519 F.3d 456
8th Cir.
2008

Lead Opinion

MURPHY, Circuit Judge.

John Doe brought this action against the Department of Veterans Affairs, R. James Nicholson in his official capacity as the Secretary of the Department (collectively the VA), and Dr. Samuel Hall,1 alleging that Dr. Hall improperly revealed private medical and personal information to Doe’s union representative in violation of the Privacy Act, 5 U.S.C. § 552a (the Act). The district court2 granted the VA’s motion for summary judgment, and Doe appeals. We affirm.

I.

Doe is a veteran who was formerly employed at the Minneapolis Veterans Administration Medical Center (the Center) as a housekeeping aide. As part of the hiring process, he had a preplacement medical exam with the Center’s Employee Health Service (EHS). Doe initially re*459vealed that he was HIV positive on forms which he completed as part of the preplacement exam, and his HIV status was entered into records in his Employee Medical File (Doe’s file).3

Dr. Hall, a licensed physician, formerly served as the Director of EHS. Doe occasionally used the limited medical services EHS provides to Center employees. He saw Dr. Hall in EHS on September 30, 2002 for chills and mentioned his HIV infection during that visit. Dr. Hall recorded that information in his note from the visit, which is part of Doe’s file. Doe saw Dr. Hall again on February 3, 2003 to follow up on a groin injury he had received on the job. Doe again mentioned his HIV status and revealed that he had smoked marijuana to increase his appetite. Dr. Hall included that information in his note from the visit. That note is also in Doe’s file and indicates that the doctor urged Doe to cease his marijuana use. Dr. Hall testified in his deposition that EHS did not see many Center employees who were HIV positive. During his deposition Doe stated that he felt that Dr. Hall’s manner became condescending after he mentioned using marijuana.

Doe received a note at the beginning of his shift on February 26, 2003, instructing him to see Dr. Hall. Doe felt apprehensive about this meeting so he asked his union representative, George Rankin, to meet him at EHS. The meeting with Dr. Hall had been scheduled by Doe’s supervisor, John Kangas, who was ill that day and unable to attend. Kangas had discussed Doe’s frequent absences with Dr. Hall over the phone a few days earlier, however, so the doctor decided to proceed with the meeting even without Kangas to see if he could help address any problems that might be contributing to the absences. Rankin arrived at Dr. Hall’s office shortly after the doctor and Doe began to talk. Doe does not dispute that he invited Rankin into the room, but he claims he first told Dr. Hall not to reveal any of his medical information to Rankin. Dr. Hall denies Doe told him that and during the meeting he mentioned both Doe’s HIV positive status and his use of marijuana. Doe became upset, objected to the comments, and left the room with Rankin.

In this action Doe claims that Dr. Hall failed to comply with the Privacy Act by discussing Doe’s confidential medical information in Rankin’s presence without proper consent. The district court granted the VA’s motion for summary judgment, concluding that because Dr. Hall had learned about Doe’s HIV status and marijuana use from Doe himself rather than from a record, his actions did not violate the Act, citing Olberding v. U.S. Department of Defense, 709 F.2d 621 (8th Cir.1983) (per curiam).

Doe appeals from the grant of summary judgment to the VA, arguing that Dr. Hall’s disclosure violated the plain terms and intent of the Privacy Act. He urges us to distinguish Olberding on factual and legal grounds. As a matter of public policy, he asserts that Olberding chills dialogue between doctors and patients, inhibits the necessary flow of information to the government, and leads to irrational results. The VA. argues that no disclosure forbidden under the terms of the Act occurred, that Olberding controls, and that the VA would in no event be liable under the Act because of other defenses.4 The *460VA contends that public policy requires affirmance and that Dr. Hall followed the community standard of care by assuming Doe had implicitly consented to the disclosure by inviting Rankin to the meeting. Doe asserts that the VA defenses are without merit.

II.

We review de novo a district court’s grant of summary judgment, viewing the facts and all reasonable inferences in the light most favorable to the nonmoving party. Carraher v. Target Corp., 503 F.3d 714, 716 (8th Cir.2007). We will affirm if there is no genuine issue of material fact and the moving party is entitled to judgment as a matter of law. Gretillat v. Care Initiatives, 481 F.3d 649, 652 (8th Cir.2007); see also Fed.R.Civ.P. 56(c); Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247-48,106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). In order to create an issue for trial the nonmoving party must produce sufficient evidence to support a verdict in his favor based on more than “speculation, conjecture, or fantasy.” Putman v. Unity Health Sys., 348 F.3d 732, 733-34 (8th Cir.2003) (internal quotation omitted); see also Fed.R.Civ.P. 56(e); Anderson, 477 U.S. at 249-50, 106 S.Ct. 2505.

The Privacy Act prohibits federal agencies from “disclosing] any record which is contained in a system of records by any means of communication to any person ... except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains.” 5 U.S.C. § 552a(b). The Act defines “record” as “any item, collection, or grouping of information about an individual that is maintained by an agency, including ... medical history ... and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual.” 5 U.S.C. § 552a(a)(4). It defines “system of records” as a “group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.” 5 U.S.C. § 552a(a)(5) (emphasis added). The parties do not disagree that the information revealed by Dr. Hall was contained in a record covered by the Act or that the employee health records are a system of records protected by the Act. Their dispute focuses in the first instance on whether what Dr. Hall revealed in the presence of Rankin had been retrieved from a record covered by the Act.

A.

Doe submits that a question of material fact exists as to whether Dr. Hall actually retrieved the information from his medical file prior to the disclosure, making summary judgment inappropriate. Doe now asserts that his file was with Dr. Hall during the meeting and that having the file would have been consistent with the doctor’s practice. The VA responds that nothing in the record refutes Dr. Hall’s declaration that he spoke solely from his recollection of information Doe told him on February 3. In his deposition Doe said only that Dr. Hall “might have had a file” during the meeting, and in answer to specific questions he testified that he “couldn’t say” whether Dr. Hall consulted a file during the meeting or whether the file Dr. Hall might have had was his own file. Even viewed in the light most favorable to Doe, this evidence does not amount to *461more than speculation that Dr. Hall might have retrieved Doe’s information from an agency record prior to disclosing it. This was insufficient to defeat the motion for summary judgment. See, e.g., Mann v. Yarnell, 497 F.3d 822, 827 (8th Cir.2007) (nonmoving party’s allegations or speculations unsupported by specific facts or evidence are insufficient to withstand motion for summary judgment).

Doe contends that the retrieval rule has no basis in the statutory language of the Privacy Act and submits that Dr. Hall’s actions violated the plain terms of the Act. Several amici representing the interests of people affected by HIV also argue against the application of the retrieval rule to such sensitive medical information. The VA responds that the Privacy Act does not afford any special protection to HIV status and that the Act’s safeguards only apply when the source of the released information was a system of records maintained by a federal agency. Otherwise, liability might arise through the mere coincidence that disclosed information happened to be in a record even if the discloser had no familiarity with that record.

In interpreting a statute, we begin our inquiry with the language of the statute. E.g., United States v. Hansl, 439 F.3d 850, 853 (8th Cir.2006). If the plain language of the statute is unambiguous it controls. E.g., Tr. of the Twin City Bricklayers Fringe Benefit Funds v. Superior Waterproofing, Inc., 450 F.3d 324, 329 (8th Cir.2006). Our role is to interpret and apply statutes as written, for the power to redraft laws to implement policy changes is reserved to the legislative branch. United States v. White Plume, 447 F.3d 1067, 1072 (8th Cir.2006) (internal quotation omitted).

We interpreted § 552a of the Privacy Act in Olberding, where we held that “the only disclosure actionable under section 552a(b) is one resulting from a retrieval of the information initially and directly from the record contained in the system of records.” 709 F.2d at 622 (internal quotation omitted). In affirming the denial of the claims of an army captain who alleged that officers violated the Privacy Act by disclosing that he had been evaluated by a psychiatrist for mental disorders, we explained that the purpose of the Act “is to preclude a system of records from serving as the source of personal information about a person that is then disclosed without the person’s prior consent.” Id. (internal quotation omitted).

Although the communications in question in Olberding duplicated information in the agency’s system of records, that information had not been retrieved from a record covered by § 552a(b). Id. Because the disclosures “arose from the personal knowledge of an individual” rather than information obtained from a government record, we concluded that the Act was not implicated. Id. Even if the discloser knew or had reason to believe that such information might also be found in a protected record, it would create an “intolerable burden” to impose liability for disclosures of independently acquired information and would also extend the Act beyond its purpose. Id. Our decision in Olberding is controlling precedent, see Hoffman v. Rubin, 193 F.3d 959, 966 (8th Cir.1999), and Dr. Hall did not violate the Privacy Act as interpreted in Olberding.

Attempting to distinguish Olberding, Doe argues that in that case the contested information was entered into the system of records only after the string of disclosures had begun, while his HIV status was placed in written format and stored in his file prior to Dr. Hall’s disclosure. The disclosures in Olberding occurred both before and after the record was created, however. See Olberding v. U.S. Dep’t of *462Defense, 564 F.Supp. 907, 910-11 (S.D.Iowa 1982). Doe contends further that the form on which he made the initial disclosure of his HIV status promised him confidentiality and compelled him to report his medical information truthfully, adding that his information was revealed by a doctor rather than a military officer. None of this is material to whether Dr. Hall’s actions violated the Privacy Act. Doe’s suggestion that Olberding was inappropriately influenced by the Feres doctrine which limits the relief available to military personnel for injuries suffered incident to their service, see Feres v. United States, 340 U.S. 135, 71 S.Ct. 153, 95 L.Ed. 152 (1950), is unsupported. The court’s opinion in Olberding neither mentioned the Feres doctrine nor relied on the policies underlying it.

B.

Another argument Doe advances is that the retrieval rule should not apply when the contents of a record are disclosed by the person who prepared the record, urging that we apply a so-called scrivener exception to the rule. He cites two cases in support of this argument. Bartel v. FAA, 725 F.2d 1403 (D.C.Cir. 1984), involved an air safety inspector’s Privacy Act challenge to the release of information gathered in an agency investigation of him. Although it was not clear whether the FAA official who released the information had examined the investigation report, the court ruled that the Privacy Act may have been triggered if the agency official had revealed his own official determination made on the basis of an investigation which he ordered and which generated a protected personnel record. Id. at 1408-09. In the second case cited by Doe, Wilborn v. Department of Health & Human Services, 49 F.3d 597 (9th Cir. 1995), abrogated on other grounds by Doe v. Chao, 540 U.S. 614, 618, 124 S.Ct. 1204, 157 L.Ed.2d 1122 (2004), the Privacy Act was violated by an administrative law judge who used agency records and information collection methods to compile facts about an employee in a report and then without authorization disclosed the report’s existence and information contained in it. 49 F.3d at 600-01. The Ninth Circuit reasoned that any independent knowledge that he had had arisen from the creation of the report and use of the agency’s system for collecting information. Id. at 602.

These cases are readily distinguishable from Doe’s case and they present facts which fall clearly within the Privacy Act’s safeguards. In them an employee’s personal information was acquired from an agency’s system of records and eventually released by officials involved with the data retrieval. This is precisely the type of disclosure that the Act forbids in its proscription against disclosing a “record ... contained in a system of records.” 5 U.S.C. § 552a(b). In contrast, Dr. Hall’s knowledge came from Doe himself rather than from the doctor’s use of the Center’s information collection system. Doe’s case does not present the same concerns about threats to privacy from misuse of the government’s sophisticated systems for collecting and storing personal information as in the cited cases. See Wilborn, 49 F.3d at 601; Bartel, 725 F.2d at 1410. The exception Doe requests would be broader than the exception recognized in the cases he cites. In Wilbom, for example, an official made use of an agency’s information collection system to create a record from which he then disclosed information. In remanding the Bartel case for further proceedings, the D.C. Circuit indicated that there could be statutory liability if the official had divulged conclusions based on an investigation which had produced a protected record. Here, *463Dr. Hall learned the information directly from Doe. Olberding forecloses use of Doe’s requested exception in our circuit in any event. See 709 F.2d at 622.

C.

Section 552a(b) does not prohibit disclosure of information independently acquired. 5 U.S.C. § 552a(b). Congress limited the type of disclosure that would lead to liability by proscribing only the disclosure of a record “contained in a system of records,” id., not the disclosure of all records or information. The statutory definition of record emphasizes the agency’s maintenance of the record; the definition for system of records focuses on the agency’s control over the records and the ability to retrieve the information by some type of identifying particular that is assigned to an individual. See 5 U.S.C. § 552a(a)(4)-(5). Personal knowledge and memories are not included in the terminology or definitions of the Act.

This interpretation is consistent with the guidelines promulgated by the Office of Management and Budget (OMB) the year after the enactment of the Privacy Act. See Privacy Act of 1974, Pub.L. No. 93-579, § 6, 88 Stat. 1896, 1909 (1974) (authorizing OMB to develop guidelines and regulations for implementing the Act).5 The OMB guidelines clarify that the term record as used in the Act does not include “a record contained in someone’s memory.” Privacy Act Guidelines, 40 Fed.Reg. 28,949, 28,951 (July 9, 1975). The D.C. Circuit has viewed these guidelines as entitled to “ ‘the deference usually accorded interpretation of a statute by the agency charged with its administration.’ ” See Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1120 & n. 8 (D.C.Cir.2007), quoting Albright v. United States, 631 F.2d 915, 920 n. 5 (D.C.Cir. 1980).

Our interpretation of the Act is also supported by Congress’ finding in the enacted statute that “in order to protect the privacy of individuals identified in information systems maintained by Federal agencies, it is necessary and proper for Congress to regulate the collection, maintenance, use, and dissemination of information by such agencies.” Privacy Act of 1974, Pub.L. No. 93-579, § 2(a)(5), 88 Stat. 1896 (1974). Other courts have recognized the general applicability of the retrieval rule. See Orekoya v. Mooney, 330 F.3d 1, 6 & n. 3 (1st Cir.2003), abrogated on other grounds by Chao, 540 U.S. at 618, 124 S.Ct. 1204; Thomas v. U.S. Dep’t of Energy, 719 F.2d 342, 345 (10th Cir.1983); see also Wilborn, 49 F.3d at 600. In Thomas the Tenth Circuit noted that the Act’s legislative history “indicates that Congress was concerned predominantly with the increasing use of computers and sophisticated information systems and the potential abuse of such technology.” 719 F.2d at 345; see also Privacy Act of 1974, Pub.L. No. 93-579, § 2(a)(2), 88 Stat. 1896 (1974). In sum, we are not persuaded that Congress intended the Act to reach disclosures such as Dr. Hall’s.

D.

Doe and the amici emphasize the sensitivity of the information communicated by Dr. Hall, particularly Doe’s HIV status, and the importance of preserving confidentiality in a medical setting. They contend that the district court’s decision might compromise relationships between medical care providers and patients, as *464well as between the government and citizens, by reducing individuals’ willingness to share information with doctors or the government. They further argue that the retrieval rule could lead to unintended consequences by providing less protection to more memorable information and penalizing accurate disclosures which have been checked against the record, but not careless unverified disclosures. While these arguments may well have some merit as a matter of public policy, Doe and the amici essentially invite us to rewrite the statute to address their concerns. That invitation would more appropriately be addressed to Congress. See White Plume, 447 F.3d at 1076.

III.

For these reasons we affirm the judgment of the district court.

Notes

. Dr. Hall was dismissed without prejudice by stipulation.

. The Honorable Patrick J. Schütz, United States District Judge for the District of Minnesota.

. Doe also received medical care from the Center as a veteran, but those medical records are maintained separately and are not at issue here.

. The VA argues that Dr. Hall's conduct did not meet the standard of intentional or willful behavior necessary to create liability under 5 U.S.C. § 552a(g)(4) and that his disclosure *460was protected under the need to know and individual access exceptions in §§ 552a(b)(l) and (d)(1).

. Congress later amended this authority to require notice and public comment for such OMB regulations and guidelines. See Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1120 n. 8 (D.C.Cir.2007), citing Computer Matching and Privacy Protection Act of 1988, Pub.L. No. 100-503, § 6, 102 Stat. 2507, 2513 (1988).



Concurrence Opinion

HANSEN, Circuit Judge,

concurring.

I concur in the court’s judgment because our panel is bound by the broad holding of Olberding, where our court agreed with the district court’s conclusion “ ‘that the only disclosure actionable under § 552a(b) is one resulting from a retrieval of the information initially and directly from the record contained in the system of records.’ ” Olberding v. U.S. Dep’t of Def., 709 F.2d 621, 622 (8th Cir.1983) (per curiam) (quoting Olberding v. U.S. Dep’t of Def., 564 F.Supp. 907, 913 (S.D.Iowa 1982)). There is no evidence that Dr. Hall retrieved the information he disclosed about Doe “initially and directly from the record,” and therefore the appellees are entitled to summary judgment on Doe’s claim under § 552a(b) of the Privacy Act. I write separately because, in my view, Olberding’s holding is broader than necessary for its underlying facts, and if we were writing on a clean slate, I would recognize a “scrivener’s exception” to the judge-created retrieval rule.

The Privacy Act prohibits federal agencies from “disclosing] any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains,” 5 U.S.C. § 552a(b), unless certain enumerated exceptions exist. “Congress passed the Act ‘to protect the privacy of individuals identified in information systems maintained by Federal agencies’ by preventing the ‘misuse’ of that information.” Thomas v. U.S. Dep’t of Energy, 719 F.2d 342, 345-46 (10th Cir. 1983) (quoting Privacy Act of 1974, Pub.L. No. 93-579, § 2, 88 Stat. 1896 (1974)). As explained by the Joint House and Senate Report, “[t]his would cover such activities as ... reporting personal disclosures contained in personnel and medical records....” S.Rep. No. 93-1183, H.R.Rep. No. 93-1416, at 51 (1974), reprinted in 1974 U.S.C.C.A.N. 6916, 6966.

The Privacy Act itself does not define “disclose” and does not specifically require that the information disclosed be retrieved directly from the record, but courts generally apply some type of retrieval requirement to give effect to the meaning and purpose of the Privacy Act. See Orekoya v. Mooney, 330 F.3d 1, 6 (1st Cir.2003) (“The Privacy Act prohibits ... ‘nonconsensual disclosure of any information that has been retrieved from a protected record.’ ”) (quoting Bartel v. FAA, 725 F.2d 1403, 1408 (D.C.Cir.1984)), abrogated on other grounds by Doe v. Chao, 540 U.S. 614, 124 S.Ct. 1204, 157 L.Ed.2d 1122 (2004). Courts have consistently recognized that the Privacy Act does not prohibit the disclosure of information that also happens to be contained in a system of records when the information disclosed was actually *465learned from an independent source. See Thomas, 719 F.2d at 345 (collecting cases). And rightly so, as doing so “would impose an ‘intolerable burden, and would expand the Privacy Act beyond the limits of its purpose.’ ” Wilborn v. Dep’t of Health & Human Servs., 49 F.3d 597, 600 (9th Cir. 1995) (quoting Olberding, 709 F.2d at 622), abrogated on other grounds by Doe, 540 U.S. 614, 124 S.Ct. 1204, 157 L.Ed.2d 1122. The court in Olberding rejected a similar proposed rule where the plaintiff urged the court to broadly hold that a disclosure has been made any time “agency personnel disclose information they possess by means other than retrieval from a system of records if they know or have reasonable grounds to believe that the information may also be found in a record contained in a system of records.” Olberding, 709 F.2d at 622.

Nonetheless, there are limited circumstances that justify an exception to the general retrieval rule, particularly where “a mechanical application of that rule would thwart, rather than advance, the purpose of the Privacy Act.” Wilbom, 49 F.3d at 600 (recognizing an exception to the retrieval rule where an agency employee discloses information about a report he authored even though he “may not have physically retrieved the disclosed information from” the agency’s records); see also Bartel, 725 F.2d at 1409 (recognizing an exception for “disclosure by an agency official of his official determination made on the basis of an investigation which generated a protected personnel record”). Strict adherence to the retrieval rule would “allow[] an official to ‘circumvent the Act with respect to a record he himself initiated by simply not reviewing the record before reporting its contents or conclusions,’” thereby “ ‘depriving] the Act of all meaningful protection of privacy.’ ” Pilon v. U.S. Dep’t of Justice, 73 F.3d 1111, 1118 (D.C.Cir.1996) (quoting Bartel, 725 F.2d at 1409, 1411).

The “scrivener’s exception” to the general retrieval rule I would apply is narrow, based on the facts of the case before us, and it is limited only to disclosures made by the author of a record of information the author learned and recorded in the course of creating the record.6 A record cannot exist without someone creating it, and it cannot be created without the author first learning the information to put into the record. Here, Dr. Hall learned of Doe’s medical condition and marijuana use only for the purpose of and while creating a medical history report, which the parties concede is a record contained in the VAMC’s system of records. This is the exact type of information Congress intended to protect. See S.Rep. No. 93-1183, H.R.Rep. No. 93-1416, at 51 (“This would cover such activities as ... reporting personal disclosures contained in personnel and medical records.... ”). Dr. Hall did not learn the information independently of the record, nor did he later learn it from the record. His knowledge was acquired only in the course of creating the record. To exempt the author of a record that is contained in a system of records from the disclosure rules because the author could not have made the record until he first learned the information to be included in the record turns the Privacy Act on its head. It exempts anyone who creates a record from the disclosure rules as long as he can later remember the information he learned while creating the record without *466refreshing his memory with the record. This is to my mind an absurd result. In my view, a scrivener’s exception fits neatly within the necessary and narrowly-defined exception recognized by the D.C. Circuit and the Ninth Circuit, an exception that furthers rather than thwarts the purpose of the Privacy Act without imposing an intolerable burden on federal agencies, while at the same time including conduct that clearly should fall within the Act.

Because we are bound by Olberding’s holding, see United States v. Vertac Chem. Corp., 453 F.3d 1031, 1048 (8th Cir.2006) (“A panel of this Court is bound by a prior Eighth Circuit decision unless that case is overruled by the Court sitting en banc.” (internal marks omitted)), cert. denied, — U.S. -, 127 S.Ct. 2098, 2099, 167 L.Ed.2d 812 (2007), I concur in the court’s judgment.

GRUENDER, Circuit Judge, concurring in the judgment and in the opinion except as to parts II.C and II.D.

. The scrivener’s exception does no harm to the outcome in Olberding, where General Shea disclosed information he learned not from creating a record, but from his firsthand knowledge from issuing his own order that Olberding submit to the psychiatric exam. See Olberding, 709 F.2d at 622.