Bocage et al v. Acton Corporation et al

Filing 51

MEMORANDUM OPINION. Signed by Judge R David Proctor on 2/15/2018. (KAM)

FILED
2018 Feb-15 AM 09:49
U.S. DISTRICT COURT
N.D. OF ALABAMA

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ALABAMA
SOUTHERN DIVISION
JORDAN BOCAGE, et al.,
Plaintiffs,
v.
ACTON CORPORATION, et al.,
Defendants.

)
)
)
)
)
)
)
)
)
)
)

Case No. 2:17-cv-01201-RDP

MEMORANDUM OPINION
This matter is before the court on Defendant IM Records, Inc.’s Motion to Dismiss or, in
the Alternative, to Strike the Class Definition (Docs. # 13; 14) and Defendant Acton
Corporation’s Motion to Dismiss (Doc. # 37). The Motions are fully briefed. (Docs. # 13; 14;
27; 33; 37; 43; 44). On December 14, 2017, the court held a hearing on these Motions. For the
reasons explained below, both Motions (Docs. # 13; 37) are due to be granted.
I.

Background
Plaintiffs allege that they requested medical records from Defendants and were charged

improper search and retrieval fees in violation of the Health Insurance Portability and
Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic
and Clinical Health Act (the “HITECH Act”). (Doc. # 1). Plaintiff Joel Kelly (“Kelly”) alleges
that he requested his medical records from Defendant Acton Corporation (“Acton”) six different
times and was charged and paid a $5.00 retrieval fee to Acton for each of his requests. (Id. at
¶ 31-36). Plaintiff Sheila Garrett (“Garrett”) alleges that she requested her medical records from
Acton and was charged and paid a $5.00 retrieval fee to Acton for this request. (Id. at ¶ 40).

Plaintiff Jordan Bocage (“Bocage”) alleges that she requested her medical records from
Defendant IM Records, Inc. (“IM Records”) two different times and was charged and paid a
$5.00 search and retrieval fee to IM Records for each of her requests. (Id. at ¶ 42-43).
On July 18, 2017, Plaintiffs filed this action, seeking damages under Alabama state law
claims of unjust enrichment, negligent misrepresentation, fraudulent misrepresentation, breach of
implied contract, and conversion. (Doc. # 1). Plaintiffs also seek declaratory and injunctive
relief. (Id.). Plaintiffs brought this action on behalf of themselves and a class of similarly
situated individuals “who were assessed a ‘retrieval’ or ‘search fee’ from 2013 to the present
from Defendants for the procurement and/or purchase of the protected health information.” (Id.
at ¶ 45). IM Records filed its Motion to Dismiss or, in the Alternative, to Strike the Class
Definition on October 11, 2017. (Doc. # 13). Acton filed its Motion to Dismiss on November
20, 2017. (Doc. # 37). As appendixes to their motions to dismiss, Defendants Acton and IM
Records included copies of each of Plaintiffs’ medical records requests, which show that these
requests were made by Plaintiffs’ attorneys, not by Plaintiffs themselves. (Docs. # 13-1; 37-1).
II.

The Documents Defendants Attached to their Complaint Are Central to Plaintiffs’
Claims and Undisputed
“The district court generally must convert a motion to dismiss into a motion for summary

judgment if it considers materials outside the complaint.” Day v. Taylor, 400 F.3d 1272, 127576 (11th Cir. 2005) (citing Fed. R. Civ. P. 12(b)). However, a “court may consider a document
attached to a motion to dismiss without converting the motion into one for summary judgment if
the attached document is (1) central to the plaintiff’s claim and (2) undisputed. Id. at 1276. Both
of these elements are met here.
The documents are central to Plaintiffs’ claims for at least two reasons. First, Plaintiffs
2

explicitly reference these documents and thereby incorporate these requests and invoices into
their Complaint. (Doc. # 1 at ¶ 31-36, 40, 42-43); see Taylor, 400 F.3d at 1276 (explaining that
if a “document’s contents are alleged in a complaint and no party questions those contents,” the
court may consider the attached document if it is central to the plaintiff’s claim). Second, the
documents are “at the very heart of” Plaintiffs’ claims because Plaintiffs’ claims center on
whether Plaintiffs were improperly charged (via the referenced invoices attached to Defendants’
motions to dismiss) for their medical records requests. See Taylor, 400 F.3d at 1276.
Plaintiffs do not dispute that Defendants’ attached documents are central to Plaintiffs’
claims nor do they dispute the authenticity of the documents. Moreover, the documents are
accompanied by authenticating affidavits that attest to their accuracy. See id. (noting that an
attached document is “undisputed” if “the authenticity of the document is not challenged”).
Rather than directly challenging the centrality and/or authenticity of the documents at issue,
Plaintiffs argue that the court must accept the allegations in the Complaint that “each of the
individual Plaintiffs requested their [medical records]” as true. (Docs. # 27 at p. 3; 43 at ¶ 3).
But, this argument misses the mark. The court need not accept the conclusory allegation that
Plaintiffs’ individually requested their medical records from Defendants if, in fact, Defendants
have put forth undisputed documents -- that are both referenced in Plaintiffs’ Complaint and are
central to their claims -- showing otherwise. As such, the court may consider these appendixes
without converting Defendants’ motions to dismiss into motions for summary judgment. See
Taylor, 400 F.3d at 1275.
III.

Standard of Review
The Federal Rules of Civil Procedure require only that the complaint provide “a short and
3

plain statement of the claim showing that the pleaser is entitled to relief.” Fed. R. Civ. P. 8(a)(2).
However, the complaint must include enough facts “to raise a right to relief above the
speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). Pleadings that
contain nothing more than “a formulaic recitation of the elements of a cause of action” do not
meet Rule 8 standards, nor do pleadings suffice that are based merely upon “labels and
conclusions” or “naked assertion[s]” without supporting factual allegations. Twombly, 550 U.S.
at 555, 557. In deciding a Rule 12(b)(6) motion to dismiss, courts view the allegations in the
complaint in the light most favorable to the non-moving party. Watts v. Fla. Int’l. Univ., 495
F.3d 1289, 1295 (11th Cir. 2007).
To survive a motion to dismiss, a complaint must “state a claim to relief that is plausible
on its face.” Twombly, 550 U.S. at 570. “A claim has facial plausibility when the plaintiff
pleads factual content that allows the court to draw the reasonable inference that the defendant is
liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Although “[t]he
plausibility standard is not akin to a ‘probability requirement,’” the complaint must demonstrate
“more than a sheer possibility that a defendant has acted unlawfully.” Id. A plausible claim for
relief requires “enough fact[s] to raise a reasonable expectation that discovery will reveal
evidence” to support the claim. Twombly, 550 U.S. at 556.
In considering a motion to dismiss, a court should “1) eliminate any allegations in the
complaint that are merely legal conclusions; and 2) where there are well-pleaded factual
allegations, ‘assume their veracity and then determine whether they plausibly give rise to an
entitlement to relief.’” Kivisto v. Miller, Candield, Paddock & Stone, PLC, 413 Fed. App’x 136,
138 (11th Cir. 2011) (quoting Am. Dental Assn. v. Cigna Corp., 605 F.3d 1283, 1290 (11th Cir.
4

2010)). That task is context specific and, to survive the motion, the allegations must permit the
court based on its “judicial experience and common sense . . . to infer more than the mere
possibility of misconduct.” Twombly, 550 U.S. at 556. Further, “courts may infer from the
factual allegations in the complaint ‘obvious alternative explanation[s],’ which suggest lawful
conduct rather than the unlawful conduct the plaintiff would ask the court to infer.” Am. Dental,
605 F.3d at 1290 (quoting Iqbal, 556 U.S. at 682). If the court determines that well-pleaded
facts, accepted as true, do not state a claim that is plausible, the claims are due to be dismissed.
Twombly, 550 U.S. at 556.
IV.

Analysis
Both Defendant Acton and Defendant IM Records argue that (1) all of Plaintiffs’ claims

are due to be dismissed because medical record requests by attorneys are not subject to the fee
restrictions imposed by HIPAA and the HITECH Act and (2) Plaintiffs’ misrepresentation
claims1, in particular, are due to be dismissed because (a) Defendants never made an actionable
representation to Plaintiffs and (b) Plaintiffs have not plausibly alleged their reliance on any such
representations. (Docs. # 14, 37). Defendant IM Records2 also contends that Plaintiffs’ claims
are improperly repackaged HIPAA claims for which no private right of action exists. (Doc.
# 14). The court evaluates each of these arguments, in turn.

1

Defendant IM Records also alleges that “Plaintiffs lack standing to bring and/or have failed to sufficiently allege
claims for negligent and fraudulent misrepresentation” and move to dismiss these claims under Rule 12(b)(1). (Doc.
# 14). Because the court finds that Plaintiffs have not plausibly alleged violations of HIPAA and the HITECH Act,
it need not address Defendant IM Records’ standing arguments.
2

If the court does not dismiss this action, Defendant IM Records asks the court to strike the class definition because
-- as IM Records argues -- the court lacks personal jurisdiction over the putative class claims of requestors who are
not residents of Alabama. (Doc. # 14). Because the court finds that this action is due to be dismissed on other
grounds, the court finds it unnecessary to decide Defendant IM Records’ Motion to Strike.

5

A.

HIPAA and the HITECH Act Restrictions on Charges for Medical Records
Apply to Individuals and Individuals’ Personal Representatives

Ultimately, the parties’ disagreement about Plaintiffs’ claims centers on whether a
medical record request by an individual’s attorney may be subject to the fee restrictions imposed
by HIPAA and the HITECH Act. To answer this question, the court first examines “the statutory
text, and proceed[s] from the understanding that [u]nless otherwise defined, statutory terms are
generally interpreted in accordance with their ordinary meaning.” Sebelius v. Cloer, 569 U.S.
369, 376 (2013) (internal quotations omitted); see also Hallstrom v. Tillamook Cty., 493 U.S. 20,
25 (1989) (“‘[T]he starting point for interpreting a statute is the language of the statute itself.’”).
The court has a duty to refrain from reading words or elements into a statutory or regulatory text.
See Dean v. United States, 556 U.S. 568, 572 (2009).

Likewise, the court construes

“‘[r]egulations with a common sense regard for regulatory purposes and plain meaning.’” Bivens
v. Bank of Am., N.A., 868 F.3d 915, 920 (11th Cir. 2017) (quoting United States v. Fuentes–
Coba, 738 F.2d 1191, 1195 (11th Cir. 1984)). “[A]gency interpretations are ‘entitled to respect .
. . to the extent that those interpretations have the power to persuade.’” United States v. R&F
Properties of Lake Cty., Inc., 433 F.3d 1349, 1357 (11th Cir. 2005) (quoting Christensen v.
Harris Cty., 529 U.S. 576, 587 (2000)).
Congress enacted HIPAA to improve “the efficiency and effectiveness of the health care
system, by encouraging the development of a health information system through the
establishment of standards and requirements for the electronic transmission of certain health
information.” HIPAA § 261, Pub. L. No. 104-191, 110 Stat. 1936. HIPAA directs the Secretary
of the U.S. Department of Health and Human Services (“HHS”) to develop regulations to
achieve HIPAA’s purpose. See 42 U.S.C. § 1320d-2. In doing so, HHS published the HIPAA
6

Privacy Rule, which provides that “an individual has a right of access to inspect and obtain a
copy of protected health information about the individual in a designated record set, for as long
as the protected health information is maintained in the designated record set.” 45 C.F.R.
§ 164.524(a)(1) (emphasis added).
HIPAA further specifies as follows:
If the individual requests a copy of the protected health
information or agrees to a summary or explanation of such
information, the covered entity may impose a reasonable, costbased fee, provided that the fee includes only the cost of: (i) Labor
for copying the protected health information requested by the
individual, whether in paper or electronic form; (ii) Supplies for
creating the paper copy or electronic media if the individual
requests that the electronic copy be provided on portable media;
(iii) Postage, when the individual has requested the copy, or the
summary or explanation, be mailed; and (iv) Preparing an
explanation or summary of the protected health information, if
agreed to by the individual as required by paragraph (c)(2)(iii) of
this section.
45 C.F.R. § 164.524(c)(4) (emphasis added). HHS has clarified that § 164.524(c)(4) “limits only
the fees that may be charged to individuals, or to their personal representatives in accordance
with § 164.502(g), when the request is to obtain a copy of protected health information about the
individual in accordance with the right of access. The fee limitations in § 164.524(c)(4) do not
apply to any other permissible disclosures by the covered entity, including . . . disclosures that
are based on an individual’s authorization . . . .” 67 Fed. Reg. 53182, 53254 (Aug. 14, 2002).
Application of this regulation to the facts of this case centers on the definition of the term
“individual” as used in HIPAA. “Individual” is defined as “the person who is the subject of the
protected health information.” 45 C.F.R. § 160.103. A personal representative (and that term is
defined as a person who “under applicable law . . . has authority to act on behalf of an individual
7

who is an adult or an emancipated minor in making decisions related to health care”) must be
treated as the individual. Id. at §§ 164.502(g)(1), (2).
In Webb v. Smart Document Solutions, LLC, the Ninth Circuit held that the definition of
“individual,” as used in HIPAA does not encompass designated agents, such as personal
attorneys. Webb v. Smart Document Sols., LLC, 499 F.3d 1078 (9th Cir. 2007). As the Ninth
Circuit explained, “the regulations restrict the fee limitations to requests made by the individual
and concretely define ‘individual’ in a way that excludes others acting on that individual’s
behalf.” Id. at 1084. Using the statutory canon “expressio unius est exclusio alterius, which
‘creates a presumption that when a statute designates certain persons, things, or manners of
operation, all omissions should be understood as exclusions,’” the Webb court noted that HHS
explicitly provided for one situation in which persons other than the individual may be treated as
the individual and that situation only occurs “when a ‘personal representative’ is authorized to
make healthcare-related decisions for an individual.” Id. (citing Silvers v. Sony Pictures Entm’t,
Inc., 402 F.3d 881, 885 (9th Cir. 2005) (en banc) and 45 C.F.R. § 164.502(g)). Of course, HHS
was “fully capable of writing in an even broader definition” of the term “individual,” and HHS
“considered adopting a broader definition of ‘individual’ that would have included legal
representatives, but in the final rule ultimately decided against it.” Id. at 1085 (citing 65 Fed.
Reg. 82492). Ultimately, HHS eliminated from the final rule the provisions designating a legal
representative as an “individual” and instead chose to include a separate standard for personal
representatives. Id. (citing 65 Fed. Reg. 82492).
The court finds the Ninth Circuit’s analysis of HIPAA requirements (or, at least, the
HIPPA requirements in place before 2009) persuasive. However, after the Ninth Circuit ruled on
8

Webb v. Smart Document Solutions, LLC, Congress enacted the HITECH Act. See Pub. L. No.
111–5, Title XIII, 123 Stat. 226 (2009). Plaintiffs argue that the enactment of the HITECH Act
makes Webb inapplicable to the facts of this case. The HITECH Act expanded HIPAA to
include individuals’ rights to obtain electronic health records and added stronger privacy and
security requirements to protect health information. See id. Specifically (and of particular
relevance to this case), the HITECH Act provides as follows:
In applying section 164.524 of title 45, Code of Federal
Regulations, in the case that a covered entity uses or maintains an
electronic health record with respect to protected health
information of an individual-- (1) the individual shall have a right
to obtain from such covered entity a copy of such information in an
electronic format and, if the individual chooses, to direct the
covered entity to transmit such copy directly to an entity or person
designated by the individual, provided that any such choice is
clear, conspicuous, and specific; (2) if the individual makes a
request to a business associate for access to, or a copy of, protected
health information about the individual, or if an individual makes a
request to a business associate to grant such access to, or transmit
such copy directly to, a person or entity designated by the
individual, a business associate may provide the individual with
such access or copy, which may be in an electronic form, or grant
or transmit such access or copy to such person or entity designated
by the individual; and (3) notwithstanding paragraph (c)(4) of such
section, any fee that the covered entity may impose for providing
such individual with a copy of such information (or a summary or
explanation of such information) if such copy (or summary or
explanation) is in an electronic form shall not be greater than the
entity’s labor costs in responding to the request for the copy (or
summary or explanation).
42 U.S.C. § 17935(e).
In January 2013, HHS published a final rule modifying the Privacy, Security, and
Enforcement Rules of HIPAA in order to implement the statutory amendments under the
HITECH Act. See 78 Fed. Reg. 5566, 5566. Under the Final Rule, HSS amended the HIPAA
9

Privacy Rule to include the following provision:
If an individual’s request for access directs the covered entity to
transmit the copy of protected health information directly to
another person designated by the individual, the covered entity
must provide the copy to the person designated by the individual.
The individual’s request must be in writing, signed by the
individual, and clearly identify the designated person and where to
send the copy of protected health information.
45 C.F.R. § 164.524(c)(3)(ii); see also 78 Fed. Reg. 5566, 5702.

Plaintiffs argue that

§ 164.524(c)(3)(ii) in combination with § 164.524(c)(4) establishes that Defendants improperly
charged Plaintiffs’ legal representatives retrieval fees because Plaintiffs provided Defendants
with written requests, signed by the individuals, that clearly identified their attorneys as their
designees for the transmissions of their protected health information. (Doc. # 27). Defendants
counter that Plaintiffs’ requests do not qualify as patient directives because Plaintiffs’ attorneys,
rather than the individuals themselves, requested the Plaintiffs’ protected health information
from Defendants. (Docs. # 33, 37, 44).
The court agrees with Defendants that the language of the regulation suggests that, in
order for the HIPAA fee restrictions under 45 C.F.R. § 164.524(c)(4) to apply, the overarching
requirement is that the individual, or a personal representative of the individual, must request his
or her protected health information. Section 164.524(c)(3)(ii) does not alter this requirement;
rather, it plainly provides three requirements that must be met for an individual to request a
covered entity to transmit that individual’s protected health information directly to another
person: (1) the request must be in writing, (2) the request must be signed by the individual, and
(3) the request must clearly identify the designated person and where the individual’s personal
health information is to be sent. 45 C.F.R. § 164.524(c)(3)(ii). Furthermore, it is reasonable to
10

understand that, in order for §§ 164.524(c)(3)(ii) and 164.524(c)(4) to apply, an “individual”
must request the covered entity to transmit his or her protected health information, not merely
authorize his or her protected health information to be disclosed.
However, the fee restriction language in HIPAA leaves room for confusion, especially
when applied to the facts of this case. At first glance, Plaintiffs’ interpretation that, following the
HITECH Act, the fee limitations in 45 C.F.R. § 164.524(c)(4) applied to attorneys requesting
personal health information on behalf of their clients and with their clients’ authorizations
presents a decent argument. See Young v. Cmty. Nutrition Inst., 476 U.S. 974, 988 (1986)
(Stevens, J., dissenting) (“The task of interpreting a statute requires more than merely inventing
an ambiguity and invoking administrative deference. A statute is not ‘unclear unless we think
there are decent arguments for each of two competing interpretations of it.’”) (quoting R.
DWORKIN, LAW’S EMPIRE 352 (1986)). These conflicting reasonable interpretations arguably
create ambiguity and, therefore, the court turns to administrative guidance. See Scialabba v.
Cuellar de Osorio, 134 S. Ct. 2191, 2195 (2014) (“When an agency thus resolves statutory
tension, ordinary principles of administrative deference require this Court to defer.”). Plaintiffs
and Defendants agree that, in this case, the court should defer to HHS guidance. Unfortunately
for Plaintiffs, this guidance does not support their positions.
HHS guidance on when HIPAA fee limitations apply establishes that an individual or an
individual’s personal representative -- not merely the individual’s attorney -- must directly
request the protected health information. See Individuals’ Rights under HIPAA to Access Their
Health Information 45 CFR § 164.524, U.S. Dep’t of Health & Human Services (Feb. 25, 2016),
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.
11

html#newlyreleasedfaqs (last visited Dec. 13, 2017). HHS explains,
The fee limits apply when an individual directs a covered entity to
send the PHI to the third party. . . . [W]ritten access requests by
individuals to have a copy of their PHI sent to a third party that
include [the] minimal elements [of 45 CFR 164.524(c)(3)(ii)] are
subject to the same fee limitations in the Privacy Rule that apply to
requests by individuals to have a copy of their PHI sent to
themselves. This is true regardless of whether the access request
was submitted to the covered entity by the individual directly or
forwarded to the covered entity by a third party on behalf and at
the direction of the individual (such as by an app being used by the
individual). Further, these same limitations apply when the
individual’s personal representative, rather than the individual
herself, has made the request to send a copy of the individual’s
PHI to a third party.
In contrast, third parties often will directly request PHI from a
covered entity and submit a written HIPAA authorization from the
individual (or rely on another permission in the Privacy Rule) for
that disclosure. Where the third party is initiating a request for
PHI on its own behalf, with the individual’s HIPAA
authorization (or pursuant to another permissible disclosure
provision in the Privacy Rule), the access fee limitations do not
apply. However, as described above, where the third party is
forwarding - on behalf and at the direction of the individual - the
individual’s access request for a covered entity to direct a copy of
the individual’s PHI to the third party, the fee limitations apply.
Id. (emphasis added). HHS’s explicit statement that a third party initiating a request for PHI on
its own behalf with the individual’s HIPAA authorization (as was done in this case) is not subject
to the HIPAA fee limitations confirms Defendants’ legal and factual position in this case and
runs directly contrary to Plaintiffs’ proposed construction of 45 C.F.R. §§ 164.524(c)(3)(ii) and
164.524(c)(4). See id. After examining guidance from HHS, the court holds that a legal
representative who requests an individual’s protected health information (and is not a personal
representative of the individual) is not entitled to the fee limitations imposed under HIPAA by 45
C.F.R. § 164.524(c)(4). See Auer v. Robbins, 519 U.S. 452, 457 (1997) (“Because Congress has
12

not ‘directly spoken to the precise question at issue,’ we must sustain the Secretary’s approach so
long as it is ‘based on a permissible construction of the statute.’”) (quoting Chevron, U.S.A., Inc.
v. Nat. Res. Def. Council, Inc., 467 U.S. 837, 842-43 (1984)).
All of Plaintiffs’ claims are premised on the allegation that Defendants improperly
charged Plaintiffs fees in violation of HIPAA and the HITECH Act. (Doc. # 1). The court finds
that Plaintiffs have not plausibly alleged that Defendants charged Plaintiffs improper fees
because attorneys are not subject to the HIPAA and HITECH Act fee limitations. Therefore,
Plaintiffs’ Complaint is due to be dismissed. See Twombly, 550 U.S. at 570.
B.

Plaintiffs’ Misrepresentation Claims Fail Because Plaintiffs Do Not Allege
Reliance on Defendants’ Representations

Counts II and III of Plaintiffs’ Complaint allege that Defendants made negligent and
fraudulent misrepresentations to Plaintiffs by collecting search and retrieval fees from Plaintiffs.
(Doc. # 1 at ¶¶ 61- 68). Neither count states a claim.
In order to establish a negligent misrepresentation claim under Alabama law, a plaintiff
must establish the following:
(a) a false representation of an existing material fact; (b) a
representation (1) that the speaker knew was false when made, (2)
that was made recklessly and without regard to its truth or falsity,
or (3) that was made by telling the listener that the speaker had
knowledge that the representation was true while having no such
knowledge; (c) reliance by the listener on the representation,
coupled with deception by it; (d) the reasonableness of that
reliance under the circumstances; and (e) damage to the listener
proximately resulting from his or her reasonable reliance.
Pace v. Alfa Mut. Ins. Co., 178 F. Supp. 3d 1201, 1220 (M.D. Ala. 2016) (internal quotations
omitted) (quoting City of Prattville v. Post, 831 So.2d 622, 628 (Ala. Civ. App. 2002)). To
establish a fraudulent misrepresentation claim under Alabama law, “a plaintiff must show: ‘(1) a
13

false representation (2) concerning a material existing fact (3) [reasonably] relied upon by the
plaintiff (4) who was damaged as a proximate result.’” Id. at 1216 (quoting Fisher v. Comer
Plantation, Inc., 772 So.2d 455, 463 (Ala. 2000)).
The court agrees with Defendants that Plaintiffs do not plausibly plead negligent and
fraudulent misrepresentation claims under Alabama law because Plaintiffs have not plausibly
alleged that Defendants made a representation to Plaintiffs or that Plaintiffs relied on any
representation that Defendants made.3 When requesting Plaintiffs’ protected health information
from Defendants, Plaintiffs’ attorneys communicated directly with Defendants. (Docs. # 13-1;
37-1). Plaintiffs and Defendants were never in contact with one another. As a result, Plaintiffs
cannot plausibly allege that any misrepresentation was made to them by Defendants.
Additionally, at best, Plaintiffs have presented a misrepresentation of law, not fact.
“Alabama law on fraud . . . generally requires a misrepresentation of a material fact.” Randolph
Cty. v. Ala. Power Co., 784 F.2d 1067, 1070 (11th Cir. 1986); see Johnson v. Sorensen, 914 So.
2d 830, 839 (Ala. 2005) (“‘It has been said that misrepresentation or concealment as to matter of
law cannot constitute remedial fraud, because everyone is presumed to know the law, and
therefore cannot in legal contemplation be deceived by erroneous statements of law, and such
representations are ordinarily regarded as mere expressions of opinion on which the hearer has
no right to rely.’”) (quoting Best v. Best, 25 So.2d 723, 725 (1946)). Exceptions to this general
rule arise when the speaker of an alleged misrepresentation was an attorney or “where to hold to
the contrary would be against public policy.” Randolph Cty., 784 F.2d at 1070. Plaintiffs do not
3

Furthermore, a misrepresentation claim requires the establishment of a false representation. See Pace, 178 F.
Supp. 3d at 1216, 1220. As discussed above, the court finds that the fees Defendants charged were not improper
under HIPAA and the HITECT Act. Accordingly, based on the facts alleged, Plaintiff cannot establish the false
statement element of a misrepresentation claim.

14

argue that either exception applies in this case. Indeed, even if viewed as a misrepresentation of
law claim, the misrepresentation was made to Plaintiffs’ attorneys. Therefore, regardless of
whether HIPAA fee limitations apply to attorneys requesting an individual’s protected health
information, Plaintiffs’ misrepresentations claims are due to be dismissed.
C.

The Court Declines to Decide Whether Plaintiffs’ Other State Law Claims
Based on Alleged HIPAA Violations Are Improper

In addition to Plaintiffs’ misrepresentation claims against Defendants, Plaintiffs also
allege state law claims of unjust enrichment, breach of implied contract, and conversion. (Doc.
# 1). Defendant IM Record argues that Plaintiffs’ claims are improperly repackaged HIPAA
claims for which no private right of action exists. (Doc. # 14, 33). In reply, Plaintiffs contend
that, because a violation of a federal or state statute may support state law claims and because
Plaintiffs have only pleaded Alabama state law claims seeking damages for Defendants’ alleged
violations of HIPAA and the HITECH Act, Plaintiffs are not foreclosed from pleading state law
claims based on alleged HIPAA violations. (Doc. # 27).
“[P]rivate rights of action to enforce federal law must be created by Congress.”
Alexander v. Sandoval, 532 U.S. 275, 286 (2001). The Eleventh Circuit has “decline[d] to hold
that HIPAA creates a private cause of action.” Sneed v. Pan Am. Hosp., 370 F. App’x 47, 50
(11th Cir. 2010); see Crawford v. City of Tampa, 397 F. App’x 621, 623 (11th Cir. 2010) (“[N]o
private right of action exists under the Health Insurance Portability and Accountability Act.”).
Although the Eleventh Circuit has not ruled on whether an alleged HIPAA violation may support
a state law claim, it has held that HIPAA does not create a private cause of action or an
enforceable right in the context of § 1983. See Sneed, 370 F. App’x at 50. In dicta, the Eleventh
Circuit has also noted that “the Fifth Circuit and numerous district courts have concluded that
15

there is no private right of action for a violation of HIPAA’s confidentiality provisions.” Bradley
v. Pfizer, Inc., 440 F. App’x 805, 809 (11th Cir. 2011) (finding that an invasion of privacy claim
that was based on a HIPAA violation was not actionable).
Plaintiffs argue that the fact that no private right of action exists under HIPAA does not
preclude a cause of action based on an alleged HIPAA violation under Alabama law. (Doc. # 27
at p. 10-13). In support of their argument, Plaintiffs point to the Middle District of Alabama’s
ruling in Smith v. Triad of Alabama, No. 1:14-CV-324-WKW, 2015 WL 5793318, at *11-13
(M.D. Ala. Sept. 29, 2015). In Smith, the court allowed a negligence per se action that was
based on a violation of HIPAA to proceed past the motion to dismiss stage because (1) “no
binding precedent [exists] holding that a HIPAA violation is not a proper basis for a negligence
per se claim under Alabama law,” and (2) Alabama case law allows negligence per se claims to
be based on both federal and state statutes even when a private right of action is not
contemplated by the statute in question. See Smith, 2015 WL 5793318, at *11-12 (“In light of
Defendant’s failure to provide precedent binding on this court holding that HIPAA cannot serve
as the basis of a negligence per se claim, coupled with the Allen [v. Delchamps, Inc., 624 So.2d
1065 (Ala. 1993)] decision, which indicates Alabama court’s willingness to allow statutes that do
not otherwise provide private causes of action to serve as the basis for a negligence per se claim,
Plaintiffs’ negligence per se claim is not due to be dismissed on the basis that it is not cognizable
as a matter of law.”).
The ruling in Smith regarding a negligence per se claim does not necessarily apply to
Plaintiffs’ unjust enrichment, breach of implied contract, and conversion claims. In a negligence
per se claim, a plaintiff points to a law and argues that the law creates a duty and establishes a
16

statutory standard of care. See Emery v. Talladega Coll., 688 F. App’x 727, 730 (11th Cir.
2017). But the existence of a duty is not an element necessary to establish unjust enrichment,
breach of implied contract, and conversion claims. See, e.g., Portofino Seaport Vill., LLC v.
Welch, 4 So. 3d 1095, 1098 (Ala. 2008) (“To prevail on a claim of unjust enrichment under
Alabama law, a plaintiff must show that: (1) the defendant knowingly accepted and retained a
benefit, (2) provided by another, (3) who has a reasonable expectation of compensation.”); Ellis
v. City of Birmingham, 576 So. 2d 156, 157 (Ala. 1991) (explaining that a breach of implied
contract claims involves the same elements as an express contract and differs only in the method
of expressing mutual assent); Schaeffer v. Poellnitz, 154 So. 3d 979, 988 (Ala. 2014) (“For a
conversion claim to stand, there must be a wrongful taking or a wrongful detention or
interference, an illegal assumption of ownership, or an illegal use or misuse of another’s
property.”) (internal quotations omitted). Accordingly, the court is not convinced that an alleged
HIPAA violation creates actionable unjust enrichment, breach of implied contract, and
conversion claims under Alabama law.

But, in any event, because the court holds that

Defendants did not violate HIPAA or the HITECH Act and all of Plaintiffs’ claims are based on
Defendants alleged violations of these Acts, the court finds it unnecessary to explore whether,
and to what extent, a state law claim may be based on alleged HIPAA violations.
V.

Conclusion
For the reasons outlined above, Defendants’ Motions to Dismiss are due to be granted.

As such, this action is due to be dismissed without prejudice. An Order consistent with this
Memorandum Opinion will be entered.

17

DONE and ORDERED this February 14, 2018.

_________________________________
R. DAVID PROCTOR
UNITED STATES DISTRICT JUDGE

18