OPINION
TRAXLER, Circuit Judge:John Doe brought an action against Detective Garrett G. Broderick, see 42 U.S.C.A. § 1983 (West Supp 1998), alleging that Detective Broderick violated Doe’s rights under the Fourth Amendment and under federal statutory law when Detective Broderick, without probable cause, entered the file room of a substance abuse treatment clinic and searched Doe’s confidential treatment records along with numerous other patients’ records. Doe also sought to impose municipal liability upon Fairfax County, Detective Broderick’s employer. The district court denied Detective Broderick qualified immunity at the summary judgment stage, but dismissed Doe’s claim against Fairfax County. We affirm in part, reverse in part, and remand the matter for trial.
I.
In August 1998, a jewelry store reported a grand larceny to the Fairfax County *444Police Department. Detective Broderick was among those assigned to investigate the matter. The report submitted by the jewelry store indicated that the suspect, a white male, asked a sales clerk to show him a diamond engagement ring. When she handed the ring over for inspection, the suspect ran from the store and then fled the scene in a vehicle parked nearby and driven by an accomplice. The sales clerk, however, was able to obtain the tag number for the vehicle. Broderick determined that the suspect had escaped in a car stolen from a parking garage located in the same vicinity as the jewelry store. The parking garage was also situated near the Fairfax Methadone Treatment Center (“the methadone clinic” or “clinic”), a facility that provided treatment for a wide variety of substance abuse problems.
Based on these facts, and his belief that drug addicts often engage in criminal activity to support their habits, Detective Broderick hypothesized that the suspect may have been a patient at the nearby methadone clinic. He concluded that it would aid his investigation if he could establish the identities of the patients who had been receiving treatment at the methadone clinic during or near the time that the grand larceny occurred. Accordingly, Detective Broderick telephoned the clinic and indicated that he wanted to examine records that would reveal who was at the clinic at the time of the grand larceny. The clinic refused, however, to disclose any information in the absence of a court order.
As a result, Detective Broderick consulted Assistant Commonwealth Attorney Ian Rodway for advice on how to proceed. According to Detective Broderick, he explained to Rodway why he believed that the suspect could have come from the methadone clinic and asked Rodway how he could obtain access to the clinic’s records. Rodway, however, remembers that Detective Broderick indicated that he wanted only to examine the entries in the clinic’s log book. In any event, Rodway told him that it would be necessary for him to get a search warrant. They did not discuss whether Detective Broderick’s theory established probable cause.
Detective Broderick then prepared a proposed search warrant that directed that the clinic be searched for “records, documents and photographs.” J.A. 227. He also drafted a supporting affidavit in which he requested that the search include the following:
the full names of all patients, dates of birth, social security numbers, photographs, home addresses and work locations if availablef,] the opening of any file cabinets, desks, closets, locked safes, boxes, bags, compartments or things in the nature ther[e]of, found in or upon said premises to include any and all electronically stored computer data.
J.A. 232. The affidavit explained that, based on his training and experience, Detective Broderick believed that the grand larceny suspect was potentially someone who was receiving treatment at the methadone clinic:
Based upon your Affiant’s training, experience and participation in other criminal investigations [of] offenses concerning Grand Lareen[ies] your Affiant knows:
That it is common for people who have addictions[to] various narcotics to include but not limited to heroin, cocaine, methadone, and other schedule one and schedule two narcotics to engage in these kinds of criminal activities to support [their] daily drug addictions. It is your Affiant’s experience that heroin and cocaine addicts will obtain stolen vehicles and go on crime spree[s] stealing various merchandise which is easily sold on the streets for [ ] quick cash to support [their] drug addictions.
Based on [these] facts, it is your Affi-ant’s belief that ... (the methadone treatment) clinic holds information on possible suspects.
*445J.A. 232. After circulating the affidavit and proposed warrant to other officers for feedback, Detective Broderick submitted the materials to a magistrate judge, who issued a search warrant.
Armed with the warrant, Detective Bro-derick and five other Fairfax County officers entered the methadone clinic to execute the search warrant. Even though the police officers had a search warrant, an employee of the clinic initially refused to open the door to the room where the files were kept. She eventually relented, however, when the officers threatened to charge her with obstruction of justice. A number of items were then seized from the clinic, including the clinic’s log book, files containing biographical information for seventy-nine male patients being treated at the clinic, photographs of these patients, and a large number of dosage sheets that detailed how much methadone was being administered to a given patient. The file of appellee John Doe (“Doe”) was among the records seized, and it included his name, photograph, address, methadone dosage information, urine screen history, and confidences Doe shared with his counselors at the clinic. Doe’s file contained only information that had been compiled by the clinic staff during Doe’s treatment at the clinic. Although Doe was receiving treatment from the clinic during this general time frame, he was not present at the clinic at the time of the search.
The patients’ files were taken to the Fairfax County Police Department and stored in Detective Broderick’s office. Detective Broderick went through the files in order to match the photographs of the patients with the background information contained in the clinic records. Photocopies were made of the patient photographs. Otherwise, the material seized from the clinic was undisturbed. About two weeks following the execution of the search warrant, Fairfax County police returned the seized material and the photocopies to the clinic.
Doe brought this civil rights action against Detective Broderick and Fairfax County, alleging that Broderick lacked probable cause to seize his patient files maintained at the clinic and, therefore, violated his right to be free from unreasonable searches and seizures under the Fourth Amendment. See 42 U.S.C.A. § 1988 (West Supp.1998). Doe also alleged a section 1983 claim against the defendants on the alternate basis that Detective Broderick failed to comply with the requirements of a federal statute that regulates the disclosure of drug treatment records. See 42 U.S.C.A. § 290dd-2 (West Supp.1998).1
Asserting that he was entitled to qualified immunity, Detective Broderick moved for summary judgment on Doe’s section 1983 claims against him in his individual capacity. The district court denied Bro-derick’s motion. The court concluded that Doe had a reasonable expectation of privacy in his records at the methadone clinic, and that Broderick lacked probable cause to conduct the search, thus violating the Fourth Amendment and 42 U.S.C.A § 290dd-2.2 The court then determined *446that the law was clearly established at the time that Broderick’s search of Doe’s files stored at the clinic violated his rights under section 290dd-2. The district court also apparently concluded, but did not expressly state, that Detective Broderick’s conduct violated clearly established Fourth Amendment law because the court ultimately denied Detective Broderick’s motion for summary judgment based on qualified immunity. Detective Broderick immediately appealed the denial of qualified immunity.
Fairfax County also moved for summary judgment. The district court granted the motion, concluding that the record contained no evidence that the alleged deprivation occurred because of a custom or practice. Doe appeals from the district court’s grant of summary judgment to Fairfax County.
II.
We turn first to Detective Broderick’s invocation of qualified immunity, which protects government officials performing discretionary functions “from liability for civil damages insofar as their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known.” Harlow v. Fitzgerald, 457 U.S. 800, 818, 102 S.Ct. 2727, 73 L.Ed.2d 396 (1982). Qualified immunity exists fundamentally to protect officers in the performance of their duties unless they are “plainly incompetent” or they “knowingly violate the law.” Malley v. Briggs, 475 U.S. 335, 341, 106 S.Ct. 1092, 89 L.Ed.2d 271 (1986).
To determine whether Detective Broderick is entitled to qualified immunity, we follow a two-step analytical process. First, we must determine whether Doe has alleged the deprivation of a constitutional or statutory right in the first place. See Wilson v. Layne, 526 U.S. 603, 609, 119 S.Ct. 1692, 143 L.Ed.2d 818 (1999). If so, we may proceed to determine whether Detective Broderick is entitled to qualified immunity or whether, because he ran afoul of clearly established constitutional rights, he is to be held personally accountable for his unlawful conduct. See id.; Harlow, 457 U.S. at 818, 102 S.Ct. 2727.
Accordingly, we begin with the first inquiry and address Doe’s argument that Detective Broderick abridged his rights under both 42 U.S.C.A. § 290dd-2 and the Fourth Amendment to the United States Constitution. We consider these rights in turn.
A.
Doe first contends that Congress has afforded him an individual statutory right under 42 U.S.C.A. § 290dd-2, which prohibits, except in limited circumstances, the disclosure of “[rjecords of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research.” 42 U.S.C.A. § 290dd-2(a). The statute sharply limits the availability of such records for use in criminal proceedings: “Except as authorized by a court order granted under subsection (b)(2)(C) of this section, no record referred to in subsection (a) of this section may be used to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient.” 42 U.S.C.A. § 290dd-2(c). In turn, subsection (b)(2)(C) permits disclosure only upon an “application showing good cause therefor, including the need to avert a substantial risk of death or serious bodily harm.”3 *447Significantly, the statute imposes criminal sanctions on those who transgress it, providing that “[a]ny person who violates any provision of this section or any regulation issued pursuant to this section shall be fined in accordance with Title 18.” 42 U.S.C.A. § 290dd-2(f).
There is no question that the confidentiality and disclosure provisions contained in section 290dd-2 were not satisfied. But, Detective Broderick’s failure to observe the requirements of section 290dd-2, or any other federal statute, does not automatically give rise to a civil rights claim pursuant to section 1983. This is because “[s]eetion 1983 itself creates no rights; rather it provides ‘a method for vindicating federal rights elsewhere conferred.’ ” Kendall v. City of Chesapeake, 174 F.3d 437, 440 (4th Cir.1999) (quoting Albright v. Oliver, 510 U.S. 266, 271, 114 S.Ct. 807, 127 L.Ed.2d 114 (1994)). “In order to seek redress through § 1983 ... a plaintiff must assert the violation of a federal right, not merely a violation of federal law” Blessing v. Freestone, 520 U.S. 329, 340, 117 S.Ct. 1353, 137 L.Ed.2d 569 (1997) (emphasis in original). Even if a civil rights plaintiff has shown that' a federally-created right has been abridged, section 1983 is still unavailable as a remedy if “Congress has foreclosed such enforcement of the statute in the enactment itself.” Wright v. City of Roanoke Redevelopment & Hous. Auth., 479 U.S. 418, 423, 107 S.Ct. 766, 93 L.Ed.2d 781 (1987). Congress can foreclose recourse to section 1983 by expressly forbidding it in the statute or by impliedly doing so through the creation of a comprehensive scheme to enforce the statute. See Blessing, 520 U.S. at 341, 117 S.Ct. 1353.
Thus, the violation of a federal statute is not actionable under section 1983 if one of the following is true: (1) “the statute d[oes] not create enforceable rights, privileges, or immunities within the meaning of § 1983,” or (2) “Congress has foreclosed such enforcement of the statute in the enactment itself.” Wright, 479 U.S. at 423, 107 S.Ct. 766. Detective Broderick argues that both are true in this case. We agree that section 290dd-2 does not create individual entitlements that can be enforced via section 1983.
The district court considered three factors, identified by the Supreme Court in Blessing, in assessing whether a statute creates an actionable federal right. Blessing tells us that the following questions are relevant to the determination of whether a statute creates an individual, enforceable right: Did Congress intend the statutory provision to benefit plaintiff? Is the ostensible right so “vague and amorphous” that its enforcement would prove difficult? And, is the statutory provision at issue phrased in mandatory rather than discretionary terms? See Blessing, 520 U.S. at 340-41, 117 S.Ct. 1353. The district court’s application of Blessing led it to conclude that Congress intended to provide Doe a right against disclosure of his drug treatment records, except as specifically delineated in § 290dd-2, that is enforceable through civil litigation.
In our view, Congress did not enact section 290dd-2 for the principal benefit of Doe and others who receive treatment at drug rehabilitation facilities. To begin with, we note that this statute is an unlikely spot for Congress to establish an actionable right, and we say this primarily because section 290dd-2 imposes criminal sanctions on would-be violators. See 42 U.S.C.A. § 290dd-2(f). The Supreme Court historically has been loath to infer a private right of action from “a bare criminal statute,” Cort v. Ash, 422 U.S. 66, 80, 95 S.Ct. 2080, 45 L.Ed.2d 26 (1975), because criminal statutes are usually couched in terms that afford protection to the general public instead of a discrete, well-de*448fined group. See California v. Sierra Club, 451 U.S. 287, 294, 101 S.Ct. 1775, 68 L.Ed.2d 101 (1981) (rejecting the view that “a victim of any crime would be deemed an especial beneficiary of the criminal statute’s proscription”); Cannon v. University of Chicago, 441 U.S. 677, 690, 99 S.Ct. 1946, 60 L.Ed.2d 560 (1979).
Significantly, the fact that criminal statutes do not ordinarily create individual rights led the' Seventh Circuit Court of Appeals to conclude that section 290dd-2 does not confer rights on any specific group of beneficiaries because it is a criminal provision that was enacted for the good of the public at large. See Chapa v. Adams, 168 F.3d 1036, 1038 (7th Cir.), cert. denied, — U.S.-, 120 S.Ct. 104, 145 L.Ed.2d 88 (1999). We find Chapa’s reasoning persuasive:
Section 290dd-2 is a criminal prohibition, and it has been a long time since the Supreme Court used a criminal law as the basis of a private civil action. Some statutes defining crimes also authorize agencies to file civil suits, and the Court has occasionally held that these may be supplemented by private enforcement — though [such] decisions ... have been in bad odor since the late 1970s. Today the principal question is whether the statute creates rights in favor of identified persons. If yes, a private action to enforce these rights is apt to be inferred; otherwise not. Criminal statutes, which express prohibitions rather than personal entitlements and specify a particular remedy other than civil litigation, are accordingly poor candidates for the imputation of private rights of action.
Personal rights could in principle be 1 derived from criminal statutes. The rule “do not rob a bank” implies that a bank has a right not to be robbed.- But the Supreme Court has been unwilling to treat criminal laws as implying private entitlements in this fashion and has held that the victims of crime therefore lack any legal right to compel a criminal prosecution. That reluctance to form private entitlements from criminal prohibitions blocks the judicial creation of private rights of action as well.
Chapa, 168 F.3d at 1037-38 (citations omitted).
We recognize, of course, that determining whether a statutory violation may be enforced through section 1983 “is a' different inquiry than that involved in determining whether a private right of action can be implied from a particular statute.” Wilder v. Virginia Hosp. Ass’n, 496 U.S. 498, 508 n. 9, 110 S.Ct. 2510, 110 L.Ed.2d 455 (1990); see Former Spec. Project Emp. Ass’n v. City of Norfolk, 909 F.2d 89, 91-94 (4th Cir.1990). These inquiries overlap, however. In either case, we are required to determine whether Congress has created a right that can be enforced. Compare Blessing, 520 U.S. at 341, 117 S.Ct. 1353 (a section 1983 plaintiff must “demonstrate[ ] that a federal statute creates an individual right”), with Cort, 422 U.S. at 78, 95 S.Ct. 2080 (a private right of action exists for the violation of a federal statute only if “the statute create[s] a federal right in favor of the plaintiff’). Cf. Suter v. Artist M., 503 U.S. 347, 363, 112 S.Ct. 1360, 118 L.Ed.2d 1 (1992) (“Having concluded that § 671(a)(15) does not create a federally enforceable right ... under § 1983, the conclusion of the Court of Appeals that the Adoption Act contains an implied right of action for private enforcement ... may be disposed of quickly.”).
There is nothing in the text of section 290dd-2 to indicate that Congress had in mind the creation of individual rights. For example, instead of providing patients with the right to maintain the privacy of their records, subsection (a) establishes a broad proscription against the disclosure of substance abuse treatment records maintained not only for rehabilitation but for education, training, and research. See 42 U.S.C.A. § 290dd-2(a). Subsection (b) permits disclosure pursuant to a court order that balances “the public interest and the need for disclosure against the injury *449to the patient, to the physician-patient relationship, and to the treatment services.” See 42 U.S.C.A. § 290dd-2(b)(2)(C) (emphasis added). The language used in section 290dd-2 suggests that Congress was concerned primarily with fostering programs aimed at curtailing our nation’s staggering substance abuse problems. The primary beneficiary is the public. Ensuring the confidentiality of patient records encourages voluntary participation in such programs which, in turn, improves public health. See Chapa, 168 F.3d at 1038 (“Like other criminal statutes, § 290dd-2 creates rights in favor of society, not just particular members of society. ... Addicts will be more likely to accept treatment — and the rest of society therefore will be better off — if treatment is confidential.”). Legislative history, moreover, confirms that Congress enacted the section as part of an effort to combat the American public’s drug abuse problem and that Congress intended to encourage individuals to seek treatment. See H.R. Conf. Rep. No. 92-775, at 28 (1972), reprinted in 1972 U.S.C.C.A.N. 2045, 2072 (explaining the confidentiality provisions in the predecessor to section 290dd-2 were necessary because “[wjithout that assurance, fear of public disclosure of drug abuse or of records that will attach for life will discourage thousands from seeking the treatment they must have if this tragic national problem is to be overcome.”); S.Rep. No. 102-131, at 2 (1992), reprinted in 1992 U.S.C.C.A.N. 277, 278 (The Alcohol, Drug Abuse and Mental Health Administration Reorganization Act, of which section 290dd-2 was a part, was aimed at fighting “drug abuse, alcohol abuse, and mental illness.”); see generally Ellison v. Cocke County, Tenn., 63 F.3d 467, 470-71 (6th Cir.1995).
Only the Sixth Circuit Court of Appeals has considered the precise issue before us — whether 42 U.S.C.A. § 290dd-2 establishes rights that are enforceable through section 1983. See Ellison, 63 F.3d at 471-72. Ellison concluded that “Congress did not ‘unambiguously confer’ upon the patient-beneficiaries the right to enforce the statute’s confidentiality provision through a Section 1983 claim.” Id. at 472 (quoting Suter, 503 U.S. at 363, 112 S.Ct. 1360). We agree. We hold that section 290dd-2 does not create “enforceable rights, privileges, or immunities within the meaning of § 1983.” Wright, 479 U.S. at 423, 107 S.Ct. 766.
Accordingly, we reverse the judgment of the district court to the extent it permits Doe to pursue a section 1983 claim based on Detective Broderick’s failure to comply with section 290dd-2.
B.
Doe next alleges that Detective Broder-ick trenched upon his Fourth Amendment rights when Broderick seized his records from the methadone clinic without probable cause. The district court concluded that Doe had a legitimate expectation of privacy in his files that were held by the methadone clinic, giving rise to the Fourth Amendment’s protection against unreasonable searches and seizures. See United States v. Miller, 425 U.S. 435, 440, 96 S.Ct. 1619, 48 L.Ed.2d 71 (1976) (“[N]o interest legitimately protected by the Fourth Amendment is implicated by governmental investigative activities unless there is an intrusion into a zone of privacy.” (internal quotation marks omitted)). The district court found that Detective Broderick’s search of Doe’s clinic records lacked probable .cause and therefore violated Doe’s Fourth. Amendment rights. Turning to the question of qualified immunity, the district court observed' — without elaborating further — that Doe’s Fourth Amendment right against tlm search of his clinic files in the absence of probable cause “was arguably not clearly established under existing law at the time of [Detective] Broderick’s search.” J.A. 539. Nevertheless, the district court apparently concluded that this right was clearly established because the court ultimately denied Detective Broder-ick’s motion for summary judgment.
*4501.
We first consider Doe’s claim that Detective Broderick violated his Fourth Amendment rights by obtaining and examining his patient file during the search of the methadone clinic without probable cause. We conclude that Doe has stated a claim under the Fourth Amendment. Indeed, at oral argument Detective Broder-ick conceded this point. However, we are obliged to address this point to “promote[ ] clarity in the legal standards for official conduct, to the benefit of both the officers and the general public.” Wilson, 526 U.S. at 609, 119 S.Ct. 1692.
The protections of the Fourth Amendment are triggered when an individual seeking refuge under the Fourth Amendment “has a legitimate expectation of privacy in the invaded place” or the item seized. Rakas v. Illinois, 439 U.S. 128, 143, 99 S.Ct. 421, 58 L.Ed.2d 387 (1978); see United States v. Rusher, 966 F.2d 868, 873-74 (4th Cir.1992). Thus, searches and seizures conducted in the absence of probable cause and a warrant are impermissible only if the officer encroaches upon a legitimate expectation of privacy. See California v. Greenwood, 486 U.S. 35, 39, 108 S.Ct. 1625, 100 L.Ed.2d 30 (1988). A legitimate expectation of privacy exists when the individual seeking Fourth Amendment protection maintains a “subjective expectation of privacy” in the area searched that “society [is] willing to recognize ... as reasonable.” California v. Ciraolo, 476 U.S. 207, 211, 106 S.Ct. 1809, 90 L.Ed.2d 210 (1986); see Oliver v. United States, 466 U.S. 170, 177-78, 104 S.Ct. 1735, 80 L.Ed.2d 214 (1984) (explaining that the legitimacy of a reasonable expectation of privacy under the Fourth Amendment is determined by “our societal understanding”).
There is no question that Doe maintained a genuine subjective expectation of privacy'in his records and files kept at the methadone clinic.4 The more interesting issue is whether a patient’s expectation of privacy — Doe’s expectation of privacy — in his treatment records and files maintained by a substance abuse treatment center is one that society is willing to recognize as objectively reasonable and thus comes within ambit of the Fourth Amendment’s protections. See Greenwood, 486 U.S. at 39, 108 S.Ct. 1625. We think it is.
Section 290dd-2 is relevant to the determination of whether there is a “societal understanding” that Doe has a legitimate expectation of privacy in his treatment records. In United States v. Miller, 425 U.S. 435, 442-43, 96 S.Ct. 1619, 48 L.Ed.2d 71 (1976), the Supreme Court observed that “[t]he lack of any legitimate expectation of privacy concerning the information kept in bank records was assumed by Congress in enacting the Bank Secrecy Act, the express purpose of which is to require records to be maintained because they ‘have a high degree of usefulness in criminal, tax, and regulatory investigations and proceedings.’ ” The relevant statute here, 42 U.S.C.A. § 290dd-2, does quite the opposite, making access to the records more difficult for criminal investigation purposes. Under these circumstances, we think that the statute is a fitting indication that society is willing to recognize Doe’s expectation of privacy as objectively reasonable. See Florida v. Riley, 488 U.S. *451445, 451, 109 S.Ct. 693, 102 L.Ed.2d 835 (1989) (plurality opinion) (analyzing defendant’s expectation of privacy by reference to FAA regulations); cf. Greenwood, 486 U.S. at 43-44, 108 S.Ct. 1625 (rejecting the argument that a reasonable expectation of privacy can be determined solely by state law because the analysis turns on “our societal understanding” of what deserves Fourth Amendment protection) (internal quotation marks omitted). The reason for this is apparent: medical treatment records contain intimate and private details that people do not wish to have disclosed, expect will remain private, and, as a result, believe are entitled to some measure of protection from unfettered access by government officials. We are satisfied that Doe maintained a legitimate expectation of privacy in his substance abuse treatment records for Fourth Amendment purposes.
2.
Having concluded that the Fourth Amendment protects Doe’s legitimate privacy interest in his substance abuse treatment records, we turn briefly to consider whether Detective Broderick’s admitted conduct amounted to a violation of the Fourth Amendment. To be constitutional, a search must be “reasonable.” See Vernonia School Dist. v. Acton, 515 U.S. 646, 653, 115 S.Ct. 2386, 132 L.Ed.2d 564 (1995). When law enforcement officials are searching for evidence of a crime, reasonableness requires probable cause and a warrant unless one of the exceptions to the warrant requirement applies. See Katz v. United States, 389 U.S. 347, 357, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967) (calling “per se unreasonable” any search conducted without a warrant issued by a judge or magistrate pursuant to a showing of probable cause and in the absence of an exception).
The fundamental constitutional principle that search warrants must be founded upon probable cause derives from the language of the Fourth Amendment itself, which provides that “no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” U.S. Const. amend. IV; see United States v. Harris, 403 U.S. 573, 577, 91 S.Ct. 2075, 29 L.Ed.2d 723 (1971). A police officer seeking the issuance of a search warrant must present an affidavit containing facts sufficient to “provide the magistrate with a substantial basis for determining the existence of probable cause.” Illinois v. Gates, 462 U.S. 213, 239, 103 S.Ct. 2317, 76 L.Ed.2d 527 (1983). Probable cause exists when “there are reasonably trustworthy facts which, given the totality of the circumstances, are sufficient to lead a prudent person to believe that the items sought constitute fruits, instrumentalities, or evidence of crime and will be present at the time and place of the search.” United States v. Suarez, 906 F.2d 977, 984 (4th Cir.1990). The officer’s supporting affidavit must make it apparent, therefore, that there is some nexus between the items to be seized and the criminal activity being investigated. See Warden v. Hayden, 387 U.S. 294, 307, 87 S.Ct. 1642, 18 L.Ed.2d 782 (1967).
By contrast, Detective Broderick’s affidavit does not identify a single fact that would suggest to a reasonable person that there was any link whatsoever between the methadone clinic and the jewelry theft. We agree with the district court that “if Broderick’s premise — that drug addicts steal to finance their addictions — were enough for probable cause, it would allow him to search any location where drug addicts might congregate during his investigation of any local theft.... [H]e ostensibly could conduct routine, general searches of Fairfax County.” J.A. 535. The effect of issuing a warrant based on Detective Broderick’s hypothesis was to sanction an exploratory search through clinic records based on a hunch, which is impermissible. See Andresen v. Maryland, 427 U.S. 463, 480, 96 S.Ct. 2737, 49 L.Ed.2d 627 (1976) (explaining the Fourth Amendment is designed specifically to pro*452hibit the use of general warrants whereby the authorities engage in “a general, exploratory rummaging in a person’s belongings.”).
In sum, Detective Broderick’s affidavit offered nothing more than a guess, based not on specific and reliable facts but on a broad generalization, that drug addicts are prone to steal things to support their drug habits. Because a mere hunch that illegal activity is afoot will not provide a valid foundation for the issuance of a search warrant, see United States v. Sokolow, 490 U.S. 1, 7, 109 S.Ct. 1581, 104 L.Ed.2d 1 (1989), we conclude — and Detective Broderick does not dispute — that there was no probable cause justifying the search and seizure of patient records from the methadone clinic, and that no reasonable officer in his shoes could have believed otherwise.5
Thus, we find that Detective Broderick’s search of the clinic’s records and files without probable cause violated Doe’s rights under the Fourth Amendment, as Detective Broderick candidly admits.
III.
We turn now to the question of qualified immunity. Detective Broderick argues that he is protected by qualified immunity because it was not clearly established in August 1998 that patients in drug treatment facilities had a legitimate expectation of privacy in their files stored at those facilities and, therefore, that it was not clearly established that an officer would violate their Fourth Amendment rights by entering a clinic and conducting a search of confidential patient files and records without a warrant or the slightest hint of probable cause. In view of the admitted lack of probable cause in his warrant to search a private area within the clinic for closely held treatment information, we think Detective Broderick misses the mark when he argues that his immunity from suit hinges on Doe’s expectation of privacy in his treatment records.
Qualified immunity exists to balance two significant, but incompatible, policy considerations. See Anderson v. Creighton, 483 U.S. 635, 638, 107 S.Ct. 3034, 97 L.Ed.2d 523 (1987). Section 1983 allows an aggrieved citizen to hold state and local law enforcement officers liable for violating his federally protected rights; monetary liability “ ‘may offer the only realistic avenue for vindication of constitutional guarantees.’ ” Id. (quoting Harlow v. Fitzgerald, 457 U.S. 800, 814, 102 S.Ct. 2727, 73 L.Ed.2d 396 (1982)). Subjecting officers to civil liability, however, creates the undesirable possibility that they would be “unduly inhibit[ed] ... in the discharge of their duties,” id., and that government would be “excessively] disrupted],” Harlow, 457 U.S. at 818, 102 S.Ct. 2727, by officers who are concerned primarily with avoiding personal liability. As this court has previously observed, “[t]he police must have the ability to move swiftly to solve crimes or to apprehend dangerous criminals before evidence is destroyed or becomes stale, witnesses die or vanish, or a suspect has a chance to escape or to repeat *453the crime.” Porterfield v. Lott, 156 F.3d 563, 567 (4th Cir.1998).
Therefore, police officers who are investigating criminal wrongdoing are accorded qualified immunity to “shield[ ] [them] from liability for civil damages insofar as their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known.” Harlow, 457 U.S. at 818, 102 S.Ct. 2727. “Qualified immunity thus provides a ‘safe-harbor’ from tort damages for police officers performing objectively reasonable actions in furtherance of their duties.” Porterfield, 156 F.3d at 568 (emphasis added). This “safe-harbor” ensures that officers will not be liable for “bad guesses in gray areas” 'but only for “transgressing bright lines.” Maciariello v. Sumner, 973 F.2d 295, 298 (4th Cir.1992). Of course, officers are not afforded protection when they are “plainly incompetent or ... knowingly violate the law.” Malley, 475 U.S. at 341, 106 S.Ct. 1092. But, in gray areas, where the law is unsettled or murky, qualified immunity affords protection to an officer who takes an action that is not clearly forbidden — even if the action is later deemed wrongful. Simply put,' qualified immunity exists to protect those officers who reasonably believe that their actions do not violate federal law.
Officer Broderick was not operating in a murky area of the law. Firmly-rooted precedent would have made it apparent to a reasonable officer that Detective Broderick’s conduct was unlawful under the Fourth Amendment. It is safe to say that in August 1998, it was clear that law enforcement officials were not free to barge into an area within a place of business where the public was not invited and over the objection of the proprietors conduct a general search for evidence of a crime without the slightest hint of probable cause. The expectation that one generally remains free from warrantless searches in the privacy of the home is at the heart of the Fourth Amendment, see Silverman v. United States, 365 U.S. 505, 511-12, 81 S.Ct. 679, 5 L.Ed.2d 734 (1961), but the Supreme Court has long recognized that searches of office buildings and commercial premises in the absence of a search warrant grounded upon probable cause are unreasonable as well, see Marshall v. Barlow’s, Inc., 436 U.S. 307, 311, 98 S.Ct. 1816, 56 L.Ed.2d 305 (1978); G.M. Leasing Corp. v. United States, 429 U.S. 338, 353, 97 S.Ct. 619, 50 L.Ed.2d 530 (1977); See v. City of Seattle, 387 U.S. 541, 543, 87 S.Ct. 1737, 18 L.Ed.2d 943 (1967). And, it is not a new concept that even in a public facility, government officials cannot search for evidence of a crime, absent probable cause, in areas that are closely guarded and private. See Katz, 389 U.S. at 351, 88 S.Ct. 507 (“What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.” (citations omitted)). Thus, not surprisingly, the Supreme Court has determined that a search of desk drawers and locked file cabinets located in a workplace is almost always unreasonable if it fails to conform to the warrant requirement. See Mancusi v. De-Forte, 392 U.S. 364, 88 S.Ct. 2120, 20 L.Ed.2d 1154 (1968); Go-Bart Importing Co. v. United States, 282 U.S. 344, 51 S.Ct. 153, 75 L.Ed. 374 (1931); cf. Lo-Ji Sales, Inc. v. New York, 442 U.S. 319, 99 S.Ct. 2319, 60 L.Ed.2d 920 (1979) (“[T]here is no basis for the notion that because a retail store invites the public to enter, it consents to wholesale searches and seizures that do not conform to Fourth Amendment guarantees.”).
The proposition that police officers should obey the Fourth Amendment before searching private areas concealed by locked cabinets and doors remains valid when the doors and cabinets are found in a medical facility, and the Supreme Court has acknowledged as much. In O’Connor v. Ortega, 480 U.S. 709, 107 S.Ct. 1492, 94 L.Ed.2d 714 (1987) (plurality opinion), the *454Court examined the appropriate limits of an administrative search conducted by a public hospital during a fraud investigation of one of its physician-employees. The search encompassed the physician’s desk and file cabinets, which he did not share with anyone, and yielded documents relating to the doctor’s private affairs. A majority of the Court reached the conclusion that, at the very least, the doctor had a reasonable expectation of privacy in his desk and file cabinets against invasion by his employer, see id. at 714-19, 107 S.Ct. 1492; id. at 730, 107 S.Ct. 1492 (Scalia, J., concurring), and the plurality noted that the expectation of privacy is even greater where the search is conducted by the police, see id. at 717, 107 S.Ct. 1492 (“The operational realities of the workplace ... may make some employees’ expectations of privacy unreasonable when an intrusion is by a supervisor rather than a law enforcement official”). Although the plurality determined that the probable cause standard was inappropriate for such intrusions by public employers who are investigating work-related misconduct, see id. at 725-26, 107 S.Ct. 1492, it drew a distinction between searches conducted by public employers on work-related matters and searches conducted by law enforcement officials for evidence of a crime. It is clear that probable cause is required for invasions of the latter variety — a principle that a majority of the Court accepted. See id. at 719-22, 107 S.Ct. 1492; id. at 730, 107 S.Ct. 1492 (Scalia, J., concurring) (“[Ojne’s personal office is constitutionally protected against warrantless intrusions by the police, even though employer and co-workers are not excluded.”). Prior to O’Connor, in Pembaur v. City of Cincinnati, 475 U.S. 469, 106 S.Ct. 1292, 89 L.Ed.2d 452 (1986), the Court observed that a state prosecutor “directly caused the violation of petitioner’s Fourth Amendment rights,” id. at 484, 106 S.Ct. 1292, when he instructed officers who were standing in the public reception area of a medical clinic to forcibly enter, without a search warrant, the private portion of the clinic which was closed off by a door. The officers did so even though clinic employees locked the door when the officers entered the reception area and asked the officers to leave. See id. at 472-73, 106 S.Ct. 1292.
There is no dispute in the case before us that the room in the methadone treatment center containing the patients’ records was a private room and not a place where the general public was welcome. Before he even attempted to obtain the search warrant, Detective Broderick was aware of an incident in which a clinic supervisor told police officers, who were called to the clinic to investigate a possible overdose, that the clinic had not called them, that the police were not welcome, and that the clinic would not provide any information. Accordingly, Detective Broderick was well aware that the clinic considered the type of information he sought to be confidential. Detective Broderick confirmed this during his investigation of the larceny when he telephoned the clinic about the possibility of acquiring patient information. The clinic informed him that it would not relinquish any information to the police without a court order. As a result, Detective Bro-derick applied for and obtained the search warrant, suggesting to us that he knew, as any reasonable officer in his shoes would have known, that the clinic’s record room and the records contained therein were sufficiently private to necessitate probable cause to search. Finally, when Detective Broderick executed the search warrant, one of the clinic’s employees initially locked herself inside the record room to protect the confidentiality of the files and relented only after she was threatened with arrest for obstruction of justice.
A search warrant based upon probable cause was clearly necessary for law enforcement officers to enter the clinic’s file room and to examine the information contained in the clinic’s patient records, rendering Detective Broderick’s search in the absence of probable cause a violation of clearly established Fourth Amendment principles. To be clearly es*455tablished, the law must be “sufficiently clear that a reasonable official would understand that what he is doing violates that right.” Anderson, 483 U.S. at 640, 107 S.Ct. 3034. “This is not to say that an official action is protected by qualified immunity unless the very action in question has previously been held unlawful, but it is to say that in the light of pre-existing law the unlawfulness must be apparent.” Id. (citation omitted); see Buonocore v. Harris, 65 F.3d 347, 357 (4th Cir.1995) (explaining that the requirement that the law prohibiting an officer’s conduct be clearly established “includes not only specifically adjudicated rights but those manifestly included within more general applications of the core constitutional principle invoked.” (internal quotation marks omitted)).
In August 1998, clearly established Fourth Amendment principles prohibited officers from searching private areas within commercial or business premises, or even private areas within public places, without probable cause. We believe it would have been apparent to a reason-able officer that these limitations encompassed a locked, patient-records room within a methadone clinic that contained confidential patient files, and that, if nothing else, Detective Broderick knew (or should have known) that his actions violated the Fourth Amendment rights of every person who had an expectation of privacy in the records room or the records contained there. The fact that he may not have known the identities of the persons wronged, or their precise numbers, is not determinative, for it was obvious that the files were not public, but were private, and that what he was doing violated the rights of all persons having a privacy interest in them. See Anderson, 483 U.S. at 640, 107 S.Ct. 3034. Thus, by searching without ptrobable cause, Detective Broderick clearly violated the Fourth Amendment, subjecting himself to suit by all persons vested with a legitimate expectation of privacy under the Fourth Amendment.
Although “the very action in question ... [may not have] previously been held unlawful,” we are satisfied that “in light of pre-existing law the unlawfulness ... [was] apparent.” Id. Consequently, Detective Broderick cannot cloak his clearly unconstitutional conduct with qualified immunity simply because a question 'may have existed as to whether Doe, in particular, had a legitimate expectation of privacy in his methadone treatment records. Detective Broderick engaged in actions which he knew or should have known were unacceptable and violative of the Fourth Amendment, leaving no principled reason why he should be immune from suit. By conducting his search without probable cause, Detective Broderick had already “transgressed] bright lines,” Maciariello, 973 F.2d at 298, marking the limits of his qualified immunity protection.6 We therefore affirm the district court in its rejection of this defense.
IV.
Doe cross appeals the district court’s dismissal of Fairfax County from his ac*456tion. The district court found no evidence that Detective Broderick conducted his search pursuant to an official policy or a custom maintained by Fairfax County. See Monell v. Department of Soc. Servs., 436 U.S. 658, 690-91, 98 S.Ct. 2018, 56 L.Ed.2d 611 (1978). The district court likewise rejected Doe’s claim that Fairfax County failed to train Broderick properly to adhere to the requirements of section 290dd-2 because, even assuming Fairfax County had not properly trained Detective Broderick, it found no evidence that the failure to do so was a result of Fairfax County’s deliberate indifference to Doe’s rights. See City of Canton v. Harris, 489 U.S. 378, 388-89, 109 S.Ct. 1197, 103 L.Ed.2d 412 (1989).
Doe points to no written or formal policy that would have caused his deprivation, see Monell, 436 U.S. at 690, 98 S.Ct. 2018, nor does Doe argue that the search was the result of “affirmative decisions of individual policymaking officials,” Carter v. Morris, 164 F.3d 215, 218 (4th Cir.1999) (citing Pembaur v. City of Cincinnati, 475 U.S. 469, 483-84, 106 S.Ct. 1292, 89 L.Ed.2d 452 (1986)). Moreover, we see nothing in the record that suggests Detective Broderick’s search was the result of a “persistent and widespread” practice such that Fairfax County could be held liable. Monell, 436 U.S. at 691, 98 S.Ct. 2018. The search of the methadone clinic was an odd, isolated incident that was the first of its kind at the Fairfax County Police Department. Isolated, unprecedented incidents such as this one are insufficient to create municipal liability. See Carter, 164 F.3d at 220 (A “meager history of isolated incidents” does not establish a municipal custom).
Doe also contends that Fair-fax County is liable because it failed to adequately train Detective Broderick and other Fairfax County law enforcement officers. In making this argument, Doe highlights the fact that Fairfax County concedes it did not make its law enforcement officers aware of 42 U.S.C.A. § 290dd-2 prior to August 1999. Doe points to nothing else that would undermine the adequacy of Fairfax County’s training of law enforcement officers. A municipality’s failure to train its officers can result in liability under section 1983 only when such failure reflects “deliberate indifference” to the rights of its citizens. See Harris, 489 U.S. at 388, 109 S.Ct. 1197. That is, “[o]nly where a failure to train reflects a ‘deliberate’ or ‘conscious’ choice by a municipality — a ‘policy’ as defined by our prior cases — can a city be liable for such failure under § 1983.” Id. at 389, 109 S.Ct. 1197. There is simply nothing in the record to suggest that Fairfax County’s lack of instruction of its officers on this federal statute was the result of an affirmative, conscious decision. Moreover, because this was a single incident, the need for training with regard to the confidentiality of drug treatment records was not so “plainly obvious” to the policymakers that the failure to instruct on section 290dd-2 can be said to be deliberately indifferent. See id. at 390 n. 10, 109 S.Ct. 1197. In sum, Doe advances his failure-to-train theory of municipal liability merely by reference to this single incident involving Detective Broderick; however, the Supreme Court has rejected the notion that “a § 1983 plaintiff [can] ... establish municipal liability without submitting proof of a single action taken by a municipal policymaker.” City of Oklahoma City v. Tuttle, 471 U.S. 808, 821, 105 S.Ct. 2427, 85 L.Ed.2d 791 (1985). Accordingly, we affirm the judgment of the district court dismissing Fair-fax County from the action.
V.
For the foregoing reasons, we affirm the district court’s denial of qualified immunity to Detective Broderick on Doe’s Fourth Amendment claim, and we remand for further proceedings on that issue. We affirm the dismissal of Fairfax County from the action. We reverse the district court’s denial of qualified immunity to Detective *457Broderick on Doe’s claim that Detective Broderick violated 42 U.S.C.A. § 290dd-2.
AFFIRMED IN PART, REVERSED IN PART, AND REMANDED
. The district court dismissed Doe’s claims against Broderick in his official capacity, a ruling that Doe does not challenge on appeal. Likewise, Doe does not challenge the district court’s dismissal of his claim under Virginia law against both defendants for intentional infliction of emotional distress.
. This statute provides that ”[r]ecords of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided ... be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under ... this section.” The law permits disclosure upon consent of the patient, for a medical emergency, pursuant to a court order upon a showing of good cause, and in other very limited circumstances. See 42 U.S.C.A. § 290dd-2(b).
. The statutory text further instructs that
In assessing good cause the court shall weigh the public interest and the need for disclosure against the injury to the patient, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, shall impose appropriate safeguards against unauthorized disclosure.
*44742 U.S.C.A. § 290dd-2(b)(2)(C). Naturally, disclosure is also permitted if the patient consents. See 42 U.S.C.A. § 290dd-2(b)(l).
. Doe gave unrefuted deposition testimony that his treatment at the methadone clinic (which has always been voluntary) is "closely held” information that he has revealed to no one outside of his immediate family, the medical personnel administering treatment, and other individuals participating in his therapy. J.A. 359. And, because payment for treatment at the facility was provided through Medicare, some information was necessarily released to those individuals who administer Medicare funds. Doe testified, however, that his records were held by the clinic “under lock and key” in a place "where[he] had reason to believe that they would be safe” and remain private. J.A. 394. We have not been directed to anything in the record that would seriously undermine what Doe maintains was an actual expectation of privacy.
. Detective Broderick did not pursue the argument, either in his brief or at oral argument, that he is shielded from liability because he sought the warrant in good faith. The Supreme Court has instructed that the appropriate question is whether any "officer of reasonable competence would have requested the warrant" in the first place; if not, the magistrate’s issuance of the warrant "is not just a reasonable mistake, but an unacceptable error indicating gross incompetence or neglect of duty” and "[t]he officer ... cannot excuse his own default by pointing to the greater incompetence of the magistrate." Malley v. Briggs, 475 U.S. 335, 346 n. 9, 106 S.Ct. 1092, 89 L.Ed.2d 271 (1986). Detective Broderick makes no assertion that the magistrate's issuance of the warrant was "within the range of professional competence of a magistrate,” i.e., that the magistrate made a reasonable mistake, which would relieve him of liability, see. id., nor does he contend that his consultation with an assistant Commonwealth Attorney prior to applying for the warrant made his application any more reasonable, see Swanson v. Powers, 937 F.2d 965, 972 (4th Cir.1991).
. We also do not read our decision in Tarantino v. Baker, 825 F.2d 772 (4th Cir.1987), cited by the dissent, as requiring a contrary result. In Tarantino, the detective, who had received an anonymous tip that marijuana plants were being grown inside a former general store, looked through a crack in the wall and saw marijuana plants. Armed with this information, the detective secured a valid search warrant and seized the plants. During the criminal trial of the building’s occupant, Tarantino, the district court suppressed the evidence seized because the detective "invaded Tarantino’s ‘zone of expected privacy' when he looked through the crack hoping to confirm the informant’s tip.” Id. at 773. The government did not appeal. In the ensuing section 1983 action against the detective, we held that because the law regarding the expectation of privacy by a commercial building’s occupant was unsettled and unevenly applied at the time of the search, the detective was entitled to qualified immunity because his actions did not “contravene[ ] any clearly settled fourth amendment principles.” Id. at 776 (internal quotation marks omitted). Unlike the situation in Tarantino, there is no question in this case that Detective Broderick’s actions did contravene clearly settled Fourth Amendment principles.
. Before today, no court has ever held that a drug treatment center patient has a legitimate expectation of privacy in his records sufficient to gamer Fourth Amendment protection in the records. In fact, I believe it is a relatively close question as to whether society would consider Doe's expectation of privacy to be objectively reasonable. Cf. ante at 450 ("The more interesting issue is whether a patient’s expectation of privacy' — Doe’s expectation of privacy — in his treatment records and files maintained by a substance abuse treatment center is one that society is willing to recognize as objectively reasonable and thus comes within ambit of the Fourth Amendment’s protections.”). In the end, I agree with the majority’s conclusion that 42 U.S.C.A. § 290dd-2 (West Supp.2000) itself demonstrates society’s willingness to recognize as reasonable Doe's expectation of privacy in his records kept at the methadone clinic. See ante at 450-51. I express no opinion on whether other patients — i.e., patients outside of the precise context involving drug treatment centers covered by § 290dd-2 that we are faced with today — have similarly legitimate expectations of privacy in their medical records. Nor do I understand the majority opinion as suggesting any intent on its part to weigh in on such issues not directly controlled by this case.