Hancock v. Cnty. of Rensselaer

• Decision Date: 09 February 2018
• Docket Number: Docket No. 16-2888,August Term, 2017
• Citation: 882 F.3d 58
• Parties: Keith HANCOCK, Tamera Thomas, Jason Dessingue, Plaintiffs-Appellants, v. The COUNTY OF RENSSELAER, Jack Mahar, Elaine Young, David Hetman, Defendants-Appellees.
• Court: U.S. Court of Appeals — Second Circuit

882 F.3d 58

Keith HANCOCK, Tamera Thomas, Jason Dessingue, Plaintiffs-Appellants,

v.The COUNTY OF RENSSELAER, Jack Mahar, Elaine Young, David Hetman, Defendants-Appellees.¹

Docket No. 16-2888

August Term, 2017

United States Court of Appeals, Second Circuit.

Argued: September 20, 2017

Decided: February 9, 2018

ELMER ROBERT KEACH, III, Law Offices of Elmer Robert Keach, III, PC (Maria K. Dyson, on the brief), Albany, N.Y., for Plaintiffs-Appellants.

JAMES A. RESILA, Carter, Conboy, Case, Blackmore, Maloney & Laird, P.C., Albany, N.Y., for Appellees-Appellees County of Rensselaer, Jack Mahar, and David Hetman.

KEVIN A. LUIBRAND, Latham, N.Y., for Defendant-Appellee Elaine Young.

Before: WALKER, POOLER, and LOHIER, Circuit Judges.

POOLER, Circuit JudgeAppellants were employees of the Rensselaer County Jail. Their medical records were secretly accessed without their permission by at least one other employee at the Jail. They sued in the United States District Court for the Northern District of New York, alleging violations of their right to privacy in health information under the Fourteenth Amendment and of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030. The district court dismissed all of the CFAA claims for failure to state a claim. After discovery, it granted summary judgment to Appellees on the Fourteenth Amendment claims, reasoning that Appellants did not have a constitutionally protected interest in medical privacy because the medical conditions described in their records were insufficiently stigmatizing. Appellants appealed both rulings. We now AFFIRM the district court's determination regarding the CFAA claims and VACATE its determination regarding Appellants' right to privacy in medical records. Regarding the latter, we find that even individuals with non-stigmatizing medical conditions have a right to privacy in their medical records, even if their interest in privacy might be less. We REMAND this case back to the district court for further proceedings consistent with this analysis, including a consideration of whether qualified immunity might apply.

BACKGROUND

I. Factual Background

Troy, New York is home to both Samaritan Hospital and Rensselaer County Jail. Samaritan serves as the primary healthcare provider for most of the Jail's detainees and many of its employees. Appellants are among those employees who have seen doctors at Samaritan.

The Jail does not rely entirely on Samaritan for healthcare services; it also employs its own medical staff. That staff included Elaine Young, a registered nurse. To facilitate continuity of care, Samaritan provided Young with electronic access to Samaritan's medical records on three computers at the Jail through a password-protected system. Logging in with this password provided unlimited access to Samaritan's entire medical records system.

Before she was granted access to Samaritan's record system, Young signed a one-page clearly worded agreement stating that she would only use the system in a way that preserved patient confidentiality. This consent form cautioned that "Federal law and regulations strictly limit the purposes for which patient information may be accessed and used." App'x at 1679. Its terms then restricted use for the purposes of "providing medical treatment to the patient," "securing payment for treatment of the patient," and "quality assurance activities, professional competence review activities and health care fraud or abuse detection."Id. Accessing Samaritan's system for "other purposes" was only permitted with "signed authorization of the patient" or "approval of the [Samaritan] Privacy Officer." Id.

Young had apparently been unable to obtain passwords for other nurses to use, so she taped her login information inside a drawer at the nurse's desk at the Jail. Any person who knew where the password was kept and had access to that desk could thus view any of Samaritan's medical records.

In late 2011, Samaritan learned that "health information relating to a patient of Samaritan Hospital may have been accessed for an improper purpose by an employee" of the Jail. App'x at 35, 41, 47.

After an investigation, Samaritan determined that the password assigned to Young had been used to access the medical records of multiple non-inmate patients, including some Jail employees. Samaritan thereafter deactivated Young's account and requested that the office of the Rensselaer County Sheriff investigate. Jack Mahar, the Rensselaer County Sheriff, was also in charge of running the Jail.

Mahar appointed Corrections Lieutenant James Karam to conduct the investigation. Karam did so until August 2012, when he resigned due to medical issues and the pressure that Mahar allegedly placed on him. According to Karam, Mahar had attempted to convince Karam to delay the investigation to prevent at least one employee from being notified that his medical records had been accessed. No one was ever criminally prosecuted for accessing Samaritan's medical records.

In March 2013, Samaritan sent letters to patients whose records its internal investigations found had been viewed without their permission. The letters detailed when and for how long each patient's medical records had been accessed via Young's account.

Confronted with this information, a number of patients sued the County of Rensselaer and several of its employees. Some of these lawsuits have been settled; some continue at the district court level. E.g. , Pasinella v. County of Rensselaer , No. 13-cv-00607, consent order (N.D.N.Y. Sept. 23, 2014); Colantonio v. County of Rensselaer , No. 14-cv-00107, judgment dismissing by reason of settlement (N.D.N.Y. Apr. 24, 2015); Karam v. County of Rensselaer , No. 13-cv-01018, order and stipulation of discontinuance (N.D.N.Y. Sept. 6, 2016); Snyder v. County of Rensselaer , No. 14-cv-00242, order and stipulation of dismissal (N.D.N.Y. Sept. 26, 2014); Rogers v. Mahar , No. 14-cv-01162, order and stipulation of dismissal (N.D.N.Y. Jan. 25, 2016); Momrow v. County of Rensselaer , No. 15-cv-00521, complaint filed (N.D.N.Y. Apr. 29, 2015).

Appellants are among those who received the letter from Samaritan and subsequently sued. Relying on the preliminary results of Karam's investigation and on a number of depositions taken across many of these cases, they allege that their records were accessed as part of Mahar's campaign to rein in Jail employees' use of sick leave. It is undisputed that Mahar enforced a sick leave policy that penalized employees deemed to be taking "excessive" sick leave. Appellants note that access of their medical records took place during or soon after instances in which they had taken "extended or unexpected" sick leave. Appellants' Br. at 9. They allege that Mahar or somebody acting under Mahar's direction either used Young's password or directed Young to do so in order to determine whether Appellants had been using sick leave in accordance with the policy Mahar was enforcing. Appellees offer no alternative explanation or justification for the unauthorized access of Appellants' medical records.

II. Procedural History

Appellants filed their initial complaint on September 20, 2013, alleging violations of their rights to privacy implied by the Due Process Clause of the Fourteenth Amendment and of their rights under the CFAA. On September 24, 2014, the district court granted Appellees' motion to dismiss with respect to the claims under the CFAA, determining that Appellants had failed to allege the damages required by that statute. It denied the motion with respect to the civil rights claim.

On February 10, 2015, Appellants filed an amended complaint alleging only the civil rights cause of action. After more than a year of discovery, Appellees moved for summary judgment on Appellants' Section 1983 claim. The motion was granted in August 2016. Hancock v. County of Rensselaer , No. 1:13-CV-1184, 2016 WL 8732374 (N.D.N.Y. Aug. 5, 2016).

Relying heavily on its interpretation of our previous decision in Matson v. Board of Education of City School District of N.Y. , 631 F.3d 57 (2d Cir. 2011), the district court found that Appellants failed to show that they had a constitutionally protected right to privacy in their medical records. The court read Matson as limiting the right to privacy in one's medical records only to those records that contain evidence of medical conditions that are both serious and stigmatizing. Hancock , 2016 WL 8732374, at *3. It found that none of the Appellants had information in their histories that would expose them to discrimination and intolerance, so none of them could establish that their Fourteenth Amendment rights had been violated. Id. at *3-4.

Final judgment was filed in favor of Appellees on August 8, 2016. This appeal of both the dismissal and the grant of summary judgment was filed on August 17.

DISCUSSION

I. CFAA Claims

A. Standard of Review

Although "[i]t is well settled that an amended pleading ordinarily supersedes the original and renders it of no legal effect," we do not require futile repleading of a claim that has been dismissed with prejudice. In re Crysen/Montenay Energy Co. , 226 F.3d 160, 162 (2d Cir. 2000). Thus, the fact that Appellants' amended complaint lacked the CFAA cause of action does not amount to a waiver of that cause of action for purposes of appellate review. Id.

"We review de novo a district court's decision to dismiss a complaint pursuant to [Federal] Rule [of Civil Procedure] 12(b)(6), accepting all factual allegations as true and drawing all reasonable inferences in the plaintiff's favor." Crawford v. Cuomo , 796 F.3d 252, 256 (2d Cir. 2015) (citation omitted). "To survive a 12(b)(6) motion, the complaint must contain factual allegations that plausibly give rise to an entitlement to relief." Id. (citation omitted).

B. Discussion

Congress originally enacted the CFAA in 1984 to criminalize the then-novel problem of hacking. Ten years later, it added a private right of action. See Violent Crime Control and Law Enforcement...