KATAYOON BERESTON, APPELLANT, v. UHS OF DELAWARE, INC. AND DISTRICT HOSPITAL PARTNERS, LP, D/B/A GEORGE WASHINGTON UNIVERSITY HOSPITAL, APPELLEES.
No. 15-CV-244
DISTRICT OF COLUMBIA COURT OF APPEALS
March 8, 2018
Appeal from the Superior Court of the District of Columbia (CAB-416-14)
(Hon. John M. Mott, Trial Judge)
(Argued December 10, 2015 Decided March 8, 2018)
Keith Lively, with whom Andre P. Barlow was on the brief, for appellant.
Alan S. Block, with whom Nadia A. Patel was on the brief, for appellees.
Before GLICKMAN and MCLEESE, Associate Judges, and FERREN, Senior Judge.
Opinion for the court by Associate Judge GLICKMAN.
Concurring opinion by Senior Judge FERREN at page 43.
Opinion by Associate Judge MCLEESE, concurring in part and dissenting in part, at page 48.
Although an at-will employee who is discharged for refusing to violate the law (or for оther reasons that transgress a clear mandate of public policy) may have a common-law cause of action for wrongful termination, we affirm the dismissal of Ms. Bereston‘s claims. We hold that the first count of her complaint fails to plead facts sufficient to state a plausible claim that Ms. Bereston‘s refusal to break the law was the sole or predominant reason for her firing. As to the second count, Ms. Bereston concedes that it does not state a cognizable claim under current law. Although this court has held that termination of employment in contravention of public policy may be actionable, we have not extended that holding to adverse
I.
Before summarizing the allegations in Ms. Bereston‘s complaint, wе set forth the standards under which we will evaluate their sufficiency. We review de novo a trial court‘s dismissal of a complaint for failure to state a claim upon which relief can be granted.2 “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible
A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged. The plausibility standard is not akin to a “probability requirement,” but it asks for more than a sheer possibility that a defendant has acted unlawfully. . . . Where a complaint pleads facts that are “merely consistent with” a defendant‘s liability, it “stops short of the line between possibility and plausibility of ‘entitlement to relief.‘”5
“When there are well-pleaded factual allegations, a court should assume their veracity[,]”6 but that tenet does not extend to “a legal conclusion couched as a factual allegation[.]”7 “Bare allegations of wrongdoing that ‘are no more than conclusions are not entitled to the assumption of truth,’ and are insufficient to
Ms. Bereston‘s complaint presents the facts underlying her claims as follows.
The Hospital hired Ms. Bereston on October 3, 2011, to serve as its Director of Admissions. Her duties in this position included “ensuring” that the Hospital
Ms. Bereston‘s compliance-related difficulties at the Hospital allegedly began at the outset of her two-year tenure as Director of Admissions, in October 2011, when she found that Emergency Room patients were being asked how they would pay for treatment before they were screened by a triage nurse.
In March 2012, Mr. Davis convened a meeting of the Hospital‘s entire admissions staff. The meeting provided an opportunity for staff to “voice their frustration” with Ms. Bereston and her disruption of their work routine; she “was forced to listen to a long list of frivolous and petty complaints” from admissions staff who “condemned her for being mean and difficult to approach.” After the
Ms. Bereston perceived that her subsequent efforts to bring the Hospital into compliance with federal laws and regulations were also unpopular; the complaint alleges in general terms that Ms. Bereston was treated with hostility and “bullied and ridiculed by both staff and her superiors[,]” but it provides few if any specifics to substantiate that she suffered such treatment or that her superiors opposed the changes she recommended. In addition to what has been quoted already in this opinion, the complaint states only that when Ms. Bereston advised Hospital officials of the “Stark Law” violation, “an associate administrator . . . ridiculed [her] for not spelling the name of the law correctly in an email,” and Mr. Davis admonished her for spelling and grammar mistakes. Ms. Bereston also alleges that she “sought psychiatric care to cope with the intense hostility she faced on an almost daily basis” from the staff and the рhysicians who were discontented with
The complaint states that in 2013, Kimberly Russo, the Hospital‘s Chief Operating Officer, “accused” Ms. Bereston of lacking “influence leadership” and not being “a team player.” Ms. Russo allegedly blamed Ms. Bereston for her staff‘s poor performance and high turnover rate (which Ms. Bereston acknowledges were problems), while physician and staff complaints about her “were always taken at face value and often handled unprofessionally by both Ms. Russo and [Hospital] human resources staff.”16 The complaint also alleges that “Ms. Russo and others continued systematic assaults on Ms. Bereston‘s authority by not supporting [her] efforts to earn the respect of and goodwill with the physicians and staff[,]” as when her requests for schedule changes and additional staff to “ease the burden on her overworked” Admissions Department employees were denied.
Ms. Bereston asserts that, by tolerating the discontent and hostility she allegedly endured and withholding their full support for her efforts, senior Hospital officials were “deliberately undermining [her] authority and diminishing her ability
The incident that allegedly precipitated Ms. Bereston‘s termination arose not from a change that she initiated, but rather from a requested staffing change that she refused to make. The request came in the summer of 2012, when a physician, Dr. Rachel Brem, sought changes in the intake process at the Hospital‘s radiology clinic (which Dr. Brem managed) because patient registration was too slow. Dr. Brem requested that six admissions registrars be assigned to the clinic to handle the patient registration in situ. Ms. Bereston told her that because the registration area was small and insufficiently private, it would be “impossible” to install more than
In May 2013, when a solution had not been devised,18 Dr. Brem again complained and insisted that the number of admissions registrars in her clinic be increased from three to six. By this time, other physicians also were complaining about registratiоn delays and demanding more admissions personnel. The physicians threatened to refer their patients elsewhere if the Hospital did not satisfy
On September 6, 2013, Ms. Russo met with Ms. Bereston and issued her a Performance Improvement Plan (“PIP“). The PIP gave Ms. Bereston ninety days to improve but also provided for a review after thirty days, at which time she could be terminated pursuant to the Hospital‘s progressive discipline policy. Ms. Bereston‘s complaint does not recite the PIP‘s contents except to say that it “accused” her of lacking qualities of “leadership” and “satisfaction” and mentioned “feedback from our corporate partner” as the reason for the discipline.19 Although Ms. Bereston was not told what the “feedback” was, her complaint alleges that it “related to [her] insistence that [the Hospital] comply with various laws and regulations.” The complaint contains no factual allegations supporting this assertion as to the nature of the “feedback.” Nor do Ms. Bereston‘s factual
According to the complaint, “[i]t was clear to Ms. Bereston that this PIP was issued by Ms. Russo to lay the groundwork to fire her at the next opportunity.” Nonetheless, after thirty days, Ms. Bereston had not come up with a HIPAA-compliant solution to Dr. Brem‘s problem (and the complaint does not allege that Ms. Bereston made progress in any other area). On October 18, 2013, Dr. Brem confronted Ms. Bereston at the radiology clinic.20 Angrily “accusing her of not knowing anything, not fixing anything, [and] not taking responsibility,” Dr. Brem allegedly demanded six registrars for her clinic “or she would walk out of the Hospital, taking her practice and her patients with her.” Ms. Bereston “reluctantly” proposed a compromise plan to provide “up to five” admissions personnel plus a “floating manager,” although she privately believed this would be “stretching HIPAA to the absolute limit, and that the demands placed upon the floating manager would be untenable.” Dr. Brem rejected this proposal and reiterated her demand for six registrars immediately or the Hospital “would start losing
Ms. Bereston was given no official explanation for her discharge. Her complaint asserts that the Hospital terminated her because of her refusal to break the law to satisfy Dr. Brem and other MFA physicians.21 “Also part of the motivation to terminate Ms. Bereston,” the complaint states, “was simple laziness and a refusal to confront physician and staff discontent” arising from her implementation of changes that “often came at the expense of convenience for the physicians and staff.”22
A. Wrongful Discharge
1. Ms. Bereston‘s Invocation of the Adams-Carl Exception to Employment at Will
Ms. Bereston was an at-will employee of the Hospital. “It has long been settled in the District of Columbia that an employer may discharge an at-will employee at any time and for any reason, or for no reason at all.”23 This court has recognized a designedly “narrow” exception to this common-law rule, under which an at-will employee may have a claim sounding in tort for wrongful discharge if the employer‘s “sole” (or at least “predominant“) reason for terminating the employee was the employee‘s refusal to break the law24 or was in some other respect contrary to a “clear mandate of public policy . . . .”25
We conclude that Ms. Bereston‘s complaint fails in two respects to present a plausible claim for relief from her discharge under the Adams-Carl exception to the at-will employment doctrine. First, the well-pleaded factual allegations of the complaint do not show that putting six registrars in the radiology clinic actually would have violated HIPAA by jeopardizing the confidentiality of patient health information. Second, the well-pleaded factual allegations of the complaint also are insufficient to support a plausible claim that the Hospital‘s sole or predominant reason for firing Ms. Bereston was her refusal to break the law, or that the Hospital‘s expressed rеasons for putting her on a PIP were pretextual. In each of these two respects, we find that the complaint pleads facts that are at best “merely consistent with” the Hospital‘s alleged liability and so “stops short of the line between possibility and plausibility of ‘entitlement to relief.‘”30
As to the first deficiency, in order to state a plausible claim for relief under the Adams-Carl exception, it is not enough for Ms. Bereston merely to assert that acceding to Dr. Brem‘s request for six registrars would have endangered the privacy of protected patient information in violation of HIPAA. That is only a conclusion of law. Nor is it enough for Ms. Bereston merely to allege that she acted as she did because she reasonably believed she was refusing to break the law. This court has never held that an employee‘s reasonable (but wrong) belief that what her employer required her to do was illegal is enough to support a wrongful-discharge claim under the Adams-Carl exception to employment at will. On the contrary, we have expressly declined to “alter our requirement for a remedy for wrongful discharge of an at-will employee to a lesser requirement that the employee have a reasonable belief that he or she is being wrongfully discharged.”31
As other courts have discerned, there is good reason for not extending the exception to employees who were fired for refusing to do what they incorrectly believed was unlawful. We agree with the following explanation by the United States Court of Appeals for the Third Circuit:
The public policy exception to the doctrine of employment at-will does not exist . . . to protect the employee. Rather it is the protection of society from public harm, or the need to vindicate fundamental individual rights, that undergird[s] an at-will employee‘s common law action for wrongful discharge . . . .
The employee‘s good intentions are not enough to create a cause of action for wrongful discharge . . . . If an employee can avoid discipline whenever he reasonably believes his employer is acting unlawfully, it is the employee, not the public, who is protected by the good intentions. A company acting within the law is presumed to pose no threat to the public at large. The creation of a cause of action based on an employee‘s reasonable belief about the law would leave a private employer free to act only at the sufferance of its employees whenever reasonable men or women can differ about the meaning or application of a law governing the action the employer proposes. The effect such a rule might have on corporate governance and the efficient operation of private business organizations is not insignificant. . . . [W]e therefore conclude that a clear violation оf public policy depends on an actual violation of law.32
Absent are any factual allegations clarifying whether, how, or to what extent raising the number of registrars in the radiology clinic from three to six actually would have exposed patient health information to a heightened risk of unintentional disclosure. For example, the complaint does not describe the dimensions or layout of the radiology clinic‘s admissions area or the space allotted for the transmission and receipt of confidential patient information. It says nothing about the volume of patients the radiology clinic currently serves and how adding registrars would affect the number of persons present at any given time. It does not describe the nature and duration of the registration process or why it might subject protected patient information to increased exposure to bystanders. Assuming that Ms. Bereston‘s concern was with crowding in the admissions area, her complaint does not identify and describe that putative problem in any way. It says nothing about how close bystanders already were or would be to patients being admitted; whether their proximity already did or would permit them to overhear or glimpse confidential information; or how often such opportunities
In short, the complaint fails to explain in any factual way why the confidentiality of patient health information could be preserved in the radiology clinic admissions area with three registrars, and indeed with the five registrars plus a roving manager that Ms. Bereston counter-offered, but not with six registrars. It is not obvious that increasing the number of registrars to six would be likely to increase the risk of such unintentional disclosures or that measures could not be taken to minimize that risk.33
Moreover, even if there would have been a somewhat greater risk of unintentionally exposing confidential patient health information to bystanders, that does not necessarily mean adding registrars would have violated HIPAA. The Privacy Rule makes clear that HIPAA does not require covered entities to
3. Failure to Plausibly Allege an Improper Motive for Discharge
Turning to the second shortcoming of Ms. Bereston‘s claim of wrongful discharge, while it is true that her termination came on the heels of her blow-up with Dr. Brem, we perceive the factual allegations of the complaint to be insufficient to support a plausible assertion that the Hospital‘s sole or predominant reason for firing her was her refusal to violate HIPAA. First, the complaint does not allege that the Hospital ever ordered Ms. Bereston to violate HIPAA in order to
Second, as recounted above, the complaint alleges that the Hospital was seriously dissatisfied with Ms. Bereston‘s performance as Director of Admissions for significant and identified reasons other than her refusal or inability to satisfy Dr. Brem‘s request for more registrars (or her insistence on compliance with health care laws and regulation in general). Staff allegedly were dismayed by the disruption of their working arrangements and complained that Ms. Bereston was “mean and difficult to approach.” Numerous physicians allegedly complained that Ms. Bereston was not addressing their problems with registration delays and inadequate admissions staffing. Ms. Bereston‘s supervisors – the Hospital‘s Chief Financial Officer and its Chief Operating Officer – had counseled her without apparent success on the need to be friendlier and to improve her leadership and personnel management skills. It got to the point that Ms. Bereston‘s own staff were insubordinate, and that physicians (again, not only Dr. Brem) were threatening to leave the Hospital because she was failing to satisfy their concerns. Eventually, Ms. Bereston was given a Performance Improvement Plan that identified “leadership” and “satisfaction” as the areas in which she needed to show progress. The factual, non-conclusory allegations of the complaint do not support
The narrow exceptions to the “employment at-will” doctrine which we have recognized in Adams and Carl were not designed to prevent an employer from terminating an at-will employee in order to eliminate unacceptable internal conflict and turmoil. It matters little, if at all, who was most at fault. An employer is not required to tolerate an intolerable working environment.37
At best, Ms. Bereston‘s complaint pleads facts that are merely consistent with her theory of the Hospital‘s liability. It stops well short of making a plausible
B. Harassment and Retaliation
1. Uncertain Cognizability of the Proposed Cause of Action
The second count of Ms. Bereston‘s complaint asserts that the Hospital violated “District of Columbia public policy” by harassing her and rеtaliating against her “for her efforts to bring the employer into compliance with the several laws and regulations governing its operation.”38 As Ms. Bereston acknowledges, this count advances a new common law tort cause of action (which we may denominate for convenience as “wrongful discipline“) that our court has never recognized. When this court formulated the Adams-Carl exception to the doctrine of at-will employment, we took pains to emphasize that the tort of wrongful discharge in contravention of public policy is a very narrow one. We did not contemplate the creation of an analogous remedy in tort for adverse employment
Although many states recognize public policy claims for wrongful discharge, only a handful of courts have considered whether to extend that recognition (in the absence of statutory authorization) to wrongful-discipline claims, and “[t]he few decisions on the subject are divided.”40 Arguably, creation
We are wary of attempting to resolve these competing policy considerations by judicial fiat. We have appreciated that in matters such as this, the legislature “is in a far better position than a court to make policy decisions on behalf of the citizenry.”45 Normally, it is up to the legislature to decide whether to attach liability to previously lawful conduct. In the District of Columbia, it is through legislative action that employees currently have causes of action against employers who harass or retaliate against them for engaging in certain activities, namely those protected by the District of Columbia Human Rights Act,46 the Whistleblower Protection Act,47 and the Workers’ Compensation Act.48 Whether and how to extend the list of statutorily protected activities so as to protect employees from harassment or retaliation for conduct covered by the Adams-Carl public-policy
2. Insufficiency of the Allegations of Retaliation and Harassment
In this case, however, it is unnecessary for us to decide whether to recognize a common-law cause of action for retaliation and harassment offensive to public policy. Were we to do so, we would require the same prima facie showing as is required for comparable claims of retaliation and harassment under the District of Columbia Human Rights Act and other statutes. Under our employment discrimination laws (as under their federal counterparts), a prima facie showing of actionable retaliation requires the employee to show “employer action[] that would have been materially adverse to a reasonable employee.”49 Typically, though not inevitably, such an action is one that has “materially adverse consequences
Ms. Bereston‘s complaint fails to allege sufficient facts to support a plausible claim of actionable retaliation (i.e., apart from her termination) or hostile work environment. First, Ms. Bereston does not allege that she was demoted or reassigned to a position with different responsibilities, that her salary or benefits were reduced, that she was denied a promotion, salary increase, or bonus, or that she suffered any other significant change in her employment status or materially adverse employment action. We do not deny that “the [mere] imposition of a PIP – even one that does not result in a negative impact on salary, grade or performance appraisal – can constitute an adverse action.”57 However, as we have said, Ms. Bereston‘s well-pleaded factual allegations fail to support her conclusory assertion that the PIP in her case was issued in retaliation for her putatively protected conduct (either in refusing to violate HIPAA or for her compliance
Second, although Ms. Bereston‘s complaint repeatedly alleges in conclusory terms that she was “bullied, harassed, ridiculed, sabotaged, [and] humiliated” because of her insistence that the Hospital comply with applicable laws, the well-pleaded factual allegations in the complaint fail to demonstrate it. To be sure, Ms. Bereston alleges that she received what she considered unmerited criticism of her job performance (charges of unfriendliness, aloofness, poor leadership and management of her department, excessive rigor in enforcing regulations, not being a “team player“) and was counseled by her superiors to improve. On one occasion she was obliged to listen to complaints of her staff that she deemed “frivolous and petty.” She encountered disagreement with and opposition to her “unpopular” changes in Hospital procedures and did not receive the credit she believes she deserved. Allegedly, the Hospital‘s “executives, administrators, and physicians did not respect nor always accept her recommendations to comply with existing law and regulations because it meant changing the status quo, creating inconvenience, and making less profit.” Simply put, these allegations may show serious work-related disagreements, criticisms, and dissatisfaction, but without greater specificity, they do not evince the kind of severe and pervasive ridicule,
Indeed, despite Ms. Bereston‘s difficulties and understandable stress, her complaint alleges that she continued to perform her job well and does not identify any unreasonable interference with her actual work performance. Moreover, the complaint acknowledges that the Hospital generally implemented the changes she called for in her compliance role, even when her superiors initially were skeptical or reluctant.59 That Ms. Bereston‘s role was, in part, that of a compliance officer does not mean she was immune from questioning and critical evaluation of her
At most, Ms. Bereston‘s complaint cites a few more or less offensive incidents. It alleges that members of Ms. Bereston‘s staff were rude and hostile to her after she changed Emergency Room admissions procedures to their displeasure; that Mr. Davis and another Hospital administrator ridiculed her spelling and grammar in an email; that she was given “lip service” when she reported pharmacy billing irregularities; and that Dr. Brem lost her temper with her and screamed at her. By themselves, these were isolated incidents in a two-year period of employment (and at least some of them might fairly be characterized as trivial). They cannot be said to have been severe and pervasive enough to have altered the conditions of Ms. Bereston‘s employment and created a hostile work environment, or to have constituted materially adverse actions against her by the Hospital.60
IV.
For the foregoing reasons, we affirm the judgment of the Superior Court dismissing appellant‘s complaint pursuant to
According to paragraph 74 of her complaint, Ms. Bereston alleges that her hospital employer violated the District‘s public policy “by retaliating, harassing and eventually terminating” her employment bеcause of her efforts to bring the hospital “into compliance with the several laws and regulations governing its operation.” Although a few jurisdictions have recognized common law exceptions based on public policy for alleged retaliation against an employee short of discharge — commonly demotion for filing a workers’ compensation or whistleblower claim5 — I am reluctant to recognize an unlawful harassment/retaliation exception in this case.
It is obviously true that the kind of fact-finding and law-applying I have just outlined is something the courts do every day, but we do so by applying statutes that spell out all the required ground rules. Thus, as illustrated in the opinion of the court,6 a judge-made exception here would require us to рiggy-back selectively
Unlike the factual fight in the typical harassment/retaliation case like Ms. Bereston‘s, where the sides have conflicting stories to tell, a typical demotion for assertion of whistleblower protection or worker‘s compensation would generate controversy only over an employer‘s reasons for demoting an employee who asserts an unquestionable right or duty. I say “typical” demotion because, of
I, therefore, concur separately in the opinion of the court to assure that nothing we say here forecloses efforts to achieve common law causes of actions, as appropriate, in the employment area.
MCLEESE, Associate Judge, concurring in part and dissenting in part: The opinion for thе court affirms the trial court‘s dismissal of Ms. Bereston‘s complaint. I agree as to Ms. Bereston‘s wrongful-termination claim, for the reason stated in Part III.A.2, which I join: the complaint fails to adequately allege that Ms. Bereston was being directed to violate HIPAA in connection with patient registration procedures. The court need not address whether the complaint was deficient in the other respects identified in Part III.A.3, and I therefore do not join
I respectfully dissent as to Ms. Bereston‘s claim of what might be called wrongful discipline in violation of public policy. As the opinion for the court notes, ante at 31, this court has not yet decided whether to recognize such a claim. Other courts have divided on the question, ante at 32 n.40, and the Restatement of Employment Law “expresses no view” on the question. § 5.01 cmt. c (Am. Law Inst. 2015). I agree with the courts that have concluded that the relevant considerations on balance favor recognizing such claims. We initially recognized a claim for wrongful termination because it would be “patently contrary to the public welfare” to permit an еmployer “to require [its] employees to break the law as a condition of continued employment.” Adams v. George W. Cochran & Co., 597 A.2d 28, 32 (D.C. 1991) (internal quotation marks omitted). Although we described the doctrine of wrongful termination as “very narrow,” id. at 34, we have since expanded the doctrine in a variety of ways. See Rosella v. Long Rap, Inc., 121 A.3d 775, 778 (D.C. 2015) (recognizing that doctrine was subsequently
In my view, it would also be patently contrary to the public welfare to permit employers to impose harsh adverse employment consequences short of termination on employees to coerce employees to violate the law or to punish employees for refusing to break the law. I acknowledge the court‘s concern about injecting the courts unduly into the employment relationship. Ante at 32-34. As the court notes, ante at 34, other statutes — such as the
I agree with the court that a claim of wrongful discipline in violation of public policy would require the employee to show “employer action that would have been materially adverse to a reasonable employee.” Ante at 35 (brackets and internal quotation marks omitted). I do not agree, however, that Ms. Bereston‘s complaint was properly subject to dismissal under that standard. Ante at 38-42. The complaint alleges that staff called Ms. Bereston names, made remarks about her race, and screamed in her face; supervisory personnel failed to discourage that conduct and refused to let Ms. Bereston respond; a supervisor suggested that Ms. Bereston‘s job security would be endangered if she insisted on compliance with the law; supervisory personnel made unwarranted accusations that Ms. Bereston was not a good leader or team player; Ms. Bereston was ridiculed and admonished for minor errors even though other employees were not treated similarly; and Ms. Bereston was unjustifiably placed on a Performance Improvement Plan (PIP). I do not view those allegations as conclusory, and if they are proven it seems to me that a reasonable factfinder could cоnclude that Ms. Bereston was subjected to
In sum, I would vacate the dismissal of Ms. Bereston‘s wrongful-discipline claim and remand for further proceedings. I therefore respectfully dissent in part.
Notes
Here, too, we view the complaint‘s allegations regarding the Hospital‘s motivations as conclusory.the physicians and staff had to change the way they had “always” done things. They had to learn new processes and procedures designed to protect privacy conсerns. [The Hospital] did not want to shoulder the responsibility of managing physician and staff discontent, and found it desirable to allow Ms. Bereston to take the blame and suffer the brunt of physicians’ and staff‘s daily hostility.
Offense. A person who knowingly and in violation of this part [42 U.S.C. §§ 1320d et seq.] . . . (3) discloses individually identifiable health information to another person, shall be punished as provided in subsection (b). For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have . . . disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1180 (b)(3) [42 U.S.C. § 1320d-9 (b)(3)]) and the individual . . . disclosed such information without authorization.
(1) Standard: Safeguards. A covered entity must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.
(2)(i) Implementation specification: Safeguards. A covered entity must reasonably safeguard protected health information from any intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications or other requirements of this subpart.
(ii) A covered entity must reasonably safeguard protected health information to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.