FILED
United States Court of Appeals
UNITED STATES COURT OF APPEALS Tenth Circuit
FOR THE TENTH CIRCUIT February 14, 2020
_________________________________
Christopher M. Wolpert
Clerk of Court
CASSANDRA FREIER,
Plaintiff - Appellant,
v. No. 19-1347
(D.C. No. 1:19-CV-00702-LTB-GPG)
THE STATE OF COLORADO; (D. Colo.)
NORTHEAST HEALTH PARTNERS,
LLC; BEACON HEALTH OPTIONS,
INC.; DOES 1-100,
Defendants - Appellees.
_________________________________
ORDER AND JUDGMENT*
_________________________________
Before LUCERO, PHILLIPS, and EID, Circuit Judges.
_________________________________
Cassandra Freier appeals the district court’s dismissal of her claim that defendants
improperly disclosed her personal health information. Exercising jurisdiction under 28
U.S.C. § 1291, we affirm.
*
After examining the briefs and appellate record, this panel has determined
unanimously that oral argument would not materially assist in the determination of
this appeal. See Fed. R. App. P. 34(a)(2); 10th Cir. R. 34.1(G). The case is therefore
ordered submitted without oral argument. This order and judgment is not binding
precedent, except under the doctrines of law of the case, res judicata, and collateral
estoppel. It may be cited, however, for its persuasive value consistent with
Fed. R. App. P. 32.1 and 10th Cir. R. 32.1.
I
After Freier’s health insurance company requested her medical files from her
healthcare provider to review the claims for payment, Freier sued. She alleged that the
request violated the Health Insurance Portability and Accountability Act (“HIPAA”), 42
U.S.C. § 1320d-6, and constituted professional negligence and deceptive business
practices. Adopting the magistrate judge’s report and recommendation, the district court
dismissed Freier’s HIPAA claim with prejudice under 28 U.S.C. § 1915(e)(2)(B)(ii). It
concluded the claim was legally frivolous because HIPAA does not authorize a private
right of action. The court declined to exercise supplemental jurisdiction over Freier’s two
state-law claims. Freier timely appealed.
II
We review the district court’s dismissal under § 1915(e)(2)(B)(ii) de novo,
“look[ing] to the specific allegations in the complaint to determine whether they plausibly
support a legal claim for relief.” Kay v. Bemis, 500 F.3d 1214, 1218 (10th Cir. 2007)
(quotation omitted). Our review of the court’s dismissal of Freier’s state-law claims is
for abuse of discretion. See Nielander v. Bd. of Cty. Comm’rs, 582 F.3d 1155, 1172
(10th Cir. 2009). Because Freier proceeds pro se, we “liberally construe [her] pleadings,”
Requena v. Roberts, 893 F.3d 1195, 1205 (10th Cir. 2018), but “do not assume the role of
advocate,” Yang v. Archuleta, 525 F.3d 925, 927 n.1 (10th Cir. 2008) (quotation
omitted).
As an initial matter, Freier failed to submit timely and specific objections to the
magistrate judge’s report and recommendation. Parties who do so generally waive
2
appellate review of factual and legal questions. Moore v. United States, 950 F.2d 656,
659 (10th Cir. 1991). This firm-waiver rule does not apply, however, “when (1) a pro se
litigant has not been informed of the time period for objecting and the consequences of
failing to object, or when (2) the ‘interests of justice’ require review.” Morales-
Fernandez v. I.N.S., 418 F.3d 1116, 1119 (10th Cir. 2005). Freier argues that the second
exception applies because the district court committed plain error in its interpretation of
HIPAA and dismissal of her state-law claims.1 We hold the district court did not err.
We have previously concluded that HIPAA does not confer a private right of
action. Wilkerson v. Shinseki, 606 F.3d 1256, 1267 n.4 (10th Cir. 2010) (“HIPAA
does not create a private right of action for alleged disclosures of confidential
medical information.”). This holding is consistent with those of our sibling circuits
to have considered the issue. See Stewart v. Parkview Hosp., 940 F.3d 1013, 1015
(7th Cir. 2019); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Seaton v.
Mayberg, 610 F.3d 530, 533 (9th Cir. 2010); Acara v. Banks, 470 F.3d 569, 571 (5th
Cir. 2006). “Those courts have reasoned that Congress, by delegating enforcement
authority to the Secretary of Health and Human Services, did not intend for HIPAA
to include or create a private remedy.” Stewart, 940 F.3d at 1015. Moreover,
“HIPAA’s focus on the conduct of those with access to medical information—as
1
Because the magistrate judge notified Freier that failure to object in writing
to the report and recommendation within fourteen days may bar any appeal, the first
exception does not apply.
3
opposed to the rights of individual patients—also weighs against finding an implied
private right of action.” Id.
Freier argues that Wilkerson is no longer good law following a 2009 amendment
to HIPAA, contending that the amended version of § 1320d-6 creates a right of action
because it sets forth an “offense.” We disagree. The amendment added the following
sentence to § 1320d-6:
For purposes of the previous sentence, a person (including an
employee or other individual) shall be considered to have
obtained or disclosed individually identifiable health
information in violation of this part if the information is
maintained by a covered entity (as defined in the HIPAA
privacy regulation described in section 1180(b)(3)) and the
individual obtained or disclosed such information without
authorization.
See Am. Recovery & Reinvestment Act of 2009, Pub. L. No. 111-5, § 13409, 123 Stat.
115, 271 (2009) (codified at § 1320d-6(a)).2 The amendment merely adds language
specifying what constitutes a HIPAA violation. It does not add any “rights-creating
language.” Boswell v. Skywest Airlines, Inc., 361 F.3d 1263, 1267 (10th Cir. 2004)
(citation omitted). And contrary to Freier’s argument that the provision creates a private
right of action because it sets forth an offense, the use of the word “offense” predates the
2
The amendment took effect in February 2010, id. § 13423, 123 Stat. at 276,
after the events that gave rise to the suit in Wilkerson, 606 F.3d at 1260-61.
4
amendment. See HIPAA, Pub. L. No. 104-191, § 1177, 110 Stat. 1936, 2029 (1996)
(codified as amended at § 1320d-6).
Moreover, the amendment provides that state attorneys general, in addition to the
Secretary, can enforce HIPAA violations. See Am. Recovery & Reinvestment Act,
§ 13410(e)(1), 123 Stat. at 274-75 (codified at § 1320d-5(d)). This broadening of
enforcement authority underscores Congress’ intent to limit HIPAA enforcement as
specified in the statute. See Alexander v. Sandoval, 532 U.S. 275, 290 (2001) (“The
express provision of one method of enforcing a substantive rule suggests that Congress
intended to preclude others.”). Thus, the amendment does not change our conclusion that
HIPAA does not provide a private right of action for the alleged disclosure of
confidential medical information.3
We also affirm the district court’s dismissal of Freier’s two state-law claims for
lack of jurisdiction. Neither of these claims presents a federal question. Because Freier
and defendant Northeast Health Partners are both citizens of Colorado, the case does not
satisfy the requirements of diversity jurisdiction. See Grynberg v. Kinder Morgan
3
Although HIPAA does not provide a private right of action, an individual
may file a complaint with the Department of Health and Human Services (“HHS”)
alleging a HIPAA violation. 45 C.F.R. § 160.306. If HHS finds the complaint
meritorious after an investigation, it may refer the case to the Department of Justice
for prosecution under HIPAA’s criminal provisions; obtain voluntary compliance,
corrective action, or a resolution agreement; or issue a formal finding of a violation
and impose a civil penalty. § 160.312(a); HHS, Enforcement Process,
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-
process/index.html (last visited Jan. 31, 2020). If civil penalties are imposed, the
entity on which they are imposed may request a hearing before an administrative law
judge. § 160.504.
5
Energy Partners, L.P., 805 F.3d 901, 905 (10th Cir. 2015) (“Diversity jurisdiction
requires complete diversity—no plaintiff may be a citizen of the same state as any
defendant.”). Given its dismissal of Freier’s HIPAA claim, the district court did not
abuse its discretion in declining to exercise supplemental jurisdiction over the remaining
state-law claims. See Smith v. City of Enid ex rel. Enid City Comm’n, 149 F.3d 1151,
1156 (10th Cir. 1998) (“When all federal claims have been dismissed, the court may, and
usually should, decline to exercise jurisdiction over any remaining state claims.”).
III
AFFIRMED. Freier’s motion to proceed in forma pauperis is GRANTED.
Entered for the Court
Carlos F. Lucero
Circuit Judge
6