Lombrano v. Department of the Air Force ( 2022 )

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
JENNIFER L. LOMBRANO,
Plaintiff,
v. No. 21-cv-872 (DLF)
DEPARTMENT OF THE AIR FORCE,
Defendant.
MEMORANDUM OPINION
Jennifer Lombrano brings this action against the Department of the Air Force under the
Privacy Act, 5 U.S.C. § 552a. Lombrano alleges that the Air Force impermissibly disclosed
information from her medical records to her workplace, resulting in both her termination from
that workplace and her early retirement from a related government agency. Before the Court is
the Air Force’s Motion to Dismiss her complaint pursuant to Federal Rule of Civil Procedure
12(b)(6). Dkt. 14. For the reasons that follow, the Court will deny the motion.
I. BACKGROUND
When considering a motion to dismiss, the Court takes the well-pleaded factual
allegations in the complaint as true. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). At the time
of the events at issue, Lombrano was a commissioned officer in the United States Public Health
Service, First Am. Compl. (Compl.) ¶ 3, Dkt. 12-4, serving as an oral and maxillofacial surgeon,
id. ¶ 15. Per a Memorandum of Agreement, she had been assigned to the SouthCentral
Foundation (SouthCentral) in Anchorage, Alaska. Id. ¶ 16. SouthCentral is a “nonprofit health
care organization serving nearly 65,000 Alaska Native and American Indian people.” Id. ¶ 17.
Lombrano intended to stay with SouthCentral after her retirement from the Public Health
Service. Id. ¶ 18.
However, in August 2020, Lombrano “was suffering from severe panic attacks resulting
from personal and professional issues.” Id. ¶ 20. As a Public Health Service officer, Lombrano
receives healthcare at Department of Defense Medical Treatment Facilities, such as the hospital
at Joint Base Elmendorf-Richardson. Id. ¶ 22. On approximately August 14, 2020, Lombrano
visited “the on-call outpatient mental health care provider at Joint Base Elmendorf-Richardson
with whom [Lombrano] confided that she had intended to seek treatment” at a ten-day alcohol
and drug rehabilitation treatment facility in Seattle. Id. ¶ 23.
The outpatient treatment provider advised Lombrano to stay the night for medical
attention given her health history (specifically, a cardiac ablation approximately a year earlier).
Id. ¶ 24. The outpatient provider also “told her that the next day she would be able to make her
treatment arrangements” and that she would be provided “options for treatment programs that
were covered by Tricare insurance.” Id. ¶ 25. However, Lombrano was placed in the “inpatient
Behavioral Health Unit, essentially . . . a psych ward behind locked doors.” Id. ¶ 26. As part of
an inventory of Lombrano’s belongings, “hospital officials seized three 2 milligram Gummy
Bears infused with THC, the metabolite for marijuana.” Id. ¶ 29.
The next day, on August 15, 2020, Lombrano “met with Colonel Christine Campbell,
USAF, the attending psychiatrist, in the inpatient Behavioral Clinic at Joint Base Elemendorf-
Richardson.” Id. ¶ 31. “Colonel Campbell disclosed that she had already contacted
SouthCentral Foundation, that she ha[d] spoken with [Lombrano’s] supervisor and that she had
disclosed [Lombrano’s] medical condition and her current mental state.” Id. ¶ 32. One day later,
on August 16, 2020, Lombrano’s supervisor at SouthCentral informed her that Campbell “in fact
2
had contacted the HR department and told them that she was impaired, mentally unstable, had an
alcohol problem and now had a drug charge for possession of an illegal substance.” Id. ¶ 33.
SouthCentral terminated Lombrano’s assignment in a letter dated September 2, 2020. Id.
¶ 36. Lombrano alleges that this termination was “[b]ased upon the unlawful disclosures by Air
Force personnel.” Id. Lombrano further alleges that she was “forced to retire early” from the
Public Health Service and lost “the difference in salary versus her retired pay.” Id. ¶ 45. After
her termination, she alleges that “she could only find employment on a part-time, two-day per
week basis.” Id. Finally, she alleges that “[h]er future employment prospects are jeopardized
because she will have to reveal circumstances behind the dismissal to future employers.” Id.
II. LEGAL STANDARDS
Rule 12(b)(6) of the Federal Rules of Civil Procedure allows a defendant to move to
dismiss the complaint for “failure to state a claim upon which relief can be granted.” Fed. R.
Civ. P. 12(b)(6). To survive a Rule 12(b)(6) motion, a complaint must contain factual matter
sufficient “to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550
U.S. 544, 570 (2007). A facially plausible claim is one that “allows the court to draw the
reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at
678. This standard does not amount to a specific probability requirement, but it does require
“more than a sheer possibility that a defendant has acted unlawfully.” Id.; see also Twombly,
550 U.S. at 555 (“Factual allegations must be enough to raise a right to relief above the
speculative level.”). A complaint need not contain “detailed factual allegations,” but alleging
facts that are merely consistent with a defendant’s liability . . . stops short of the line between
possibility and plausibility.” Iqbal, 556 U.S. at 678 (internal quotation marks omitted).
3
The Court must “accept as true” all the factual allegations in the plaintiff’s complaint, id.
at 678, and “grant[] the benefit of all inferences that can be derived from the facts alleged,”
Hettinga v. United States, 677 F.3d 471, 476 (D.C. Cir. 2012) (internal quotation marks omitted).
The Court need not accept, however, any “legal conclusion [that is] couched as a factual
allegation.” Iqbal, 556 U.S. at 678 (internal quotation marks omitted). Likewise, the Court will
not credit an “unadorned, the-defendant-unlawfully-harmed-me accusation,” or a “[t]hreadbare
recital[] of the elements of a cause of action, supported by mere conclusory statements.” Id.Ultimately, “[d]etermining whether a complaint states a plausible claim for relief [is] a context-
specific task that requires the reviewing court to draw on its judicial experience and common
sense.” Id. at 679.
III. ANALYSIS
The Privacy Act “contains a comprehensive and detailed set of requirements for the
management of confidential records held by Executive Branch agencies.” FAA v. Cooper, 566
U.S. 284, 287 (2012). It “safeguards the public from unwarranted collection, maintenance, use
and dissemination of personal information contained in agency records.” In re OPM Data Sec.
Breach Litig., 928 F.3d 42, 61–62 (D.C. Cir. 2019) (quoting Henke v. Dep’t of Com., 83 F.3d
1453, 1456 (D.C. Cir. 1996)). To that end, the Privacy Act prohibits agencies from disclosing
“any record which is contained in a system of records by any means of communication to any
person, or to another agency, except pursuant to a written request by, or with the prior consent
of, the individual to whom the record pertains,” unless certain exceptions apply. 5 U.S.C.
§ 552a(b).
The Privacy Act contains a private right of action against agencies that improperly
disclose such records. See id. § 552a(g)(1)(D). “To unlock the Privacy Act’s waiver of
4
sovereign immunity and state a cognizable claim for damages, a plaintiff must allege that (i) the
agency ‘intentional[ly] or willful[ly]’ violated the Act’s requirements for protecting the
confidentiality of personal records and information; and (ii) she sustained ‘actual damages’ (iii)
‘as a result of’ that violation.” In re OPM, 928 F.3d at 62 (quoting 5 U.S.C. § 552a(g)(4)).
The Air Force moves to dismiss Lombrano’s complaint on two grounds. See Mot. to
Dismiss at 6, Dkt. 14. First, the Air Force argues that Lombrano failed to plausibly allege the
disclosure violated the Privacy Act. Id. at 6. Second, the Air Force argues that Lombrano failed
to sufficiently plead actual damages. Id. at 10. Both arguments fail.
A. Improper Disclosure
1. The Alleged Disclosure
Lombrano has sufficiently alleged the elements required to state a claim for improper
disclosure. “Privacy Act claims for monetary damages based on improper disclosure . . . have
four elements: ‘1) the disclosed information is a record contained within a system of records; 2)
the agency improperly disclosed the information; 3) the disclosure was willful or intentional; and
4) the disclosure adversely affected the plaintiff.’” Doe v. DOJ, 660 F. Supp. 2d 31, 44–45
(D.D.C. 2009) (quoting Logan v. Dep’t of Veterans Affs., 357 F. Supp. 2d 149, 154 (D.D.C.
2004)). In this case, Lombrano has alleged that her information was contained in her medical
records, see, e.g., Compl. ¶ 44, which were maintained within a system of records protected by
the Privacy Act, see id. ¶¶ 38, 44.1 Lombrano has identified the recipients of the information,
see id. ¶¶ 32–33, 42, 44; the person who allegedly disclosed the information, see id.; and the time
1
The Air Force argues that Lombrano failed to allege that Campbell accessed the records
through the use of Lombrano’s name or another identifier. See Def.’s Reply at 3, Dkt. 17. But
one can infer that medical records would include identifying information, 5 U.S.C. § 552a(a)(4),
and be “retrieved by the name of the individual” or by some other identifier, id. § 552a(a)(5).
5
period—a span of one day—during which the information was disclosed, see id. ¶¶ 23, 31–32.
In addition, Lombrano has alleged that she had never spoken with Campbell before the
disclosure to SouthCentral and that Campbell “was not present when Plaintiff was admitted to
the hospital.” Id. ¶ 44. Finally, she has alleged that she lost her job and was forced to retire
early as a result of the disclosure. Id. ¶ 45; see infra III.B.
The facts here resemble those in Feldman v. CIA, 797 F. Supp. 2d 29 (D.D.C. 2011). In
Feldman, a CIA employee alleged that the agency improperly disclosed information regarding an
investigation relating to his travel reimbursements. See 797 F. Supp. 2d at 32, 34. As relevant
here, the employee under investigation based this claim on allegations that other employees
“learned of the investigation despite having no official connection to it.” Id. at 37. The CIA
argued that the other employees may have gained their knowledge from independent sources,
such as “other employees who were interviewed by the CIA OIG investigators,” rather than from
protected records. Id. at 40. However, the Court stated that reliance on a “res ipsa loquitur
inference . . . at the pleading stage may be sufficient to survive a motion to dismiss, depending
on the facts alleged.” Id. at 41. In Feldman, it was enough at the motion to dismiss stage that
the plaintiff had alleged that the record at issue was protected by the Privacy Act; that the
employees who learned the information had “no official connection to the investigation”; that
Feldman had “identified these employees by name”; and that Feldman had “identified the
approximate time period in which they learned about the investigation.” Id.Similar to Feldman, Lombrano’s assertion that Campbell “could only have” obtained the
disclosed information “by reading the medical record that was created when Plaintiff entered the
hospital at Joint Base Elmendorf-Richardson” is plausible. Compl. ¶ 44. It rests on a single
“reasonable inference,” Iqbal, 556 U.S. at 678, not, as the Air Force contends, “a series of
6
speculative assumptions,” Mot. to Dismiss at 7. It is true that Lombrano’s inference, see Compl.
¶ 44, will likely be “inadequate to sustain a Privacy Act claim on the merits.” Feldman, 797 F.
Supp. 2d at 41 (discussing Armstrong v. Geithner, 608 F.3d 854 (D.C. Cir. 2010)); see
Armstrong, 608 F.3d at 857–61. But Lombrano is not required to connect all the dots now.
“Indeed, in the typical case, a plaintiff can hardly be expected to know the full details behind an
improper disclosure prior to discovery, since those details are most likely to be under the control
of the defendant.” Feldman, 797 F. Supp. 2d at 41.
Even though Campbell may have obtained Lombrano’s disclosed information without
accessing any medical record, see Mot. to Dismiss at 7, dismissal of her complaint is not
warranted at this early stage. “[A] complaint survives a motion to dismiss even [i]f there are two
alternative explanations, one advanced by [the] defendant and the other advanced by [the]
plaintiff, both of which are plausible.” VoteVets Action Fund v. U.S. Dep’t of Veterans Affs., 992
F.3d 1097, 1104 (D.C. Cir. 2021) (quoting Banneker Ventures, LLC v. Graham, 798 F.3d 1119,
1129 (D.C. Cir. 2015) (internal quotation marks omitted)). The Air Force contends that
Campbell “naturally would have discussed patients” with her colleagues due to her role as “the
attending (i.e., supervising) psychiatrist at the behavioral clinic.” Mot. to Dismiss at 7; see also
Doe v. U.S. Dep’t of Treasury, 706 F. Supp. 2d 1, 6 (D.D.C. 2009) (noting that, as a general
matter, “[t]he disclosure of information derived solely from independent sources is not
prohibited by the statute even though identical information may be contained in [a] system of
records” (citation omitted)). But Lombrano has offered a plausible explanation for how
Campbell learned the relevant information. Lombrano “will need to amass sufficient evidence to
meet [her] burden of proof as the case proceeds,” but she “need not do so at the pleading stage.”
Kelley v. FBI, 67 F. Supp. 3d 240, 265 (D.D.C. 2014).
7
2. The Routine Use Exceptions
The Air Force argues that even if Campbell obtained the allegedly disclosed information
from Lombrano’s records, Lombrano has failed to show that the Privacy Act’s exceptions do not
apply. See Mot. to Dismiss at 8. Specifically, the Air Force argues that the alleged disclosure
was permissible under two of the Privacy Act’s “routine use” exceptions. 5 U.S.C. § 552a(b)(3);
see Mot. to Dismiss at 8.
By way of background, a “routine use” is a “disclosure of a record . . . which is
compatible with the purpose for which [the record] was collected.” 5 U.S.C. § 552a(a)(7). All
agencies that “maintain[] a system of records” are required to publish a notice in the Federal
Register whenever they create a new, or revise an existing, system of records. Id. § 552a(e)(4).
This system of records notice (SORN) must include “each routine use of the records contained in
the system, including the categories of users and the purpose of such use.” Id. § 552a(e)(4)(D).
The law enforcement routine use, which applied at the relevant time throughout the
Department of Defense, provides:
If a system of records maintained by a DoD Component to carry out its functions indicates
a violation or potential violation of law, whether civil, criminal, or regulatory in nature,
and whether arising by general statute or by regulation, rule, or order issued pursuant
thereto, the relevant records in the system of records may be referred, as a routine use, to
the agency concerned, whether Federal, State, local, or foreign, charged with the
responsibility of investigating or prosecuting such violation or charged with enforcing or
implementing the statute, rule, regulation, or order issued pursuant thereto.
Department of Defense Privacy Program, 72 Fed. Reg. 18,758, 18,784 (Apr. 13, 2007) (codified
as amended at 32 C.F.R. pt. 310 app. A); see also Privacy Act of 1974; Technical Amendment,
86 Fed. Reg. 64,367, 64,368 (Nov. 18, 2021) (reinstating the above routine use after it was
“erroneously deleted” in 2019 from the Code of Federal Regulations). The Air Force has
specifically subjected its Medical Records System to this routine use. See Privacy Act of 1974;
8
System of Records, 75 Fed. Reg. 34,709, 34,711 (June 18, 2010) (incorporating all the
Department of Defense’s “Blanket Routine Uses” by reference).
The routine use for law enforcement does not apply here. Although Lombrano’s
possession of the gummy bears containing marijuana was arguably relevant to her employment,
see Mot. to Dismiss at 8; Def.’s Reply at 4, the routine use allows only disclosures to agencies
charged with either “enforcing or implementing” the relevant law or “investigating or
prosecuting” violations thereof. 72 Fed. Reg. at 18,784. The Public Health Service is not a law
enforcement agency, and the Air Force has not suggested that it is charged with enforcing or
implementing laws prohibiting marijuana.
The Air Force’s reliance on a second routine use, which pertains to disclosures made
when requesting information, also fails. See Def.’s Reply at 5. This routine use states:
A record from a system of records maintained by a Component [of the Department of
Defense] may be disclosed as a routine use to a Federal, State, or local agency maintaining
civil, criminal, or other relevant enforcement information or other pertinent information,
such as current licenses, if necessary to obtain information relevant to a Component
decision concerning the hiring or retention of an employee, the issuance of a security
clearance, the letting of a contract, or the issuance of a license, grant, or other benefit.
72 Fed. Reg. at 18,784 (codified as amended at 32 C.F.R. pt. 310 app. A). This routine use also
does not apply because SouthCentral and the Public Health Service, the entities that made the
relevant retention decisions, are not components of the Department of Defense. See 42 U.S.C.
§§ 201–203 (noting that the Public Health Service falls within the Department of Health and
Human Services). Moreover, even if this routine use applied, the Air Force has forfeited this
argument by raising it for the first time in its reply brief. It is well settled that the exceptions in
the Privacy Act are affirmative defenses, which defendants must either timely raise or eventually
forfeit. See Kelley, 67 F. Supp. 3d at 265 n.15 (reading Doe v. FBI, 936 F.2d 1346 (D.C. Cir.
1991); Richardson v. Bd. of Governors of Fed. Rsrv. Sys., 248 F. Supp. 3d 91, 101 (D.D.C.
9
2017). And under the “ordinary rules of forfeiture,” arguments are generally “forfeited if [they
are] raised for the first time in reply.” Twin Rivers Paper Co. v. SEC, 934 F.3d 607, 615 (D.C.
Cir. 2019) (citation omitted). Because the Air Force raised its second routine use in that manner,
it cannot prevail on that exception here.
The Air Force’s remaining arguments are red herrings. First, the Air Force argues that
Lombrano’s complaint focuses on “express[ing] disagreement with the Air Force’s action with
respect to Plaintiff’s termination” and that “[t]he Privacy Act . . . is not a vehicle for amending
the judgments of federal officials that are reflected in records maintained by federal agencies.”
Mot. to Dismiss at 9. However, Lombrano’s complaint clearly alleges improper disclosure under
the Privacy Act. See, e.g., Compl. ¶¶ 42–43. Whether Lombrano’s complaint also indicates
disagreement with her termination or judgments reflected in her medical records is irrelevant.
Second, the Air Force argues that “[t]o the extent . . . that Plaintiff bases her claim upon HIPAA .
. . the Court should reject Plaintiff’s use of the Privacy Act in the disguise of a HIPAA claim.”
Mot. to Dismiss at 9. While Lombrano’s complaint includes a reference to HIPAA, see Compl.
¶ 34, it focuses on and states a claim under the Privacy Act, see id. ¶¶ 40–46.
B. Actual Damages
To state a claim under the Privacy Act, a plaintiff must also allege “actual damages,” 5
U.S.C. § 552a(g)(4)(A), a phrase that requires a “pecuniary” harm, Cooper, 566 U.S. at 295–96.
Lombrano has met that standard by alleging that Campbell’s disclosure caused both the
termination of her SouthCentral assignment and her forced retirement from the Public Health
Service. See Compl. ¶¶ 36, 45. Clearly, the loss of employment creates at least some pecuniary
harm. See Hill v. DOD, 70 F. Supp. 3d 17, 21 (D.D.C. 2014). And although the Air Force
objects that Lombrano has failed to provide the specific amount of the difference between her
10
salary and retirement pay, see Mot. to Dismiss at 11; Def.’s Reply at 6, she is not required to do
so at this stage of the proceeding.2 See Hill, 70 F. Supp. 3d at 22 (plaintiff not required to
quantify specific pecuniary harms to “survive a Rule 12(b)(6) . . . motion”). To state a claim for
relief under the Privacy Act, it is enough to plausibly “some pecuniary harm, no matter how
slight.” Cooper, 566 U.S. at 296. Because Lombrano has cleared that bar, her claim survives the
Air Force’s motion to dismiss.
CONCLUSION
For the foregoing reasons, the Air Force’s motion to dismiss is denied. An order
consistent with this decision accompanies this memorandum opinion.
________________________
DABNEY L. FRIEDRICH
United States District Judge
February 9, 2022
2
This conclusion is consistent with Richardson v. Board of Governors of the Federal Reserve
System, 288 F. Supp. 3d 231 (D.D.C. 2018), as the alleged disclosures in that case occurred only
after the plaintiff’s termination, id. at 237. See Mot. to Dismiss at 11 (discussing the case).
11