Margaret A. Acara, Plaintiff-appellant, v. Bradley C. Banks, M.d., Defendant-appellee, 470 F.3d 569 (5th Cir. 2006)

Appellant Margaret Acara ("Acara") filed suit against Appellee Dr. Bradley Banks ("Dr. Banks") in Louisiana district court for disclosing her medical information during a deposition without her consent. Acara's complaint claimed subject matter jurisdiction based entirely upon an alleged violation of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified primarily in Titles 18, 26 and 42 of the United States Code). Acara later sought leave to amend her complaint to change her residency from Louisiana to New York in order to establish diversity jurisdiction. The district court held that HIPAA does not give rise to a private cause of action, and therefore no subject matter jurisdiction existed. In addition, the district court denied Acara's motion to amend her complaint to allege diversity jurisdiction after a magistrate judge determined Acara to be a resident of Louisiana. Therefore, the district court granted Dr. Bank's motion to dismiss pursuant to Rule 12(b) (1), or alternatively Rule 12(b) (6). This timely appeal followed. For the reasons stated below, we affirm.

1. Private Right of Action Under HIPAA.

Whether or not HIPAA provides for a private cause of action is a question of statutory interpretation subject to de novo review. In re ADM/Growmark River Sys., Inc., 234 F.3d 881, 886 (5th Cir. 2000). HIPAA generally provides for confidentiality of medical records. 42 U.S.C. §§ 1320d-1 to d-7. Private rights of action to enforce federal law must be created by Congress. Alexander v. Sandoval, 532 U.S. 275, 286, 121 S. Ct. 1511, 149 L. Ed. 2d 517 (2001). HIPAA has no express provision creating a private cause of action, and therefore we must determine if such is implied within the statute. Banks v. Dallas Hous. Auth., 271 F.3d 605, 608 (5th Cir. 2001). "The judicial task is to interpret the statute Congress has passed to determine whether it displays an intent to create not just a private right but also a private remedy. Statutory intent on this latter point is determinative." Id.¹  In addition, the plaintiff has the relatively heavy burden to show Congress intended private enforcement, and must overcome the presumption that Congress did not intend to create a private cause of action. Casas v. Am. Airlines, Inc., 304 F.3d 517, 521-22 (5th Cir. 2002).

HIPAA does not contain any express language conferring privacy rights upon a specific class of individuals. Instead, it focuses on regulating persons that have access to individually identifiable medical information and who conduct certain electronic health care transactions. 42 U.S.C. § 1320d-1. HIPAA provides both civil and criminal penalties for improper disclosures of medical information. 42 U.S.C. §§ 1320d-5, d-6. However, HIPAA limits enforcement of the statute to the Secretary of Health and Human Services. Id. Because HIPAA specifically delegates enforcement, there is a strong indication that Congress intended to preclude private enforcement. Alexander, 532 U.S. at 286-87, 121 S. Ct. 1511 ("The express provision of one method of enforcing [a statute] suggests Congress intended to preclude others.").

While no other circuit court has specifically addressed this issue, we are not alone in our conclusion that Congress did not intend for private enforcement of HIPAA. Every district court that has considered this issue is in agreement that the statute does not support a private right of action. See, e.g., Agee v. United States, 72 Fed. Cl. 284 (2006); Walker v. Gerald, No. 05-6649, 2006 WL 1997635 (E.D. La. June 27, 2006); Poli v. Mountain Valleys Health Ctrs., Inc., No. 2:05-2015-GEB-KJM, 2006 WL 83378 (E.D. Cal. Jan.11, 2006); Cassidy v. Nicolo, No. 03-CV-6603-CJS, 2005 WL 3334523 (W.D.N.Y. Dec.7, 2005); Johnson v. Quander, 370 F. Supp. 2d 79 (D.D.C. 2005); Univ. of Colo. Hosp., 340 F. Supp. 2d 1142 (D. Colo. 2004); O'Donnell v. Blue Cross Blue Shield of Wyo., 173 F. Supp. 2d 1176 (D. Wyo. 2001); Means v. Ind. Life & Accident Ins. Co., 963 F. Supp. 1131 (M.D. Ala. 1997); Wright v. Combined Ins. Co. of Am., 959 F. Supp. 356 (N.D. Miss. 1997).

Furthermore, Acara provides no authority to support her assertion that a private right of action exists under HIPAA, and her policy arguments are unpersuasive. We hold there is no private cause of action under HIPAA and therefore no federal subject matter jurisdiction over Acara's asserted claims.

2. Diversity Jurisdiction.

In this action Acara sought leave to amend her original complaint to change her residency from Louisiana to New York and thus alternatively plead diversity to satisfy subject matter jurisdiction. The question of whether or not Acara's residency had changed from Louisiana to New York was referred to a magistrate judge who later determined that Acara was a resident of Louisiana.

As long as the district court applies the correct standard of law, findings as to the state residency of the parties will be upheld unless clearly erroneous. Coury v. Prot, 85 F.3d 244, 249 (5th Cir. 1996). We find no evidence that either the magistrate judge or district judge clearly erred in the determination that Acara remained a Louisiana resident. Therefore, since both the plaintiff and the defendant are residents of Louisiana, there is no diversity and this court lacks subject matter jurisdiction. The district court's judgment dismissing the complaint is AFFIRMED. Acara is free to pursue any remaining state law claims in state court.

AFFIRMED.