UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
JENNIFER L. LOMBRANO, Plaintiff,
v. No. 21-cv-872 (DLF)
DEPARTMENT OF THE AIR FORCE, Defendant.
MEMORANDUM OPINION
Jennifer Lombrano brings this action against the Department of the Air Force under the Privacy Act, 5 U.S.C. § 552a. Lombrano alleges that the Air Force impermissibly disclosed information from her medical records to her workplace, resulting in both her termination from that workplace and her early retirement from a related government agency. Before the Court is the Air Force’s Motion to Dismiss her complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). Dkt. 14. For the reasons that follow, the Court will deny the motion. I. BACKGROUND When considering a motion to dismiss, the Court takes the well-pleaded factual allegations in the complaint as true. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). At the time of the events at issue, Lombrano was a commissioned officer in the United States Public Health Service, First Am. Compl. (Compl.) ¶ 3, Dkt. 12-4, serving as an oral and maxillofacial surgeon, id. ¶ 15. Per a Memorandum of Agreement, she had been assigned to the SouthCentral Foundation (SouthCentral) in Anchorage, Alaska. Id. ¶ 16. SouthCentral is a “nonprofit health care organization serving nearly 65,000 Alaska Native and American Indian people.” Id. ¶ 17.
Lombrano intended to stay with SouthCentral after her retirement from the Public Health Service. Id. ¶ 18.
However, in August 2020, Lombrano “was suffering from severe panic attacks resulting from personal and professional issues.” Id. ¶ 20. As a Public Health Service officer, Lombrano receives healthcare at Department of Defense Medical Treatment Facilities, such as the hospital at Joint Base Elmendorf-Richardson. Id. ¶ 22. On approximately August 14, 2020, Lombrano visited “the on-call outpatient mental health care provider at Joint Base Elmendorf-Richardson with whom [Lombrano] confided that she had intended to seek treatment” at a ten-day alcohol and drug rehabilitation treatment facility in Seattle. Id. ¶ 23.
The outpatient treatment provider advised Lombrano to stay the night for medical attention given her health history (specifically, a cardiac ablation approximately a year earlier). Id. ¶ 24. The outpatient provider also “told her that the next day she would be able to make her treatment arrangements” and that she would be provided “options for treatment programs that were covered by Tricare insurance.” Id. ¶ 25. However, Lombrano was placed in the “inpatient Behavioral Health Unit, essentially . . . a psych ward behind locked doors.” Id. ¶ 26. As part of an inventory of Lombrano’s belongings, “hospital officials seized three 2 milligram Gummy Bears infused with THC, the metabolite for marijuana.” Id. ¶ 29.
The next day, on August 15, 2020, Lombrano “met with Colonel Christine Campbell, USAF, the attending psychiatrist, in the inpatient Behavioral Clinic at Joint Base Elemendorf- Richardson.” Id. ¶ 31. “Colonel Campbell disclosed that she had already contacted SouthCentral Foundation, that she ha[d] spoken with [Lombrano’s] supervisor and that she had disclosed [Lombrano’s] medical condition and her current mental state.” Id. ¶ 32. One day later, on August 16, 2020, Lombrano’s supervisor at SouthCentral informed her that Campbell “in fact
3
had contacted the HR department and told them that she was impaired, mentally unstable, had an alcohol problem and now had a drug charge for possession of an illegal substance.” Id. ¶ 33.
SouthCentral terminated Lombrano’s assignment in a letter dated September 2, 2020. Id.
¶ 36. Lombrano alleges that this termination was “[b]ased upon the unlawful disclosures by Air Force personnel.” Id. Lombrano further alleges that she was “forced to retire early” from the Public Health Service and lost “the difference in salary versus her retired pay.” Id. ¶ 45. After her termination, she alleges that “she could only find employment on a part-time, two-day per week basis.” Id. Finally, she alleges that “[h]er future employment prospects are jeopardized because she will have to reveal circumstances behind the dismissal to future employers.” Id. II. LEGAL STANDARDS Rule 12(b)(6) of the Federal Rules of Civil Procedure allows a defendant to move to dismiss the complaint for “failure to state a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). To survive a Rule 12(b)(6) motion, a complaint must contain factual matter sufficient “to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A facially plausible claim is one that “allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. This standard does not amount to a specific probability requirement, but it does require “more than a sheer possibility that a defendant has acted unlawfully.” Id.; see also Twombly, 550 U.S. at 555 (“Factual allegations must be enough to raise a right to relief above the speculative level.”). A complaint need not contain “detailed factual allegations,” but alleging facts that are merely consistent with a defendant’s liability . . . stops short of the line between possibility and plausibility.” Iqbal, 556 U.S. at 678 (internal quotation marks omitted).
4
The Court must “accept as true” all the factual allegations in the plaintiff’s complaint, id.
at 678, and “grant[] the benefit of all inferences that can be derived from the facts alleged,” Hettinga v. United States, 677 F.3d 471, 476 (D.C. Cir. 2012) (internal quotation marks omitted). The Court need not accept, however, any “legal conclusion [that is] couched as a factual allegation.” Iqbal, 556 U.S. at 678 (internal quotation marks omitted). Likewise, the Court will not credit an “unadorned, the-defendant-unlawfully-harmed-me accusation,” or a “[t]hreadbare recital[] of the elements of a cause of action, supported by mere conclusory statements.” Id. Ultimately, “[d]etermining whether a complaint states a plausible claim for relief [is] a context- specific task that requires the reviewing court to draw on its judicial experience and common sense.” Id. at 679. III. ANALYSIS The Privacy Act “contains a comprehensive and detailed set of requirements for the management of confidential records held by Executive Branch agencies.” FAA v. Cooper, 566 U.S. 284, 287 (2012). It “safeguards the public from unwarranted collection, maintenance, use and dissemination of personal information contained in agency records.” In re OPM Data Sec. Breach Litig., 928 F.3d 42, 61–62 (D.C. Cir. 2019) (quoting Henke v. Dep’t of Com., 83 F.3d 1453, 1456 (D.C. Cir. 1996)). To that end, the Privacy Act prohibits agencies from disclosing “any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior consent of, the individual to whom the record pertains,” unless certain exceptions apply. 5 U.S.C. § 552a(b).
The Privacy Act contains a private right of action against agencies that improperly disclose such records. See id. § 552a(g)(1)(D). “To unlock the Privacy Act’s waiver of
5
sovereign immunity and state a cognizable claim for damages, a plaintiff must allege that (i) the agency ‘intentional[ly] or willful[ly]’ violated the Act’s requirements for protecting the confidentiality of personal records and information; and (ii) she sustained ‘actual damages’ (iii) ‘as a result of’ that violation.” In re OPM, 928 F.3d at 62 (quoting 5 U.S.C. § 552a(g)(4)).
The Air Force moves to dismiss Lombrano’s complaint on two grounds. See Mot. to Dismiss at 6, Dkt. 14. First, the Air Force argues that Lombrano failed to plausibly allege the disclosure violated the Privacy Act. Id. at 6. Second, the Air Force argues that Lombrano failed to sufficiently plead actual damages. Id. at 10. Both arguments fail.
A. Improper Disclosure 1. The Alleged Disclosure Lombrano has sufficiently alleged the elements required to state a claim for improper disclosure. “Privacy Act claims for monetary damages based on improper disclosure . . . have four elements: ‘1) the disclosed information is a record contained within a system of records; 2) the agency improperly disclosed the information; 3) the disclosure was willful or intentional; and 4) the disclosure adversely affected the plaintiff.’” Doe v. DOJ, 660 F. Supp. 2d 31, 44–45 (D.D.C. 2009) (quoting Logan v. Dep’t of Veterans Affs., 357 F. Supp. 2d 149, 154 (D.D.C. 2004)). In this case, Lombrano has alleged that her information was contained in her medical records, see, e.g., Compl. ¶ 44, which were maintained within a system of records protected by the Privacy Act, see id. ¶¶ 38, 44.1 Lombrano has identified the recipients of the information, see id. ¶¶ 32–33, 42, 44; the person who allegedly disclosed the information, see id.; and the time
1 The Air Force argues that Lombrano failed to allege that Campbell accessed the records through the use of Lombrano’s name or another identifier. See Def.’s Reply at 3, Dkt. 17. But one can infer that medical records would include identifying information, 5 U.S.C. § 552a(a)(4), and be “retrieved by the name of the individual” or by some other identifier, id. § 552a(a)(5).
6
period—a span of one day—during which the information was disclosed, see id. ¶¶ 23, 31–32. In addition, Lombrano has alleged that she had never spoken with Campbell before the disclosure to SouthCentral and that Campbell “was not present when Plaintiff was admitted to the hospital.” Id. ¶ 44. Finally, she has alleged that she lost her job and was forced to retire early as a result of the disclosure. Id. ¶ 45; see infra III.B.
The facts here resemble those in Feldman v. CIA, 797 F. Supp. 2d 29 (D.D.C. 2011). In Feldman, a CIA employee alleged that the agency improperly disclosed information regarding an investigation relating to his travel reimbursements. See 797 F. Supp. 2d at 32, 34. As relevant here, the employee under investigation based this claim on allegations that other employees “learned of the investigation despite having no official connection to it.” Id. at 37. The CIA argued that the other employees may have gained their knowledge from independent sources, such as “other employees who were interviewed by the CIA OIG investigators,” rather than from protected records. Id. at 40. However, the Court stated that reliance on a “res ipsa loquitur inference . . . at the pleading stage may be sufficient to survive a motion to dismiss, depending on the facts alleged.” Id. at 41. In Feldman, it was enough at the motion to dismiss stage that the plaintiff had alleged that the record at issue was protected by the Privacy Act; that the employees who learned the information had “no official connection to the investigation”; that Feldman had “identified these employees by name”; and that Feldman had “identified the approximate time period in which they learned about the investigation.” Id.
Similar to Feldman, Lombrano’s assertion that Campbell “could only have” obtained the disclosed information “by reading the medical record that was created when Plaintiff entered the hospital at Joint Base Elmendorf-Richardson” is plausible. Compl. ¶ 44. It rests on a single “reasonable inference,” Iqbal, 556 U.S. at 678, not, as the Air Force contends, “a series of
7
speculative assumptions,” Mot. to Dismiss at 7. It is true that Lombrano’s inference, see Compl. ¶ 44, will likely be “inadequate to sustain a Privacy Act claim on the merits.” Feldman, 797 F. Supp. 2d at 41 (discussing Armstrong v. Geithner, 608 F.3d 854 (D.C. Cir. 2010)); see Armstrong, 608 F.3d at 857–61. But Lombrano is not required to connect all the dots now. “Indeed, in the typical case, a plaintiff can hardly be expected to know the full details behind an improper disclosure prior to discovery, since those details are most likely to be under the control of the defendant.” Feldman, 797 F. Supp. 2d at 41.
Even though Campbell may have obtained Lombrano’s disclosed information without accessing any medical record, see Mot. to Dismiss at 7, dismissal of her complaint is not warranted at this early stage. “[A] complaint survives a motion to dismiss even [i]f there are two alternative explanations, one advanced by [the] defendant and the other advanced by [the] plaintiff, both of which are plausible.” VoteVets Action Fund v. U.S. Dep’t of Veterans Affs., 992 F.3d 1097, 1104 (D.C. Cir. 2021) (quoting Banneker Ventures, LLC v. Graham, 798 F.3d 1119, 1129 (D.C. Cir. 2015) (internal quotation marks omitted)). The Air Force contends that Campbell “naturally would have discussed patients” with her colleagues due to her role as “the attending (i.e., supervising) psychiatrist at the behavioral clinic.” Mot. to Dismiss at 7; see also Doe v. U.S. Dep’t of Treasury, 706 F. Supp. 2d 1, 6 (D.D.C. 2009) (noting that, as a general matter, “[t]he disclosure of information derived solely from independent sources is not prohibited by the statute even though identical information may be contained in [a] system of records” (citation omitted)). But Lombrano has offered a plausible explanation for how Campbell learned the relevant information. Lombrano “will need to amass sufficient evidence to meet [her] burden of proof as the case proceeds,” but she “need not do so at the pleading stage.” Kelley v. FBI, 67 F. Supp. 3d 240, 265 (D.D.C. 2014).
8
2. The Routine Use Exceptions The Air Force argues that even if Campbell obtained the allegedly disclosed information from Lombrano’s records, Lombrano has failed to show that the Privacy Act’s exceptions do not apply. See Mot. to Dismiss at 8. Specifically, the Air Force argues that the alleged disclosure was permissible under two of the Privacy Act’s “routine use” exceptions. 5 U.S.C. § 552a(b)(3); see Mot. to Dismiss at 8.
By way of background, a “routine use” is a “disclosure of a record . . . which is compatible with the purpose for which [the record] was collected.” 5 U.S.C. § 552a(a)(7). All agencies that “maintain[] a system of records” are required to publish a notice in the Federal Register whenever they create a new, or revise an existing, system of records. Id. § 552a(e)(4). This system of records notice (SORN) must include “each routine use of the records contained in the system, including the categories of users and the purpose of such use.” Id. § 552a(e)(4)(D).
The law enforcement routine use, which applied at the relevant time throughout the Department of Defense, provides:
If a system of records maintained by a DoD Component to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or by regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the agency concerned, whether Federal, State, local, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, rule, regulation, or order issued pursuant thereto.
Department of Defense Privacy Program, 72 Fed. Reg. 18,758, 18,784 (Apr. 13, 2007) (codified as amended at 32 C.F.R. pt. 310 app. A); see also Privacy Act of 1974; Technical Amendment, 86 Fed. Reg. 64,367, 64,368 (Nov. 18, 2021) (reinstating the above routine use after it was “erroneously deleted” in 2019 from the Code of Federal Regulations). The Air Force has specifically subjected its Medical Records System to this routine use. See Privacy Act of 1974;
9
System of Records, 75 Fed. Reg. 34,709, 34,711 (June 18, 2010) (incorporating all the Department of Defense’s “Blanket Routine Uses” by reference).
The routine use for law enforcement does not apply here. Although Lombrano’s possession of the gummy bears containing marijuana was arguably relevant to her employment, see Mot. to Dismiss at 8; Def.’s Reply at 4, the routine use allows only disclosures to agencies charged with either “enforcing or implementing” the relevant law or “investigating or prosecuting” violations thereof. 72 Fed. Reg. at 18,784. The Public Health Service is not a law enforcement agency, and the Air Force has not suggested that it is charged with enforcing or implementing laws prohibiting marijuana.
The Air Force’s reliance on a second routine use, which pertains to disclosures made when requesting information, also fails. See Def.’s Reply at 5. This routine use states:
A record from a system of records maintained by a Component [of the Department of Defense] may be disclosed as a routine use to a Federal, State, or local agency maintaining civil, criminal, or other relevant enforcement information or other pertinent information, such as current licenses, if necessary to obtain information relevant to a Component decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant, or other benefit.
72 Fed. Reg. at 18,784 (codified as amended at 32 C.F.R. pt. 310 app. A). This routine use also does not apply because SouthCentral and the Public Health Service, the entities that made the relevant retention decisions, are not components of the Department of Defense. See 42 U.S.C. §§ 201–203 (noting that the Public Health Service falls within the Department of Health and Human Services). Moreover, even if this routine use applied, the Air Force has forfeited this argument by raising it for the first time in its reply brief. It is well settled that the exceptions in the Privacy Act are affirmative defenses, which defendants must either timely raise or eventually forfeit. See Kelley, 67 F. Supp. 3d at 265 n.15 (reading Doe v. FBI, 936 F.2d 1346 (D.C. Cir. 1991); Richardson v. Bd. of Governors of Fed. Rsrv. Sys., 248 F. Supp. 3d 91, 101 (D.D.C.
10
2017). And under the “ordinary rules of forfeiture,” arguments are generally “forfeited if [they are] raised for the first time in reply.” Twin Rivers Paper Co. v. SEC, 934 F.3d 607, 615 (D.C. Cir. 2019) (citation omitted). Because the Air Force raised its second routine use in that manner, it cannot prevail on that exception here.
The Air Force’s remaining arguments are red herrings. First, the Air Force argues that Lombrano’s complaint focuses on “express[ing] disagreement with the Air Force’s action with respect to Plaintiff’s termination” and that “[t]he Privacy Act . . . is not a vehicle for amending the judgments of federal officials that are reflected in records maintained by federal agencies.” Mot. to Dismiss at 9. However, Lombrano’s complaint clearly alleges improper disclosure under the Privacy Act. See, e.g., Compl. ¶¶ 42–43. Whether Lombrano’s complaint also indicates disagreement with her termination or judgments reflected in her medical records is irrelevant. Second, the Air Force argues that “[t]o the extent . . . that Plaintiff bases her claim upon HIPAA . . . the Court should reject Plaintiff’s use of the Privacy Act in the disguise of a HIPAA claim.” Mot. to Dismiss at 9. While Lombrano’s complaint includes a reference to HIPAA, see Compl. ¶ 34, it focuses on and states a claim under the Privacy Act, see id. ¶¶ 40–46.
B. Actual Damages To state a claim under the Privacy Act, a plaintiff must also allege “actual damages,” 5 U.S.C. § 552a(g)(4)(A), a phrase that requires a “pecuniary” harm, Cooper, 566 U.S. at 295–96. Lombrano has met that standard by alleging that Campbell’s disclosure caused both the termination of her SouthCentral assignment and her forced retirement from the Public Health Service. See Compl. ¶¶ 36, 45. Clearly, the loss of employment creates at least some pecuniary harm. See Hill v. DOD, 70 F. Supp. 3d 17, 21 (D.D.C. 2014). And although the Air Force objects that Lombrano has failed to provide the specific amount of the difference between her
11
salary and retirement pay, see Mot. to Dismiss at 11; Def.’s Reply at 6, she is not required to do so at this stage of the proceeding.2 See Hill, 70 F. Supp. 3d at 22 (plaintiff not required to quantify specific pecuniary harms to “survive a Rule 12(b)(6) . . . motion”). To state a claim for relief under the Privacy Act, it is enough to plausibly “some pecuniary harm, no matter how slight.” Cooper, 566 U.S. at 296. Because Lombrano has cleared that bar, her claim survives the Air Force’s motion to dismiss.
CONCLUSION
For the foregoing reasons, the Air Force’s motion to dismiss is denied. An order consistent with this decision accompanies this memorandum opinion.
________________________
DABNEY L. FRIEDRICH
United States District Judge February 9, 2022
2 This conclusion is consistent with Richardson v. Board of Governors of the Federal Reserve System, 288 F. Supp. 3d 231 (D.D.C. 2018), as the alleged disclosures in that case occurred only after the plaintiff’s termination, id. at 237. See Mot. to Dismiss at 11 (discussing the case).