Fatemi v. Rahn et al

Filing 37

ORDER granting 21 Motion for Summary Judgment. Signed by Judge D. P. Marshall Jr. on 1/12/2015. (jak)

IN THE UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF ARKANSAS
WESTERN DIVISION

NASRIN FATEMI

v.

PLAINTIFF

No. 4:13-cv-742-DPM

DAN RAHN, in his official capacity;
DEBRA FISER, in her official and individual
capacities; JOHN DAY, in his official and
individual capacities; VERA CHENAULT,
in her individual capacity; and UNIVERSITY
OF ARKANSAS BOARD OF TRUSTEES

DEFENDANTS

ORDER
1. The remaining issue is whether the University Defendants retaliated
against Dr. Fatemi when they reported certain alleged HIP AA violations. In
its Order resolving many claims at the threshold, and converting what
remained of the motion to dismiss into one for summary judgment, the Court
gave the parties time to file any new HIPAA-related documents and new
arguments. The University Defendants have supplemented the record. NQ 35.
Dr. Fatemi asks the Court to withhold a ruling pending completion of
informal or formal discovery. NQ 34. The Court of Appeals recently affirmed
summary judgment for the University Defendants in Dr. Fatemi' s first case,

which alleged discrimination of various kinds in U AMS' s decision to end her
neurosurgery residency.

Fatemi v. White, No. 13-2536, slip op.,(8th Cir.

January 6, 2015).
2. Because no direct evidence of retaliation exists on the HIP AA-related
claims, the Court considers Dr. Fatemi' s Title VII claim under McDonnellDouglas's familiar framework. To make a prima facie case, Dr. Fatemi must

show that she engaged in statutorily protected activity, that the University
Defendants took an adverse action against her, and that a causal connection
exists between the two occurrences. Bakhtiari v. Lutz, 507 F.3d 1132, 1137 (8th
Cir. 2007). If she does, the burden of production shifts to the University
Defendants to "show a legitimate, non-retaliatory reason for the challenged
action." Ibid. Dr. Fatemi can overcome that reason by showing it was
pretextual. Dr. Fatemi's retaliation claims under the First Amendment and
the Arkansas Civil Rights Act share the same analysis. Tyler v. Univ. of
Arkansas Board of Trustees, 628 F.3d 980, 986 (8th Cir. 2011); Brown v. City of
Jacksonville, 711 F.3d 883, 892 (8th Cir. 2013). Viewing the record in a light

most favorable to Dr. Fatemi, she hasn't provided sufficient evidence that
creates a reasonable inference of retaliation.

-2-

First, it is doubtful that Dr. Fatemi has suffered an adverse employment
action. Filing her original lawsuit against the University Defendants was
certainly protected conduct. Dr. Fatemi alleges harm in her profession and
costs incurred in defending against the alleged HIPAA violations. But she
hasn't offered proof that any employment-related harm has resulted from the
University Defendants' HIP AA reporting. Her difficulties in finding new
work are undoubtedly caused in part by her failed residency at U AMS. Those
difficulties, though, are insufficiently linked to the HIP AA issues. Hughes v.
Stottlemyre,454 F.3d 791,797 (8th Cir. 2006). The University Defendants never
identified Dr. Fatemi by name when reporting the alleged breach, making the
patient notifications, or issuing the press release. NQ 35. Nor does the record
show that she was sanctioned or penalized as a result. And Dr. Fatemi hasn't
shown how DAMS's discussion with its lawyers about whether she was
subject to criminal charges harmed her professional prospects.
Second, assuming the University Defendants' HIPAA disclosures were
tinged with some "gotcha" motivated by Dr. Fatemi' s first lawsuit, and
assuming the disclosures have dented her professional reputation, the
University Defendants had a legitimate, non-retaliatory reason to act. And

-3-

Dr. Fatemi hasn't shown that the reason was pretextual. The critical inquiry
here is not whether Dr. Fatemi actually violated HIP AA, but whether the
University Defendants "in good faith believed that [she] was guilty of the
conduct justifying" the OCR report, the patient notifications, and the press
release. Johnson v. Securitas Security Services USA, Inc., 769 F.3d 605, 612 (8th
Cir. 2014)(en bane). They did. No evidence supports Dr. Fatemi' s allegation
that University Defendants knew that she hadn't violated the statute. The
undisputed facts show the University Defendants' good faith.
The HIP AA regulations impose a duty on covered entities such as
U AMS to issue notifications for privacy breaches "reasonably believed" to
have occurred. 45 C.P.R.§ 164.404; see also 45 C.P.R.§§ 164.406 & 164.408. Dr.
Fatemi acknowledged on deposition that she wasn't authorized to keep the
health records for research. Case No. 4:11-cv-458, NQ 64-2 at 9. Her argument
that she could keep them to help in her first lawsuit fails. HIP AA regulations
permit the "covered entity" to use private health information for "health
operations," which include disclosure for resolving internal grievances. 45
C.P.R. § 164.506; 65 Fed. Reg. 82462-01. This regulation allowed UAMS to
disclose patients' records; it didn't allow Dr. Fatemi to keep them. UAMS,

-4-

moreover, invited public scrutiny of its HIP AA policies and subjected itself
to a federal investigation and penalties when it decided to report the
circumstances. 42 U.S.C. § 1320d-5; NQ 13-1; Case No. 4:11-cv-458, NQ 64-4 at
3. That self-exposure reveals good faith, not a retaliatory attack. A fact-finder
could conclude only one thing: the University Defendants reasonably believed
in good faith that a HIP AA breach had occurred, and were therefore dutybound to report.
Third, the email exchange between Vera Chenault and Dr. Debra Fiser
doesn't undermine the University Defendants' good faith. NQ 13-1; Alvarez v.

Des Moines Bolt Supply, Inc., 626 F.3d 410, 417 (8th Cir. 2010). Chenault (the
HIP AA compliance officer) notified Dr. Fiser (the Dean of the College of
Medicine), Dr. Day, and another UAMS official about the possible breach
involving many patients and her investigation of it. Dr. Fiser responded:" Oh.
My. Gosh. Does she have any potential exposure because of this?" Chenault
answered the question:" Absolutely. We are going to discuss turning her over
to the police and US Attorney's Office for theft of the records on Monday[,]"
at a meeting with counsel. NQ 13-1 at 2-3. Context is important. There was a
lot in Chenault's original email. "Unfortunately, it appears as though Dr.

-5-

Fateminevercompleted HIPAA training at DAMS, which is probably why we
will end up having to notify these patients." NQ 13-1 at 1. Chenault wrote that
she was investigating why her office didn't stop Dr. Fatemi' s computer access,
which is what DAMS policy dictated if someone doesn't complete their
training. Ibid. Finally, Chenault also noted that DAMS was working on a
complete patient list and risk analysis to determine whether breach
notifications were required. Ibid.
Read in context, Chenault's answer about discussing with counsel a
report to police and federal prosecutors was part of an across-the-board
response.

The University Defendants were assessing DAMS's HIP AA

exposure, Dr. Fatemi's personal exposure, and responding vigorously on all
fronts. While a reasonable inference of retaliation could be drawn from the
email, that inference, standing alone, is insufficient to support a verdict.
Guimaraes v. SuperValu, Inc., 674 F.3d 962,980 (8th Cir. 2012). The point was

that Dr. Fatemi' s potential criminal liability was going to be explored and
discussed with DAMS's lawyers promptly-as part of a global response.
Finally, Dr. Fatemi' s comparator argument fails. Another resident's
leaving one surgery schedule unsecured, and thus allowing two unauthorized

-6-

people to see it, is incomparable to Dr. Fatemi keeping more than fifteen
hundred surgery schedules, which covered thousands of patients, for two
years after her firing. NQ 30 at 5; Ridout v. JBS USA, LLC, 716 F.3d 1079,
1084-85 (8th Cir. 2013). Dr. Fatemi has no valid comparator that would create
a material fact question on pretext.
3. In any event, the individual University Defendants are entitled to
qualified immunity. "Officials are not liable for bad guesses in gray areas;
they are liable for transgressing bright lines." Austell v. Sprenger, 690 F.3d 929,
936 (8th Cir. 2012) (quotation omitted). The University Defendants were
obligated to guard their patients' privacy, and are entitled to discretion in
doing so. Halpern v. Wake Forest University Health Sciences,669 F.3d 454,462-63
(4th Cir. 2012). As reflected in Chenault's email, U AMS had to make a careful
and thorough breach determination. The Court sees no mistake on what
HIPAA required here. But if Fiser, Day, or Chenault made one, then qualified
immunity protects them against suit for the judgment call.
4. Dr. Fatemi' s request for further discovery, NQ 34, is denied as futile.
Magee v. Trustees of Hamline University, Minnesota, 747 F.3d 532, 537 (8th Cir.

2014). As the Court noted in its recent Order, muchHIPAA-related discovery

-7-

was done in the first case. NQ 33 at 5. OCR recently closed its investigation. NQ

35-1, attachment 3. The undisputed material fact is that the University
Defendants never publicly named Dr. Fatemi as the doctor involved in the
breach. And the University Defendants only disclosed particulars about her
and the retained records to OCR as required by law. 45 C.F.R. § 164.408. The
Court sees no reasonable possibility that more discovery could develop any
facts that would get Dr. Fatemi' s retaliation case to a jury.

* * *
Motion for summary judgment, NQ 21, granted.
So Ordered.
D.P. Marshall (r.
United States District Judge

-8-