308 F. Supp. 3d 14
D.C. Cir.2018Background
- Pro se plaintiff sued USPC Chair J. Patricia Smoot and two CSOSA employees (Maria T. Cecala and Akil Walker) alleging unauthorized disclosures from his CSOSA file and misuse of that information, seeking $200,000 in damages.
- Allegations: Cecala disclosed unverified/false information from plaintiff’s CSOSA file to third parties (a nurse practitioner, a mental-health provider’s nurse, and an attorney), and that information contributed to a parole-violation report and a subsequent ~one month incarceration; Walker and Smoot are accused of failing to investigate or respond.
- Defendants moved to dismiss under Fed. R. Civ. P. 12(b)(1) (jurisdiction/sovereign immunity) and 12(b)(6) (failure to state a claim).
- Court concluded sovereign immunity bars official-capacity constitutional claims and dismissed those claims for lack of subject-matter jurisdiction; individual-capacity and statutory claims were assessed on the merits.
- Court dismissed Privacy Act and HIPAA claims for failure to state a claim (Privacy Act allegations too vague to be plausible and plaintiff failed to plead cognizable damages tied to the alleged disclosure; HIPAA provides no private right of action).
- Court also dismissed without prejudice any FTCA/negligence claim because plaintiff failed to exhaust administrative remedies; overall dismissal was without prejudice.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether sovereign immunity bars official-capacity constitutional claims | Hill alleges due process and equal protection violations by federal officers in office | Defendants: suits against officials in official capacity are effectively suits against the government and barred absent waiver | Held: Sovereign immunity applies; official-capacity constitutional claims dismissed for lack of jurisdiction |
| Whether Privacy Act claim survives dismissal | Hill alleges CSOSA disclosed records from his system file to third parties causing harm | Defendants: plaintiff didn’t identify specific records or plausibly plead injury; some claims implicate custody and Heck bar | Held: Privacy Act claim dismissed under Rule 12(b)(6) as insufficiently pleaded and lacking proven damages; Heck may bar claims tied to custody but not necessarily disclosures unrelated to custody |
| Whether HIPAA supplies a private right of action | Hill asserts HIPAA violation | Defendants: HIPAA contains no private cause of action; remedy is administrative complaint to HHS OCR | Held: HIPAA claim dismissed (no private right of action) |
| Whether FTCA/negligence claim can proceed | Hill later asserted negligence and sought damages | Defendants: plaintiff failed to exhaust administrative remedies required by FTCA | Held: Negligence/FTCA claim dismissed without prejudice for failure to exhaust administrative remedies |
Key Cases Cited
- FDIC v. Meyer, 510 U.S. 471 (sovereign immunity bars Bivens-style damages claims against the United States and federal agencies)
- Heck v. Humphrey, 512 U.S. 477 (damage claims that would imply invalidity of conviction/sentence are barred unless conviction/sentence first invalidated)
- Anyanwutaku v. Moore, 151 F.3d 1053 (clarifies Heck’s scope: habeas requirement applies only when success would necessarily imply speedier release)
- Sussman v. U.S. Marshals Serv., 494 F.3d 1106 (Privacy Act claim requires actual disclosure of records "about" the plaintiff and retrieved by name)
- Acara v. Banks, 470 F.3d 569 (HIPAA does not create a private right of action)
- Twombly v. Bell Atl. Corp., 550 U.S. 544 (pleading must state a claim that is plausible on its face)
- Ashcroft v. Iqbal, 556 U.S. 662 (complaint’s factual allegations must plausibly give rise to liability)