, 2020, adding Defendants KFHP and KFHP-Mid. (ECF No. 30). On January 20, 2021, the court ordered dismissal of KPIC with prejudice. (ECF No. 42). On March 24, 2021, the court issued an order directing Plaintiffs to clarify inconsistent and contradictory allegations contained in their amended complaint. (ECF No. 44). On April 2, 2021, Plaintiffs filed a second amended

complaint, clarifying their allegations. (ECF No. 45). On April 15, 2021, Kaiser filed the presently pending motion to dismiss Counts V and VI of Plaintiffs’ second amended complaint. (ECF No. 47). Plaintiffs allege in Count V that Kaiser disclosed their personal information “to third parties in violation of HIPAA and Maryland Privacy Laws[.]” Plaintiffs allege in Count VI that Kaiser “breached [its] duty of care owed to Plaintiffs by acting negligently, recklessly, and carelessly[.]” (ECF No. 45, ¶¶ 18, 23). Plaintiffs responded in opposition and Kaiser replied. (ECF Nos. 48 & 49). III. Standard of Review A motion to dismiss under Fed.R.Civ.P. 12(b)(6) tests the

sufficiency of the complaint. Presley v. City of Charlottesville, 464 F.3d 480, 483 (4th Cir. 2006). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 677-78 (2009). “[T]he district court must accept as true all well-pleaded allegations and draw all reasonable factual inferences in plaintiff’s favor.” Mays v. Sprinkle, 992 F.3d 295, 299 (4th Cir. 2021) (reversing a district court’s dismissal of a complaint because “we must accept the well- pleaded facts and draw reasonable inferences in favor of the plaintiff”). In evaluating the complaint, unsupported legal allegations need not be accepted. Revene v. Charles Cty. Comm’rs,

882 F.2d 870, 873 (4th Cir. 1989). Legal conclusions couched as factual allegations are insufficient, Iqbal, 556 U.S. at 678, as are conclusory factual allegations devoid of any reference to actual events. United Black Firefighters of Norfolk v. Hirst, 604 F.2d 844, 847 (4th Cir. 1979); see also Francis v. Giacomelli, 588 F.3d 186, 193 (4th Cir. 2009). “[W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged - but it has not ‘show[n]’ – ‘that the pleader is entitled to relief.’” Iqbal, 556 U.S. at 679 (quoting Fed.R.Civ.P. 8(a)(2)). Thus, “[d]etermining whether a complaint states a plausible claim for relief will . . . be a

context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Id. IV. Analysis Kaiser moves to dismiss Counts V and VI for failure to state a claim under Fed.R.Civ.P. 12(b)(6). (ECF No. 47, at 1). A. Count V Count V, entitled “HIPAA/Negligence”, asserts claims under both federal and state law. In particular, Plaintiffs allege that Kaiser “intentionally, negligently and/or recklessly without consent” disclosed Tilman Dunbar, Jr.’s personal information to the MCPD, and that such information was protected under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and “Maryland Privacy Laws” although the second amended complaint does

not itself identify any specific state law. (ECF No. 45, ¶¶ 17- 18). While not entirely clear, the court construes Court V as also asserting a claim for negligence given the inclusion of the term in the title. 1. HIPAA “HIPAA provides that ‘[a] person who knowingly . . . discloses individually identifiable health information to another person’ without authorization shall be fined, imprisoned, or both.” Payne v. Taslimi, 998 F.3d 648, 660 (4th Cir. 2021) (quoting 42 U.S.C. § 1320d-6(a)(3), (b)). Kaiser argues that Count V should be

dismissed as to the alleged HIPAA violation because HIPAA does not create a private right of action and alternatively, because the second amended complaint fails to allege a disclosure of protected personally identifying health information. For Plaintiffs to recover under HIPAA, “the statute must create a private right to sue.” Payne, 998 F.3d at 660. Joining the consensus of every circuit court that has considered the issue, the United States Court of Appeals for the Fourth Circuit recently agreed that HIPAA does not create a private right of action: Every circuit court to consider whether HIPAA created a private right to sue has found that it does not. See Meadows v. United Servs., Inc., 963 F.3d 240, 244 (2d Cir. 2020); Stewart v. Parkview Hosp., 940 F.3d 1013, 1015 (7th Cir. 2019); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Wilkerson v. Shinseki, 606 F.3d 1256, 1267 n.4 (10th Cir. 2010); United States v. Streich, 560 F.3d 926, 935 (9th Cir. 2009); Acara v. Banks, 470 F.3d 569, 571-72 (5th Cir. 2006); see also Faber v. Ciox Health, LLC, 944 F.3d 593, 596-97 (6th Cir. 2019) (stating, in dictum, that HIPAA does not create a private right of action). This is because HIPAA does not expressly allow for a private cause of action but delegates enforcement authority to the Secretary of the Department of Health and Human Services, reflecting Congress’ intent to forgo creating a private remedy.

Payne, 998 F.3d at 660. See also Atkinson-Bush v. Baltimore Washington Med. Ctr., Inc., No. 10-cv-2350-BEL, 2011 WL 2216669, at *3 (D.Md. May 25, 2011); Dixon v. Corcoran, No. 18-cv-3149-TDC, 2020 WL 707115, slip op. at 3 (D.Md. Feb. 12, 2020). Given that HIPAA does not allow for private enforcement, Plaintiffs’ HIPAA claims in Count V must be dismissed. 2. Maryland’s Confidentiality of Medical Records Act Plaintiffs also allege in Count V that Kaiser disclosed Tilman Dunbar, Jr.’s “address and personal information” to the MCPD in violation of “Maryland Privacy Laws[.]” (ECF No. 45, ¶¶ 17-18). While the second amended complaint fails to identify any specific state statute, Plaintiffs clarify in their response brief that they are alleging that the disclosure was a violation of the Maryland Confidentiality of Medical Records Act (the “MCMRA”). The MCMRA “was enacted to provide for the confidentiality of medical records[.]” Warner v. Lerner, 115 Md.App. 428, 431 (1997). Pursuant to the statutory language: ‘Medical record’ means any oral, written or other transmission in any form or medium of information that: (i) Is entered in the record of a patient; (ii) Identifies or can readily be associated with the identity of a patient or recipient; and (iii) Relates to the health care of the patient or recipient. Md. Code Ann., Health-Gen section 4-301(j)(1). In support of dismissal, Kaiser argues that, similar to HIPAA, the MCMRA also does not permit an individual to bring a private right of action for civil, compensatory damages. (See ECF No. 47, at 2-3). Kaiser also argues that the second amended complaint fails to state a claim because it does not allege a disclosure of protected health information. (ECF No. 49, ¶¶ 6-7). It is not entirely clear whether the MCMRA allows for an individual to bring a private right of action. Compare Maryland Bd. of Physicians v. Geier, 451 Md. 526, 538 (2017) (discussing dismissal of a claim by the Montgomery County Circuit Court based

on its “finding that [the MCMRA] did not create a private cause of action”), with Maryland Dep’t of Health: Maryland Confidentiality of Medical Records Act Compared with HIPAA Privacy Statute & Regulation (2003) (the MCMRA “authorizes a private right of action.”). Even if a private right of action is permissible under the MCMRA, however, Plaintiffs’ claims still fail because the second amended complaint fails sufficiently to allege a violation of the MCMRA because it fails to allege disclosure of a “medical record[.]” (ECF No. 49, ¶¶ 6-7). Plaintiffs’ second amended complaint vaguely asserts that Kaiser was in possession of their “private, confidential, and

protected personal information[.]” (ECF No. 45, ¶¶ 17-18). Critically, however, the complaint is devoid of any facts alleging that Kaiser divulged any information that could be construed as a “medical record” as such term is defined under the MCMRA. Rather, the second amended complaint only alleges that Kaiser disclosed “Plaintiffs’ address and personal information[.]” (ECF No. 45, ¶

17). Plaintiffs’ address is not a “medical record” under the MCMRA. See Md. Code Ann., Health-Gen section 4-301(j)(1). The only other information Plaintiffs allege that Kaiser disclosed is Tilman Dunbar, Jr.’s name, age, weight, height, date of birth, and photo. (ECF No. 48, ¶ 2). Again, such information does not constitute a “medical record” as the term is defined under the MCMRA. Therefore, even if the MCMRA does allow for a private right of action, the allegations in the second amended complaint are insufficient to state a violation of the MCMRA. Accordingly, the MCMRA claims advanced in Count V will also be dismissed. 3. Negligence The last remaining claim lodged against Kaiser in Count V is a negligence claim.2 The second amended complaint nebulously

states that “Kaiser . . . negligently and/or recklessly without consent of [Mr. Tilman Dunbar, Jr.] disclosed information to third

2 While Plaintiffs allege a standalone negligence claim in Count VI against Kaiser, they also title Count V as “HIPAA/Negligence” and thus, the court presumes that in Count V, Plaintiffs are attempting to allege a separate, per se negligence claim based on the violation of a statute, specifically a violation of HIPAA. parties in violation of HIPAA and Maryland Privacy Laws.” (ECF No. 45, ¶ 18). Plaintiffs’ opposition, however, seems to clarify that the negligence claims asserted in Count V are based on an alleged breach of a duty of confidentiality, which Plaintiffs aver arises under HIPAA and the MCMRA. (See ECF No. 48-1, at 7).

“To prove negligence under Maryland law, a plaintiff must show that: (1) the defendant was under a duty to protect the plaintiff from injury; (2) the defendant breached that duty; (3) the plaintiff suffered actual injury or loss; and (4) the loss or injury proximately resulted from the defendant’s breach of the duty.” Quigley v. United States, 865 F.Supp.2d 685, 696 (D.Md. 2012) (citing Valentine v. On Target, Inc., 353 Md. 544, 549 (1999)). Kaiser moves to dismiss arguing that “Plaintiffs cannot utilize an alleged HIPAA violation to bootstrap a state common law negligence claim.” (ECF No. 47-1, at 6). The court agrees. The Court of Appeals of Maryland explained that pursuant to the “Statute or Ordinance Rule” “a statute or ordinance can

prescribe a duty and that [a] ‘violation of the statute . . . is itself evidence of negligence.’” Kiriakos v. Phillips, 448 Md. 440, 457 (2016) (quoting Blackburn Ltd. P’ship v. Paul, 438 Md. 100, 111 (2014). The Court of Appeals of Maryland delineated the following standard when endeavoring to establish a prima facie case of negligence based on the Statute or Ordinance Rule: a plaintiff needs to show “(a) the violation of a statute or ordinance designed to protect a specific class of persons which includes the plaintiff, and (b) that the violation proximately caused the injury complained of.” Brooks v. Lewin Realty III, Inc., 378 Md. 70 (2003). In an analogous case, the United States District Court for the District of Arizona determined that “‘to

the extent that HIPAA universally has been held not to authorize a private right of action, to permit HIPAA regulations to define per se the duty and liability for breach is no less than a private action to enforce HIPAA, which is precluded.’” Skinner v. Tel- Drug, Inc., No. CV-16-00236-TUC-JGZ, 2017 WL 1076376, at *3 (D. Ariz. Jan. 27, 2017) (quoting Sheldon v. Kettering Health Network, 40 N.E.3d 661, 674 (Ohio Ct. App. 2015). Plaintiffs assert that HIPAA creates a statutory duty of confidentiality and that Kaiser breached that duty by violating HIPAA. As made clear in Skinner, the bar on a private right of action to enforce HIPAA cannot be circumvented through a negligence claim based on an alleged HIPAA violation.3 Accordingly, the

negligence claim based on a violation of HIPAA in Count V will also be dismissed. Likewise, any assertion of a negligence claim based on a violation of the MCMRA is similarly deficient because, as stated

3 The court recognizes that Skinner is not binding on the court, however, the court has not found, and the parties have not pointed to, a case that is authoritative on this subject. Thus, the court finds Skinner to be persuasive. previously, the second amended complaint fails to allege a violation of the MCMRA. Without alleging a disclosure of “medical records[,]” Plaintiffs’ second amended complaint fails to allege a violation of the MCMRA, and by extension, fails to allege a breach of any per se duty owed by statute. B. Count VI

Plaintiffs’ negligence claims against Kaiser in Count VI must also be dismissed. Plaintiffs assert that Kaiser: caused harm to Plaintiffs by: (1) Seeking a fraudulent and meritless search warrant against [Tilman Dunbar, Jr.]. (2) Defendants executing and arresting Plaintiffs falsely for a theft scheme Defendants knew or should have known Plaintiffs did not commit. (3) Falsely arresting the Plaintiffs. (4) Falsely imprisoning the Plaintiffs. (5) Illegally and unconstitutionally violating Plaintiffs’ constitutional rights in violation of Federal Statute 1983. (6) That Plaintiffs were damaged by Defendants’ negligence including, but not limited to humiliation, embarrassment, annoyance, inconvenience, loss of public standing and reputation, violation of their civil rights.

(ECF No. 45, at 10-11). Despite naming Kaiser as a defendant in Count VI, none of the allegations contained therein, pertain to actions taken by Kaiser, and rather, pertain only to conduct by the MCPD and Corporal Biedlingmaier.4 Kaiser correctly argues that Count VI alleges

4 Also pending is a motion to dismiss filed by Defendants Biedlingmaier, the MCPD, and Montgomery County, Maryland. (ECF No. 33). The court will resolve this motion in a separate opinion. negligence by a government actor – not by it. Plaintiffs’ conclusory statements that Kaiser breached a duty owed to Plaintiffs is insufficient to cure this fatal deficiency. Accordingly, Count VI of the second amended complaint as to Kaiser will also be dismissed. Because Counts V and VI are the only counts

in the second amended complaint for which Kaiser is named as a defendant, Kaiser will be dismissed as a party from this suit. V. Conclusion For the foregoing reasons, the motion to dismiss filed by Kaiser will be granted. A separate order will follow.

/s/ DEBORAH K. CHASANOW United States District Judge