Coles v. Howard University

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

KATRICE COLES,

Plaintiff,

v. Civil Action No. 23-2508 (TJK) HOWARD UNIVERSITY et al.,

Defendants.

MEMORANDUM OPINION

Plaintiff sued in the Superior Court of the District of Columbia, asserting several statutory and common law claims against a hospital and her employer relating to the alleged improper disclosure of her medical records. Defendants removed. To justify removal, the hospital argued— and Plaintiff did not contest—that this Court has federal-question jurisdiction, and it is true that one claim in the complaint invokes a federal law: the Health Insurance Portability and Accountability Act of 1996, or HIPAA. But just a few days later, the hospital moved to dismiss and argued that—again, with no opposition from Plaintiff—the HIPAA claim must be dismissed because the statute provides no cause of action to establish subject-matter jurisdiction. The Court agrees that the HIPAA claim must be dismissed for that reason. Moreover, that claim is the only possible basis for the Court’s subject-matter jurisdiction over this case. Thus, because the Court will grant the motion to dismiss the HIPAA claim, it must remand the rest of the case for lack of subject-matter jurisdiction. I. Factual and Procedural Background

Plaintiff alleges that she was terminated from her job as a ramp agent for Piedmont Airlines in April 2023. ECF No. 1-1 at 6. She had submitted a medical note from Howard University *2 Hospital to cover a 27-day period of absences from work, but a hospital staffer advised Piedmont that no patient with Plaintiff’s name had been seen there since January 2019. Id. Piedmont then fired Plaintiff for falsifying her medical records. Id.

In July 2023, Plaintiff sued Howard University Hospital Corporation and Howard University Hospital (collectively, “Howard”) and Piedmont in the Superior Court of the District of Columbia. She alleged (1) violations of HIPAA and D.C. Code § 31–3426; (2) violations of the District of Columbia Consumer Protection Procedures Act and the Notification of Security Breach Obligation; (3) common law invasion of privacy; (4) breach of contract; (5) negligence and negligence per se; and (6) negligent supervision. She brought all six counts against Howard but only the latter two against Piedmont.

Both Howard and Piedmont removed the case based on federal-question jurisdiction. Howard claimed that removal was proper because the first count alleges a violation of federal law under HIPAA and because the remaining claims are “contingent upon whether there was a violation of HIPAA.” ECF No. 1 at 4–5. And according to Piedmont, the negligence claims against it arise under federal law because they are completely pre-empted by the Railway Labor Act (RLA). ECF No. 7 at 1. Now Howard and Piedmont move to dismiss. Howard argues that dismissal of all claims against it—including the HIPAA claim—is warranted for lack of subject-matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). ECF No. 6-1 at 7–8. Piedmont argues that the Court lacks subject-matter jurisdiction over the negligence claims against it because of RLA preemption. ECF No. 12 at 1. II. Legal Standards

“When confronted with [] a motion to dismiss under both Rule 12(b)(1) and Rule 12(b)(6), the Court must first consider whether it has subject-matter jurisdiction.” Hamilton v. United States, *3 502 F. Supp. 3d 266, 272 (D.D.C. 2020) (citing Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 94–95 (1998)). If subject-matter jurisdiction is lacking, the Court need not reach any remaining 12(b)(6) arguments. Schmidt v. U.S. Capitol Police Bd., 826 F. Supp. 2d 59, 64 (D.D.C. 2011). Moreover, under Rule 12(b)(1), the plaintiff has the burden to establish the Court’s subject-matter jurisdiction. DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 342 (2006). In evaluating a Rule 12(b)(1) motion, the Court must “assume the truth of all material factual allegations in the complaint and . . . grant[ Plaintiff] the benefit of all inferences that can be derived from the facts alleged.” Am. Nat’l Ins. Co. v. FDIC, 642 F.3d 1137, 1139 (D.C. Cir. 2011) (citation omitted).

The Court has an independent duty to ensure it has proper jurisdiction at all times because federal courts have limited jurisdiction and “possess only that power authorized by [the] Constitution and statute.” Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). After a case is removed, if a federal court determines that it lacks subject-matter jurisdiction, then it must remand the case back to state court. 28 U.S.C. § 1447(c); see also Merkulov v. U.S. Park Police, 75 F. Supp. 3d 126, 129 (D.D.C. 2014) (“[T]he Court must satisfy itself that it maintains jurisdiction over the removed proceeding.”). Because of federalism concerns, “[t]he Court must resolve any ambiguities concerning the propriety of removal in favor of remand.” US Airways Master Exec., Council, Air Line Pilots Assoc., Int’l. v. Am. W. Master Exec. Council, Air Line Pilots Assoc., Int’l., 525 F. Supp. 2d 127, 132 (D.D.C. 2007). III. Analysis

A. HIPAA Claim

1. The HIPPA Claim Must be Dismissed for Lack of Subject-Matter Ju- risdiction

Howard argues that the HIPAA claim must be dismissed because HIPAA lacks a private right of action. ECF No. 6-1 at 13–14. In response, Plaintiff expressly concedes that Howard is *4 correct and even notes that she plans to drop the claim entirely. ECF No. 13 at 5. The Court concurs with the parties. There is “clear consensus among courts” that no private action exists under HIPAA. Lee-Thomas v. LabCorp, 316 F. Supp. 3d 471, 474 (D.D.C. 2018); Hudes v. Aetna Life Ins. Co., 806 F. Supp. 2d 180, 195–196 (D.D.C. 2011), aff'd, 493 F. App’x 107 (D.C. Cir. 2012) (collecting cases). Rather, the statute explicitly provides that the Secretary of Health and Human Services is charged with imposing penalties for HIPAA violations. See 42 U.S.C. § 1320d–5. And multiple courts, including within this Circuit, have dismissed HIPAA claims for lack of subject-matter jurisdiction because a private right of action is absent. See, e.g., Johnson v. Quander, 370 F. Supp. 2d 79, 100 (D.D.C. 2005), aff'd, 440 F.3d 489 (D.C. Cir. 2006); Logan v. Dep't of Veterans Affs., 357 F. Supp. 2d 149, 155 (D.D.C. 2004); Acara v. Banks, 470 F.3d 569, 572 (5th Cir. 2006). Thus, the Court will dismiss the HIPAA claim under Rule 12(b)(1).1

2. The HIPAA Claim Does Not Support Removal

Sections 1331 and 1441 together authorize removal to federal court for federal questions. Section 1441 permits removal for “any civil action brought in a State court of which the district courts of the United States have original jurisdiction.” 28 U.S.C. § 1441(a). And Section 1331 creates original jurisdiction in federal district courts for “all civil actions arising under the

1 Some authority suggests, despite the parties’ positions, that the HIPAA claim should in- stead be dismissed for failure to state a claim. See John Doe v. Metro. Police Dep't of D.C., 445 F.3d 460, 466–67 (D.C. Cir. 2006) (explaining that a statute’s failure to provide a cause of action should ordinarily be considered under 12(b)(6)). But even if the Court dismissed the claim on those grounds, that would not affect its disposition of the case. With no federal claims remaining, the Court would still exercise its discretion to remand the state claims. See Bunch v. District of Columbia, 151 F. Supp. 3d 148, 153 (D.D.C. 2015) (“When a case involving state and federal claims is removed from state court, and subsequently the federal claims are dismissed before trial, the district court has discretion to remand to state court . . . [the] pendent claims upon a proper determination that retaining jurisdiction over the case would be inappropriate . . . The D.C. Circuit has repeatedly expressed its preference for remand in these circumstances.”) (citations omitted); see also D.C. Pro. Taxicab Drivers Ass'n v. District of Columbia, 880 F. Supp. 2d 67, 76 (D.D.C. 2012).

Constitution, laws, or treaties of the United States.” 28 U.S.C. § 1331. Thus, a claim can only support removal under Section 1441 if it first establishes subject-matter jurisdiction under Section 1331.2

The HIPAA claim does not arise under the Constitution, laws, or treaties of the United States for purposes of Section 1331. Indeed, it must be dismissed under Rule 12(b)(1) precisely because, absent a private right of action, it presents no federal question that establishes subject-matter jurisdiction. Thus, despite its invocation of a federal statute, the HIPAA claim does not provide the Court with original jurisdiction over this suit and cannot serve as the basis for removal under Section 1441. See Moses v. SunTrust Mortg., Inc., No. 11-CV-00822 (BJR), ECF No. 23 at 3 (D.D.C. Jan. 13, 2012) (“Regardless of whether removal [appears] initially proper, a district court should dismiss an action for lack of subject matter jurisdiction when the facts and allegations before the court belie any averment that federal jurisdiction exists.”).

B. The Remaining Claims Do Not Create Federal-Question Jurisdiction, and So They Also Do Not Support Removal

In its notice of removal, Howard contends that the remaining state law claims create federal-question jurisdiction because they “are contingent upon whether there was a violation of HIPAA.” ECF 1 at 5. Howard is right that in a “special and small category” of cases, a state law claim can create federal-question jurisdiction. See Gunn v. Minton, 568 U.S. 251, 258 (2013). But that is so only when a federal issue is: “(1) necessarily raised, (2) actually disputed, (3) substantial, and (4) capable of resolution in federal court without disrupting the federal-state balance approved

2 Of course, subject-matter jurisdiction can also be established under Section 1332 for di- versity of citizenship. But here, Plaintiff and Piedmont are both citizens of Maryland, so no party argues for jurisdiction on that ground. See ECF No. 1-1 at 4–5.

by Congress.” Id. Here, the remaining state law claims do not come close to meeting those demanding requirements.

To begin, a violation of HIPAA is not “necessarily raised” in the remaining claims. The complaint cites several state statutes that could serve as an independent basis for state liability irrespective of any HIPAA violation. See ECF 1-1 at 10, 12–13 (citing D.C. Code §§ 31-3426 et seq., 28-3901 to 28-3913, 28-3851 et seq.). And even if the same disclosure of personal health information that allegedly violated those state laws also allegedly violated HIPAA, that does not transform HIPAA into an “essential element” of those state claims. See D.C. Ass'n of Chartered Pub. Schs. v. District of Columbia, 930 F.3d 487, 491 (D.C. Cir. 2019) (quoting Grable & Sons Metal Prods., Inc. v. Darue Eng'g & Mfg., 545 U.S. 308, 315 (2005)). Nor is the complaint’s “[p]assing reference[] to [a] federal statute[]” while discussing its state claims sufficient to establish federal jurisdiction. Hayman v. Bldg Metro Cap. LLC, No. 22-CV-2092 (TJK), ECF No. 15 at 8 (D.D.C. Sept. 13, 2023).

Moreover, whether Defendants violated HIPAA is not a “substantial” issue in the remaining claims. Substantial issues of federal law are those that “present a nearly pure issue of law” rather than “fact-bound and situation-specific” cases. Bender v. Jordan, 623 F.3d 1128, 1130 (D.C. Cir. 2010) (citation omitted). There is no pure issue of HIPAA law here. The remaining state claims revolve around detailed factual questions about the information disclosed, the steps that were taken to protect it, and the nature of the parties’ agreement to protect it—none of which depends on “a legal question that call[s] for the interpretation of federal statutes.” District of Columbia v. Elevate Credit, Inc., 554 F. Supp. 3d 125, 146 (D.D.C. 2021).3

3 Even negligence per se, which may appear to rest on an interpretation of HIPAA, has been consistently held not to create federal-question jurisdiction when it is brought alongside a

Finally, even if the remaining claims did necessarily depend on a violation of HIPAA, that still would not create federal-question jurisdiction. As already explained, HIPAA does not create a private cause of action, and when “a complaint alleg[es] a violation of a federal statute as an element of a state cause of action, when Congress has determined that there should be no private, federal cause of action for the violation, [the complaint] does not state a claim ‘arising under the Constitution, laws, or treaties of the United States.’” Merrell Dow Pharms. Inc. v. Thompson, 478 U.S. 804, 817 (1986). Thus, none of Plaintiff’s state claims raise an issue of federal law sufficient to create federal jurisdiction, or a basis for removal.

Piedmont advances a different but also flawed basis for federal-question jurisdiction. Piedmont argues that removal is warranted because Plaintiff’s claims against them “are completely pre-empted by the Railway Labor Act.” ECF No. 7 at 1. But a federal defense of preemption does not normally suffice to create federal-question jurisdiction. See Organic Consumers Ass’n v. Gen. Mills, Inc., 235 F. Supp. 3d 226, 230 (D.D.C. 2017) (citing Caterpillar, Inc. v. Williams, 482 U.S. 386, 392 (1987)). Only in rare cases, when the preemptive force is “extraordinary,” can a federal statute operate to completely preempt a state law claim and transform it into an issue of federal law. Metro. Life Ins. Co. v. Taylor, 481 U.S. 58, 65 (1987). Not so here.

In Beneficial National Bank v. Anderson, the Supreme Court explained that complete preemption only applies to statutes that provide “the exclusive cause of action for the claim asserted.” 539 U.S. 1, 8 (2003). In that case, the Court identified the National Bank Act as one of

regular negligence claim, as is the case here. See Harding-Wright v. D.C. Water & Sewer Auth., 350 F. Supp. 2d 102, 105–06 (D.D.C. 2005) (“If negligence and negligence per se are merely alternative theories under which [Plaintiff] may be found liable for the same underlying conduct, then the presence of the negligence per se claim cannot support this court’s continued jurisdic- tion.”); see also Green v. Wachovia Bank N.A., No. 06-CV-1929 (EGS), ECF No. 17 at 5–6 (D.D.C. May 2, 2007).

those rare statutes. It also referenced the only two other statutes it had ever recognized as creating complete preemption—neither of which was the RLA. Id. Before Beneficial National Bank, a few circuits had concluded that the RLA created complete preemption. But soon after, one of those circuits reversed course after finding that the RLA does not provide an exclusive cause of action, and because the Supreme Court had explicitly identified only two qualifying statutes. Sullivan v. Am. Airlines, Inc., 424 F.3d 267, 276 (2d Cir. 2005) (reconsidering Shafii v. British Airways, PLC, 83 F.3d 566 (2d Cir. 1996)). Similarly, several other circuits that had previously found that the RLA provided complete preemption changed their tune. See Moore-Thomas v. Alaska Airlines, Inc., 553 F.3d 1241, 1246 (9th Cir. 2009) (overruling Grote v. Trans World Airlines, Inc., 905 F.2d 1307 (9th Cir. 1990)); Hughes v. United Air Lines, Inc., 634 F.3d 391, 395 (7th Cir. 2011) (overruling Graf v. Elgin, Joliet and E. Ry Co., 790 F.2d 1341 (7th Cir. 1986)). Thus, the “emerging trend” is that “the RLA does not provide for complete preemption.” US Airways, 525 F. Supp. 2d at 134.4 And while the D.C. Circuit has not directly addressed this issue, at least one of its members has suggested that complete preemption should be limited to only those statutes explicitly recognized by the Supreme Court. See Republic of Venezuela v. Philip Morris Inc., 287 F.3d 192, 201 (D.C. Cir. 2002) (Williams, J., concurring) (noting a lack of “an analytical basis for extending the complete preemption doctrine beyond the two statutes that the Supreme Court has held effected such a preemption.”). The Court finds the reasoning of these circuits persuasive and agrees that the RLA does not create complete preemption. Thus, the RLA does not establish federal-question jurisdiction for removal purposes.

4 The lone holdout against this trend appears to be the Eighth Circuit. Yet even that court has only “expressed doubts” as to whether Beneficial National Bank definitively established that the RLA does not create complete preemption. See Richardson v. BNSF Ry. Co., 2 F.4th 1063, 1070 (8th Cir. 2021).

• • * *

After dismissing Plaintiff’s HIPAA claim for lack of subject-matter jurisdiction, no claims remain that support this Court’s exercise of federal-question jurisdiction over this suit. Thus, remand is required. See 28 U.S.C. § 1447(c) (“[i]f at any time before final judgment it appears that the district court lacks subject matter jurisdiction, the case shall be remanded.”); see also Republic of Venezuela, 287 F.3d at 196 (“When it appears that a district court lacks subject matter jurisdiction over a case that has been removed from a state court, the district court must remand the case.”). IV. Conclusion

For all the above reasons, the Court will grant in part Howard’s motion to dismiss as to the HIPAA claim and remand the case to the Superior Court of the District of Columbia under 28 U.S.C. § 1447(c) for lack of subject-matter jurisdiction.

/s/ Timothy J. Kelly TIMOTHY J. KELLY United States District Judge Date: October 31, 2023