Justin Laster v. CareConnect Health Inc.

USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 1 of 8

[DO NOT PUBLISH]

IN THE UNITED STATES COURT OF APPEALS

FOR THE ELEVENTH CIRCUIT

________________________

No. 20-14726

Non-Argument Calendar

________________________

D.C. Docket No. 1:20-cv-00137-LAG

JUSTIN LASTER,

Plaintiff - Appellant,

versus

CARECONNECT HEALTH INC.,

GRADY MEMORIAL HOSPITAL

CORPORATION,

AMERICUS & SUMTER COUNTY

HOSPITAL AUTHORITY,

PHOEBE SUMTER MEDICAL CENTER,

PHOEBE PUTNEY HEALTH SYSTEM, et al.,

Defendants - Appellees.

________________________

Appeal from the United States District Court

for the Middle District of Georgia

________________________

(April 20, 2021)

USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 2 of 8

Before MARTIN, ROSENBAUM, and BRANCH, Circuit Judges.

PER CURIAM:

Justin Laster, proceeding pro se, filed a lawsuit alleging the unlawful

disclosure of his protected health information. According to Laster’s complaint, he

suffered an injury in May 2019 while working for the Georgia Department of

Corrections (“DOC”). In the months that followed, he sought medical care at various

healthcare facilities, and he filed a workers’ compensation claim and a release

authorizing the disclosure of medical records related to that claim. The DOC

contested the claim, and the Georgia Department of Administrative Services denied

it in September 2019. At that point, in Laster’s view, his medical release terminated.

But according to Laster, after the denial of his claim, his medical providers

unlawfully disclosed his medical records to a law firm acting on behalf of the State

of Georgia and the Department of Administrative Services. It appears that the law

firm sought his medical records after he requested a hearing on his workers’

compensation claim before an Administrative Law Judge.

Based on these facts, Laster alleged violations of Georgia state law and his

federal rights under 18 U.S.C. §§ 241, 245, and 246; the Health Insurance Portability

and Accountability Act of 1996 (“HIPAA”), 42 U.S.C. § 1320d-6; the Public Health

Service Act, 42 U.S.C. § 290dd-2, and accompanying regulations, 42 C.F.R. §§ 2.13

and 2.31; and 42 U.S.C. § 1983.

2

USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 3 of 8

Because Laster requested leave to proceed in forma pauperis, the district court

screened Laster’s complaint under 28 U.S.C. § 1915(e)(2) and sua sponte dismissed

it without prejudice for failure to state a viable claim. The court found that Laster

failed to state a claim under Title 18, HIPAA, and the Public Health Service Act

because those statutes did not create a private cause of action. As for the § 1983

claims, the court concluded that the defendants were private actors not subject to

liability under § 1983. Finally, the court declined to exercise supplemental

jurisdiction over the state-law claims. The court gave Laster thirty days to file an

amended complaint.

Laster chose to appeal instead of filing an amended complaint. See Briehler

v. City of Miami, 926 F.2d 1001, 1002 (11th Cir. 1991) (“[A] plaintiff has the choice

either of pursuing a permissive right to amend a complaint after dismissal or of

treating the order as final and filing for appeal.” (quotation marks omitted)). On

appeal, he largely restates his allegations and contends that the defendants are not

immune from liability because they are subject to Georgia state law and federal law.

We review de novo the sua sponte dismissal of an action for failure to state a

claim, accepting the allegations in the complaint as true. Brown v. Johnson, 387

F.3d 1344, 1347 (11th Cir. 2004). And because Laster is proceeding pro se, we

liberally construe his filings. See Erickson v. Pardus, 551 U.S. 89, 94 (2007).

3

USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 4 of 8

Dismissal for failure to state a claim under 28 U.S.C. § 1915(e)(2) is governed

by the same standard as dismissal for failure to state a claim under Rule 12(b)(6),

Fed. R. Civ. P. Mitchell v. Farcass, 112 F.3d 1483, 1490 (11th Cir. 1997). To

survive a motion to dismiss under Rule 12(b)(6), the complaint must “contain

sufficient factual matter, accepted as true, to state a claim to relief that is plausible

on its face.” Am. Dental Ass’n v. Cigna Corp., 605 F.3d 1283, 1289 (11th Cir. 2010)

(quotation marks omitted). That means the complaint’s factual allegations, accepted

as true, “must be enough to raise a right to relief above the speculative level.” Bell

Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007).

Here, the district court correctly dismissed Laster’s claims under Title 18, the

Public Health Service Act, and HIPAA because these statutes do not create private

rights of action. “[P]rivate rights of action to enforce federal law must be created by

Congress.” Alexander v. Sandoval, 532 U.S. 275, 286 (2001). The critical question

is whether the statute “displays an intent to create not just a private right but also a

private remedy.” Id. Without such Congressional intent, “a cause of action does not

exist and courts may not create one, no matter how desirable that might be as a policy

matter, or how compatible with the statute.” Id. at 286–87.

For starters, Laster cannot rely on 18 U.S.C. §§ 241, 245, and 246 because

these sections pertain to criminal law and do not provide a civil cause of action or

any civil remedies. See Hanna v. Home Ins. Co., 281 F.2d 298, 303 (5th Cir. 1960)

4

USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 5 of 8

(“The sections of Title 18 may be disregarded in this suit. They are criminal in nature

and provide no civil remedies). 1

Nor is a private right of action created by 42 U.S.C. § 290dd-2, under which

42 C.F.R. §§ 2.13 and 2.31 were promulgated. Section 290dd-2 limits the disclosure

of records of substance-abuse programs and provides for criminal penalties for those

who violate the act. But nothing in the language of that statute “suggests that

Congress intended to create a private right of action for violations of the

confidentiality provision.” Ellison v. Cocke Cnty., Tenn., 63 F.3d 467, 470 (6th Cir.

1995). Rather, the language reflects that “Congress intended the statute to be

enforced through the imposition of criminal penalties.” Id.; see also Doe v.

Broderick, 225 F.3d 440, 446–49 (4th Cir. 2000) (holding that § 290dd-2 does not

create a federally-enforceable private right); Chapa v. Adams, 168 F.3d 1036, 1038

(7th Cir. 1999) (holding that § 290dd-2 does not create a private cause of action for

damages).

Likewise, every circuit to have considered the issue has also held that no

private right of action exists under HIPAA. See Meadows v. United Servs., Inc., 963

F.3d 240, 244 (2d Cir. 2020); Faber v. Ciox Health, LLC, 944 F.3d 593, 596–97 (6th

Cir. 2019); Stewart v. Parkview Hosp., 940 F.3d 1013, 1015 (7th Cir. 2019); Dodd

1

This Court adopted as binding precedent all Fifth Circuit decisions prior to October 1,

1981. Bonner v. City of Prichard, 661 F.2d 1206, 1209 (11th Cir. 1981) (en banc).

5

USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 6 of 8

v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Wilkerson v. Shinseki, 606 F.3d 1256,

1267 n.4 (10th Cir. 2010); United States v. Streich, 560 F.3d 926, 935 (9th Cir.

2009); Acara v. Banks, 470 F.3d 569, 570–71 (5th Cir. 2006). HIPAA generally

prohibits the disclosure of medical records without a patient’s consent. See 42

U.S.C. §§ 1320d-1 to 1320d-7. While it provides civil penalties for improper

disclosures of medical information, it does not expressly create a private cause of

action to enforce the prohibition on disclosure. Instead, it limits enforcement of the

statute to the Secretary of the Department of Health and Human Services. See 42

U.S.C. § 1320d-5. For that reason, no private right of action can be implied. “By

delegating enforcement authority to the Secretary of the Department of Health and

Human Services, the statute clearly reflects that Congress did not intend for HIPAA

to create a private remedy.” Meadows, 963 F.3d at 244; see Alexander, 532 U.S. at

290 (“The express provision of one method of enforcing a substantive rule suggests

that Congress intended to preclude others.”). Accordingly, Laster cannot state a

claim to relief under HIPAA.

We also affirm the district court’s dismissal of Laster’s § 1983 claims for

violations of his rights under the Fourteenth Amendment. Section 1983 allows

claims against any person who, acting under color of state law, deprives another of

a constitutional or federal statutory right. 42 U.S.C. § 1983.

6

USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 7 of 8

To establish a § 1983 claim, the plaintiff must show that he was (1) deprived

of a federal right (b) by a “state actor.” Harvey v. Harvey, 949 F.2d 1127, 1130

(11th Cir. 1992). “Only in rare circumstances can a private party be viewed as a

‘state actor’ for section 1983 purposes.” Id. To be considered a state actor for

purposes of § 1983, a private party must have exercised a traditionally exclusive

public function, acted in concert with public officials, or engaged in conduct

compelled by the state. Id. at 1130–31; see Focus on the Family v. Pinellas Suncoast

Transit Auth., 344 F.3d 1263, 1277 (11th Cir. 2003); Bendiburg v. Dempsey, 909

F.2d 463, 468 (11th Cir. 1990).

The district court concluded that the defendants were private parties who

could not be considered “state actors” based on the allegations in Laster’s complaint.

Laster responds that the defendants are subject to suit under § 1983 “because they

are for profit corporations, non-profit corporations, limited liability corporations,

limited liability partnerships, etc. and are subject to Georgia State Law and United

States Federal Law as private individuals are.” But that the defendants are regulated

by and subject to state and federal law is not enough on its own to show that they

acted “under color of law”—that is, that their conduct “may be fairly treated as that

of the State itself.” See Jackson v. Metro. Edison Co., 419 U.S. 345, 350–51 (1974)

(“The mere fact that a business is subject to state regulation does not by itself convert

its action into that of the State for purposes of the Fourteenth Amendment.”).

7

USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 8 of 8

Accordingly, we affirm the district court’s conclusion that Laster failed to plausibly

establish that he was harmed by a “state actor” subject to suit under § 1983.

Finally, the district court did not abuse its discretion by declining to exercise

supplemental jurisdiction over Laster’s state-law claims after dismissing all his

federal claims early in the case. See Parker v. Scrap Metal Processors, Inc., 468

F.3d 733, 738 (11th Cir. 2006) (“We review the district court’s decision not to

exercise supplemental jurisdiction for abuse of discretion.”). A district court has

“supplemental jurisdiction” over state-law claims that are closely related to a claim

over which the court has original jurisdiction. 28 U.S.C. § 1367(a). But the court

may decline to exercise supplemental jurisdiction if it “has dismissed all claims over

which it has original jurisdiction.” Id. § 1367(c).

Here, the district court properly declined to exercise supplemental jurisdiction

over Laster’s state-law claims. Laster does not suggest any independent basis for

exercising federal jurisdiction over the state-law claims, and “[w]e have encouraged

district courts to dismiss any remaining state claims when, as here, the federal claims

have been dismissed prior to trial.” Raney v. Allstate Ins. Co., 370 F.3d 1086, 1088–

89 (11th Cir. 2004). Accordingly, the district court did not abuse its discretion in

declining to exercise supplemental jurisdiction over the remaining claims.

AFFIRMED.

8