IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MONTANA BUTTE DIVISION
HEIDI HARRINGTON,
CV-21-15-BU-BMM Plaintiff,
vs. ORDER
MADISON COUNTY, MADISON COUNTY SHERIFF’S OFFICE, MADISON COUNTY ATTORNEY’S OFFICE, DOUG YOUNG, MADISON VALLEY HOSPITAL, INC., d/b/a MADISON VALLEY MEDICAL CENTER and JOHN DOES 1-10,
Defendants.
INTRODUCTION Defendant Madison Valley Medical Center (d/b/a Madison Valley Medical Center “MVMC”) has filed a Motion to Dismiss Counts VII through X of the Complaint for failure to state a claim. (Doc. 19). Plaintiff Heidi Harrington (“Harrrington”) opposes the Motion. (Doc. 23). MVMC argues that Harrington impermissibly bases Counts VII through X of her Complaint on the Health Insurance Portability Accountability Act (“HIPAA”), for which no private right of action exists, and therefore those counts should be dismissed as having failed to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6).
FACTUAL AND LEGAL BACKGROUND Harrington attempted suicide on March 17, 2020, by consuming a large amount of medications and alcohol before driving her car. (Doc. 20 at 2). Madison County Sheriff’s Office (“MCSO”) located an unresponsive Harrington in her car
and subsequently brought her to MVMC for treatment. Id. at 2–3. Harrington alleges that during her treatment, while she was still unresponsive, a nurse disclosed Harrington’s blood alcohol content and blood test
results to MCSO deputies. Id. Harrington also alleges that MVMC provided a copy of her medical records to MCSO deputies before the County obtained an investigative subpoena to obtain those records, though the County eventually obtained a subpoena on March 27, 2020. Id.
The County charged Harrington with driving under the influence on April 2, 2020. The state district court dismissed those charges on November 6, 2020, due to MCSO having first obtaining the records without proper legal authority. Id.
Harrington filed suit against Madison County, MCSO, Madison County Attorney’s Office, Doug Young (collectively “County Defendants”), and MVMC on February 23, 2020. (Doc. 1, Doc. 14). Harrington asserted five claims against MVMC: Count VI (Violation of Mont. Code Ann. § 50-16-801); Count VII (Invasion of Privacy); Count VIII (Negligence); Count IX (Negligent/Intentional Infliction of Emotional Distress); Count X (Consumer Protection Act). (Doc. 14 at
14–7). MVMC admits that Harrington has stated a claim under the Montana Health Care Information Act (“MHCIA”) with regard to Count VI and it does not seek to
dismiss Count VI at this time. (Doc. 20 at 2); see also Mont. Code Ann. § 50-16- 801 et seq. MVMC moves to dismiss the remaining four claims against it for failure to state a claim. Fed. R. Civ. P. 12(b)(6). LEGAL STANDARDS
To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable
inference that the defendant is liable for the misconduct alleged. Id. DISCUSSION MVMC argues that Counts VII through X of Harrington’s Complaint are
founded on nothing other than an alleged violation of HIPAA. (Doc. 20 at 5). HIPAA provides no private right of action to persons who believe their HIPAA rights have been violated. Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1081 (9th Cir. 2007). HIPAA does not preempt state law remedies, however, that complement HIPAA protections or are more stringent than HIPAA. 42 U.S.C. § 17951(a) (citing 42 U.S.C. § 1320d-7; 45 C.F.R. § 160.203). MVMC also argues
that the civil remedy provided by the MHCIA, which Harrington has already alleged as Count VI, provides the exclusive state law remedy for MVMC’s unauthorized disclosure of Harrington’s health care information. See Mont. Code
Ann. § 50-16-817(4). The Court will address each of these arguments in turn. I. Whether Harrington’s claims are impermissibly based on a violation of HIPAA.
HIPAA does not preempt state law claims related to the unauthorized disclosure of health care information, unless the claims are contrary to HIPAA’s provisions. 42 U.S.C. § 17951(a) (citing 42 U.S.C. § 1320d-7; 45 C.F.R. § 160.203). Both parties agree that HIPAA does not prevent state law claims that complement HIPAA. See (Doc. 23 at 1; Doc. 24 at 2). State law claims allowed under HIPAA include common law claims, as well as statutory claims. 45 C.F.R. § 160.202. Several states have allowed common law claims to proceed based on
unauthorized disclosures of health care information in recognition of the fact that common law claims “encourage HIPAA compliance.” R.K. v. St. Mary's Med. Ctr., Inc., 735 S.E.2d 715, 724 (W. Va. 2012); see also Byrne v. Avery Ctr. for
Obstetrics & Gynecology, P.C., 175 A.3d 1, 17 (Conn. 2018); Shepherd v. Costco Wholesale Corp., 482 P.3d 390, 397 (Ariz. 2021). MVMC argues, however, that a claim cannot be premised solely upon a HIPAA violation. (Doc. 24 at 2). MVMC relies primarily upon caselaw that
concerns attempts by plaintiffs to rely explicitly on HIPAA as the foundation for their claims. See, e.g., Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1081 (9th Cir. 2007); Seaton v. Mayberg, 610 F.3d 530, 533 (9th Cir. 2010). Only
one case MVMC cites truly credits the theory that a common law claim may rely too heavily on HIPAA to state a claim upon which relief can be granted. See Faber v. Ciox Health, LLC, 944 F.3d 593 (6th Cir. 2019) (holding that plaintiffs’ negligence claim failed because a medical-records provider’s duty to limit its fees
arose exclusively under HIPAA and not Tennessee common law). The Court need not decide whether there are some claims that rely too heavily on HIPAA to state a claim. MVMC asserts that Harrington’s claims “are
solely premised upon a violation of HIPAA’s privacy standards.” (Doc. 24 at 3). Harrington “repeatedly cites the privacy provisions set forth in HIPAA throughout the Amended Complaint.” (Doc. 20 at 8). To cite HIPAA differs, however, from “fundamentally ground[ing] these privacy interests in the HIPAA regulations.” Id.
Free access — add to your briefcase to read the full text and ask questions with AI
IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MONTANA BUTTE DIVISION
HEIDI HARRINGTON,
CV-21-15-BU-BMM Plaintiff,
vs. ORDER
MADISON COUNTY, MADISON COUNTY SHERIFF’S OFFICE, MADISON COUNTY ATTORNEY’S OFFICE, DOUG YOUNG, MADISON VALLEY HOSPITAL, INC., d/b/a MADISON VALLEY MEDICAL CENTER and JOHN DOES 1-10,
Defendants.
INTRODUCTION Defendant Madison Valley Medical Center (d/b/a Madison Valley Medical Center “MVMC”) has filed a Motion to Dismiss Counts VII through X of the Complaint for failure to state a claim. (Doc. 19). Plaintiff Heidi Harrington (“Harrrington”) opposes the Motion. (Doc. 23). MVMC argues that Harrington impermissibly bases Counts VII through X of her Complaint on the Health Insurance Portability Accountability Act (“HIPAA”), for which no private right of action exists, and therefore those counts should be dismissed as having failed to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6).
FACTUAL AND LEGAL BACKGROUND Harrington attempted suicide on March 17, 2020, by consuming a large amount of medications and alcohol before driving her car. (Doc. 20 at 2). Madison County Sheriff’s Office (“MCSO”) located an unresponsive Harrington in her car
and subsequently brought her to MVMC for treatment. Id. at 2–3. Harrington alleges that during her treatment, while she was still unresponsive, a nurse disclosed Harrington’s blood alcohol content and blood test
results to MCSO deputies. Id. Harrington also alleges that MVMC provided a copy of her medical records to MCSO deputies before the County obtained an investigative subpoena to obtain those records, though the County eventually obtained a subpoena on March 27, 2020. Id.
The County charged Harrington with driving under the influence on April 2, 2020. The state district court dismissed those charges on November 6, 2020, due to MCSO having first obtaining the records without proper legal authority. Id.
Harrington filed suit against Madison County, MCSO, Madison County Attorney’s Office, Doug Young (collectively “County Defendants”), and MVMC on February 23, 2020. (Doc. 1, Doc. 14). Harrington asserted five claims against MVMC: Count VI (Violation of Mont. Code Ann. § 50-16-801); Count VII (Invasion of Privacy); Count VIII (Negligence); Count IX (Negligent/Intentional Infliction of Emotional Distress); Count X (Consumer Protection Act). (Doc. 14 at
14–7). MVMC admits that Harrington has stated a claim under the Montana Health Care Information Act (“MHCIA”) with regard to Count VI and it does not seek to
dismiss Count VI at this time. (Doc. 20 at 2); see also Mont. Code Ann. § 50-16- 801 et seq. MVMC moves to dismiss the remaining four claims against it for failure to state a claim. Fed. R. Civ. P. 12(b)(6). LEGAL STANDARDS
To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable
inference that the defendant is liable for the misconduct alleged. Id. DISCUSSION MVMC argues that Counts VII through X of Harrington’s Complaint are
founded on nothing other than an alleged violation of HIPAA. (Doc. 20 at 5). HIPAA provides no private right of action to persons who believe their HIPAA rights have been violated. Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1081 (9th Cir. 2007). HIPAA does not preempt state law remedies, however, that complement HIPAA protections or are more stringent than HIPAA. 42 U.S.C. § 17951(a) (citing 42 U.S.C. § 1320d-7; 45 C.F.R. § 160.203). MVMC also argues
that the civil remedy provided by the MHCIA, which Harrington has already alleged as Count VI, provides the exclusive state law remedy for MVMC’s unauthorized disclosure of Harrington’s health care information. See Mont. Code
Ann. § 50-16-817(4). The Court will address each of these arguments in turn. I. Whether Harrington’s claims are impermissibly based on a violation of HIPAA.
HIPAA does not preempt state law claims related to the unauthorized disclosure of health care information, unless the claims are contrary to HIPAA’s provisions. 42 U.S.C. § 17951(a) (citing 42 U.S.C. § 1320d-7; 45 C.F.R. § 160.203). Both parties agree that HIPAA does not prevent state law claims that complement HIPAA. See (Doc. 23 at 1; Doc. 24 at 2). State law claims allowed under HIPAA include common law claims, as well as statutory claims. 45 C.F.R. § 160.202. Several states have allowed common law claims to proceed based on
unauthorized disclosures of health care information in recognition of the fact that common law claims “encourage HIPAA compliance.” R.K. v. St. Mary's Med. Ctr., Inc., 735 S.E.2d 715, 724 (W. Va. 2012); see also Byrne v. Avery Ctr. for
Obstetrics & Gynecology, P.C., 175 A.3d 1, 17 (Conn. 2018); Shepherd v. Costco Wholesale Corp., 482 P.3d 390, 397 (Ariz. 2021). MVMC argues, however, that a claim cannot be premised solely upon a HIPAA violation. (Doc. 24 at 2). MVMC relies primarily upon caselaw that
concerns attempts by plaintiffs to rely explicitly on HIPAA as the foundation for their claims. See, e.g., Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1081 (9th Cir. 2007); Seaton v. Mayberg, 610 F.3d 530, 533 (9th Cir. 2010). Only
one case MVMC cites truly credits the theory that a common law claim may rely too heavily on HIPAA to state a claim upon which relief can be granted. See Faber v. Ciox Health, LLC, 944 F.3d 593 (6th Cir. 2019) (holding that plaintiffs’ negligence claim failed because a medical-records provider’s duty to limit its fees
arose exclusively under HIPAA and not Tennessee common law). The Court need not decide whether there are some claims that rely too heavily on HIPAA to state a claim. MVMC asserts that Harrington’s claims “are
solely premised upon a violation of HIPAA’s privacy standards.” (Doc. 24 at 3). Harrington “repeatedly cites the privacy provisions set forth in HIPAA throughout the Amended Complaint.” (Doc. 20 at 8). To cite HIPAA differs, however, from “fundamentally ground[ing] these privacy interests in the HIPAA regulations.” Id.
Harrington also cites several other authorities to demonstrate that she retained a privacy interest in her medical records, including the Montana Constitution, which independently guarantees the right to privacy, Montana case law, and Montana
statutory authority. See Mont. Const. art. II, § 10; Mont. Code Ann. § 50-16-801 et seq.; Mont. Code Ann. § 46-4-301(3) (referring to “medical records or information” as “constitutionally protected material”); State v. Goetz, 2008 MT
296, ¶ 39 (“the State may not invade an individual's privacy unless the procedural safeguards attached to the right to be free from unreasonable searches and seizures are met” (citations and quotations omitted)).
Harrington cites HIPAA, similar to her citation to state law authority, to support her valid common law and state statutory claims. This reliance does not mean she has attempted to plead a private right of action under HIPAA. Though Harrington’s privacy interests in her medical records may overlap with the rights
assured by HIPAA, HIPAA does not subsume all other legal authority relating to the right to privacy merely because the privacy violated relates to medical information. To argue otherwise would be to argue preemption. MVMC has
assured the Court it is not trying to argue preemption. See (Doc. 24 at 2 (“preemption analysis is not required in this case”)). At this early stage of litigation, it would be premature for the Court to assume that Harrington’s claims, properly pled as statutory and common law claims, fail to state a theory on which
relief can be granted merely because MVMC’s actions also may have violated HIPAA. Harrington has not attempted to plead a private right of action under HIPAA,
and MVMC cannot transform her claims into something they are not. The Court determines that Harrington has alleged sufficient facts to support Claims VII through X without relying solely on HIPAA.
II. Whether the Montana Health Care Information Act provides Harrington’s exclusive remedy under Montana state law.
MVMC does not dispute that Harrington has stated a claim under the MHCIA (Count VI). It does argue, however, that this claim provides “a limitation on what, if any, civil remedies are available” for an improper disclosure of a patient’s healthcare information. (Doc. 20 at 12). MVMC claims without support that “the Montana legislature clearly considered and defined what limited civil remedies may be available, should a plaintiff establish that a violation of the statute occurred.” (Doc. 20 at 12). Nothing within the text or legislative history of the
MHCIA indicates that the Legislature intended for it to serve as an exclusive civil remedy. The Court applies Montana rules of statutory construction to interpret Montana statutes. Marten v. Haire, 329 F.R.D. 256, 261 (D. Mont. 2018). The
Court should neither “insert what has been omitted or [] omit what has been inserted” when interpreting a Montana statute. Mont. Code Ann. § 1-2-101. Montana statutes that provide exclusive remedies typically insert language that
indicates the statute provides the sole available remedy. For instance, the Montana Workers’ Compensation Act explains that “the provisions of this chapter are exclusive.” Mont. Code Ann. § 39-71-411. The MHCIA contains no language that would denote exclusivity. The Court declines to “insert what has omitted.” It remains unclear, at best, whether the civil remedy provided by the MHCIA constitutes the exclusive remedy for the unauthorized disclosure of health care information. CONCLUSION Harrington’s Complaint may overlap with the duties imposed under HIPAA and the MHCIA. This overlap does not prevent Harrington from stating other
common law and statutory claims. HIPAA permits complementary state law claims and Montana’s related statutory remedy—the MHCIA—contains no language to suggest that it provides the exclusive remedy. Harrington has alleged facts sufficient that, accepted as true, state a facially plausible claim for relief under Counts VII through X. ORDER Accordingly, IT IS ORDERED that Defendant’s Motion to Dismiss (Doc. 7) is DENIED. Dated this 6th day of December, 2021.
be a 4, 7 Ny, |/ICEA | VA fin. Brian Morris, Chief District Judge SS United States District Court