UNITED STATES DISTRICT COURT MIDDLE DISTRICT OF FLORIDA TAMPA DIVISION
WILLIE GREEN,
Plaintiff,
v. Case No. 8:25-cv-579-KKM-LSG
GALENCARE INC., et al.,
Defendants. ____________________________________
ORDER Proceeding pro se, Green filed a ninety-one page, third amended complaint against Galencare, Inc., and Allied Universal Security Services for claims arising from his visit to the Galencare’s emergency department and the creation of a security alert about Green. See 3d. Am. Compl. (TAC) (Doc. 76). Green brings claims under the Emergency Medical Condition and Active Labor Act (EMTALA), the Driver’s Privacy Protection Act (DPPA), Title VI, breach of contract, and state law torts. Both defendants move to dismiss. See Galencare MTD (Doc. 79); Allied MTD (Doc. 81). For the reasons below, I grant in part and deny in part both motions. I. BACKGROUND A. Hospital Visit
In September 2022, Green slipped and fell, causing “head trauma and lower back injuries.” TAC ¶ 10. “[E]xperiencing dizziness, blurred vision, unsteadiness, and persistent pain,” Green went to Galencare’s emergency department (the hospital) in Temple Terrace, Florida. Id. The physician
ordered multiple CT scans, which “showed no acute or emergent findings.” Id. Green was told “to return if his symptoms persisted or worsened.” Id. On March 9, 2023, Green experienced “worsening symptoms,” including “dizziness, severe headaches, severe spinal pain, blurred vision, and vomiting.”
Id. ¶ 45. He returned to the hospital, where Dr. Akeem Flemister evaluated him. Id. ¶¶ 11, 46. Green provides the medical records from the visit, which show that his vital signs were taken and he was prescribed acetaminophen and Flexeril. Medical Records (Doc. 13) at 12. Green requested new CT imaging,
which Flemister declined, explaining that there was “no new traumatic injury,” TAC ¶ 11, and that imaging was not indicated: The patient’s chief complaint, history, and exam are consistent with chronic neck and back strain as the patient has experienced his pain for 6 months without any new injuries. History and exam are negative for neuro deficits or other signs of cauda equine syndrome, epidural abscess, spinal stenosis, or other emergent etiology of back pain, and CT and MRI imaging of the back are not indicated at this time.
Medical Records at 10. Green alleges that Dr. Flemister “based his decision on [Green’s] outdated CT scan results . . . and his unsupported belief that [Green’s] CT results would be unchanged.” TAC ¶ 12. The medical records state that Dr.
Flemister offered to conduct an x-ray and Green declined, Medical Records at 11, but Green maintains that he never declined any kind of imaging, TAC ¶ 13. Green insisted on new scans and alleges that “Dr. Flemister then began to use scare tactics and [Green’s] race to discourage his repeated request for imaging.”
TAC ¶ 12. According to Green, [Dr. Flemister] stated that as an African American, exposure to radiation would place Plaintiff at risk of cancer or even death. . . . He then told Plaintiff that it was not uncommon for African Americans to be “uneducated” about radiation risk and stated that he chose to work for HCA Healthcare due to its history of mistreatment of African Americans and because he wanted to “educate his people” on their medical needs.
Id. “Dr. Flemister falsely concluded that Plaintiff's ‘exam today is negative for any acute or emergent neck or back conditions’ and that his condition was ‘stable and appropriate for discharge.’ ” Id. ¶ 14. The medical records show that Dr. Flemister referred Green to an outpatient orthopedist and assured Green that the orthopedist would see him notwithstanding his lack of insurance: [Green] agrees that orthopedic follow up and physical therapy are what he needs, and states that he cannot see an orthopedist because he has no insurance. He is counseled regarding follow-up policies with an on-call specialist, and assured that an on call orthopedic surgery will allow him to follow-up with them as he was evaluated in our emergency department. Medical Records at 11; see also TAC ¶ 65. The records—this section of which Green does not dispute—indicate that Green agreed that CT imaging was not necessary by the end of the visit:
[Green] states that as long as he is able to follow up with the orthopedic surgery, that he agrees he does not need new CT imaging & that evaluation and management plan by ortho will suffice. [Green] states that he is happy with the plan and that he is appreciative and happy with my care of him and extensive counseling regarding appropriate plan of action.
Medical Records at 11. Green was discharged. Shortly thereafter, he “collapsed at home, experiencing a sudden failure of his lower back.” TAC ¶ 64. The next day, Green tried to schedule an appointment with the orthopedist, who refused because Green was uninsured. Id. ¶ 16. B. Security Alert On April 12, 2023, Green sent Galencare a pre-suit complaint asserting that the hospital had violated EMTALA and seeking $200,000 in compensation. Id. ¶ 17. Galencare denied the claim and hospital management asked the hospital’s security manager, an employee of Allied, to send an alert warning staff about Green. Id. ¶¶ 17, 22. Allied is a “private security provider” that contracts with Galencare to provide security services. Id. ¶ 20. The security manager sent the alert via an internal portal to security personnel “across multiple facilities throughout the state.” Id. ¶ 23. The alert warned that Green was unhappy with his medical care and directed staff to post it in discrete locations: To get this to all [freestanding emergency department’s (FSEDs)] today to be on the lookout for this person in the event he should visit the main or FSED. Risk management and leadership have been involved. Angered over his medical treatment received. I was asked to prepare a BOLO. Please confirm this evening that all FSEDs have received this and that it is posted where it can be seen only by security and/ or ED leadership at the FSEDs. Id. § 23. The security manager also sent out an unredacted scan of Green’s driver’s license, which included his name, address, photo, date of birth, and license number. Id. § 24. A print-out of the alert, including Green’s unredacted license, was posted on the hospital’s “Be on the Lookout” (BOLO) wall in the hospital lobby. Id. § 25. Green’s own photographs indicate that the print-out was behind a security desk, though still visible to the public. See Jd. at 11, 13; Galencare MTD at 4. The print-out remained on the wall for more than a year, notwithstanding Green’s demands to have it removed. TAC 4{ 31, 34.
sheer 2 □□ □□ eigen Beto M ae Mer es ad ee erie eee ot Rae a esha ae teed Lac Bare Mae aes) □□ at Be Led eS eee Ala gree a peg De Me ee Mtoe gst ars eye ee ey i □□ a i] Pet BREE Pet, | at ee)
Id. ¶ 26 (excerpt of image). Within two months of sending his presuit demand, Green was the victim
of identity theft, including “fraudulent attempts to open credit cards,” and later the submission of a false tax return. Id. ¶ 41. Green has “received unexplained medical bills for services he never received and experienced loss of employment and income due to failed identity verification procedures.” Id. ¶ 41. In
November 2023, an account named “Real Tampa 813” posted Green’s social security number and a photograph of the BOLO print-out on social media, “reaching over 35,000 combined followers.” Id. ¶ 26. Green does not explain who might have posted it or how the account obtained his social security
number, which was not a part of the BOLO alert. See generally id. On March 10, 2025, Green filed this suit against Galencare and Allied Universal Security Services. See Compl. (Doc. 1). Green amended his complaint as of right, see (Doc. 11), and both defendants moved to dismiss, e.g. (Docs. 16,
25, 39). Twice I granted motions to amend his complaint, resulting in the instant third amended complaint. See (Docs. 54, 75). The complaint spans 91 pages, 260 paragraphs, and 15 counts. See TAC. Green sues under EMTALA (Counts I–III), the Driver’s Privacy Protection Act
(DPPA) (Count V and VI), Title VI (Counts XIII and XIV), breach of contract (Counts VII, VIII), and for state law torts, including negligence (Counts IV), negligence per se (Count VI), invasion of privacy (Count IX), defamation (Count X), breach of confidence (Count XII), vicarious liability (Count XI), and civil conspiracy (Count XV). Galencare and Allied move to dismiss, see Galencare
MTD; Allied MTD, and Green responds in opposition, see Resp. to Galencare (Doc. 100); Resp. to Allied (Doc. 101). II. LEGAL STANDARD Federal Rule of Civil Procedure 8(a)(2) requires “a short and plain
statement of the claim showing that the pleader is entitled to relief.” This pleading standard “does not require ‘detailed factual allegations,’ but it demands more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp.
v. Twombly, 550 U.S. 544, 555 (2007)). “A pleading that offers ‘labels and conclusions’ or ‘a formulaic recitation of the elements of a cause of action will not do.’ ” Id.(quoting Twombly, 550 U.S. at 555). “Nor does a complaint suffice if it tenders ‘naked assertion[s]’ devoid of ‘further factual enhancement.’ ”
Id.(quoting Twombly, 550 U.S. at 557). “To survive a motion to dismiss” for failure to state a claim, a plaintiff must plead sufficient facts to state a claim that is “plausible on its face.” Id.(quoting Twombly, 550 U.S. at 570). A claim is facially plausible when a
“plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. The complaint’s factual allegations are accepted “as true” and construed “in the light most favorable to the plaintiff.” Pielage v. McConnell, 516 F.3d 1282, 1284 (11th Cir. 2008). Courts should limit their “consideration to the well-pleaded
factual allegations, documents central to or referenced in the complaint, and matters judicially noticed.” La Grasta v. First Union Sec., Inc., 358 F.3d 840, 845 (11th Cir. 2004), abrogated on other grounds by Twombly, 550 U.S. 544. III. ANALYSIS
A. EMTALA – Counts I–III Green brings three claims under EMTALA against Galencare, failure to screen as required by 42 U.S.C. § 1395dd(a) (Count I), failure to provide stabilizing treatment before transfer under § 1395dd(b)–(c) (Count II), and
delay of further medical examination and treatment under § 1395dd(h) (Count III). See TAC ¶¶ 58, 72, 87. The hospital moves to dismiss all three counts as time-barred and for failure to state a claim. Galencare MTD at 7–11. I grant the motion in part and dismiss Counts I, II, and III without prejudice.
EMTALA “was enacted to prevent ‘patient dumping,’ which is the “practice of some hospitals turning away or transferring indigent patients without evaluation or treatment.” Smith ex rel. MS v. Crisp Reg’l Hosp., Inc., 985 F.3d 1306, 1307–08 (11th Cir. 2021) (citation modified). “A hospital
violates EMTALA when it ‘either fails to adequately screen a patient, or discharges or transfers the patient without first stabilizing his emergency medical condition.’ ” Matthews v. Ascension St. Vincents Clay Cnty. Hosp., No. 22-13484, 2026 WL 1230320, at *2 (11th Cir. May 5, 2026) (quoting Kizzire v. Baptist Health Sys., 441 F.3d 1306, 1310 (11th Cir. 2006)).
The statute defines “emergency medical condition” as “a medical condition manifesting itself by acute symptoms of sufficient severity (including severe pain) such that the absence of immediate medical attention could reasonably be expected to result in . . . (i) placing the health of the
individual . . . in serious jeopardy, (ii) serious impairment to bodily functions, or (iii) serious dysfunction of any bodily organ or part[.]” 42 U.S.C. § 1395dd(e)(1)(A). Galencare first argues that Green’s claims are barred by the statute of
limitations. As Green notes, the two-year deadline fell on a Sunday, extending his deadline to the next business day. Resp. to Galencare at 4–5. Green’s claims are timely. See FED. R. CIV. P. 6(a)(1)(C). I evaluate each in turn. At the outset, I note that courts “normally consider all documents that
are attached to the complaint or incorporated into it by reference” when “deciding whether a complaint states a claim upon which relief may be granted.” Gill ex rel. K.C.R. v. Judd, 941 F.3d 504, 511 (11th Cir. 2019). Green references his medical records throughout his third amended complaint, see,
e.g., TAC ¶¶ 54, 74–75, and submitted them to the Court the day after filing his first amended complaint, see Medical Records. As such, I consider them in my analysis. i. Failure to Screen – Count I Green alleges that the hospital failed to provide him an adequate medical
screening when Dr. Flemister refused to order diagnostic imaging during his second emergency room visit in March 2022. TAC ¶¶ 46, 48. Because EMTALA is not a medical malpractice statute and does not prescribe a standard of care, the test for screening merely asks if the “hospital
applies the same screening procedures to indigent patients which it applies to paying patients.” Crisp, 985 F.3d at 1308 (citation modified). Green argues that the refusal “departed from the hospital’s established protocols for patients with comparable symptoms.” TAC ¶ 48. Green bases this
on Dr. Flemister’s reference to his race when explaining the rationale about additional scans and the fact that Green received CT scans six months prior “for the same but less severe symptoms.” TAC ¶¶ 49–50. Galencare responds that, as borne out by the medical record, the screening was “wholly adequate”
under EMTALA. Galencare MTD at 9–10 (noting that the visit included measuring vitals, taking a medical history, and a physical exam, diagnosis, prescriptions, and referral). Green responds by insisting that he should have received the same or equivalent treatment during both visits. Resp. to
Galencare at 5. Green fails to allege facts that make it plausible that Galencare applied a different screening procedure to him than to paying patients. See Crisp, 985 F.3d at 1308. As an initial matter, Green’s reliance on Dr. Flemister’s comments is misplaced for purposes of a failure-to-screen claim, as they do not
relate to the hospital’s ordinary screening procedures for a patient manifesting these symptoms with a similar medical history. That leaves only Green’s allegations about his two visits to support the legal conclusion about differential treatment. Those facts alone do not allow a
court to draw a reasonable inference that Galencare failed to provide the same screening the hospital would have given to a non-indigent patient. See Almanza v. United Airlines, Inc., 851 F.3d 1060, 1071 (11th Cir. 2017) (“On a Rule 12(b)(6) motion to dismiss, the Court does not accept as true unwarranted
deductions of fact.”). First, there is no indication that Green’s insurance status changed between the two visits, yet his treatment differed, which cuts against the plausibility of his claim. Second, Green disputes the course of treatment by Dr.
Flemister that he received on that second visit, initially demanding a new CT scan that was denied. Setting aside that this argument amounts to an attack on the quality of Dr. Flemister’s medical care, which falls outside the scope of EMTALA, it also fails to account for Green’s medical history and prior
treatment for the same injury. Green never alleges facts showing that the ordinary screening for a paying patient who was treated six months earlier for a fall but who continues to experience pain from that accident would receive the same scans as at the initial visit. See generally TAC.
Last, while Green disputes specific parts of the medical records (such as whether he declined an x-ray), Green does not dispute that he agreed with the plan of action by the end of his visit. See id. ¶ 54 (disputing only that Green denied an x-ray). That the orthopedist later declined to provide free treatment
does not mean that the hospital failed to screen Green. See Brown v. E.T. Browne Drug Co., No. 25-11991, 2026 WL 1102525, at *2 (11th Cir. Apr. 23, 2026) (per curiam) (affirming the grant of a motion to dismiss based on information from the plaintiff’s medical records). I dismiss Count I without
prejudice. ii. Failure to Stabilize – Count II Count II also warrants dismissal. To succeed on a stabilization claim, the plaintiff must allege that “(1) the patient had an emergency medical condition;
(2) the hospital knew of the condition; (3) the patient was not stabilized before being transferred; and (4) the hospital neither obtained the patient’s consent to transfer nor completed a certificate indicating the transfer would be beneficial to the patient.” Harry v. Marchant, 291 F.3d 767, 774 (11th Cir.
2002). Green alleges that Galencare failed to provide stabilizing treatment before improperly discharging and transferring him. TAC ¶¶ 59, 65, 69. Galencare argues that Green failed to allege that he suffered from an emergency medical condition, that its screening confirmed he did not, and thus
that the “stabilization” requirement under EMTALA was never triggered. Galencare MTD at 10–11. Again, Galencare has the better argument. First, Green fails to plausibly allege an emergency medical condition. Although Green’s chiropractor
diagnosed “segmental and somatic dysfunction of the thoracic, cervical, and lumbar regions,” Green never explains how this qualifies as an emergency condition under the statute, and it is not otherwise readily clear why it would. See TAC ¶ 61; 42 U.S.C. § 1395dd(e)(1)(A). Further, the medical records cut
against the existence of an emergency. Cf. Gill, 941 F.3d at 514 (“[W]hen exhibits attached to a complaint contradict the general and conclusory allegations of the pleading, the exhibits govern.” (citation modified)). After reviewing Green’s prior scans, Dr. Flemister noted that they “were negative
for acute injuries” and that Green had no “new injuries.” Medical Records at 10. He deduced that Green’s “chief complaint, history, and exam are consistent with chronic neck and back strain.” Id. Even assuming Green had an emergency condition, Green does not
plausibly allege that Dr. Flemister knew of the condition and still declined to stabilize him before discharge. See Matthews, 2026 WL 1230320, at *2. Count II is dismissed without prejudice. iii. Delay of Screening and Treatment – Count III Finally, Count III alleges unlawful delay of screening and stabilizing
treatment. Under 42 U.S.C. 1395dd(h), a hospital “may not delay provision of an appropriate medical screening examination required under subsection (a) or further medical examination and treatment required under subsection (b) in order to inquire about the individual’s method of payment or insurance
status.” Green alleges two distinct violations of this provision, Dr. Flemister’s refusal to provide diagnostic testing or treatment and the orthopedist’s rejection of the “emergency referral” because of “[Green’s] insurance status.”
TAC ¶¶ 76–80. As to the latter, Green maintains that “Galencare is vicariously liable under EMTALA for the conduct of its on-call orthopedist . . . whom the hospital designated to provide follow-up evaluation for emergency patients.” Id. ¶ 85.
Galencare incorporates its argument from Counts I and II that Dr. Flemister conducted a proper screening, and, because he did not identify an emergency condition, EMTALA’s stabilizing requirement was never triggered. See Galencare MTD at 9–11. It also casts the allegation about the orthopedist
as a demand that the hospital “guarantee[] that third party providers . . . treat [Green] on a non-emergent basis free of charge.” Id. at 5–6. Green responds that “Galencare failed to specifically address” Count III, and thus its motion must be denied. Resp. to Galencare MTD at 7.
As to the first theory of Count III, Green fails to allege facts making it plausible that he suffered an emergency medical condition. Thus, Dr. Flemister’s refusal to provide another CT scan could not have triggered the stabilizing requirement. Nor does Green allege facts that allow the court to
draw an inference that Dr. Flemister’s refusal to do another scan was based on or delayed by inquiry into his financial or insurance status. As to the second theory of Count III, Green does not allege facts to state a claim related to the orthopedist. Green alleges that the orthopedist rejected
his “emergency referral” because of his inability to pay. TAC ¶ 78. But per his own allegations, Dr. Flemister had concluded that there was no emergency, so it is not plausible that Dr. Flemister made any such “emergency referral.” See TAC ¶ 14. Indeed, the patient instructions from his visit expressly state that
his exam was “negative for any acute or emergent neck or back conditions” and direct him to the orthopedist for “evaluat[ion] for appropriateness of non- emergent outpatient MRI.” Medical Record at 13 (emphasis added). What is more, Green contacted the orthopedist the day after his visit to
the hospital and then again a month later. See TAC ¶¶ 77, 83. His own allegations about his contacts with the orthopedist undermine any inference that the orthopedist was an extension of his initial hospital visit, assuming without deciding that EMTALA even applies in this outpatient, third-party context. Nor does Green specify what symptoms he had on that day or what he
reported to the orthopedist. Finally, Green fails to provide a non-speculative basis to connect Galencare to the orthopedist as necessary to establish vicarious liability. See TAC ¶ 85 (summarily asserting that the orthopedist “was acting as Galencare’s agent and apparent agent when he refused to accept
[Green’s] emergency referral”). I dismiss Counts I, II, and III without prejudice. C. Negligence – Count IV Green brings a single count of negligence against Galencare and Allied
(Count IV), id. ¶¶ 88–111, and a count of negligence per se (Count V), id. ¶¶ 112–130, which I will address in the next section. Both defendants move to dismiss but underdeveloped their arguments. “A negligence claim has four elements: (1) a duty by defendant to conform
to a certain standard of conduct; (2) a breach by defendant of that duty; (3) a causal connection between the breach and injury to plaintiff; and (4) loss or damage to plaintiff.” Bartsch v. Costello, 170 So. 3d 83, 86 (Fla. 4th DCA 2015). Green alleges that Galencare, Allied, and their employees were negligent
in their respective roles in issuing and posting the BOLO alert. He maintains that the negligence caused “actual identity theft and fraud, loss of employment and income, costs associated with credit monitoring and identity repair, and significant emotional and psychological distress.” TAC ¶ 110.
1. Galencare Green alleges that Galencare had a duty to protect his confidential information, arising from (1) the provider-patient relationship; (2) its role as a supervisor of employees; (3) the parties’ contract; (4) its own policies; (4) and
its role in creating foreseeable harm. Id. ¶¶ 89–94. As one example, Galencare allegedly breached its duties by “instruct[ing] and empower[ing] its agent to execute a retaliatory campaign on its behalf, resulting in the widespread electronic dissemination of the BOLO alert . . . .” Id. ¶ 95.
Galencare summarily raises two challenges. First, it argues that Green’s claim fails to the extent that he alleges a duty (and consequent breach) arising under HIPAA because he cannot “us[e] negligence to create a private right of action under HIPAA.” Galencare MTD at 12. While I have reservations as to
whether Green can state a claim for negligence that is essentially predicated on alleged HIPAA violations, Galencare fails to justify dismissal for failure to allege a duty or breach at this stage. It largely cabins its argument to HIPAA and does not address the theories of duty based on a special relationship, the
creation of a foreseeable risk, or oversight of Allied. Nor does it brief whether the harms were foreseeable or explain how its actions fare under Florida law. Galencare’s second argument is meritorious, although it does not defeat the entire count. Galencare avers that “[Green’s] negligence theory is
premise[d] upon allegations of intentional conduct,” which cannot support a claim for negligence in Florida. Galencare MTD at 11–12. Green does not contest the argument, but insists that Galencare waived this defense by failing to raise it in its first two motions to dismiss. Resp. to Galencare at 8.
But Green’s earlier complaints did not clearly articulate the applicable theory of relief for his negligence claim. The 142-page amended complaint was “replete” with conclusory facts and a maze of legal theories not labeled in the alternative. See, e.g., Am. Compl. ¶¶ 286–308; see also Compl. ¶¶ 300–323. As
a result, they were shotgun pleadings and merited dismissal on this basis alone. See Weiland v. Palm Beach Cnty. Sheriff’s Off, 792 F.3d 1313, 1322 (11th Cir. 2015). Green added allegations of retaliation in his second amended complaint, see 2d. Am. Compl. (Doc. 11) ¶ 95 (“Galencare, acting through the
retaliatory conduct of its management . . . willfully breached its non-delegable duty to supervise . . .”). In response, Galencare raised the intentional tort argument, see (Doc. 69) at 11–12, Galencare MTD at 11–12, and it is properly preserved here.
To that end, I agree with Galencare that “[i]t is inapposite to allege the negligent commission of an intentional tort . . . .” Lewis v. City of W. Palm Beach, Fla., 561 F.3d 1288, 1294 (11th Cir. 2009) (citing City of Miami v. Ross, 695 So.2d 486, 487 (Fla. 3d DCA 1997), and City of Miami v. Sanders, 672 So.2d 46, 48 (Fla. 3d DCA 1996)). To the extent that Green’s claims are premised on
intentional torts, they fail to sound in negligence. This includes the allegation that a Galencare employee purposefully retaliated against Green for filing an EMTALA complaint by initiating the BOLO alert, TAC ¶ 96, and that Galencare “willfully breached its non-delegable duty to supervise [Allied],” id.
¶ 95 (emphasis added). Still, broadly construing the third amended complaint in the light of Green’s pro se status, Green alleges breaches that he does not describe as intentional. See, e.g., id. ¶ 98. I dismiss Count IV as to Galencare to the extent it relies on intentional
torts. Because Galencare does not challenge causation in its motion, I do not reach the issue. Separately, I note that, to the extent Green argues that Galencare’s motion fails because it did not rebut each element, he is mistaken. See Resp.
to Galencare at 7–8. The plaintiff carries the burden to state (and later prove) each element of a claim, and failure to meet just one element will result in dismissal. 2. Allied
According to Green, Allied likewise had a duty to safeguard his information under Florida common law arising from (1) its role as a security provider with access to sensitive information; (2) a special relationship; and (3) a “voluntarily assumed duty” that Allied undertook by marketing its services; and (4) “a foreseeable zone of risk in which [Allied’s] employees could misuse
their access to sensitive information to harm patients.” Id. ¶¶ 100–103. Green alleges that Allied breached these duties by (1) “orchestrat[ing]” a data breach; (2) sending out the BOLO alert; and (3) posting the BOLO alert in the hospital lobby where it was publicly visible for more than a year. Id.
¶¶ 104, 106. As for harm, Green maintains that the “Defendants’ intentional and negligent conduct” caused “actual identity theft and fraud, loss of employment and income, costs associated with credit monitoring and identity repair, and
significant emotional and psychological distress.” Id. ¶ 110. Green attempts to trace the identity theft to the breach through temporal proximity, his lack of a history of data theft, and his efforts to secure his data. Id. ¶ 107. Allied summarily concludes that Green failed to allege a duty, but it
underdevelops this argument and provides no case law to justify dismissal on this basis at this stage. In later briefing, Allied may explain why its role “as a security provider for the Hospital” did not create a duty to act in Green’s interests under the common law, see Allied MTD at 5, and address whether the
alleged visibility of the alert on the wall created a foreseeable zone of risk, see id. at 6. Allied also argues that Green fails to allege causation. Allied MTD at 6– 7. I share Allied’s reservations on causation, but ultimately Allied fails to
persuade at this preliminary stage. See Resnick v. AvMed, Inc., 693 F.3d 1317, 1327 (11th Cir. 2012). I agree that Green fails to plausibly allege facts to support a “data breach” or that Allied or Galencare misused his social security number. See Allied MTD at 6. But Allied provides insufficient argument at this
stage to divorce its actions entirely from the Facebook posting, and does not address the standards for intervening or superseding causes in Florida. And while I have questions as to whether a driver’s license alone is sufficient for a fraudster to open a credit card account, the parties do not address why this
personal information alone cannot contribute to identity theft. Thus, I only dismiss Count IV to the extent Green’s claim depends on intentional torts. B. DPPA – Counts V–VI Green alleges that Galencare and Allied are liable for their employees’
violations under the DPPA (Count V) and that they committed negligence per se based on the DPPA violations (Count VI). I dismiss both counts with prejudice. According to Green, Galencare violated the DPPA when the hospital
manager directed security to issue a BOLO alert with Green’s license, and that Allied did the same when its employee issued the alert. See TAC ¶¶ 112–130. Galencare and Allied argue that the DPPA does not apply because the hospital obtained a copy of the license from Green, not a state department of motor vehicles. Galencare MTD at 15–16; Allied MTD at 8. Green disputes the legal
argument but does not contest that he shared his license with the hospital. See Resp. to Galencare at 9–10. Under the DPPA, “[a] person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted
under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.” Siegler v. Best Buy Co. of Minn., 519 F. App’x 604, 604–5 (11th Cir. 2013) (per curiam) (quoting 18 U.S.C. § 2724(a)).
I agree with the defendants that, based on its text and structure, the Act “prohibit[s] only the disclosure or redisclosure of information originating from state department of motor vehicles (“DMV”) records.” Id. at 605 (“The thrust of the Act is contained in § 2721, which prohibits a state DMV, and any officer,
employee, or contractor thereof, from knowingly disclosing ‘personal information’ . . . contained in motor vehicle records . . . .”); see also id. (explaining why this interpretation is most consistent with the Supreme Court’s opinion in Reno v. Condon, 528 U.S. 141 (2000)).
I dismiss Counts V and VI with prejudice because amendment would be futile. See Silberman v. Miami Dade Transit, 927 F.3d 1123, 1133 (11th Cir. 2019). D. Breach of Express Contract – Count VII Green also brings a breach of express contract claim against Galencare
(Count VII). A claim for breach of contract requires “(1) a valid contract; (2) a material breach; and (3) damages.” Abbott Lab’ys, Inc. v. Gen. Elec. Cap., 765 So. 2d 737, 740 (Fla. 5th DCA 2000). Green alleges that Galencare agreed not to share his private information
apart from specific exceptions when Green signed its “Conditions of Admission and Consent for Outpatient Care” form during his March 9 visit. TAC ¶ 144; see Conditions of Admission (COA) (Doc. 67). Green points to two provisions in the COA. The first, entitled “Use and
Disclosure of Information,” provides that “I . . . consent to my health information being used and disclosed for public health and other purposes permitted by applicable law.” COA ¶ 18. Green maintains that, by including the phrase “permitted by applicable law,” the COA “incorporated federal and
state privacy statutes, including HIPAA, the [DPPA], and applicable Florida confidentiality laws, both by operation of law and by the contract’s express language.” TAC ¶ 145. The second provision Green invokes is a consent to the use of certain
recordings: Consent to Photographs, and Video, Digital and Audio Recording. I consent to photographs, video, digital or audio recordings, and/or images of me being recorded for patient care, healthcare operations, security purposes, and/or the hospital’s quality improvement and/or risk management activities. I understand that the facility retains the ownership rights to the images and/or recordings. . . . I understand that these images and/or recordings will be securely stored and protected. Images and/or recordings in which I am identified will not be released and/or used outside of the facility without a specific written authorization from me or my legal representative unless otherwise required by law.
COA ¶ 7 (emphasis added). Green argues that Galencare breached the first provision when an Allied employee posted his driver’s license in the hospital lobby, and that it breached the second when the Allied employee sent his driver’s license photograph to other HCA facilities without his express permission. TAC ¶¶ 152–53. Galencare responds that Green’s “claim is merely a disguised claim under HIPAA and Florida state privacy laws that do not create a private cause of action,” that HIPAA permits the hospital to use Green’s “information for healthcare operations and security purposes,” and that Green in fact consented to use for these purposes. Galencare MTD at 17–18. Galencare cites Brush v. Miami Beach Healthcare Group Ltd., in which the court concluded that patient rights and privacy notices did not create “a contractual duty to protect [the plaintiff’s] private information.” 238 F.Supp.3d 1359, 1367 (S.D. Fla. 2017).The court reasoned that the provisions were “not contractual in nature” and merely described the hospital’s legal duties. Id. Further, because HIPAA did not create a private right of action and required compliance “without receiving any consideration,” the provisions could not “create contractual obligations.” Id.
To be sure, Brush is not on all fours here as the form at issue was merely a notice and not a contract. See Harris v. Progress Residential Mgmt. Servs., No. 6:24-CV-859-CEM-DCI, 2026 WL 964851, at *6 (M.D. Fla. Jan. 26, 2026) (distinguishing Brush in a breach-of-contract case because, “unlike here, [in
Brush] there was no written contract in which the Notice was incorporated, and Plaintiff paid no consideration for the Notice—it simply was not a contract”). Still, I am persuaded that Brush’s conclusions apply here. Green plainly fails to state a claim on the theory that the contract incorporated
privacy laws. “[E]very circuit to have considered the issue has also held that no private right of action exists under HIPAA.” Laster v. CareConnect Health Inc., 852 F. App’x 476, 478 (11th Cir. 2021) (per curiam). HIPAA generally requires that medical facilities seek consent to disclose protected information.
See 45 C.F.R. § 164.508(a)(1) (“Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section.”). Green does not explain how an affirmative consent from Green transforms into an
express prohibition on Galencare to violate unspecified laws. I dismiss Count VII without prejudice to the extent it is premised on a violation of state or federal law. That leaves Green with the theory that Galencare released his driver’s license photograph outside the “facility” when the Allied employee sent the
BOLO to security personnel at other HCA emergency rooms. Galencare incorporates its HIPAA argument and maintains that its actions were permitted by Green’s consent to use his photograph for “healthcare operations, security purposes, and/or the hospital’s quality improvement and/or risk
management activities.” See Galencare MTD at 17. To this Green responds that “[t]he phrase ‘will not be released’ operates as a standalone contractual promise—an absolute prohibition on disclosure absent written consent or legal compulsion.” Resp. to Galencare at 12.
Neither party explains why a copy of Green’s driver’s license qualifies as a “recorded” image under the COA or whether sending an internal security alert qualifies as sharing the image outside the “facility.” Nor do they explain whether Galencare can be held liable for the actions of Allied employees.
Absent additional briefing, I decline to dismiss Count VII to the extent it is premised on breach of this section of the COA. Last, I have serious doubts as to whether the contract indicates agreement to create enforceable rights that circumvent HIPAA’s failure to
create a private cause of action. Moving forward, both parties should elaborate on whether this provision merely restates HIPAA obligations, and, if so, whether it could be an enforceable contractual term under federal and Florida law. See Koung v. Giordano, 346 So. 3d 108, 116 (Fla. 1st DCA 2022) (“[A] demand that State Farm perform as it was statutorily required to do could not
have been a negotiated or bargained-for term of contract.”). E. Breach of Implied Contract – Count VIII Green pleads breach of implied contract (Count VIII) in the alternative to Count VII. TAC ¶ 161. “A contract implied in fact is ‘founded upon a meeting
of the minds, which, although not embodied in an express contract, is inferred, as a fact, from the conduct of the parties showing, in the light of the surrounding circumstances, their tacit understanding.’ ” Glob. Network Mgmt., LTD. v. Centurylink Latin Am. Sols., LLC, 67 F.4th 1312, 1318 (11th Cir. 2023)
(quoting Hercules Inc. v. United States, 516 U.S. 417, 424 (1996)). Green alleges that he and Galencare formed an implied contract when he accepted its “offer[] to provide healthcare services” that “required [him] to provide his sensitive and private information,” TAC ¶ 162, though he does not
specify the nature of this requirement. Further, Green asserts that he had a “reasonable expectation[] that” Galencare would protect his patient information based on its “Privacy Notice, Code of Conduct, and internal policies,” which specified when and how Galencare would use his sensitive
information. Id. ¶¶ 163–65. Galencare responds that these notices are not “contractual in nature,” and merely restate Galencare’s obligations under HIPAA. See Galencare MTD at 18–19. I agree that dismissal is warranted. Green provides no allegations that “give[] rise to a factual inference that [Galencare] tacitly agreed to secure
[Green’s] personal data in exchange for remuneration.” See Brush, 238 F. Supp. 3d at 1369. His “allegations reveal only that [he] provided [his] personal information as required to receive healthcare services from [Galencare]—not data security services beyond the privacy requirements already imposed on
Defendants by federal law.” In re Fortra File Transfer Software Data Sec. Breach Litig., 749 F. Supp. 3d 1240, 1266 (S.D. Fla. 2024) (citation modified); see also Ramirez v. Paradies Shops, LLC, 69 F.4th 1213, 1221 (11th Cir. 2023) (affirming the dismissal of an implied contract claim in a data breach case). I
also note that “a court will not imply a contract in fact where there is an express agreement addressing the matter at hand.” Centurylink, 67 F.4th at 1318–19. I dismiss Count VIII without prejudice. F. Invasion of Privacy – Count IX
Green sues both defendants for common law invasion of privacy through the public disclosure of private facts (Count IX). TAC ¶¶ 172–182. The claim against Galencare is based on the allegation that a Galencare employee directed the security manager to issue an alert with Green’s driver’s license
and “permit[ed] it to be posted in a location accessible to the public.” Id. ¶¶ 174–75. The claim against Allied is based on the posting of Green’s driver’s license in the hospital lobby and the failure to remove it. Id. ¶¶ 174–76. “In order to state a claim for public disclosure of private facts, a plaintiff must show (1) the publication, (2) of private facts, (3) that are offensive, and
(4) are not of public concern.” Harmatz v. County of Charlotte, No. 2:25-CV- 342-SPC-DNF, 2026 WL 171748, at *7 (M.D. Fla. Jan. 22, 2026) (citation modified). Galencare argues that Green fails to state a claim because he “does not
allege what [] private facts were . . . revealed[] beyond his driver’s license information,” the disclosure of which to security personnel “cannot amount to objectively highly offensive conduct.” Galencare MTD at 20. Green maintains that Galencare waived these arguments under Rule 12(g) by not raising them
in its motion to dismiss his amended complaint. Resp. to Galencare MTD at 14. But, as with his negligence claim, Green’s invasion-of-privacy claim did not clearly demonstrate the applicable theory of relief in his amended complaint. Rather, it included what appeared to be an additional claim under the DPPA.
See Am. Compl. ¶ 351 (arguing that Galencare tortiously invaded Green’s privacy by publishing information that “falls squarely within the protections of the Driver’s Protection Act”). Thus, the amended complaint was a shotgun pleading, meriting dismissal on this basis alone. See Robinson v. United States,
No. 24-12513, 2024 WL 4866864, at *2 (11th Cir. Nov. 22, 2024) (per curiam) (explaining that a shotgun complaint includes “a complaint which fails to separate each clam for relief into a different count” (citing Weiland, 792 F.3d at 1321–23), cert. denied, 146 S. Ct. 1496 (2026), reh’g denied, 146 S. Ct. 1823 (2026)). To demand that Galencare parse a 142-page, 447-paragraph, shotgun
pleading that conflates causes of action, amend twice more, and then invoke Rule 12(g) is a misuse of the Federal Rules. Galencare raised the argument in its motions to dismiss the second and third amended complaints, and it is properly preserved in this circumstance. See (Doc. 69) at 19; Galencare MTD
at 20. Turning to the merits, Green responds that “a driver’s license and the identifiers contained therein” qualify as information that is, “[b]y its very nature . . . private,” and its disclosure “offensive.” Resp. to Galencare MTD at
14. This conclusory assertion bypasses the context of the disclosure. A Galencare employee directed a security manager to send an alert, which included information that Green himself had shared with the hospital. TAC ¶ 20, 23, 25; see id. ¶ 162. What is more, the alert instructed personnel to share
the information in discrete locations with other hospital personnel. Id. ¶ 23. Green fails to explain how this qualifies as an intentional, highly offensive disclosure under Florida law. See Rowell v. Holt, 850 So. 2d 474, 478 n.1 (Fla. 2003) (explaining that invasion of privacy is an intentional tort).
Allied also moves to dismiss this count on the ground that Green “failed to show that Allied published the Security Alert to the public at large.” Allied MTD at 10. It quotes the directive that the alert be “posted where it can be seen only by security and/or ED leadership at the FSEDs.” Id. Green responds that Allied “ignores [his] additional theories, including electronic
dissemination across HCA facilities and the year-long lobby posting.” Resp. to Allied at 12. The tort of publicity “requires that a matter be ‘made public, by communicating it to the public at large, or to so many persons that the matter
must be regarded as substantially certain to become one of public knowledge.’ ” Hunstein v. Preferred Collection & Mgmt. Servs., Inc., 48 F.4th 1236, 1246– 47 (11th Cir. 2022) (citation modified) (explaining that the “dissemination of information to many people is one way publicity can occur[,] [b]ut a disclosure
to many people may still be private, or at least not ‘publicity.’ ”) For the reasons explained above, Green alleges no facts to indicate that Allied intentionally disclosed his information to the public at large by issuing an internal alert and placing it behind a security desk for security personnel
to review. See Farmer v. Humana, Inc., 582 F. Supp. 3d 1176, 1188 (M.D. Fla. 2022) (dismissing an invasion-of-privacy claim when the plaintiff failed to allege the intentional disclosure of “[personal identifying information] and [personal health information] to unauthorized persons”); cf. Cowans v.
Maximus Educ. LLC, 417 So. 3d 356, 357 (Fla. 4th DCA 2025) (holding that disclosing a loan holder’s account information “to a credit reporting agency is more narrowly focused than the public disclosure contemplated by the tort”), reh’g denied (Aug. 28, 2025), review denied, No. SC2025-1526, 2025 WL 3707672 (Fla. Dec. 22, 2025). I dismiss Count IX without prejudice.
G. Defamation by Implication – Count X Green alleges that Galencare and Allied defamed him by implication through the BOLO alert. TAC ¶¶ 183–85. Both defendants argue that Green fails to state a claim. Allied MTD at 10–13; Galencare MTD at 20–22. I agree
and dismiss Count X without prejudice. “To prove defamation under Florida law, a plaintiff must establish the following elements: (1) publication; (2) falsity; (3) actor must act with knowledge or reckless disregard as to the falsity on a matter concerning a
public official, or at least negligently on a matter concerning a private person; (4) actual damages; and (5) statement must be defamatory.” Johnston v. Borders, 36 F.4th 1254, 1275 (11th Cir. 2022) (per curiam) (citation modified). “[L]iterally true statements” can be actionable as defamation by implication
when “conveyed in such a way as to create a false impression.” Jews For Jesus, Inc. v. Rapp, 997 So. 2d 1098, 1108 (Fla. 2008). “But even if the statements are defamatory by implication, a defendant is still protected from suit if his statements qualify as an opinion . . . .” Turner v. Wells, 879 F.3d 1254, 1269
(11th Cir. 2018). “Words are defamatory under Florida law when “they tend to subject one to hatred, distrust, ridicule, contempt or disgrace or tend to injure one in one’s business or profession.” Johnston v. Borders, 36 F.4th 1254, 1275 (11th Cir. 2022) (citation modified). “Whether the defendant’s statements constitute
defamation by implication is a question [of] law for the court to determine” unless “the publication is susceptible of two reasonable interpretations, one of which is defamatory.” Turner, 879 F.3d at 1269. Green argues that the alert created the “false” impression that he “had
committed a crime, posed a physical or security threat, or otherwise warranted surveillance or avoidance.” TAC ¶¶ 185, 189. He contends that the alert “omitt[ed] the material fact that [he] had filed a lawful EMTALA complaint after being denied treatment.” Id. ¶ 186. And he contests the description of him
as “angered” when his “patient record describe[s] [him] as ‘cooperative’ and ‘asking questions.’ ” Id. ¶ 186. I agree that Green has not shown that “literally true statements” were “arranged to convey a false and defamatory gist.” See Resp. to Galencare at 15.
Green’s EMTALA complaint and $200,000 demand reasonably demonstrated that he was dissatisfied with his treatment and that caution may be warranted. See Galencare MTD at 21. The mere issuance of the alert did not indicate that Green had committed a crime. See Johnston, 36 F.4th at 1275
(quoting Loeb v. Geronemus, 66 So. 2d 241, 245 (Fla. 1953)) (“ ‘The publication made should be construed as the common mind would understand it,’ and not ‘in their mildest or most grievous sense.’ ”). Likewise, looking at the statement as a whole, the instruction to keep the alert private cuts against concluding that Galencare or Allied intentionally published his information to a third
party distinct from hospital and security personnel. See Allied MTD at 10–11 (“[T]he Security Alert itself states it was not to be published beyond ‘security and/or ED leadership at the [freestanding emergency departments].”). Count X is dismissed without prejudice.
H. Vicarious Liability – Count XI Green titles Count XI “Vicarious Liability.” He seeks to hold the defendants “vicariously liable for the tortious conduct committed by their employees and agents acting within the course and scope of their employment,”
but does not specify the underlying tort. TAC ¶ 194. His response briefing indicates that he intends to incorporate all of the tort claims into this count. See Resp. to Galencare at 16. This claim is duplicative of the others that include vicarious liability theories and is otherwise not necessary. See Gentry v. Prell,
No. 5:25-CV-50-RBD-PRL, 2025 WL 3080108, at *1 (M.D. Fla. July 3, 2025) (“[V]icarious liability need not be pled separately when it is brought against a corporate defendant, which can only act through its employees.”) (citing Nguyen v. Persp. Glob., LLC, 387 So. 3d 1265, 1269 (Fla. 2d DCA 2024)). I
dismiss Count XI without prejudice. I. Breach of Confidence – Count XII Count XII is a “breach of confidence” claim against both Galencare and
Allied. Green argues that Galencare breached its common-law “duty of confidence arising from the[] provider-patient relationship.” TAC ¶¶ 207, 211. He avers that the duty is defined by Galencare’s own code of conduct and HIPAA, which “represent[s] a widely accepted benchmark of confidentiality.”
Id. ¶¶ 208, 215. Galencare allegedly breached this duty when it “intentionally caused and allowed” the retaliatory publication of Green’s personal information. Id. ¶ 210. Galencare and Allied argue that Count XII fails because it is a disguised
HIPAA claim. Galencare MTD at 23–24. Green insists that the tort exists under Florida common law and cites Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 932 (11th Cir. 2020) (en banc). Resp. to Galencare at 17. Muransky offers little support. In that case, the plaintiff, who was suing
under a federal consumer protection law, argued that he had standing because his harm was “analogous to a common-law breach of confidence tort.” Muransky at 931. The Court assumed for the sake of deciding that the tort “was traditionally redressable in English and American common-law courts,”
a question that did not concern Florida tort law, specifically. Id. at 931–32. Indeed, it did not cite any cases from Florida courts in its analysis. See id. at 932. Without case law from Green to show that a “breach of confidence” claim is actionable in Florida (let alone its contours), I dismiss Count XII without
prejudice. J. Title VI – Counts XIII–XIV Green alleges that Galencare violated Title VI by denying him diagnostic imaging based on his race (Count XIII) and retaliating against him for filing
an EMTALA complaint by publicizing his unredacted driver’s license (Count XIV). TAC ¶¶ 222–50. Oddly, Galencare moves to dismiss the Title VI counts on one ground only—that Green fails to allege that Galencare received federal funds.
Galencare MTD at 25. This is incorrect. Under Count XIII, Green alleges that Galencare received Medicare and Medicaid funds that it used at its emergency departments. TAC ¶ 224. While the funding allegation is more conclusory in Count XIV, it is sufficient in the light of Green’s pro se status and allegations
elsewhere in the complaint. See id. ¶ 244. Galencare offers no argument or citation as to why the definitions of “program or activity” or federal financial assistance are not met here. As a result, it fails to assert a basis to dismiss Counts XIII and XIV.
Regarding Count XIII, Galencare does not challenge whether Green otherwise states a claim for discrimination or discuss Dr. Flemister’s conclusion that imaging was not medically indicated. For Count XIV, because Galencare does not question whether filing of an EMTALA complaint qualifies as a “protected activity” under Title VI, I do not reach that question. It may
raise these and other arguments in a later motion. See FED. R. CIV. P. 12(c). K. Civil Conspiracy – Count XV Last, Green alleges that Galencare and Allied conspired to retaliate against him for filing an EMTALA complaint “by unlawfully accessing, using,
and disseminating his confidential information.” TAC ¶ 251. “To establish a civil conspiracy claim, [a plaintiff] must plead sufficient facts that show (1) an agreement between two or more parties, (2) to do an unlawful act or to do a lawful act by unlawful means, (3) the doing of some overt act in pursuance of
the conspiracy, and (4) damage to plaintiff as a result of the acts done under the conspiracy.” ECB USA, Inc. v. Savencia Cheese USA, LLC, 148 F.4th 1332, 1347 (11th Cir. 2025) (citation modified). This claim fails as Green does not “allege any specific underlying claim
that survives as a cause of action” to provide a derivative civil conspiracy claim. Galencare MTD at 25. Under Green’s theory, the “[d]efendants conspired to commit multiple unlawful acts,” including invasion of privacy, breach of confidence, negligence, and violations of the DPPA. TAC ¶ 253. But as
previously explained, Green fails to plausibly allege that the defendants intended to invade his privacy or breach the DPPA, breach of confidence is not a cause of action in Florida, and “[i]t is inapposite to allege the negligent commission of an intentional tort,” Lewis, 561 F.3d at 1294.
What is more, Green “failed to allege the existence of an agreement . . . to complete an unlawful act.” Allied MTD at 15. All that Green plausibly alleges is that the defendants coordinated a security alert, but “[i]t requires too great a speculative leap” to conclude that the hospital personnel agreed to violate the
law in some other way. See United Techs. Corp. v. Mazer, 556 F.3d 1260, 1282 (11th Cir. 2009). I dismiss Count XV without prejudice. IV. CONCLUSION
Accordingly, the following is ORDERED: 1. This case is UNSTAYED. The Court will enter an amended case management and scheduling order detailing the remaining deadlines.
2. The Motions to Dismiss (Docs. 79 and 81) are GRANTED IN PART and DENIED IN PART. 3. The following counts from the Third Amended Complaint (Doc. 76) are DISMISSED WITHOUT PREJUDICE: Counts I–III, Count
IV to the extent it depends on intentional torts, Count VII to the extent it depends on incorporation of privacy laws, Counts VIII– XII, and Count XV. 4, Counts V and VI are DISMISSED WITH PREJUDICE. 5. The defendants must file a responsive pleading to the remaining counts in the Third Amended Complaint no later than July 29, 2026. ORDERED in Tampa, Florida, July 15, 2026.
= ‘mph Mizelle United States District Judge