Hancock v. Cnty. of Rensselaer
882 F.3d 58
2d Cir.2018Background
- Rensselaer County Jail nurse Elaine Young received Samaritan Hospital credentials that gave broad electronic access to patient medical records; she agreed in writing to preserve patient confidentiality.
- Young taped her login/password in a nurses' desk; that account was used to view medical records of multiple non-inmate patients, including several Jail employees (the appellants).
- Samaritan discovered the unauthorized accesses, deactivated the account, and notified affected patients; the County investigated but no criminal prosecutions followed.
- Appellants sued under 42 U.S.C. § 1983 (Fourteenth Amendment privacy violation) and the Computer Fraud and Abuse Act (CFAA); the district court dismissed the CFAA claims and later granted summary judgment for defendants on the § 1983 claim, concluding appellants’ conditions were insufficiently serious/stigmatizing to support a privacy right.
- On appeal, the Second Circuit affirmed dismissal of the CFAA claims but vacated and remanded the § 1983 ruling, holding that medical privacy is categorically protected (with varying strength) and that the district court erred by treating seriousness/stigma as a threshold bar rather than one factor in balancing.
- The Court instructed the district court on remand to weigh the government interests and actors’ intent under the appropriate substantive due process test and to consider qualified immunity for individual defendants.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Do appellants state a viable CFAA claim? | Unauthorized access to medical records caused injury/deterrence qualifying under CFAA subclauses (economic loss or impairment of medical care). | Appellants failed to plead the economic damages required by §1030(c)(4)(A)(i)(I) and alleged harms under (II) are speculative. | Affirmed dismissal: plaintiffs did not plead the required economic damages nor plausible impairment-of-care facts. |
| Does the Fourteenth Amendment protect privacy in the medical records at issue? | Medical records implicate a constitutional privacy right; any intrusion must be weighed against government interest; even non-stigmatizing conditions can be protected. | Defendants argued only sufficiently serious/stigmatizing conditions are entitled to constitutional protection (per district court reading of Matson). | Vacated district judgment: medical privacy is categorically protected; seriousness/stigma affect strength of interest but are not a threshold gate. |
| What standard governs executive intrusions into medical records of non-prisoner employees? | Apply substantive due process balancing (shocks-the-conscience) for executive actions; consider actors' intent and context. | Implicit defense relied on limited privacy interests for non-stigmatizing conditions to justify disclosure. | Court requires shocks-the-conscience analysis for executive intrusions here; even weak privacy interests can preclude malicious/egregious breaches. |
| Is qualified immunity available to individual defendants? | Plaintiffs contend defendants are liable if they violated clearly established privacy rights. | Defendants assert qualified immunity; district court did not reach the issue. | Remanded for district court to consider qualified immunity in light of the clarified rule and factual record. |
Key Cases Cited
- Matson v. Bd. of Educ. of City Sch. Dist. of N.Y., 631 F.3d 57 (2d Cir. 2011) (discussing balancing of privacy interest and government disclosure for employee medical information)
- O'Connor v. Pierson, 426 F.3d 187 (2d Cir. 2005) (articulating due process "shocks-the-conscience" standard for executive action)
- Whalen v. Roe, 429 U.S. 589 (1977) (recognizing individual interest in avoiding disclosure of personal medical matters)
- Nat'l Aeronautics & Space Admin. v. Nelson, 562 U.S. 134 (2011) (assumed constitutional protection for certain privacy interests in personal information)
- Doe v. City of New York, 15 F.3d 264 (2d Cir. 1994) (recognizing privacy interest in health information and balancing test)
- Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007) (pleading standard requiring claims be plausible)