Faber v. Ciox Health, LLC

          Argued: May 2, 2019

          Appeal from the United States District Court for the Western District of Tennessee at Memphis. No. 2:16-cv-02337-S. Thomas Anderson, District Judge.

         ARGUED:

          Kevin McCormack, BALLIN, BALLIN & FISHMAN, P.C., Memphis, Tennessee, for Appellants.

          Jay P. Lefkowitz, P.C., KIRKLAND & ELLIS, LLP, New York, New York, for Appellee.

         ON BRIEF:

          Kevin McCormack, BALLIN, BALLIN & FISHMAN, P.C., Memphis, Tennessee, for Appellants.

          Jay P. Lefkowitz, P.C., KIRKLAND & ELLIS, LLP, New York, New York, Garry K. Grooms, BURR & FORMAN LLP, Nashville, Tennessee, for Appellee.

          Before: MERRITT, KETHLEDGE, and NALBANDIAN, Circuit Judges.

          OPINION

          NALBANDIAN, CIRCUIT JUDGE.

         Courts play a limited role in effecting public policy in this country. In short: legislatures make the policy; we interpret it. So when Congress chose not to create a private right of action in HIPAA, it wasn't our job to graft one onto Tennessee common law. And when the Tennessee legislature failed to make Ciox liable under the TMRA, it wasn't up to us to make it liable anyway. The district court understood this, so we AFFIRM its judgment. But because the district court granted summary judgment to Ciox after certifying a class action without sending notice to the absentee class members, we hold that its decision binds only the named Plaintiffs.

         I.

         Ciox^[1] is one of the largest medical-records providers in the country. It doesn't provide any healthcare services of its own, but it contracts with those who do. In fact, three out of every five hospitals use Ciox to help patients access their medical records. Unsurprisingly, Ciox processes many records-about 4.3 million pages per day in 2018. It's also unsurprising, then, that Ciox is subject to many laws and regulations.

         One of those laws is the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub. L. No. 104-191, § 264, 110 Stat. 1936 (1996). HIPAA subjects Ciox to Department of Health and Human Service regulations. Those regulations include fee-limit provisions under 45 C.F.R. § 164.524(c)(4), which, in turn, prohibit Ciox from charging patients more than "reasonable, cost-based fee[s]" for their records. Id.

         HIPAA hasn't stopped the states from regulating this activity. Tennessee, for one, has layered on additional rules that govern patients' access to medical records. See Tennessee Medical Records Act of 1974 ("TMRA"), Tenn. Code. Ann. §§ 68-11-301 to -314. And those rules prevent hospitals from charging patients more than the "reasonable costs for copying and the actual costs of mailing [their] records." Tenn. Code Ann. § 68-11-304(a)(2)(A)(ii).

         That's the regulatory backdrop of this appeal. Here are the specifics: Both named Plaintiffs worked with law firms to request their medical records from two Tennessee hospitals. And both hospitals contracted with Ciox to provide patients their medical records. It was Ciox who serviced Plaintiffs' requests, and it was Ciox who charged them for their records.

         Plaintiffs would eventually file this class action. Among other things, they accused Ciox of charging them more than what HIPAA's implementing regulations and the TMRA allow. But, evidently, they realized they faced a serious hurdle: HIPAA doesn't authorize a private cause of action. See, e.g., Thomas v. Univ. of Tenn. Health Sci. Ctr. at Memphis, No. 17-5708, 2017 WL 9672523, at *2 (6th Cir. Dec. 6, 2017) (recognizing a consensus among our sister circuits "that there is no private right of action under HIPAA"). So Plaintiffs decided to style their HIPAA-based claims as common-law causes of action. These included causes of action based on negligence, negligence per se, unjust enrichment, and breach of implied-in-law contract.

         The district court dismissed Plaintiffs' TMRA claim for failure to state a claim. Plaintiffs later moved to certify a class of "persons who requested their medical records from medical providers and were subsequently overcharged for their medical records by Defendant Ciox." Plaintiffs and Ciox filed cross motions for summary judgment about three months later. And the district court eventually granted Plaintiffs' motion for class certification under Rule 23(b)(3).^[2]Just two weeks later, the district court granted Ciox's summary judgment motion.

         Plaintiffs now appeal the district court's grant of summary judgment to Ciox, which we review de novo. Tysinger v. Police Dep't of Zanesville, 463 F.3d 569, 572 (6th Cir. 2006). They also appeal the district court's dismissal of their TMRA claim, which we also review de novo. Beydoun v. Sessions, 871 F.3d 459, 464 (6th Cir. 2017).

         II.

         All of Plaintiffs' common-law claims suffer from the same fundamental defect: Tennessee common law is no substitute for the private right of action that Congress refused to create in HIPAA. That unavoidable conclusion has consequences. Here, it means that Plaintiffs cannot prove every element of their claims.

         A.

         Negligence and Negligence Per Se. Plaintiffs' negligence and negligence per se claims fail right out of the gate for the same reason: Plaintiffs cannot establish that Ciox owed Plaintiffs a duty to not overcharge for medical records.^[3] That is because no such duty exists under Tennessee's common law. See Amos v. Carson, 210 S.W.2d 677, 678 (Tenn. 1948) ("No ceiling price limitation is known to the common law. Such are either creatures of statute or some duly constituted board."). As a result, each of Plaintiffs' attempts to locate that duty leads to a predictable dead end.

         Plaintiffs first point us to Bradshaw v. Daniel, where the Tennessee Supreme Court declared, "all persons have a duty to use reasonable care to refrain from conduct that will foreseeably cause injury to others." 854 S.W.2d 865, 870 (Tenn. 1993). It isn't hard to see why Plaintiffs like this language. On its own, it's sweeping enough to turn every offense under the sun into a common-law tort. But we don't read judicial opinions in a vacuum. The Bradshaw rule is one that would be familiar to most first-year law students: All persons must exercise reasonable care to avoid causing physical harm to another's person or property. See Satterfieldv. Breeding Insulation Co., 266 S.W.3d 347, 362 (Tenn. 2008); see also Dan B. Dobbs et al., The Law of Torts § 127 (2d ed. 2019) (describing the reasonable care standard as the "default rule" for "negligent physical interferences with person or property") (emphasis added ...