Source: s3://data.kl3m.ai/documents/govinfo/USCOURTS/USCOURTS-casd-3_12-cv-01390/USCOURTS-casd-3_12-cv-01390-2/pdf.json

Nature of Suit Code: 890
Nature of Suit: Other Statutory Actions
Cause of Action: 05:0552pa Right to Privacy Act

---

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF CALIFORNIA

GARY ATKINS,

Plaintiff,

CASE NO. 12CV1390-GPC(WVG)

ORDER:

1) GRANTING DEFENDANT’S

MOTION FOR SUMMARY

JUDGMENT

[Dkt. No. 22.]

2) DENYING AS MOOT JOINT

MOTION TO CONTINUE

PRETRIAL CONFERENCE

[Dkt. No. 35.]

vs.

RAYMOND E. MABUS,

SECRETARY, DEPARTMENT OF

THE NAVY,

Defendant.

This case arises out of the government’s alleged improper disclosure of and

failure to adequately safeguard Plaintiff Gary Atkins’ sensitive medical records while

he was a patient and employee at the Naval Medical Center San Diego. Before the

Court is Defendant Raymond E. Mabus’ Motion for Summary Judgment on Plaintiff’s

action brought pursuant to the Privacy Act of 1974, 5 U.S.C. § 552a. (Dkt. No. 22.) The

Parties have fully briefed the motion. (Dkt. Nos. 31, 32.) The Court held a hearing on

the motion on June 6, 2014. Kenneth Baisch, Esq. appeared on behalf of Plaintiff;

Assistant United States Attorney Katherine Parker, Esq. appeared on behalf of

Defendant. Based on a review of the Parties’ briefs, supporting evidence, oral

- 1 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 1 of 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

arguments, and the applicable law, the Court GRANTS DefendantRaymond E. Mabus’

Motion for Summary Judgment. (Dkt. No. 22.)

BACKGROUND

Plaintiff GaryAtkins was diagnosed in 1994 with a life-threatening illness. (Dkt.

No. 31-1 ¶ 3.) Plaintiff describes his medical condition as “uniquely sensitive and

personal.” (Dkt. No. 31 at 1.) From 2005 through 2011, Plaintiff was employed at the

Naval Medical Center San Diego (“NMCSD,” otherwise known as the “Balboa Naval

Hospital”) as the Division Officer for Professional Development. (Id. at ¶ 2; Dkt. No.

22-5 at 9-11.) Upon joining the NMCSD staff in 2005, Plaintiff began seeking regular

treatment for his illness at NMCSD. (Dkt. No. 31-1 ¶ 4.) 

In 2008, Plaintiff began to suspect that other NMCSD employees were aware of

his medical diagnosis. (Dkt. No. 22-5 at 22.) On October 21, 2008, Plaintiff requested

an audit of all the individuals who had accessed his medical records on the NMCSD

electronic record-keeping program, AHLTA. (Dkt. No. 22-4, Ex. B at 3.) The audit did

not turn up any individuals Plaintiff suspected of improperly accessing his medical

records. (Dkt. No. 31-2, Ex. 3.)

In 2009, Plaintiff learned from Dr. Mary Bavaro, a doctor at NMCSD, that a

1

“problems list” populated with patients’ “keymedical diagnoses” could be accessed by

hospital employees without need for the employees to access the respective patients’

full hospital record. (Dkt. No. 22-5, Ex. A at 51; Dkt. No. 31-1 ¶ 5.) Plaintiff declares

that two additional employees of NMCSD later “confirmed what had been conveyed

by Dr. Bavaro.” (Dkt. No. 31-1 ¶ 6) (referring to NMCSD Social Worker Lisa Hess and

Psychologist or Psychiatrist Joy Martin). 

In 2010, Plaintiff’s supervisor at NMCSD was named “Captain Pratt”; at that

The Court notes that Plaintiff stated this date as “in 2009” during his

1

Deposition, (Dkt. No. 22-5 at 51:19-24), but as “in June or July of 2010” in his laterfiled Declaration. (Dkt. No. 31-1 ¶ 5.) Although this discrepancy is relevant to

Defendant’s claims that this action is time-barred, as discussed below, the Court does

not rely on the statute of limitations as the basis for its holding. The Court therefore

finds this discrepancy immaterial.

- 2 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 2 of 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

same time, NMCSD also employed Lieutenant Commander Michael Simons (“Lt.

Commander Simons”). (Id. ¶ 10.) Lt. Commander Simons would occasionally

supervise Plaintiff in place of Captain Pratt. (Id.) On June 24, 2010, while in

conversation with Lt. Commander Simons regarding NMCSD acupuncture services,

Lt. Commander Simons commented that acupuncture could “help a person with the

need for a certain type of test used for the illness [Plaintiff] suffer[s] from.” (Id.)

Plaintiff immediately reported this incident to the NMCSD Privacy Officer. (Id.)

Later on June 24, 2010, Captain Pratt and Lt. Commander Simons entered

Plaintiff’s office to discuss Plaintiff’s conversation with the Privacy Officer. Plaintiff

declares that Captain Pratt made comments he interpreted as “tacit admission that

[Captain Pratt] and Simons had improperly accessed [Plaintiff’s private medical data].”

(Id. ¶ 12.) 

In 2011, Plaintiff exchanged emails with AHLTA Sustainment Trainer Noel

Molinos. (Dkt. No. 31-2, Ex. 2.) In the course of this email exchange, Ms. Molinos

confirmed that “it would be accurate that if an employee really wanted to risk

employment and jail time they could snoop in the system and possibly get away with

no record of it.” (Id.) Following this confirmation, Plaintiff left the NMCSD for a

position with the Veterans Administration. (Dkt. No. 31-1 ¶ 14.) Plaintiff declares that

he has had to change healthcare providers due to his lack of confidence in the NMCSD

AHLTA system, and has had to pay increased insurance premiums as a result. (Id. ¶

15.) 

On June 8, 2012, Plaintiff filed the present action against Defendant Raymond

E. Mabus, alleging violations of the Privacy Act of 1974, 5 U.S.C. § 552a. (Dkt. No.

1.) On March 1, 2013, Plaintiff filed a First Amended Complaint, the current operative

complaint. (Dkt. No. 10.) Plaintiff’s First Amended Complaint seeks compensatory

damages, interest, and attorney’s fees for violation of the Privacy Act of 1974 (the

“PrivacyAct”) under two theories:(1) the government’s “inadequate safeguards” failed

to protect Plaintiff’s confidential medical diagnosis; and (2) the government’s

- 3 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 3 of 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

“improper disclosure” of Plaintiff’s confidential medical information violated the Act.

(Id.) Defendant now seeks summary judgment on Plaintiff’s claims of both inadequate

safeguards and improper disclosure. (Dkt. No. 22.)

DISCUSSION

I. Legal Standard on Summary Judgment Motion

Federal Rule of Civil Procedure 56 empowers the Court to enter summary

judgment on factually unsupported claims or defenses, and thereby “secure the just,

speedy and inexpensive determination of every action. ” Celotex Corp. v. Catrett, 477

U.S. 317, 325, 327 (1986). Summary judgment is appropriate if the “pleadings,

depositions, answers to interrogatories, and admissions on file, together with the

affidavits, if any, show that there is no genuine issue asto any material fact and that the

moving party is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(c). A fact

is material when it affects the outcome of the case. Anderson v. Liberty Lobby, Inc.,

477 U.S. 242, 248 (1986). 

The moving party bears the initial burden of demonstrating the absence of any

genuine issues of material fact. Celotex Corp., 477 U.S. at 323. The moving party can

satisfy this burden by demonstrating that the nonmoving party failed to make a

showing sufficient to establish an element of his or her claim on which that party will

bear the burden of proof at trial. Id. at 322-23. If the moving party fails to bear the

initial burden, summary judgment must be denied and the court need not consider the

nonmoving party’s evidence. Adickes v. S.H. Kress & Co., 398 U.S. 144, 159-60

(1970). 

Once the moving party has satisfied this burden, the nonmoving party cannot rest

on the mere allegations or denials of his pleading, but must “go beyond the pleadings

and by her own affidavits, or by the ‘depositions, answers to interrogatories, and

admissions on file’ designate ‘specific facts showing that there is a genuine issue for

trial.’” Celotex, 477 U.S. at 324. If the non-moving party fails to make a sufficient

showing of an element of its case, the moving party is entitled to judgment as a matter

- 4 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 4 of 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

of law. Id. at 325. “Where the record taken as a whole could not lead a rational trier

of fact to find for the nonmoving party, there is no ‘genuine issue for trial.’” 

Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587 (1986). In

making this determination, the court must “view[] the evidence in the light most

favorable to the nonmoving party.” Fontana v. Haskin, 262 F.3d 871, 876 (9th Cir.

2001). The Court does not engage in credibility determinations, weighing of evidence,

or drawing of legitimate inferences from the facts; these functions are for the trier of

fact. Anderson, 477 U.S. at 255. 

II. Statute of Limitations

“An analysis of a statute of limitations question necessarily begins with

identifying the available cause of action.” Englerius v. Veterans Administration, 837

F.2d 895, 897 (9th Cir. 1988). The Privacy Act’s two year statute of limitation, 5

U.S.C. § 552a(g)(5), begins to run when a plaintiff “knows or has reason to know of

the alleged violation.” Rose v. United States, 905 F.2d 1257, 1259 (9th Cir. 1990)

(citing Englerius, 837 F.2d at 897).

As alleged in Plaintiff’s First Amended Complaint, Plaintiff alleges fourtheories

of liability under the Privacy Act: (1) disclosure of his medical records to persons who

did not have a need to know the contents of his medical records; (2) failure to provide

Plaintiff with a list of all persons accessing his medical records; (3) failure to keep an

accurate accounting of the disclosures of his records; and (4) failure to establish

appropriate administrative, technical, and physical safeguards to ensure the security

and confidentiality of the records. (Dkt. No. 10, FAC ¶ 16.) 

As discussed more fully below, the first theory amounts to an “improper

disclosure” claim. Defendant does not argue this claim is foreclosed by the statute of

limitations. (Dkt. No. 22-1 at 5.) In any event, asthe “improper disclosures” alleged by

Plaintiff occurred on and after June 24, 2010, (see Dkt. No. 31-1, Atkins Decl. ¶ 10),

the Court finds that the statute of limitations did not run on Plaintiff’s “improper

disclosures” claims prior to his filing of this action on June 8, 2012. 

- 5 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 5 of 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Plaintiff’s second through fourth theories of liability under the Privacy Act

amount to a claimfor “inappropriate safeguards.” In essence, Plaintiff alleges NMCSD

allowed individuals without authority to view his medical record to view a “problems

list” that disclosed his medical diagnosis, and that NMCSD failed to audit, or track, the

people who in fact viewed the medical diagnosis using the “problems list.” Defendant

argues Plaintiff suspected others knew of his confidential medical diagnosis in 2008

and that Plaintiff learned in 2009 of the alleged flaw in the NMCSD medical records

system that allowed unauthorized individuals to view the “problems list.” (Dkt. No.

22-1 at 5.) Accordingly, Defendant contends Plaintiff’s Privacy Act claim is time

barred. In response, Plaintiff asserts that his suspicions regarding both inaccurate

safeguards and improper disclosure were not confirmed until, at the earliest, June 2010.

(Dkt. No. 31 at 19.)

The Court finds that the Parties’ disagreement regarding the date on which the

statute oflimitations began to run on Plaintiff’s “inappropriate safeguards” claimstems

from differing characterizations of the claim. As stated above, as pled in Plaintiff’s

First Amended Complaint, Plaintiff’s “inappropriate safeguards” claim proceeds on

three theories: (1) NMCSD inappropriately allowed employees to access confidential

patient diagnoses via the “problem list”; (2) NMCSD’s software did not track who

accessed the “problems list”; and (3) NMCSD did not provide Plaintiff with a list of

people who accessed the “problems list.” To the extent that Plaintiff bases an

“inappropriate safeguards” claim under the first theory, on NMCSD’s alleged

allowance of employee access to a “problems list,” Plaintiff’s claim is barred by the

statute of limitations. At his deposition, Plaintiff testified that in 2009, no less than

three NMCSD employees showed him that employees could access a “problems list”

without accessing a patient’s entire medical record. (Dkt. No. 22-5, Notice of

Lodgment Ex. A, Atkins Depo at 51:17-25; see also Dkt. No. 31-1, Atkins Decl. ¶¶ 5,

6.) Plaintiff appears to concede this point. (Dkt. No. 31 at 18-19) (acknowledging that

Mr. Atkins learned in 2009 that “his information could have been viewed by anyone

- 6 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 6 of 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

who wanted to view the information, generally” but arguing that his “inaccurate

safeguards” cause of action did not accrue until July 2011 when he learned that they

could be viewed “with no safeguards in place to monitor access”) (emphasis in

original). Accordingly, the Court finds that the statute of limitations has run on

Plaintiff’s “inaccurate safeguards” claim to the extent that the claim is based on

NMCSD’s failure to restrict employee access to medical diagnoses on the “problems

list” and GRANTS Defendant’s motion for summary judgment on this claim. 

However, to the extent that Plaintiffseeks liability for NMCSD’s failure to keep

an accurate accounting of the individuals who accessed the “problems list” and failure

to provide Plaintiff with a list of all persons accessing Plaintiff’s medical diagnosis via

the “problems list,” Plaintiff has demonstrated that he did not receive confirmation of

this alleged inappropriate safeguard until 2011. (See Dkt. No. 31-1, Atkins Decl. ¶ 7.)

To be clear, this theory of liability differs because the alleged “inappropriate

safeguard” is NMCSD’s failure to implement proper auditing capabilities rather than

NMCSD’s failure to restrict access. The Court finds that Plaintiff’s declaration raises

a triable issue of fact as to whether Plaintiff knew or had reason to know of his

“inappropriate safeguards” claim based on NMCSD’s failure to track access to the

“problems list” until 2011. Accordingly, the Court DENIES Defendant’s motion for

summary judgment on Plaintiff’s “inaccurate safeguards” claim based on running of

the statute of limtiations, to the extent the “inaccurate safeguards” claim is based on

lack of proper auditing capabilities.

III. Inappropriate Safeguards

The Privacy Act requires agencies to “establish appropriate administrative,

technical and physical safeguards to insure the security and confidentiality of records

and to protect against any anticipated threats or hazards to their security or integrity

which could result in substantial harm, embarrassment, inconvenience, or unfairness

to any individual on whom information is maintained.” 5 U.S.C. § 552a(e)(10). The

Privacy Act is violated when a plaintiff “shows 1) that the government failed to fulfill

- 7 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 7 of 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

its record keeping obligation, 2) which failure proximately caused the adverse

determination, 3) that the agency failed intentionally or willfully to maintain the

records, and 4) that the plaintiff suffered actual damages.” Rose v. United States, 905

F.2d 1257, 1259 (9th Cir. 1990) (citation omitted). 

As discussed above, Plaintiff’s only claims under an “inappropriate safeguards”

theory of liability under the Privacy Act, that survive the statute of limitations, are: (1)

NMCSD’s software did not track who accessed the “problems list”; and (2) NMCSD

did not provide Plaintiff with a list of people who accessed the “problems list.” 

A. Establishment of Appropriate Safeguards

Defendant first argues Plaintiff cannot establish the government’s failure to

establish appropriate safeguards to protect Plaintiff’s medical records in violation of

section (e)(10) of the Privacy Act because Plaintiff has “no evidence to establish the

configuration of the AHLTA system” to meet his burden of proving that the

government failed to safeguard his records. (Dkt. No. 22-1 at 6.) Defendant argues the

only “admissible evidence regarding the configuration of the AHLTA system is

NMCSD’s explanation of the system through the declaration of Robert Dighello, IT

Specialist at NMCSD.” (Id. at 6-7.) 

Plaintiff opposes, arguing he has sufficient evidence via party admissions to

establish that the AHLTA system failed to track access to his confidential medical

diagnoses. (Dkt. No. 31 at 11-12.) Specifically, Plaintiff points to evidence in his

Declaration, (Dkt. No. 31-1), and Deposition testimony, (Dkt. No. 22-5), that

statements made to him by NMCSD employees Dr. Mary Bavaro, Lisa Hess, Joy

Martin, and others prove that AHLTA was not able to track access to the “problems

list.” (Dkt. No. 31 at 11.) Plaintiff argues these admissions were verified by Plaintiff’s

own viewing of a “problem list” that showed medical diagnoses, (id.) as well as via

email by NavyAHLTA Sustainment Trainer Ms. Noel Molinos on June 14, 2011. (Dkt.

No. 31-2 Ex. 2.)

//

- 8 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 8 of 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Under the Privacy Act, agencies must enact “appropriate” safeguards; the Act 

does not prescribe specific technical standards, leaving the agencies to manage their

own information security. 5 U.S.C. § 552a(e)(10); see also In re Dep’t of Veterans

Affairs(VA) Data Theft Litig., MISC. A. 06-0506 JR, 2007WL 7621261 (D.D.C. Nov.

16, 2007). The Court finds Plaintiff’s proffered evidence raises a triable issue of fact

asto whether the AHLTA systemappropriately safeguarded Plaintiff’s private medical

data. In particular, Plaintiff’s testimony and proffered email of Noel Molinos conflict

with Defendant’s IT Specialist declaration on the question of whether the AHLTA

system in fact allowed viewing of a “problems list” showing patient diagnoses

unrecorded by access audits during the relevant period. Accordingly, the Court finds 2

Plaintiff’s evidentiary showing related to the appropriateness ofNMCSD’s information

protection safeguards sufficient to withstand summary judgment. Anderson v. Liberty

Lobby, Inc., 477 U.S. 242, 248 (1986). 

B. Willful or Intentional Misconduct

In addition,Defendant argues Plaintiff cannot establish “willful” or “intentional”

government misconduct as required to seek civil penalties for an “inappropriate

safeguards” claim under the Privacy Act. (Dkt. No. 22-1 at 8-9.) According to

Defendant, Plaintiff has “not articulated, nor does he have, any evidence to support the

notion that anyone at NMCSD willfully or intentionally violated the Privacy Act.”

(Dkt. No. 22-1 at 9.) 

Plaintiff responds that the evidence shows “willful” or “intentional” conduct

because NMCSD knew about the deficiencies in its AHLTA system but failed to

remedy the problems. Plaintiff claims the “fact that [the issue of the deficiencies in the

AHLTA system] was brought to Mr. Atkins’ attention by no less than four of

Defendants’ employees suggests that there was an extreme departure from patient

privacy rights.” (Dkt. No. 31 at 14.) At the hearing on this matter, Plaintiff’s counsel

The Court notes that Plaintiff objects to the declaration of Robert Dighello on 2

the grounds that the declaration is vague as to time. (Dkt. No. 31-4.) The Court

SUSTAINS Plaintiff’s objection, and has not considered the Dighello Declaration.

- 9 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 9 of 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

claimed the evidence shows Defendant knew about the problem in 2009, yet did not fix

it until 2011, and that this inaction shows willful misconduct. As more fully developed

below, the evidence submitted by Plaintiff does not support this claim. 

The Privacy Act does not impose strict liability for every “technical” violation

of its provisions. Instead, the civil remedies provision of the Privacy Act providesthat,

for any “intentional or willful” refusal or failure to comply with the Act, the United

States shall be liable for “actual damages sustained by the individual as a result of the

refusal or failure.” 5 U.S.C. § 552a(g)(4)(A). To show “intentional or willful” conduct,

a plaintiff must present evidence to show that an agency’s conduct amounted to “more

than gross negligence.” Rose v. United States, 905 F.2d 1257, 1260 (9th Cir. 1990)

(citing Johnston v. Horne, 875 F.2d 1415, 1422 (9th Cir. 1989)). A plaintiff must show

that defendant “flagrantly disregarded” his rights under the Act, or engaged in behavior

so patently egregious that anyone undertaking the conduct should have known it was

unlawful. Laningham v. U.S. Navy, 813 F.2d 1236, 1242 (D.C. Cir.1987) (citations

omitted).

The Court finds that Plaintiff has failed to meet his burden of presenting

evidence to show NMCSD’s failure to track access to Plaintiff’s confidential medical

diagnosis amounted to more than gross negligence. As an initial matter, Plaintiff points

to no legal authority to support a finding that his proffered evidence suffices to

demonstrate “intentional or willful” government conduct. (Dkt. No. 31 at 13-14.) 

In addition, the record does not support Plaintiff’s claim that NMCSD

“intentionally or willfully” failed to safeguard his confidential medical diagnosis.

Plaintiff’s declaration identifies three NMCSD staff members who discussed with

3

Plaintiff the possibility that a “problems list” may be viewable without accessing a

patient’s full record prior to 2011. (Dkt. No. 31-1 ¶¶ 5-6.) However, Plaintiff’s

declaration also states that these three staff members “did not know if there was any

These staff members are Dr. Mary Bavaro, Social Worker Lisa Hess, and

3

Psychologist (or Psychiatrist) Joy Martin. (Dkt. No. 31-1, Atkins Decl. ¶¶ 5-6.) 

- 10 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 10 of

 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

way to track (1) the person who accessed the information, or (2) the date and time the

information was accessed.” (Id. ¶ 5.) As discussed above, Plaintiff’s only

“inappropriate safeguards” claim that falls within the statute of limitations is based on

NMCSD’s alleged failure to audit accessto the “problems list.”Plaintiff has introduced

no evidence to show that Dr. Bavaro, Lisa Hess, orJoy Martin knew whether or not the

AHLTA system tracked access to the “problems list” or told Plaintiff whether or not

the AHLTA system did so; in fact, Plaintiff’s proffered evidence demonstratesthat the

three staff members did neither. (See, e.g., Dkt. No. 31-2, Ex. 5, Email from Lisa Hess

to Gary Atkins) (“I do not know if the Audit only tracks the ‘sensitive’ records, I

always thought that an audit would show everyone who has looked at that person’s

medical record, regardless of how it was entered, but not sure.”). As such, the Court

findsthat Plaintiff has introduced no evidence to demonstrate that NMCSD knew about

“the problem,” as defined by NMCSD’s lack of ability to audit access to the problems

list, prior to 2011 when the problem was fixed. 

Furthermore, the fourth NMCSD staff member’s commentsto Plaintiff, made by

AHLTA trainer Noel Molinos, also fail to establish intentional or willful conduct on

behalf of NMCSD. Although Plaintiff’s declaration states that Ms. Molinos explained

to Plaintiff that there was “no way to audit who had looked at the ‘problems list’ in

2011,” (Dkt. No. 31-1 ¶ 7), the Court’s review of the email in question reveals that the

trainer merely responded affirmatively to Plaintiff’s question: “would it be accurate that

if an employee really wanted to risk employment and jail time they could snoop in the

system and possibly get away with no record of it?” (Dkt. No. 31-2, Ex. 2, Email

exchange between Gary Atkins and Noel Molinos.) Even assuming Plaintiff’s

characterization of the email was accurate, Ms. Molinos, at most, acknowledged the

lack of an appropriate safeguard to insure the confidentiality of records, not that

NMCSD intentionally or willfully failed to establish appropriate safeguards. This

evidence falls short of demonstrating government conduct rising above the level of

“gross negligence.” Cf. Rose v. United States, 905 F.2d 1257, 1260 (9th Cir. 1990)

- 11 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 11 of

 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(“The Postal Service’s failure to mail [plaintiff’s] forms diligently, to notify of her

rights, and to provide her the appropriate forms proves at best negligence.”). 

Because Plaintiff has failed to offer sufficient evidence to support a finding that

the government willfully or intentionally failed to safeguard Plaintiff’s confidential

medical diagnosis, the Court GRANTS Defendant’s motion for summary judgment on

Plaintiff’s “inappropriate safeguards” claim. See Celotex Corp. v. Catrett, 477 U.S.

317, 325, 327 (1986). 

C. Actual Damages

Defendant further argues Plaintiff cannot establish economic damages arising

out of an “inappropriate safeguards” claim. (Dkt. No. 22-1 at 9.) “Actual damages” are

a required element of Privacy Act claims. Doe v. Chao, 540 U.S. 614, 617-18, 627

(2004). The term “actual damages” in the Privacy Act is “limited to proven pecuniary

or economic harm.” Fed. Aviation Admin. v. Cooper, __U.S. __, 132 S.Ct. 1441, 1453

(2012). “An individual bringing a claim under the Privacy Act must demonstrate a

causal connection between the alleged violation of the Act and the harm suffered by

the individual.” Houlihan v. Office of Pers. Mgmt., 909 F.2d 383, 384 (9th Cir. 1990)

(internal quotation marks omitted). 

Because the Court finds Plaintiff cannot show “willful” or “intentional”

government conduct in relation to his claim for “inappropriate safeguards,” the Court

declines to address whether Plaintiff has introduced sufficient evidence to raise a

triable issue of material fact on the issue of actual damages. Accordingly, the Court

OVERRULES AS MOOT Defendant’s objections to Plaintiff’s evidence submitted in

support of actual damages pursuant to Federal Rules of Civil Procedure 37(c). (Dkt.

No. 32 at 9-10.) 

IV. Improper Disclosure

In addition to providing a remedy for inappropriate safeguards, the Privacy Act

prevents an agency from disclosing “any record . . . contained in a system of records”

without the written consent of the “individual to whom the record pertains.” 5 U.S.C.

- 12 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 12 of

 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

§ 552a(b). “To establish a claim for wrongful disclosure under the Privacy Act,

Plaintiff must establish that (1) [his] diagnosis information is a record contained in a

system of records; (2) the [NMCSD] disclosed the information improperly; (3) the

disclosure had an adverse effect on Plaintiff; (4) the disclosure was willful or

intentional; and (5) Plaintiffsuffered actual damages.” Stafford v. Social Sec. Admin.,

437 F. Supp. 2d 1113, 1117 (N.D. Cal. 2006) (citing Doe v. Chao, 540 U.S. 614,

622-23 (2004)). In determining intent or willfulness, the Court examines (1) the

“purpose” for which the disclosure was made; (2) “the source of the idea to” make the

disclosure; and (3) other “circumstances surrounding the disclosure.” Albright v.

United States, 732 F.2d 181, 189 (D.C. Cir. 1984)).

Defendant movesto dismiss Plaintiff’s “improper disclosure” Privacy Act claim

on the ground that Plaintiff cannot meet his burden of establishing that an “improper

disclosure” occurred in violation of the Privacy Act. (Dkt. No. 22-1 at 7-8.) In

response, Plaintiff claims his proffered evidence supports a conclusion that three

improper disclosures occurred: (1) Plaintiff claims Lt. Commander Simons made an

improper disclosure of Plaintiff’s diagnosis to Captain Pratt; (2) Plaintiff claims Lt.

Commander Simons made an improper disclosure of his medical diagnosis in an open

corridor where anyone could hear; and (3) Plaintiff claims there is an inference that his

diagnosis was discussed “between Simons, Pratt, Young and Eng.” (Dkt. No. 31 at 17.)

The Court finds that Plaintiff’s proffered evidence failsto raise a triable issue of

material fact and is too speculative to lead a rational trier of fact to find that an

actionable “improper disclosure” occurred within the meaning of the Privacy Act. See 

Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587 (1986). As for

the first disclosure, to support his claimthat Lt. Commander Simons made an improper

disclosure of Plaintiff’s diagnosis to Captain Pratt, Plaintiff points to his declaration

stating that Lt. Commander Simons “apprised Pratt of the situation” after Plaintiff

complained to the privacy officer about Lt. Commander Simons’ hallway disclosure.

(Id.) Plaintiff statesthat direct evidence of the disclosure exists because, “[r]ather than

- 13 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 13 of

 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

deny Mr. Atkins’ direct accusation that Commander Simons had made unauthorized

access to his medical information through AHLTA, Pratt and Simons expressly stated

that they had the authority to view the records, and that Hospital policy permitted it.”

(Id.)

Although Plaintiff’s declaration providessupport for the conclusion thatCaptain

Pratt and Lt. Commander Simons individually improperly accessed Plaintiff’s private

medical data and stated a belief that they had authority to access Plaintiff’s medical

information, Plaintiff provides no evidence demonstrating that Captain Pratt learned

about Plaintiff’s diagnosis fromLt. Commander Simons. In fact, Plaintiff’s declaration

instead supports the conclusion that Captain Pratt may have accessed Plaintiff’s

medical information via authorized or unauthorized use of the AHLTA system rather

than through the “improper disclosure” by Lt. Commander Simons as claimed by

Plaintiff. Absent evidence of an “improper disclosure” from Lt. Commander Simons

to Captain Pratt, “unauthorized access” of the AHLTA system is not actionable under

the Privacy Act. See Cacho v. Chertoff, No. 06-00292(ESH), 2006 WL 3422548 at *5

(D.D.C. Nov. 28, 2006) (holding that no private right of action exists under the Privacy

Act for unauthorized or improper access of records). Accordingly, the Court finds

Plaintiff’s proffered evidence too speculative to lead a rational trier of fact to conclude

that Lt. Commander Simons improperly disclosed a record to Captain Pratt in violation

of the Privacy Act. 

As to the second allegedly improper disclosure, Plaintiff claims Lt. Commander

Simons made a public improper disclosure when, during a recorded conversation

between Plaintiff and Lt. Commander Simons in a hallway corridor, Simons “made a

reference to a term that is closely connected to the medical problems that Mr. Atkins

suffers from.” (Dkt. No. 31 at 17; Dkt. No. 31-1 ¶ 10.) Having reviewed the transcript

of the recorded conversation, the Court finds that Plaintiff’s declaration and the

recorded conversation fail to raise a triable issue of material fact and that no rational

trier of fact could find Lt. Commander Simons’ comment to be an “improper

- 14 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 14 of

 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

disclosure” within the meaning of the Privacy Act. As an initial matter, Plaintiff has

introduced no evidence that anyone except for Plaintiff heard Lt. Commander Simons’

statement. Although the transcribed recorded conversation indicates a “witness 3” was

originally present in the conversation, the transcript reflects that Mr. Atkins and Lt.

Commander Simons exchanged at least ten uninterrupted conversational exchanges

prior to and after the allegedly improper disclosure. (Dkt. No. 31-2, Notice of

Lodgment Ex. 1.) Plaintiff’s declaration and deposition testimonymention no witnesses

when describing the hallway incident with Lt. Commander Simons. (Dkt. No. 31-1,

Atkins Decl. ¶ 10; Dkt. No. 22-5, Atkins Depo at 22.) Without evidence that any third

parties heard Lt. Commander Simons’ allegedly disclosing statement, Plaintiff has

failed to demonstrate that a disclosure occurred.

Furthermore, the Court’s review of the transcribed conversation shows that, in

response to Plaintiffsaying he didn’t know what acupuncture would be helpful for, Lt.

Commander Simons stated: “[s]tress and relaxation but it also has been proven to um,

increase ***** and stuff like that.” (Dkt. No. 31-2, Notice of Lodgment Ex. 1 at 3)

(redaction in original). The transcript reflects that Plaintiff responded, “Hm.

Interesting. Okay.” and that he and Lt. Commander Simons continued a conversation

with no apparent signs of a reaction to or agitation caused by Simons’ statement. (Id.)

The Court finds that, viewing the evidence in the light most favorable to the Plaintiff,

even if Lt. Commander Simons made reference to a term “closely connected” to Mr.

Atkins’ medical condition, (Dkt. No. 31 at 17), the statement provides insufficient

evidence that Lt. Commander Simons improperly disclosed an agency record. Plaintiff

has introduced no evidence supporting a connection between the term used by Simons

and Plaintiff’s medical condition; similarly, Plaintiff has failed to link Simon’s

comment or knowledge of Plaintiff’s medial diagnosis to information contained in an

agency record. Accordingly, the Court finds Plaintiff’s proffered evidence too

speculative to lead a rational trier of fact to conclude that Lt. Commander Simons

improperly disclosed a record, while in conversation with Plaintiff, in violation of the

- 15 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 15 of

 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Privacy Act. 

Third and last, Plaintiff contends that there “is an inference that Mr. Atkins’

diagnosis was discussed between Simons, Pratt, Young and Eng.” (Dkt. No. 31 at 17;

Dkt. No. 31-1 ¶ 12.) To support this “inference” of an improper disclosure, Plaintiff

seeks to draw from his testimony that “I called Klant, who told me that he, Pratt, Young

and Eng, who was the Medical Administrative Officer, would be having a meeting

regarding the issue, but that I was not invited. I do not know if the meeting took place.”

(Dkt. No. 31-1 ¶ 12.) This evidence is more speculative still. The “inference” Plaintiff

seeks to establish relies on an assumption that “Pratt, Young and Eng” in fact met

regarding Plaintiff’s privacy concerns and thatCaptain Pratt in fact disclosed an agency

record during that meeting. These assumptions are simply not supported by the record

and are not sufficient to carry Plaintiff’s burden of proffering evidence sufficient for

a trier of fact to find that an improper disclosure occurred within the meaning of the

Privacy Act.

Finally, there is no evidence to support that any allegedly improper disclosure

was made willfully or intentionally in order to support a claim for damages.

Accordingly, the Court GRANTS Defendant’s motion for summary judgment as to

Plaintiff’s Privacy Act claim based on an “improper disclosure” theory. 

V. Enlargement of Time for Discovery

The Court notes that, at the hearing on this matter, Plaintiff’s counsel requested

more time to conduct discovery in this case. The Court DENIES the request.

On March 7, 2014, one week after Defendant filed the present motion for

summary judgment, Plaintiff’s counsel filed an “ex parte motion to shorten time for a

motion to allow discovery beyond discovery cutoff” before Magistrate Judge William

V. Gallo. (Dkt. No. 24.) In support of the motion, Plaintiff’s counsel documented a

string of calamities that befell him during the latter part of 2013 and early 2014. (Dkt.

No. 24-1, Baisch Decl.; Dkt. No. 24-2, Smee Decl.) 

On March 11, 2014, Judge Gallo denied the motion, because: (1) Mr. Baisch

- 16 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 16 of

 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

participated in the telephonic Case Management Conference during which the fact

discovery deadline was set and therefore had notice of the deadline for the close of

discovery; (2) Counsel of record for Plaintiff is the law firm for which Mr. Baisch

worked, and it is incumbent upon counsel of record to conduct discovery in the time

frame set out by the court; and (3) Mr. Baisch waited nearly a month after learning at

the February 10, 2014 Mandatory Settlement Conference that the discovery deadline

had passed to file a motion to extend discovery. (Dkt. No. 26.) Judge Gallo also noted

that Mr. Baisch has never filed a notice of appearance for Plaintiff on the Court’s

docket. (Id.) 

Although the Court is sympathetic to Mr. Baisch’s unfortunate circumstances

and recognizes the “strong policy underlying the Federal Rules of Civil Procedure

favoring decisions on the merits,” Eitel v. McCool, 782 F.2d 1470, 1471-72 (9th Cir.

1986), the Court will not grant Mr. Baisch’s oral request at hearing to enlarge the time

for discovery in this case. As an initial matter, the Court finds counsel’s oral motion

insufficient, where counsel had the opportunity to appeal Judge Gallo’s order to this

Court, see Fed. R. Civ. P. 72(a), or to make a showing that Plaintiff “cannot present

facts essential to justify its opposition” for “specified reasons” under Federal Rule of

Civil Procedure 56(d). Furthermore, given the facts that Plaintiff’s counsel of record

in this case is “Grady and Associates,” (Dkt. No. 1-1, Civil Cover Sheet); that another

Grady and Associates attorney represented Plaintiff at the Mandatory Settlement

Conference on February 10, 2014; and that Mr. Baisch has not explained the firm’s

failuresto request an extension of time to conduct discovery until after Defendant filed

the present motion for summary judgment, the Court DENIES Plaintiff’s oral request

for extension of time to conduct discovery. 

//

//

//

// 

- 17 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 17 of

 18
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

CONCLUSION AND ORDER

Based on the foregoing, the Court GRANTS Defendant’s motion for summary

judgment. (Dkt. No. 22.) Accordingly, the Court DENIES as moot the Parties’ joint

motion to continue the final pretrial conference currently set for June 27, 2014. (Dkt.

No. 35.) The Clerk of Court is instructed to enter judgment in favor of Defendant and

terminate the case. 

IT IS SO ORDERED.

DATED: June 13, 2014

HON. GONZALO P. CURIEL

United States District Judge

- 18 - [12cv1390-GPC(WVG)]

Case 3:12-cv-01390-GPC-WVG Document 38 Filed 06/13/14 PageID.<pageID> Page 18 of

 18