Richard Faber and Jennifer Monroe, Individually and also on behalf of all similarly situated persons, Plaintiffs-Appellants,
v.
Ciox Health, LLC, d/b/a HealthPort Technologies, LLC, Defendant-Appellee.
Argued: May 2, 2019
Appeal
from the United States District Court for the Western
District of Tennessee at Memphis. No. 2:16-cv-02337-S. Thomas
Anderson, District Judge.
ARGUED:
Kevin
McCormack, BALLIN, BALLIN & FISHMAN, P.C., Memphis,
Tennessee, for Appellants.
Jay P.
Lefkowitz, P.C., KIRKLAND & ELLIS, LLP, New York, New
York, for Appellee.
ON
BRIEF:
Kevin
McCormack, BALLIN, BALLIN & FISHMAN, P.C., Memphis,
Tennessee, for Appellants.
Jay P.
Lefkowitz, P.C., KIRKLAND & ELLIS, LLP, New York, New
York, Garry K. Grooms, BURR & FORMAN LLP, Nashville,
Tennessee, for Appellee.
Before: MERRITT, KETHLEDGE, and NALBANDIAN, Circuit Judges.
OPINION
NALBANDIAN, CIRCUIT JUDGE.
Courts
play a limited role in effecting public policy in this
country. In short: legislatures make the policy; we interpret
it. So when Congress chose not to create a private right of
action in HIPAA, it wasn't our job to graft one onto
Tennessee common law. And when the Tennessee legislature
failed to make Ciox liable under the TMRA, it wasn't up
to us to make it liable anyway. The district court understood
this, so we AFFIRM its judgment. But because the district
court granted summary judgment to Ciox after certifying a
class action without sending notice to the absentee class
members, we hold that its decision binds only the named
Plaintiffs.
I.
Ciox[1] is one of the largest
medical-records providers in the country. It doesn't
provide any healthcare services of its own, but it contracts
with those who do. In fact, three out of every five hospitals
use Ciox to help patients access their medical records.
Unsurprisingly, Ciox processes many records-about 4.3 million
pages per day in 2018. It's also unsurprising, then, that
Ciox is subject to many laws and regulations.
One of
those laws is the Health Insurance Portability and
Accountability Act of 1996 ("HIPAA"), Pub. L. No.
104-191, § 264, 110 Stat. 1936 (1996). HIPAA subjects
Ciox to Department of Health and Human Service regulations.
Those regulations include fee-limit provisions under 45
C.F.R. § 164.524(c)(4), which, in turn, prohibit Ciox
from charging patients more than "reasonable, cost-based
fee[s]" for their records. Id.
HIPAA
hasn't stopped the states from regulating this activity.
Tennessee, for one, has layered on additional rules that
govern patients' access to medical records. See
Tennessee Medical Records Act of 1974 ("TMRA"),
Tenn. Code. Ann. §§ 68-11-301 to -314. And those
rules prevent hospitals from charging patients more than the
"reasonable costs for copying and the actual costs of
mailing [their] records." Tenn. Code Ann. §
68-11-304(a)(2)(A)(ii).
That's
the regulatory backdrop of this appeal. Here are the
specifics: Both named Plaintiffs worked with law firms to
request their medical records from two Tennessee hospitals.
And both hospitals contracted with Ciox to provide patients
their medical records. It was Ciox who serviced
Plaintiffs' requests, and it was Ciox who charged them
for their records.
Plaintiffs
would eventually file this class action. Among other things,
they accused Ciox of charging them more than what HIPAA's
implementing regulations and the TMRA allow. But, evidently,
they realized they faced a serious hurdle: HIPAA doesn't
authorize a private cause of action. See, e.g.,
Thomas v. Univ. of Tenn. Health Sci. Ctr. at
Memphis, No. 17-5708, 2017 WL 9672523, at *2 (6th Cir.
Dec. 6, 2017) (recognizing a consensus among our sister
circuits "that there is no private right of action under
HIPAA"). So Plaintiffs decided to style their
HIPAA-based claims as common-law causes of action. These
included causes of action based on negligence, negligence per
se, unjust enrichment, and breach of implied-in-law contract.
The
district court dismissed Plaintiffs' TMRA claim for
failure to state a claim. Plaintiffs later moved to certify a
class of "persons who requested their medical records
from medical providers and were subsequently overcharged for
their medical records by Defendant Ciox." Plaintiffs and
Ciox filed cross motions for summary judgment about three
months later. And the district court eventually granted
Plaintiffs' motion for class certification under Rule
23(b)(3).[2]Just two weeks later, the district court
granted Ciox's summary judgment motion.
Plaintiffs
now appeal the district court's grant of summary judgment
to Ciox, which we review de novo. Tysinger v. Police
Dep't of Zanesville, 463 F.3d 569, 572 (6th Cir.
2006). They also appeal the district court's dismissal of
their TMRA claim, which we also review de novo. Beydoun
v. Sessions, 871 F.3d 459, 464 (6th Cir. 2017).
II.
All of
Plaintiffs' common-law claims suffer from the same
fundamental defect: Tennessee common law is no substitute for
the private right of action that Congress refused to create
in HIPAA. That unavoidable conclusion has consequences. Here,
it means that Plaintiffs cannot prove every element of their
claims.
A.
Negligence
and Negligence Per Se. Plaintiffs' negligence and
negligence per se claims fail right out of the gate for the
same reason: Plaintiffs cannot establish that Ciox owed
Plaintiffs a duty to not overcharge for medical
records.[3] That is because no such duty exists under
Tennessee's common law. See Amos v. Carson, 210
S.W.2d 677, 678 (Tenn. 1948) ("No ceiling price
limitation is known to the common law. Such are either
creatures of statute or some duly constituted board.").
As a result, each of Plaintiffs' attempts to locate that
duty leads to a predictable dead end.
Plaintiffs
first point us to Bradshaw v. Daniel, where the
Tennessee Supreme Court declared, "all persons have a
duty to use reasonable care to refrain from conduct that will
foreseeably cause injury to others." 854 S.W.2d 865, 870
(Tenn. 1993). It isn't hard to see why Plaintiffs like
this language. On its own, it's sweeping enough to turn
every offense under the sun into a common-law tort. But we
don't read judicial opinions in a vacuum. The
Bradshaw rule is one that would be familiar to most
first-year law students: All persons must exercise reasonable
care to avoid causing physical harm to another's
person or property. See Satterfieldv. Breeding
Insulation Co., 266 S.W.3d 347, 362 (Tenn. 2008);
see also Dan B. Dobbs et al., The Law of Torts
§ 127 (2d ed. 2019) (describing the reasonable care
standard as the "default rule" for "negligent
physical interferences with person or
property") (emphasis added ...