Cross v. Ciox Health, LLC

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF NORTH CAROLINA EASTERN DIVISION NO. 4:19-CV-7-FL LAKIESHA CROSS as parent and natural ) guardian of S.C., a minor, EARLENE ) DUNBAR, ERNEST SPRUEILL, ERICA ) HIGGINS-INGRAM, and LYNETTE ) BLAKE, individually and on behalf of all ) those similarly situated, ) ) ORDER Plaintiffs, ) ) v. ) ) CIOX HEALTH, LLC, ) ) Defendant. ) This matter is before the court upon defendant’s motions to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) and 12(b)(6) (DE 31, 33). The motions have been briefed fully and the issues raised are ripe for ruling. For the following reasons, defendant’s motion under Rule 12(b)(1) is denied and its motion under Rule 12(b)(6) is granted. STATEMENT OF THE CASE Plaintiffs commenced this putative class action on January 11, 2019, and filed the operative amended complaint on April 4, 2019, asserting claims under North Carolina law against defendant for overcharging them for their medical records in violation of standards set forth in the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”), 42 U.S.C. § 300jj-11, and their implementing regulations governing fees for provision of medical records. Plaintiffs assert claims under the North Carolina Unfair and Deceptive Trade Practices Act (“UDTPA”), N.C. Gen. Stat. § 75-1.1 et seq., as well as common law claims for negligent misrepresentation and unjust enrichment. Plaintiffs seek declaratory and injunctive relief, as well as damages, including trebled and punitive damages, on behalf of themselves and a proposed class, in an amount in excess of $5,000,000.00. Plaintiffs assert subject matter jurisdiction over this matter under the Class Action Fairness Act, 28 U.S.C. § 1332 (d). Defendant filed the instant motions to dismiss on May 10, 2019, seeking dismissal of plaintiffs’ claims for lack of subject matter jurisdiction and for failure to state a claim.1 In support of the motions, defendant relies upon a declaration of Jason Martin, defendant’s vice president of credit and collections, attaching requests for records and invoices relating to plaintiffs. Defendant also relies upon an order in a civil action in the Superior Court of Fulton County, Georgia, captioned Roscoe v. Ciox Health LLC f/k/a HealthPort Technologies, LLC, No. 2018CV305235 (March 4, 2019). Plaintiffs responded in opposition to defendant’s Rule 12(b)(1) motion to dismiss on June 13, 2019. Plaintiffs responded in opposition to defendant’s Rule 12(b)(6) motion to dismiss the next day, relying upon an affidavit of Eric N. Linsk, one of plaintiffs’ attorneys, attaching notices of electronic filing and an order in a civil action in the Circuit Court for Hillsborough County, Florida, captioned Allen v. Healthport Technologies, LLC, No. 12-CA-013154 (Nov. 19, 2014). Defendant filed replies in support of its motions on July 8, 2019. On December 13, 2019, the court granted defendant leave to file a notice of subsequently decided authority, and plaintiffs filed a response thereto on December 19, 2019. On February 3, 2020, defendant filed a second notice of subsequently decided authority. 1 Defendant also moved to dismiss plaintiffs’ original complaint, but upon filing of the operative amended complaint the court denied as moot those motions on April 9, 2019. STATEMENT OF ALLEGED FACTS The facts alleged in the operative complaint2 may be summarized as follows. Plaintiffs are residents of this district. Defendant was formerly known as and operated as HealthPort Technologies, LLC and/or HealthPort Incorporated and changed its name to Ciox Health in March 2016. According to the complaint, defendant is “a specialized medical-records provider that contracts with healthcare providers in all 50 states to retrieve and release individuals’ PHI [personal health information] under HIPAA and relevant state privacy laws.” (Compl. ¶ 22). Defendant allegedly “provides medical-record retrieval services for three out of five hospitals in the United States and more than 16,000 physician practices, and handles more than 40 million medical-record requests annually.” (Id. ¶ 23). According to the complaint, defendant “manages the process of responding to a medicalrecords request for its hospital and clinic clients, including receiving the request, locating responsive documents, providing a response to the patient, invoicing the patient, and collecting payment.” (Id. ¶ 46). Defendant allegedly “advertises itself as providing a prompt and complete response to medical records requests, claiming that it can provide cost reduction to individuals requesting medical records due to its use of electronic delivery of medical records which allows requesters to view records and only print the ones you want to use.” (Id. ¶ 48 (internal quotations omitted)). 2 All references henceforth to the “complaint” in the text or “Compl.” in citations to the record are to the amended complaint (DE 20), filed April 4, 2019, unless otherwise specified. According to the complaint, defendant “sends out [a] patient’s requested medical records with its invoice,” allegedly “overcharging for such records.” (Id. ¶ 49). “For electronic deliveries of medical records, [defendant] routinely charges” a “basic fee of $5.00 or $10.00; a retrieval fee of $5.00; a $2.00 electronic data archive fee[;] and per-page copy fees even when no paper copies are being provided to the requester.” (Id. ¶ 50). Plaintiffs assert in the complaint that such fees are “improper and unlawful.” (Id.). Plaintiffs allege that defendant is aware that a federal law “Privacy Rule” “permits covered entities to impose only reasonable, cost-based fees to provide individuals (or their designated recipient) with copies of their medical records.” (Id. ¶ 51). According to plaintiffs, the “Privacy Rule” is a “privacy standard[] for health information” published by the United States Department of Health and Human Services (“HHS”) in 2000, “in accordance with instructions from Congress flowing from HIPAA.” (Id. ¶ 35 (citing Standards for Privacy of Individually Identifiable Health Information – Final Rule, 65 Fed. Reg. 82462 (Dec. 28, 2000)). According to the complaint, “the Privacy Rule addressed how consumers could obtain their PHI and how much they could be charged for copies of it,” (Compl. ¶ 37), and HITECH “clarified the procedures under which a consumer would obtain their PHI,” including by “capp[ing] the fee that a provider could charge” for copies of PHI in electronic format. (Id. ¶ 39 (citing 45 C.F.R. § 164.524 (c)(4)). Plaintiffs allege that in 2013, HHS “published amendments to the Privacy Rule,” and, in 2016, “issued a guidance document clarifying” “limits on what patients or their designated recipients may be charged for healthcare information,” (id. ¶¶ 40, 42), including allowance to “charge the requester a flat fee of $6.50” to provide records. (Id. ¶ 43). According to the complaint, defendant is “aware that the Privacy Rule as interpreted by HHS allows it to charge individuals only on the basis of its actual costs, or an average of its actual costs.” (Id. ¶ 52). Plaintiffs allege that “[d]espite knowing that federal law allows it to charge individuals only on the basis of its actual costs, or an average of its actual costs,” defendant “continually overcharges patients and their agents for their records.” (Id. ¶ 53). As detailed in the complaint, “[p]laintiffs properly requested [PHI] from their medical providers, and directed that the records be sent to their lawyers.” (Id. ¶ 68). “The medical providers forwarded [p]laintiffs’ requests” to defendant, but defendant allegedly “did not follow the HITECH Act and Privacy Rule in responding.” (Id.). In particular, plaintiffs allege a similar pattern of activity related to each named plaintiff. For example: Plaintiff S.C. is a minor and the son of Lakiesha Cross. In a written request dated May 15, 2018 and signed by his mother, Lakiesha Cross, Plaintiff S.C. requested copies of his medical records from Vidant Edgecombe Hospital in Tarboro, North Carolina. In his request, through his mother, S.C. requested copies of his medical records in electronic format only. S.C.’s request was headlined, “PATIENT DIRECTIVE TO HEALTHCARE PROVIDER PURSUANT TO HITECH RECORDS REQUEST.” S.C. needed his medical records for a personal-injury matter. S.C. directed the recipient of this request to send the records to his attorney, Christopher C. Kessler (“Kessler”), The Kessler Law Firm P.L.L.C., P.O. Box 8064, Greenville, NC 27835. S.C.’s request was accompanied by documents from The Kessler Law Firm P.L.L.C. which asserted that the HITECH Act, 42 U.S.C. §17935 (e)(1), and the statute’s implementing regulation at 45 C.F.R. § 164.524 (c)(4), applied to the request. [Defendant] responded by sending a bill for $18 dated May 22, 2018 to The Kessler Law Firm. The billed total from [defendant] included a “Basic Fee” ($5.00); a “Retrieval Fee” ($5.00); eight pages billed at 75 cents each ($6.00); fourteen pages at no cost; and an “Electronic Data Archive Fee” ($2.00). In its response to S.C.’s request, Ciox did not state that these fees reflected its actual costs, or that these fees reflected an average of its actual costs. In its response, [defendant] did not reveal that these fees are unlawful under the HITECH act and Privacy Rule. On behalf of and as agent of S.C., S.C.’s attorney paid the expense. S.C.’s attorney was required to pay the expense in order to obtain the medical records for S.C.’s personal-injury matter. . . . The expense was deducted from S.C.’s net settlement in his personal-injury matter. (Id. ¶¶ 70-78, 80). Similarly, plaintiffs Earlene Dunbar (“Dunbar”), Ernest Sprueill (“Sprueill”), Erica Higgins-Ingram (“Higgins-Ingram”), and Lynette Blake (“Blake”), requested copies of their medical records from a medical provider for a personal injury matter. They directed the recipient to send the records to Kessler. Defendant sent bills for each plaintiff to Kessler, totaling $21.25, $38.25, $66.75, and $12.00, respectively. Kessler paid the bills on behalf of and as agent for Dunbar, Sprueill, Higgins-Ingram, and Blake. Plaintiffs allege: In each case, [defendant] refused to treat the records request as coming from the patient for the purposes of the HITECH Act, but rather treated it as a request from the patient’s lawyer. In each case, [defendant] refused to apply the Patient Rate3 but instead applied rates that it considered appropriate for third-party, nonpatient requesters. In each case, [defendant allegedly] imposed impermissible fees. In none of the cases did Ciox state that these fees reflected its actual costs, or that these fees reflected an average of its actual costs, as [allegedly] required by federal law. In each case, Ciox disregarded the interpretation of the HITECH Act and Privacy Rule [allegedly] arrived at by HHS. (Id. ¶ 122). COURT’S DISCUSSION A. Standard of Review A motion to dismiss under Rule 12(b)(1) challenges the court’s subject matter jurisdiction. Such motion may either 1) assert the complaint fails to state facts upon which subject matter jurisdiction may be based, or 2) attack the existence of subject matter jurisdiction in fact, apart from the complaint. See Adams v. Bain, 697 F.2d 1213, 1219 (4th Cir. 1982). Where a defendant raises a “facial challenge[ ] . . . that do[es] not dispute the jurisdictional facts alleged in the complaint,” the court accepts “the facts of the complaint as true as [the court] would in context of a Rule 12(b)(6) challenge.” Kenny v. Wilson, 885 F.3d 280, 287 (4th Cir. 2018). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “Factual 3 According to the complaint, under HHS guidance, “[w]hen records are requested by an individual for transmission to an individual’s designee, the records provider may not charge any more for the records than it would have charged if the individual was receiving the records.” (Compl. ¶ 45). “In other words,” according to plaintiffs, “the so-called ‘Patient Rate’ applies even when the patient has the records sent to their lawyer.” (Id.) (emphasis added). allegations must be enough to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555 . In evaluating whether a claim is stated, the “court accepts all well pled facts as true and construes these facts in the light most favorable to the plaintiff,” but does not consider “legal conclusions, elements of a cause of action, . . . bare assertions devoid of further factual enhancement[,] . . . unwarranted inferences, unreasonable conclusions, or arguments.” Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 591 F.3d 250, 255 (4th Cir. 2009) (citations omitted). B. Analysis 1. Timing of Rule 12(b)(6) Motion As a threshold matter, plaintiffs argue that defendant’s Rule 12(b)(6) motion is an improper “successive motion” that is prohibited by Rule 12(g)(2), because it was filed separately, and four minutes later than, defendant’s Rule 12(b)(1) motion. Accordingly, plaintiffs argue, the later 12(b)(6) motion should be denied on that basis alone. Plaintiffs suggest defendant will have “the opportunity to make its Rule 12(b)(6) arguments later in the case, after it files an answer and engages in discovery.” (Pls’ Mem. (DE 38) at 16 n. 1).4 This argument is without merit. Federal Rule of Civil Procedure 12(b)(1) provides that “[a] motion under this rule may be joined with any other motion allowed by this rule.” Rule 12(g)(2) provides, in addition, that “[e]xcept as provided in Rule 12(h)(2) or (3), a party that makes a motion under this rule must not make another motion under this rule raising a defense or objection that was available to the party but omitted from its earlier motion.” 4 Unless otherwise specified, page numbers in citations to the record provide the page number specified by the court’s case management / electronic case filing (“CM/ECF”) system and not the page number showing on the face of the underlying document, if any. In this case, filing a Rule 12(b)(6) motion four minutes after a Rule 12(b)(1) motion does not run contrary to the requirements of Rule 12(g). The exceptions in this case are important. In particular, Rule 12(h)(2) allows the defense of “[f]ailure to state a claim upon which relief can be granted” to be raised “by a motion under Rule 12(c),” which is subject to the same standard as a motion under Rule 12(b)(6). See Burbach Broad Co. of Delaware v. Elkins Radio Corp., 278 F.3d 401, 406 (4th Cir. 2002). In this respect, even if defendant’s Rule 12(b)(6) must be treated instead as a Rule 12(c) motion, it would be adjudicated under the same standard. In addition, Rule 12(h)(3) allows a motion for lack of subject matter jurisdiction to be raised at any time. Thus, the filing of a motion under Rule 12(b)(1), at any time, does not preclude a party from filing a separate Rule 12(b)(6) motion, as here. Construing the rule in the manner plaintiffs assert could produce arbitrary and nonsensical results. For example, if defendant had filed its Rule 12(b)(1) motion four minutes after its Rule 12(b)(6) motion, instead of four minutes before, Rule 12(h)(3) expressly would have allowed the Rule 12(b)(6) motion to be considered, and the Rule 12(b)(6) motion would not be barred as a “[f]urther motion[].” Fed. R. Civ. P. 12(g)(2). By making exceptions for both motions for failure to state a claim and motions for lack of subject matter jurisdiction, Rule 12(g)(2) precludes such arbitrary results. At bottom, the relief sought in this instance would not serve the scope and purpose of the Federal Rules of Civil Procedure, which must be construed and applied by the court “to secure the just, speedy, and inexpensive determination of every action and proceeding.” Fed. R. Civ. P. 1. Where defendant seeks dismissal of plaintiffs’ claims as a matter of law, the issues raised can and should be addressed at this juncture, rather than following a period of discovery. Plaintiffs suggest, nonetheless, that it is unfair to allow defendant to rely upon separate briefs in support of both of its motions, whereas it would have been limited to a 30 page brief if it had combined its motions in accordance with Rule 12(g)(1). Given that the separate motions in this instance are allowed by Rule 12(g), there is no basis to require further limiting the number of pages. While the court does not endorse practices that unnecessarily augment filings and briefs, successive motions in this instance are not a basis for denying outright defendant’s 12(b)(6) motion. Accordingly, the court rejects plaintiffs’ threshold argument and turns next to the merits of each motion. 2. Rule 12(b)(1) Motion Defendant argues this court lacks subject matter jurisdiction over this action because it involves a “transparent attempt by plaintiffs to assert a private cause of action for damages under HIPAA and HITECH,” which plaintiffs lack standing to do. (Def’s Mem. (DE 32) at 7). However, where plaintiffs assert on the face of the complaint only North Carolina state law claims, and not claims under HIPAA or HITECH, defendant has not demonstrated a basis for dismissal of the action for lack of standing. Indeed, defendant cites no case in which a court has dismissed for lack of subject matter jurisdiction under Rule 12(b)(1) common law claims asserted by plaintiffs solely on the basis that HIPAA and HITACH provide no private cause of action. Rather, the starting point to the analysis of many courts that have addressed the issue is that HIPAA and HITACH provide no private cause of action, but then it still remains necessary to determine whether or not any of the asserted state law causes of action provides a viable alternative. See, e.g., Faber v. Ciox Health, LLC, 944 F.3d 593, 597 (6th Cir. 2019) (“Tennessee common law is no substitute for the private right of action that Congress refused to create in HIPAA. That unavoidable conclusion has consequences. Here, it means that Plaintiffs cannot prove every element of their claims.”). Accordingly, defendant’s motion under 12(b)(1) is denied. The court turns to those issues of state law in the analysis below. 3. Rule 12(b)(6) Motion Defendant argues plaintiffs fail to state a claim for every claim asserted in the complaint. Accordingly, the court evaluates each claim asserted in turn. a. UDTPA Under the UDTPA, “[u]nfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are declared unlawful.” N.C. Gen. Stat. § 75-1.1 (a). “In order to establish a violation of N.C.G.S. § 75–1.1, a plaintiff must show: (1) an unfair or deceptive act or practice, (2) in or affecting commerce, and (3) which proximately caused injury to plaintiffs.” Walker v. Fleetwood Homes of N. Carolina, Inc., 362 N.C. 63, 71-72 (2007). Whether conduct by a defendant constitutes an unfair or deceptive act or practice is a question of law for determination by the court. See id. In addition, courts applying the UDTPA “differentiate between contract and deceptive trade practice claims, and relegate claims regarding the existence of an agreement, the terms contained in an agreement, and the interpretation of an agreement to the arena of contract law.” Broussard v. Meineke Disc. Muffler Shops, Inc., 155 F.3d 331 , 347 (4th Cir.1998) (quotations omitted). “North Carolina law requires a showing of substantial aggravating circumstances to support a claim” under the UDTPA. Id. (quotations omitted). It is “unlikely that an independent tort could arise in the course of contractual performance, since those sorts of claims are most appropriately addressed by asking simply whether a party adequately fulfilled its contractual obligations.” Strum v. Exxon Co., U.S.A., 15 F.3d 327, 333 (4th Cir.1994). Plaintiffs’ UDTPA claim fails as a matter of law for multiple reasons. First, [g]iven the contractual center of this dispute, plaintiffs’ [UDTPA] claims are out of place.” Broussard, 155 F.3d at 347. Here, a simple contract for the provision of a product, copies of electronic medical records, underlies plaintiffs’ alleged entitlement to relief. Defendant allegedly billed plaintiffs for such product, and plaintiffs allegedly paid in each instance according to the billed amount to receive such product. (Compl. ¶¶ 76, 78-80, 87, 89-91, 97, 99-101, 107, 109-111, 117, 119-121). A bill for the sale of a product and plaintiffs’ payment of the billed amount to receive the product constitutes an offer and acceptance, and thus a completed contract. See Yeager v. Dobbins, 252 N.C. 824, 828 (1960) (stating that essential elements to formation of a contract are that an “offer must be communicated, must be complete, and must be accepted in its exact terms”); see, e.g., Erskine v. Chevrolet Motors Co., 185 N.C. 479 , 117 S.E. 706, 710 (1923) (“[W]here one makes a promise conditioned upon the doing of an act by another, and the latter does that act, the contract is not void for want of mutuality.”); Hardy v. Ward, 150 N.C. 385 , 64 S.E. 171, 174 (1909) (“[T]he contract is really an offer on one side, with a provision that this offer must be assented to and accepted, where a mere acceptance is contemplated, or payment must be made, where payment was the act of acceptance contemplated.”); CIM Ins. Corp. v. Cascade Auto Glass, Inc., 190 N.C. App. 808, 812 (2008) (“[T]he offeror is the master of his offer. He is entitled to require acceptance in precise conformity with his offer.”). Accordingly, where a contract governs the relationship between the parties, the rights and remedies of the parties lie in contract law and not in the UDTPA. Plaintiffs argue that they have alleged no contract between themselves and defendant, and that they requested medical records instead from their providers. Plaintiffs’ request for medical records, however, is not the offer at issue. Rather, the offer at issue is defendant’s bill for the provision of the records, and the acceptance of that offer is the payment by plaintiffs. Moreover, it is unnecessary to resolve definitively, as plaintiffs argue, whether there was “a contractual relationship between Ciox and Plaintiffs.” (Pls’ Mem. (DE 38) at 25). The key issue for the UDTPA claim is that issues “regarding the existence of an agreement, the terms contained in an agreement, and the interpretation of an agreement” must be relegated “to the arena of contract law” and not adjudicated under the guise of a UDTPA claim. Broussard, 155 F.3d at 347. In addition, and in the alternative, plaintiffs have not pleaded facts establishing a viable UDTPA claim. In the complaint, plaintiffs assert “two separate though related” theories under which defendant’s conduct constituted “unfair or deceptive acts or practices.” (Compl. ¶ 140). First, defendant “deceived and made fraudulent statements to [plaintiffs] when it represented to them . . . that [defendant] was entitled to charge them more for their medical records than allowed by the HITECH Act.” (Id. ¶ 141). Second, defendant’s “violations of the HITECH Act and the Privacy Rule were independent, predicate acts that constitute violations of the [UDTPA].” (Id. ¶ 143). Both of these theories fail as a matter of law based upon the circumstances alleged, as set forth below. i. Misrepresentation With respect to plaintiffs’ UDTPA based upon deception and “fraudulent statements,” plaintiffs must allege “actual reliance” on a misrepresentation and that such reliance was the proximate cause of the injury. Arnesen v. Rivers Edge Golf Club & Plantation, Inc., 368 N.C. 440, 452 (2015); Bumpers v. Cmty. Bank of N. Virginia, 367 N.C. 81, 88 (2013). “Additionally, any reliance on the allegedly false representations must be reasonable.” Forbis v. Neal, 361 N.C. 519, 527 (2007) (quotations omitted). Furthermore, Federal Rule of Civil Procedure 9(b) requires a plaintiff to “state with particularity the circumstances constituting fraud or mistake.” Fed. R. Civ. P. 9(b). “[T]he ‘circumstances’ required to be pled with particularity under Rule 9(b) are “the time, place, and contents of the false representations, as well as the identity of the person making the misrepresentation and what he obtained thereby.” Harrison v. Westinghouse Savannah River Co., 176 F.3d 776, 784 (4th Cir. 1999). Plaintiffs’ UDTPA claim based upon alleged misrepresentations or “fraudulent statements” fails on account of each of these elements. As an initial matter, plaintiffs have not alleged with particularity the contents of the false representations made. The complaint describes various types of representations, but none with particularity. For example, in asserting their UDTPA claim, plaintiffs allege that defendant “represented to them . . . that [defendant] was entitled to charge them more for their medical records than allowed by the HITECH Act.” (Compl. ¶ 141). By contrast, in asserting their negligent misrepresentation claim, plaintiffs allege defendant misrepresented to plaintiffs “that they were and are required to remit payment for impermissible fees . . . to receive PHI to which Plaintiffs and the putative class members were entitled.” (Id. ¶ 155). They also suggest defendant “made the representation to Plaintiffs . . . that they were and are required to remit payment for impermissible fees such as those described above.” (Id. ¶ 156). Plaintiffs further suggest that defendant failed to make certain statements in its bills sent to plaintiff: “[Defendant] did not state that these fees reflected its actual costs,” and defendant “did not reveal that these fees are unlawful under the HITECH act and Privacy Rule.” (Id. ¶ 88). In sum, plaintiffs fail to allege “the time, place, and contents of the false representations” with particularity. Harrison, 176 F.3d at 784 . Thus, their UDTPA claim based upon misrepresentations must be dismissed on this basis. In addition, plaintiffs fail to plead actual, reasonable, reliance as a proximate cause of their injury. Although they assert they “actually and reasonably relied on [defendant’s] statement that the charges were lawful,” (e.g., Compl. ¶ 79), the court need not accept for purposes of the instant motion such conclusory statement of the elements of the claim. See Nemet Chevrolet, 591 F.3d at 255 . Rather, plaintiffs must allege facts giving rise to a plausible inference of reliance. See Iqbal, 556 U.S. at 678 . Plaintiffs fail to do so. Indeed, if anything, the complaint suggests the contrary. In each instance, plaintiffs allege that their attorney requested their medical records “pursuant to HITECH,” and in several instances their attorney accompanied the request with documents “which made clear that the HITECH Act . . . and the statute’s implementing regulation . . . applied to [the] request.” (E.g., Compl. ¶¶ 83, 86). In each instance, plaintiffs’ attorney remitted payment on behalf of plaintiffs. (Am. Compl. ¶¶ 78-80, 89-91, 99-101, 109-111, 119-121). In this manner, plaintiffs have not alleged they actually relied upon purported statements by defendant, where their attorney received and paid the bills. Plaintiffs also have not alleged they took any action in reliance on the statements, again because their attorney, and not the plaintiffs, received and paid the bills. In addition, plaintiffs have not alleged their reliance, if any, was reasonable, because their attorney is alleged to have known and informed defendant in the first instance the rules upon which the charges should be based. Plaintiffs also were in a position to investigate whether the amounts billed were lawful, because, as alleged in the complaint, plaintiffs’ attorneys had all the information he needed to conclude that the amounts billed were in fact, in his view, unlawful before payment was made. For these reasons, plaintiffs fail to allege the necessary element of reliance. Relatedly, plaintiffs fail to allege any “[f]alse representation or concealment of a material fact.” Forbis, 361 N.C. at 526 (emphasis added). Rather, they allege that defendant misrepresented or concealed whether or not the alleged charges were lawful or permissible under applicable law or regulations. But, a party’s statement of a legal position or an assertion about its rights or position under the law is not an actionable misrepresentation for purposes of a UDTPA claim. See Branch Banking & Trust Co. v. Columbian Peanut Co., 649 F. Supp. 1116, 1121 (E.D.N.C.1986) (“To assert in good faith a claim predicated on an erroneous interpretation of the law is not an unfair act . . . as the remedy therfor [sic] lies in the law itself, i.e., such an erroneous view will not prevail.”); see also PCS Phosphate Co., Inc. v. Norfolk S. Corp., 559 F.3d 212, 224 (4th Cir.2009) (holding that defendants “stat[ement] that it believed it had a separate legal right to abandon its own tracks” did not constitute aggravating circumstances sufficient to establish a UDTPA claim); Canady v. Crestar Mortgage Corp., 109 F.3d 969, 976 (4th Cir.1997) (holding that defendant’s refusal to repay plaintiff’s purchase money for an eight month time period following breach of contract, “albeit incorrect” in light of subsequent bankruptcy court ruling, did not rise to the level of a violation of the UDTPA). In sum, plaintiffs’ UDTPA claim premised upon alleged misrepresentations fails as a matter of law and must be dismissed. ii. Violation of Federal Law Plaintiffs’ UDTPA claim premised upon a predicate violation of federal law and regulations also fails as a matter of law. While “a violation of a regulatory statute which governs business activities may also be a violation of N.C. Gen. Stat. § 75–1.1 . . . such a regulatory violation . . . does not automatically result in an unfair or deceptive trade practice.” Walker v. Fleetwood Homes of N. Carolina, Inc., 362 N.C. 63, 70 (2007). Instead, for example, the North Carolina Supreme Court has looked to whether the “statute at issue defined in detail unfair methods of [business] and unfair and deceptive acts or practices in the . . . industry, thereby establishing the [legislative] intent to equate a violation of that statute with the more general provision of § 751.1.” Id. at 71 (citing Gray v. N.C. Ins. Underwriting Ass’n, 352 N.C. 61, 71 (2000)). The North Carolina Supreme Court has not indicated that it would find a violation of HITECH or the Privacy Rule upon which plaintiffs rely here, in the context alleged here, to be a valid predicate for a UDTPA claim. Absent such indication, this court will not undertake to expand North Carolina law to recognize such a claim. Nor has the North Carolina Court of Appeals indicated that the alleged HITECH and Privacy Rule violations in this case would be a proper predicate for a UDTPA claim. According to that court, a violation of a statute or regulation does not constitute a per se UDTPA violation unless the statue or regulation “specifically designate[s] that a violation of the [statute or regulation] is also a violation of [the UDTPA]” or “specifically defines and proscribes conduct which is unfair or deceptive within the meaning of the UDTPA.” Noble v. Hooters of Greenville (NC), LLC, 199 N.C. App. 163, 170 (2009) (emphasis in original). Here, neither HITECH, nor the Privacy Rule and HHS guidance interpreting it as described by plaintiffs in their complaint, specifically designate that a violation thereof is also a violation of the UDTPA. (See, e.g., Compl. ¶¶ 41-45). Likewise, neither specifically defines and proscribes conduct which is unfair or deceptive within the meaning of the UDTPA. Rather, as described by plaintiffs in the complaint, the Privacy Rule and HHS guidance interpreting it, sets forth guidelines for calculating fees that covered entities may charge patients for medical records. (Id.). It does not specifically define and proscribe “unfair or deceptive acts or practices in or affecting commerce” N.C. Gen. Stat. § 75-1.1 (a) (emphasis added). Cases cited by plaintiffs recognizing a UDTPA violation based upon predicate violation of law are inapposite. For example, plaintiffs cite Stanley v. Moore, 339 N.C. 717, 722 (1995), in which the North Carolina Supreme Court held that a violation of the North Carolina Ejectment of Residential Tenants Act, N.C. Gen. Stat. § 42-25.9 , could support a claim of trebled damages under the UDTPA. However, in Stanley, the court expressly noted that North Carolina law had already recognized that “a landlord’s trespass upon the leased premises, eviction of the tenant without resort to judicial process, and conversion of the tenant’s personal property constituted unfair or deceptive acts or practices in commerce within the meaning of N.C.G.S. § 75–1.1.” (Id. at 723 (emphasis added) (citing Love v. Pressley, 34 N.C. App. 503, 517 (1977)). The court also found determinative a provision in the Ejectment of Residential Tenants Act, which provided that “[t]he remedies created by this section are supplementary to all existing common-law and statutory rights and remedies.” Id. (quoting N.C. Gen. Stat. § 42-25.9 (c)). The court reasoned: “We are convinced that the language of subsection (c) expressly preserves the rights of a tenant who is wrongfully evicted to pursue alternative common law and statutory claims for relief, including claims for treble damages and attorney's fees under the Unfair and Deceptive Practices Act, an Act which predated the enactment of the Ejectment of Residential Tenants Act.” Id. Stanley thus is instructively distinguishable from the instant case because the statute in Stanley not only proscribed conduct that was recognized under North Carolina law as unfair, deceptive, and injurious to well-being of tenants, but also expressly reserved remedies for a violation thereof. There is no similar recognition under North Carolina law that HITECH or the Privacy Act guidelines plaintiffs rely upon proscribe conduct that is unfair, deceptive, and injurious to well-being of the consuming public, much less on a par with a landlord’s resort to a physical self-help eviction, as in Stanley. Similarly inapposite is Drouillard v. Keister Williams Newspaper Servs., Inc., 108 N.C. App. 169 (1992), where the court held that a violation of the North Carolina Trade Secrets Protection Act, “Article 24, Chapter 66,” based upon a purported “misappropriation of trade secrets” to be sufficient to support a claim of “[u]nfair methods of competition in or affecting commerce,” under the UDTPA. Id. at 172-173 . Unlike the circumstances alleged in the instant case, the trade secrets violations in that case readily translated to “unfair methods of competition,” as required under the UDTPA. Drouillard also involved a state statute governing the same types of conduct as the UDTPA, whereas this case involves an exclusive and comprehensive federal statutory and regulatory scheme, as alleged by plaintiffs, governing procedures and guidelines for charging for copies of PHI. Cf. Skinner v. E.F. Hutton & Co., 314 N.C. 267, 275 (1985) (holding that securities transactions allegedly in violation of the antifraud provisions of the North Carolina Securities Act and the federal Securities Exchange Act of 1934 did not constitute per se violations of the UDTPA, where such transactions “were already subject to pervasive and intricate regulation under” state and federal law). Plaintiffs also argue that they have alleged an actionable unfair and deceptive trade practice by defendants based upon alleged “systematic overcharging of Plaintiffs,” (pls’ Mem. (DE 38) at 26), citing Sampson-Bladen Oil Co. v. Walters, 86 N.C. App. 173, 177 (1987). The cited case, however, is instructively distinguishable. There, the liable defendant charged the plaintiff “for approximately 2,600 more gallons of oil than [the plaintiff] received,” over a two year period by creating false invoices for the oil that was never delivered. Id. at 174 . Here, defendant is not alleged to have created false invoices for products not received by plaintiffs over a two year period. Unlike in Sampson-Bladen Oil Co., the alleged bills here stated the basis for the charges and there are no facts alleged to infer an intent to deceive. Indeed, there is a fundamental difference between a case such as Sampson-Bladen Oil Co., where a defendant charged for products not actually delivered, and the instant case where the defendant allegedly determined the rate for a charge based upon its own understanding of the law. (See, e.g., Compl. ¶ 122). Moreover, in this case, the complaint describes a single instance for each plaintiff of an alleged overcharge in violation of HITECH and Privacy Rule regulations, not multiple charges for deliveries of products that never arrived. Accordingly, Sampson-Bladen Oil Co. does not support a UDTPA claim under the circumstances alleged. In sum, plaintiffs’ UDTPA claim fails as a matter of law because a violation of HITECH or the Privacy Rule is not an unfair and deceptive act under the meaning of the UDTPA, and because plaintiffs have not otherwise alleged an unfair and deceptive act by defendants. b. Negligent Misrepresentation “The tort of negligent misrepresentation occurs when a party justifiably relies to his detriment on information prepared without reasonable care by one who owed the relying party a duty of care.” Raritan River Steel Co. v. Cherry, Bekaert & Holland, 322 N.C. 200, 206 (1988). Here, where plaintiffs assert a claim of negligent misrepresentation on the same basis as their UDTPA claim premised upon misrepresentations by defendant, this claim fails for all the same reasons as the UDTPA claim. The claim is barred by the North Carolina “economic loss rule.” Legacy Data Access, Inc. v. Cadrillion, LLC, 889 F.3d 158, 164 (4th Cir. 2018). Plaintiffs also have not alleged a misrepresentation of fact or reasonable reliance on the part of plaintiffs. Raritan River Steel Co., 322 N.C. at 206 . In addition, and in the alternative, plaintiffs cannot establish that defendant owed a duty of care to plaintiffs under the circumstances alleged. “Negligence is the failure to exercise proper care in the performance of a legal duty which the defendant owed the plaintiff under the circumstances surrounding them.” Dunning v. Forsyth Warehouse Co., 272 N.C. 723, 725 (1968). Here, plaintiffs fail to demonstrate under North Carolina law a recognition of a duty of care not to overcharge for medical records. Plaintiffs suggest that statutory rules can create a standard of care, the violation of which will constitute a breach of a duty of care on the part of defendant. Plaintiffs cite to Springer v. Joseph Schlitz Brewing Co., 510 F.2d 468, 472 (4th Cir. 1975), for the proposition that, under North Carolina law, “violation of a statute designed to protect persons or property is a negligent act, and if such negligence proximately causes injury, the violator is liable.” For this proposition, however, Springer cites Murray v. Bensen Aircraft Corp., 259 N.C. 638 (1963) (federal aircraft safety statute), and Bell v. Page, 271 N.C. 396 (1967) (town ordinance regulating private swimming pools). Springer itself involved discharge of sewage alleged to have a “toxic or poisonous effect” and “harmful to aquatic life in the receiving stream.” 510 F.2d at 473 . Each of the cited cases recognized a duty arising from statute protecting against physical harm to another’s person or property. As such, they are insufficient to establish under North Carolina law a duty arising from a statute and regulations, as here, allegedly governing the amount that can be charged for medical records. Plaintiffs also rely upon Acosta v. Byrum, 180 N.C. App. 562, 568 (2006), in which the plaintiff asserted a claim of negligent infliction of emotional distress against her psychiatrist, based upon the allegation that the psychiatrist “negligently engaged in conduct by permitting [an associate] to use his access code in violation of the rules and regulations of the University Health Systems, Roanoke Chowan Hospital, and HIPAA,” resulting in dissemination of the plaintiff’s medical records to third parties. There, the North Carolina Court of Appeals opined that HIPPA, in addition to the internal rules and regulations of defendant’s employer, established a “duty to maintain privacy in [plaintiff’s] confidential medical records,” and “that these rules provide the standard of care.” Id. Acosta, however, is inapposite to plaintiffs’ negligent misrepresentation claim, because Acosta involved a duty arising from a physician-patient relationship, and the standard of care pertained to the maintenance of the privacy of the patient’s medical records. Defendant, by contrast, is not alleged to be a physician, and there are no facts alleged permitting an inference that it adopted a physician-patient relationship with plaintiffs. Moreover, where Acosta involved maintenance of the privacy of the patient records, the instant claims concern merely the amount of money properly chargeable for copies of the records, when sending them to an attorney representing plaintiffs in personal injury matters. Plaintiffs suggest, nonetheless, that their medical providers delegated responsibility to defendant to provide the requested records, and assumed the trust relationship flowing between an ordinary patient-physician relationship. Plaintiffs, however, cite no authority for stretching a physician-patient duty of care, under North Carolina law, to a third-party that charges for copies of medical records. The court has identified no basis in the law for doing so under the circumstances alleged. In sum, plaintiffs have failed to demonstrate a duty of care arising under North Carolina law not to overcharge for medical records under the circumstances alleged. Plaintiffs’ negligent misrepresentation claim thus fails as a matter of law for failure to establish this element of the claim and additional elements noted herein. c. Unjust Enrichment “The general rule of unjust enrichment is that where services are rendered and expenditures made by one party to or for the benefit of another, without an express contract to pay, the law will imply a promise to pay a fair compensation therefor.” Krawiec v. Manly, 370 N.C. 602, 615 (2018). “In order to establish a claim for unjust enrichment, a party must have conferred a benefit on the other party, and the benefit must not be gratuitous and it must be measurable.” Id. (quotations omitted). “A claim of this type is neither in tort nor contract but is described as a claim in quasi contract or a contract implied in law.” Booe v. Shadrick, 322 N.C. 567, 570 (1988). Accordingly, “[i]f there is a contract between the parties the contract governs the claim and the law will not imply a contract.” Id. Plaintiffs’ unjust enrichment claim fails as a matter of law because there is a contract governing the payment obligation as between the parties. Plaintiffs expressly allege that they were billed for their medical records, and that they paid such bills. Such bills and the payments thereof, constituted a contract between the parties that precludes plaintiffs’ claim. Id. In addition, and in the alternative, plaintiffs’ claim for unjust enrichment fails because the doctrine of voluntary payment applies based upon the allegations of the complaint. Under North Carolina law, it is a “well established rule of law that the voluntary payment of money by a person who has full knowledge of all the facts cannot be recovered.” Guerry v. Am. Trust Co., 234 N.C. 644, 647 (1951); see Collins v. Covert, 246 N.C. 303, 306 (1957). Here, where it is alleged that plaintiffs’ attorney requested medical records from defendant, expressly citing provisions of HITECH and the Privacy Rule allegedly applicable to the requests, and where it is alleged that defendant provided an itemized bill showing charges for the medical records, and where it is alleged that plaintiffs’ attorney proceeded to pay the bills as requested, payment thus was made by plaintiffs with full knowledge of all the facts pertinent to their instant claims. Accordingly, the voluntary payment doctrine bars their claims for unjust enrichment. Plaintiffs argue that the voluntary payment doctrine should not apply because they have alleged they were “required to pay” the billed charges “in order to obtain the medical records” for their personal injury matters. (E.g. Compl. ¶¶ 78, 89, 99). However, “[a] rule that has been frequently applied is that to constitute the coercion or duress which will be regarded as sufficient to make a payment involuntary, there must be some actual or threatened exercise of power possessed, or believed to be possessed, by the party exacting or receiving the payment over the person or property of another, for which the latter has no other means of immediate relief than by making the payment.” Big Bear of N. Carolina, Inc. v. City of High Point, 294 N.C. 262, 266 (1978). Here, plaintiffs do not meet this standard of “coercion or duress” because they have alleged their attorney both requested and paid for the medical records, specifically citing HITECH and in some instances the Privacy Rule. Moreover, plaintiffs’ assertion that they were “required” to pay the full amount charged in defendant’s bills in order to obtain their medical records is a conclusion of law that is contrary to HIPAA regulations, which indeed requires a covered entity, such as defendant, to act on an individual’s request for access to PHI within 30 days without regard to payment. See 45 C.F.R. § 164.524 (b)(2); see also 45 C.F.R. § 164.524 (c)(4) (providing separate rules for imposition of fees for copies of PHI). Specifically, under the timely action rule, the covered entity must “provide the access requested,” or “provide the individual with a written denial” within 30 days of receipt of the request. 45 C.F.R. § 164.524 (b)(2)(i). Here, there is no factual allegation permitting an inference that defendant did not or would not comply with this provision. Furthermore, in the alternative, plaintiffs have not demonstrated that “an equitable remedy based upon a quasi-contract or a contract implied in law,” necessary to establish an unjust enrichment claim, is warranted under the circumstances alleged. Ron Medlin Const. v. Harris, 364 N.C. 577, 580 (2010). Recovery “must depend on the justice and equity of the case.” Dean v. Mattox, 250 N.C. 246, 251 (1959). “The purpose of such equity-inspired relief is to provide just compensation for the wrong, not to impose a penalty, and such relief is given in accordance with the principles governing equity jurisdiction, not to inflict punishment but to prevent an unjust enrichment.” Hannon Armstrong & Co. v. Sumitomo Tr. & Banking Co., 973 F.2d 359 , 365 (4th Cir. 1992). Here, plaintiffs have alleged that the issue of the amount of charges allowed under HITECH and the Privacy Rule, where an attorney requests medical records on behalf of a client for a personal injury matter, as here, has been subject of complaints made directly to HHS, and a lawsuit by defendant against HHS over its interpretation of HITECH, in the United States District Court for the District of Columbia, captioned Ciox Health, LLC v. Azar, No. 1:18-CV-40 (D.D.C.). (See Compl. ¶¶ 60-61, 63-67).5 With respect to the complaints made to HHS, the department allegedly “warned that [it] might initiate a formal investigation if the department received similar complaints.” (Id. ¶ 61). In such circumstances, where the issue of amount of charges payable upon a request for records by a third-party attorney is a matter of dispute before HHS and subject to resolution as a matter of federal law, plaintiffs have not demonstrated that justice and equity under North Carolina law requires an equitable remedy of unjust enrichment. Cf. Faber, 944 F.3d at 597 (“Plaintiffs cite no authority remotely suggesting that ‘justice and equity’ under Tennessee common law so requires.”). In sum, plaintiffs have failed to allege facts establishing a claim to the equitable remedy of a contract implied in law to recover their voluntary payment of alleged overcharges. Therefore, their unjust enrichment claim must be dismissed as a matter of law. d. Dismissal With Prejudice Given that plaintiffs’ substantive claims fail as a matter of law, plaintiffs have not established entitlement to relief in the form of declaratory judgment, injunction, or punitive damages. In addition, where the viability of plaintiffs’ claims turns largely upon issues of the 5 On January 27, 2020, the United States District Court for the District of Columbia declared unlawful and vacated a 2013 HHS rule pertaining to “third-party directive[s]” and 2016 HHS guidance regarding extension of “the Patient Rate to reach third-party directives.” See Ciox Health, LLC v. Azar, No. 18-CV-40-APM, 2020 WL 418454 * 25 (D.D.C. Jan. 27, 2020). This ruling calls into question the legal premise to plaintiffs’ complaint, namely whether defendant’s alleged conduct violated HIPAA, HITECH, or the Privacy Rule. scope of North Carolina law, and it is unlikely that any amendment to the factual allegations will cure the deficiencies in plaintiffs’ claims, dismissal in this instance is with prejudice. CONCLUSION Based on the foregoing, defendant’s motion to dismiss for lack of subject matter Jurisdiction under Rule 12(b)(1) (DE 31) is DENIED and its motion to dismiss for failure to state a claim under Rule 12(b)(6) (DE 33) is GRANTED. Plaintiffs’ claims are DISMISSED WITH PREJUDICE. The clerk is DIRECTED to close this case. SO ORDERED, this the 3rd day of February, 2020. Copii Mca — nited States District Judge