USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 1 of 8
[DO NOT PUBLISH]
IN THE UNITED STATES COURT OF APPEALS
FOR THE ELEVENTH CIRCUIT
________________________
No. 20-14726
Non-Argument Calendar
________________________
D.C. Docket No. 1:20-cv-00137-LAG
JUSTIN LASTER,
Plaintiff - Appellant,
versus
CARECONNECT HEALTH INC.,
GRADY MEMORIAL HOSPITAL
CORPORATION,
AMERICUS & SUMTER COUNTY
HOSPITAL AUTHORITY,
PHOEBE SUMTER MEDICAL CENTER,
PHOEBE PUTNEY HEALTH SYSTEM, et al.,
Defendants - Appellees.
________________________
Appeal from the United States District Court
for the Middle District of Georgia
________________________
(April 20, 2021)
USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 2 of 8
Before MARTIN, ROSENBAUM, and BRANCH, Circuit Judges.
PER CURIAM:
Justin Laster, proceeding pro se, filed a lawsuit alleging the unlawful
disclosure of his protected health information. According to Laster’s complaint, he
suffered an injury in May 2019 while working for the Georgia Department of
Corrections (“DOC”). In the months that followed, he sought medical care at various
healthcare facilities, and he filed a workers’ compensation claim and a release
authorizing the disclosure of medical records related to that claim. The DOC
contested the claim, and the Georgia Department of Administrative Services denied
it in September 2019. At that point, in Laster’s view, his medical release terminated.
But according to Laster, after the denial of his claim, his medical providers
unlawfully disclosed his medical records to a law firm acting on behalf of the State
of Georgia and the Department of Administrative Services. It appears that the law
firm sought his medical records after he requested a hearing on his workers’
compensation claim before an Administrative Law Judge.
Based on these facts, Laster alleged violations of Georgia state law and his
federal rights under 18 U.S.C. §§ 241, 245, and 246; the Health Insurance Portability
and Accountability Act of 1996 (“HIPAA”), 42 U.S.C. § 1320d-6; the Public Health
Service Act, 42 U.S.C. § 290dd-2, and accompanying regulations, 42 C.F.R. §§ 2.13
and 2.31; and 42 U.S.C. § 1983.
2
USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 3 of 8
Because Laster requested leave to proceed in forma pauperis, the district court
screened Laster’s complaint under 28 U.S.C. § 1915(e)(2) and sua sponte dismissed
it without prejudice for failure to state a viable claim. The court found that Laster
failed to state a claim under Title 18, HIPAA, and the Public Health Service Act
because those statutes did not create a private cause of action. As for the § 1983
claims, the court concluded that the defendants were private actors not subject to
liability under § 1983. Finally, the court declined to exercise supplemental
jurisdiction over the state-law claims. The court gave Laster thirty days to file an
amended complaint.
Laster chose to appeal instead of filing an amended complaint. See Briehler
v. City of Miami, 926 F.2d 1001, 1002 (11th Cir. 1991) (“[A] plaintiff has the choice
either of pursuing a permissive right to amend a complaint after dismissal or of
treating the order as final and filing for appeal.” (quotation marks omitted)). On
appeal, he largely restates his allegations and contends that the defendants are not
immune from liability because they are subject to Georgia state law and federal law.
We review de novo the sua sponte dismissal of an action for failure to state a
claim, accepting the allegations in the complaint as true. Brown v. Johnson, 387
F.3d 1344, 1347 (11th Cir. 2004). And because Laster is proceeding pro se, we
liberally construe his filings. See Erickson v. Pardus, 551 U.S. 89, 94 (2007).
3
USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 4 of 8
Dismissal for failure to state a claim under 28 U.S.C. § 1915(e)(2) is governed
by the same standard as dismissal for failure to state a claim under Rule 12(b)(6),
Fed. R. Civ. P. Mitchell v. Farcass, 112 F.3d 1483, 1490 (11th Cir. 1997). To
survive a motion to dismiss under Rule 12(b)(6), the complaint must “contain
sufficient factual matter, accepted as true, to state a claim to relief that is plausible
on its face.” Am. Dental Ass’n v. Cigna Corp., 605 F.3d 1283, 1289 (11th Cir. 2010)
(quotation marks omitted). That means the complaint’s factual allegations, accepted
as true, “must be enough to raise a right to relief above the speculative level.” Bell
Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007).
Here, the district court correctly dismissed Laster’s claims under Title 18, the
Public Health Service Act, and HIPAA because these statutes do not create private
rights of action. “[P]rivate rights of action to enforce federal law must be created by
Congress.” Alexander v. Sandoval, 532 U.S. 275, 286 (2001). The critical question
is whether the statute “displays an intent to create not just a private right but also a
private remedy.” Id. Without such Congressional intent, “a cause of action does not
exist and courts may not create one, no matter how desirable that might be as a policy
matter, or how compatible with the statute.” Id. at 286–87.
For starters, Laster cannot rely on 18 U.S.C. §§ 241, 245, and 246 because
these sections pertain to criminal law and do not provide a civil cause of action or
any civil remedies. See Hanna v. Home Ins. Co., 281 F.2d 298, 303 (5th Cir. 1960)
4
USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 5 of 8
(“The sections of Title 18 may be disregarded in this suit. They are criminal in nature
and provide no civil remedies). 1
Nor is a private right of action created by 42 U.S.C. § 290dd-2, under which
42 C.F.R. §§ 2.13 and 2.31 were promulgated. Section 290dd-2 limits the disclosure
of records of substance-abuse programs and provides for criminal penalties for those
who violate the act. But nothing in the language of that statute “suggests that
Congress intended to create a private right of action for violations of the
confidentiality provision.” Ellison v. Cocke Cnty., Tenn., 63 F.3d 467, 470 (6th Cir.
1995). Rather, the language reflects that “Congress intended the statute to be
enforced through the imposition of criminal penalties.” Id.; see also Doe v.
Broderick, 225 F.3d 440, 446–49 (4th Cir. 2000) (holding that § 290dd-2 does not
create a federally-enforceable private right); Chapa v. Adams, 168 F.3d 1036, 1038
(7th Cir. 1999) (holding that § 290dd-2 does not create a private cause of action for
damages).
Likewise, every circuit to have considered the issue has also held that no
private right of action exists under HIPAA. See Meadows v. United Servs., Inc., 963
F.3d 240, 244 (2d Cir. 2020); Faber v. Ciox Health, LLC, 944 F.3d 593, 596–97 (6th
Cir. 2019); Stewart v. Parkview Hosp., 940 F.3d 1013, 1015 (7th Cir. 2019); Dodd
1
This Court adopted as binding precedent all Fifth Circuit decisions prior to October 1,
1981. Bonner v. City of Prichard, 661 F.2d 1206, 1209 (11th Cir. 1981) (en banc).
5
USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 6 of 8
v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Wilkerson v. Shinseki, 606 F.3d 1256,
1267 n.4 (10th Cir. 2010); United States v. Streich, 560 F.3d 926, 935 (9th Cir.
2009); Acara v. Banks, 470 F.3d 569, 570–71 (5th Cir. 2006). HIPAA generally
prohibits the disclosure of medical records without a patient’s consent. See 42
U.S.C. §§ 1320d-1 to 1320d-7. While it provides civil penalties for improper
disclosures of medical information, it does not expressly create a private cause of
action to enforce the prohibition on disclosure. Instead, it limits enforcement of the
statute to the Secretary of the Department of Health and Human Services. See 42
U.S.C. § 1320d-5. For that reason, no private right of action can be implied. “By
delegating enforcement authority to the Secretary of the Department of Health and
Human Services, the statute clearly reflects that Congress did not intend for HIPAA
to create a private remedy.” Meadows, 963 F.3d at 244; see Alexander, 532 U.S. at
290 (“The express provision of one method of enforcing a substantive rule suggests
that Congress intended to preclude others.”). Accordingly, Laster cannot state a
claim to relief under HIPAA.
We also affirm the district court’s dismissal of Laster’s § 1983 claims for
violations of his rights under the Fourteenth Amendment. Section 1983 allows
claims against any person who, acting under color of state law, deprives another of
a constitutional or federal statutory right. 42 U.S.C. § 1983.
6
USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 7 of 8
To establish a § 1983 claim, the plaintiff must show that he was (1) deprived
of a federal right (b) by a “state actor.” Harvey v. Harvey, 949 F.2d 1127, 1130
(11th Cir. 1992). “Only in rare circumstances can a private party be viewed as a
‘state actor’ for section 1983 purposes.” Id. To be considered a state actor for
purposes of § 1983, a private party must have exercised a traditionally exclusive
public function, acted in concert with public officials, or engaged in conduct
compelled by the state. Id. at 1130–31; see Focus on the Family v. Pinellas Suncoast
Transit Auth., 344 F.3d 1263, 1277 (11th Cir. 2003); Bendiburg v. Dempsey, 909
F.2d 463, 468 (11th Cir. 1990).
The district court concluded that the defendants were private parties who
could not be considered “state actors” based on the allegations in Laster’s complaint.
Laster responds that the defendants are subject to suit under § 1983 “because they
are for profit corporations, non-profit corporations, limited liability corporations,
limited liability partnerships, etc. and are subject to Georgia State Law and United
States Federal Law as private individuals are.” But that the defendants are regulated
by and subject to state and federal law is not enough on its own to show that they
acted “under color of law”—that is, that their conduct “may be fairly treated as that
of the State itself.” See Jackson v. Metro. Edison Co., 419 U.S. 345, 350–51 (1974)
(“The mere fact that a business is subject to state regulation does not by itself convert
its action into that of the State for purposes of the Fourteenth Amendment.”).
7
USCA11 Case: 20-14726 Date Filed: 04/20/2021 Page: 8 of 8
Accordingly, we affirm the district court’s conclusion that Laster failed to plausibly
establish that he was harmed by a “state actor” subject to suit under § 1983.
Finally, the district court did not abuse its discretion by declining to exercise
supplemental jurisdiction over Laster’s state-law claims after dismissing all his
federal claims early in the case. See Parker v. Scrap Metal Processors, Inc., 468
F.3d 733, 738 (11th Cir. 2006) (“We review the district court’s decision not to
exercise supplemental jurisdiction for abuse of discretion.”). A district court has
“supplemental jurisdiction” over state-law claims that are closely related to a claim
over which the court has original jurisdiction. 28 U.S.C. § 1367(a). But the court
may decline to exercise supplemental jurisdiction if it “has dismissed all claims over
which it has original jurisdiction.” Id. § 1367(c).
Here, the district court properly declined to exercise supplemental jurisdiction
over Laster’s state-law claims. Laster does not suggest any independent basis for
exercising federal jurisdiction over the state-law claims, and “[w]e have encouraged
district courts to dismiss any remaining state claims when, as here, the federal claims
have been dismissed prior to trial.” Raney v. Allstate Ins. Co., 370 F.3d 1086, 1088–
89 (11th Cir. 2004). Accordingly, the district court did not abuse its discretion in
declining to exercise supplemental jurisdiction over the remaining claims.
AFFIRMED.
8