Hancock v. Cty. of Rensselaer, No. 16-2888, 2018 U.S. App. LEXIS 3090 (2d Cir. Feb. 9, 2018).
Last week, the Second Circuit issued a decision in an appeal of a judgment from the United States District Court for the Northern District of New York, affirming in part and vacating in part the district court’s ruling which granted summary judgment to appellees. Plaintiffs-appellants were employees of the Rensselaer County Jail located in Troy, New York. Troy is also home to Samaritan Hospital, which is the primary provider of healthcare for the Jail’s inmates and employees. Defendants-appellees include, among others, Jack Mahar, the Rensselaer County Sheriff who ran the jail, and Elaine Young, a jail nurse. Appellants allege that Mahar used, or directed someone to use, Elaine Young's password to access appellants’ medical information via Samaritan’s electronic health records system in order to investigate whether Jail employees were violating Mahar’s sick leave policy. No alternative explanation for the unauthorized access was given by the appellees.
The appellants assert claims alleging violations of their right to privacy under the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, and the Fourteenth Amendment. The Appellate Court affirmed the district court’s ruling regarding the CFAA, determining appellants failed to plead damages under Subclause (I) of the CFAA, which requires proof of economic damages, or Subclause (II), which requires proof of impairment of medical care. The Court rejected appellants’ theory that Subclause (I) was applicable, because “it states quite unambiguously damages…are limited to economic [d]amages.” Regarding Subclause (II), the Court was not unsympathetic to appellants’ theory that unauthorized access to medical information as part of the enforcement of a sick leave policy could lead to a chilling effect with respect to the pursuit of medical care, but ultimately rejected the theory because it was “merely a hypothetical” and the appellants stated no facts that could “nudge their claims across the line from conceivable to plausible.”
The Court vacated the district court’s judgment regarding the Fourteenth Amendment claim and ordered a remand of the issue, ruling that (1) the appellants had a right to privacy in their medical information under the Fourteenth Amendment, and (2) there was a genuine dispute as to whether appellees violated those rights. The right to privacy, while fundamental, is not absolute. Whether the right was infringed will depend on the application of the “shock the conscience” standard, which is a balancing test that asks whether the government’s invasion of privacy was “so arbitrary as to shock the conscience.” This test results in a Fourteenth Amendment violation only when “the individual’s interest in privacy outweighs the government’s interest in breaching it.” In applying this standard, the Court rejected the district court’s determination that the individual’s privacy right must meet a threshold level of stigmatization, instead reasoning that the nature of the medical information is relevant with respect to the government’s actions in the balancing test, but need not pass any threshold in order to bring a successful claim. In the Court’s words, “[m]alicious invasions of privacy are constitutionally unacceptable even in the face of weak individual privacy interests.” The substantive due process guaranteed by the Fourteenth Amendment protects the privacy of medical information regardless of whether it is stigmatizing or not. While the individual interest in privacy, determined in this context by the level of stigmatization of medical information, is relevant in comparison to how compelling the government’s interests are, “even the weakest privacy interests cannot be overridden by totally arbitrary or outright malicious government action.”
Ultimately, because the district court treated the seriousness of the appellants’ medical information as a threshold inquiry, the Second Circuit vacated the district court’s ruling and remanded for reconsideration. The Court explained that, on remand, the district court should consider the fact that appellees offered no reason for the breach, and to examine whether Mahar had malicious intent in accessing the records. Finally, the district court should decide whether the appellees are entitled to qualified immunity.
According to Elmer Robert Keach III, an attorney for the plaintiff-appellants, the Court’s decision "makes clear that people have an absolute right to keep their medical records private and protected from governmental review in the absence of compelling circumstances... [and] also makes clear that Sheriff Mahar’s effort to avoid accountability for his repugnant actions to his employees has failed." Sheriff Mahar is no stranger to the court; there are several lawsuits relating to similar breaches of medical information, some pending and some settled. The similar lawsuits include Pasinella v. County of Rensselaer (consent order), Colantonio v. County of Rensselaer (judgment dismissing by reason of settlement), Karam v. County of Rensselaer (order and stipulation of discontinuance), Snyder v. County of Rensselaer (order and stipulation of dismissal), Rogers v. Mahar (order and stipulation of dismissal), and Momrow v. County of Rensselaer (complaint filed). Danielle Sanzone of The Record, a local Troy newspaper, details a similar lawsuit involving the Jail’s unauthorized access to medical records of a nine-year-old girl treated at Samaritan Hospital following a dog bite.
Jack Peterson is a 1L student at Harvard Law School.