Doe v. Thompson

332 F. Supp. 2d 124 (2004)

John DOE, D.M.D., Plaintiff,
v.
Tommy G. THOMPSON, Director, Department of Health and Human Services Defendant.

No. CIV.A. 02-2193(RBW).

United States District Court, District of Columbia.

August 17, 2004.

James Clayton Culotta, Law Office of Kenneth Joel Haber, P.C., Kenneth Joel Haber, Rockville, MD, for Plaintiff.

Edith Margeurita Shine, Ana Matheson, U.S. Attorneys Office, Washington, DC, for Defendant.

MEMORANDUM OPINION

WALTON, District Judge.

This matter comes before the Court upon the defendant's motion to dismiss the plaintiff's complaint pursuant to Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil Procedure, or in the alternative for summary judgment and the plaintiff's cross-motion for summary judgment. Upon consideration of the parties' submissions, the court will deny the defendant's motion to dismiss, grant in part and deny in part the defendant's motion for summary judgment, and also grant in part and deny in part the plaintiff's motion for summary judgment. As explained below, the end result of the Court's rulings on the several motions before it is that the plaintiff is unable to maintain this action because his Privacy Act claim is barred by the applicable statute of limitations.

I. Factual Background

The Health Care Quality Improvement Act ("HCQIA"), 42 U.S.C. §§ 11101 et seq. (2004), was enacted in 1986. The purpose of the HCQIA is to protect patients from incompetent physicians by establishing a database to collect information related to professional competence or conduct which could adversely affect the health or welfare of patients. Compl. ¶ 10.^[1] To accomplish the purpose of the HCQIA, Congress authorized the Department of Health and Human Services ("DHHS") to maintain the National Practitioners' Data Bank ("NPDB"), 42 U.S.C. §§ 11133 et seq. (2004). Id. ¶ 11. The NPDB is a database that contains information relating to the professional performances of medical doctors. Specifically, the NPDB contains records of reports which detail malpractice settlements, malpractice awards, and adverse disciplinary actions such as suspensions, terminations from medical staffs, and the loss of licenses to practice medicine. Id. ¶ 23. The NPDB contains information about, inter alia, dentists and oral surgeons. Id.

On February 17, 1994, St. John's Mercy Medical Center ("St.John's") located in St. Louis, Missouri, filed an Adverse Action Report ("Report") with the NPDB regarding its summary suspension of the plaintiff for an indefinite period. Id. ¶ 30. When the Report was filed the plaintiff was licensed to practice dentistry in the State of Missouri. Defendant's Memorandum of Points and Authorities in Support of Defendant's Motion to Dismiss or in the Alternative for Summary Judgment ("Def.'s Mem.") at 6. The Report cited the reasons for the suspension as the, "[u]se of excessive physical force in attempting to restrain a patient who was combative while under anesthesia." Id. A Practitioner Notification Document was sent to the plaintiff to inform him that a Report had been filed with the NPDB. Compl. ¶ 30. Pursuant to 42 U.S.C. § 11133(a)(1)(A), it is mandatory for hospitals to report any professional review action that adversely affects the clinical privileges of a physician for more than 30 days. Def.'s Mem. at 4. Moreover, it is mandatory to report the acceptance of the surrender of such clinical privileges while the physician is under investigation by the hospital for alleged incompetence or improper professional conduct. Id. (citing 42 U.S.C. § 11133(a)(1)(B)).

On May 20, 1994, St. John's submitted a revision to its Report of the suspension of the plaintiff, stating that the suspension had been lifted retroactively to April 25, 1994. Compl. ¶ 31. Specifically, the revised Report stated:

This report revises the adverse action report filed 2/17/94, which informed the [NPDB] of the summary suspension of Dr. Doe pending psychiatric evaluation. Based on the receipt of a positive evaluation, the summary suspension of Dr. Doe has been revoked, effective April 25, 1994.

Def.'s Mem. at 7. The plaintiff objected to use of the term "positive" in describing the results of his psychiatric evaluation. Compl. ¶ 40. The plaintiff claimed that using the word "positive [was] untrue and inaccurate in that it indicate[d] that some psychiatric impairment was found." Id. In a letter to the NPDB dated March 27, 2002, the plaintiff formally asked the DHHS to amend his records pursuant to the Privacy Act, 5 U.S.C. § 552a et seq. (2004), and "remove the statement concerning the psychiatric examination because of its inaccuracy and lack of any ... relevanc[y] or necessity to the agency['s] purposes." Id. ¶ 70. The plaintiff claimed that the revised Report has caused him to refrain from seeking medical privileges at other hospitals. Id. ¶ 117. He asserts that since hospitals must consult the NPDB every time a physician applies for clinical privileges or is placed on staff, that he could be denied privileges by a hospital on the basis of the information contained in the revised Report, which would result in yet another NPDB entry which would "reflect unfavorably upon him." Id. ¶¶ 115, 117; see also 42 U.S.C. § 11135.^[2] However, instead of reviewing the plaintiff's request pursuant to the Privacy Act, the DHHS responded by informing the plaintiff that the sole administrative remedy available to him was the procedures promulgated by the DHHS in 45 C.F.R. 60.14.^[3]Id. ¶ 82. Thus, on May 3, 2002, the plaintiff applied for Secretarial Review of the revised Report under the procedures established by the DHHS regulation. Id. ¶ 98.

After the Secretarial Review of the language in the revised Report was completed, the Secretary of the DHHS concluded that the revised Report indeed was inaccurate. Def.'s Mem. at 8. The language therefore was amended twice and now reads:

This report revises the adverse action report filed February 17, 1994, which informed the [NPDB] of the summary suspension of Dr. Doe pending an appropriate evaluation. Based on the receipt of an evaluation that found that Dr. Doe was not suffering from any type of psychiatric disorder, the summary suspension of Dr. Doe has been revoked effective April 25, 1994.

Def.'s Mem. at 9.^[4] However, the plaintiff continues to object to any reference to a psychiatric examination in his NPDB records because they still reference the psychiatric examination. Compl. ¶ 110. The plaintiff argues that pursuant to the Privacy Act the information pertaining to the psychiatric examination should not be reflected in his NPDB records. Compl. ¶ 140. Therefore, the plaintiff seeks, inter alia, the following relief: (1) an order "declaring unlawful [any] further release of information concerning the existence of the psychiatric examination of [the p]laintiff in 1994 and declaring unlawful further release [by the DHHS] of any information concerning the results of [the] examination", Compl. ¶ 142; (2) a declaration that the DHHS, and any of its components with responsibilities regarding the NPDB, "are bound in their dealings with [the p]laintiff by the Privacy Act and 45 C.F.R. Part 5b," id. ¶ 145; and a determination "that the procedures [set forth in] 45 C.F.R. Part 60.14 are inadequate to protect the Privacy Act [rights] of persons" who have reports about them submitted to the NPDB, id. ¶ 143; (3) an "order directing the DHHS to reissue the releases previously issued but with the psychiatric information being deleted, with a notice contained in the release that the prior releases were issued in error," id. ¶ 140; (4) an award of reasonable attorney's fees and costs pursuant to the Privacy Act, id. ¶¶ 147-49; and (5) the expungement from the NPDB of any records pertaining to the psychiatric evaluation of the plaintiff pursuant to the discretionary exercise of the Court's inherent powers, id. ¶ 150.

II. Analysis

A. Standards of Review

1. Motion to Dismiss

When reviewing a motion to dismiss, the court must accept as true all the factual allegations contained in the complaint. Leatherman v. Tarrant County Narcotics Intelligence & Coordination Unit, 507 U.S. 163, 164, 113 S. Ct. 1160, 122 L. Ed. 2d 517 (1993). A motion to dismiss under Rule 12(b)(6) tests not whether a plaintiff will ultimately prevail on the merits, but only whether the plaintiff has properly stated a claim for which she is entitled to relief. Woodruff v. DiMario, 197 F.R.D. 191, 193 (D.D.C.2000). Thus, a complaint should not be dismissed for failure to state a claim unless "it appears beyond doubt that the plaintiff can prove no set of facts in support of [her] claim which would entitle [her] to relief." Conley v. Gibson, 355 U.S. 41, 45-46, 78 S. Ct. 99, 2 L. Ed. 2d 80 (1957).

2. Summary Judgment

In reviewing the parties' motions for summary judgment, the Court must determine that there exists "no genuine issue as to any material fact and ... [that] the moving party is entitled to judgment as a matter of law." Fed.R.Civ.P. 56(c). The Court must review the facts in the light most favorable to the non-moving party in making this determination. Celotex Corp. v. Catrett, 477 U.S. 317, 325, 106 S. Ct. 2548, 91 L. Ed. 2d 265 (1986). In making its determination, the Court evaluates the "pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any ...," that are presented to the Court. Fed.R.Civ.P. 56(c). Once a motion for summary judgment has been properly made and supported by evidence, the non-moving party must then demonstrate the existence of a genuine issue of material fact for trial. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587, 106 S. Ct. 1348, 89 L. Ed. 2d 538 (1986) (citing Fed.R.Civ.P. 56(e)). The existence of "some alleged factual dispute between the parties will not defeat an otherwise properly supported motion for summary judgment; the requirement is that there be no genuine issue of material fact." Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247-48, 106 S. Ct. 2505, 91 L. Ed. 2d 202 (1986). A fact is material if it "might affect the outcome of the suit under the governing law." Id. at 248, 106 S. Ct. 2505. Summary judgment is mandated if a party fails to establish an element essential to that party's case on which that party will have the burden of proof at trial. Celotex Corp., 477 U.S. at 322, 106 S. Ct. 2548.

3. Judicial Review under the Privacy Act

Section 552a (g)(1) of Title 5 of the United States Code provides that:

[w]henever any agency, (A) makes a determination ... not to amend an individual's record in accordance with his request, or fails to make such review in conformity with that subsection; (B) refuses to comply with an individual request under subsection (d)(1) of this section; (C) fails to maintain any record concerning any individual with such accuracy, relevance, timeliness, and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, or opportunities of, or benefits to the individual that may be made on the basis of such record, and consequently a determination is made which is adverse to the individual, or; (D) fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual, the individual may bring a civil action against the agency, and the district courts of the United States shall have jurisdiction in the matters under the provisions of this subsection.

5 U.S.C. § 552a (g)(1).

B. Does the Privacy Act Supercede the HCQIA Regulations Promulgated by the DHHS?

The plaintiff argues that this case should be controlled by the Privacy Act and not the regulations promulgated by the DHHS, which provides the procedures for disputing information maintained in the NPDB. Compl. ¶ 126. The plaintiff claims that the letter he sent to the NPDB on March 27, 2002, was not a request for Secretarial Review pursuant to 45 C.F.R. Part 60, but was rather a request for the review of his record pursuant to the Privacy Act. Id. ¶ 70. The Privacy Act requires that "prior to disseminating any record about an individual to any person other than an agency ... [, the agency must] make reasonable efforts to assure that such records are accurate, complete, timely, and relevant for agency purposes." 5 U.S.C. § 552a (e)(6). The plaintiff argues that once the DHHS was advised of the alleged inaccurate, incomplete, and irrelevant language in the revised Report, dissemination of the revised Report should have ceased since the act required that "reasonable" efforts be taken to assure the report's accuracy, completeness, timeliness, and relevance, "prior" to further dissemination. Plaintiff's Response to Defendant's Motion to Dismiss or in the Alternative for Summary Judgment ("Pl.'s Resp.") at 20.

Thus, the plaintiff concludes that had the requirements of the Privacy Act been employed he would have been afforded greater protection from dissemination of inaccurate and damaging information. Compl. ¶ 143. The plaintiff contends that the DHHS guidelines applicable to the NPDB (45 C.F.R. 60.14) do not consider factors encompassed in the Privacy Act, which are "designed to assure that the government does not abuse its far reaching power to collect and disseminate information about individuals." Pl.'s Resp. at 18. For example, the NPDB guidelines only require that the "accuracy" of the report be assessed, whereas reasonable efforts to confirm the information's timeliness, completeness, and relevance must be made pursuant to the Privacy Act. Def.'s Mem. at 5. Furthermore, the plaintiff contends that the NPDB continues to disseminate records while the accuracy of records are under review pursuant to the DHHS guidelines, whereas the Privacy Act requires the exercise of "reasonable" efforts before further dissemination occurs. Pl.'s Resp. at 19. Thus, the plaintiff concludes that, "the [DHHS] totally skirts the provisions of the Privacy Act which require `reasonable' efforts to assure accuracy, completeness, timeliness and relevance[.]" Id. at 20.

On the other hand, the defendant argues that "the provisions of the Privacy Act as applied to a system of records created by statute are superseded by HCQIA, the enabling statute for the NPDB, which specifically sets forth requirements for the collection, retention and dissemination of the information contained in the [NPDB.]" Def.'s Mem. at 11; see also 42 U.S.C. §§ 11131-11136. The defendant also argues that the Privacy Act does not apply here because "the [NPDB's] enabling statute, the HCQIA, was enacted in 1986 after the Privacy Act of 1974" and it addresses "the collection, retention, disclosures and challenge of information in the NPDB." Id. The defendant cites to Doe v. United States Dep't of Health & Human Serv., 871 F. Supp. 808, 814-15 (E.D.Pa.1994), aff'd, 66 F.3d 310 (3rd Cir.1995) as support for its position, which held that the specific reporting provisions encompassed in the HCQIA supersede any claims the plaintiff might otherwise have under the Privacy Act. See also In Re Johnson, 787 F.2d 1179, 1181-82 (7th Cir.1986) (recognizing that a specific statute takes precedent over a more general statute, and a later statute may limit the scope of an earlier statute).

Additionally, the defendant posits that the HCQIA complies with the standards set by the Privacy Act. Def.'s Mem. at 12. The defendant claims that the dispute resolution procedures promulgated by the DHHS "not only use the corrective procedures of the Privacy Act as a framework, [but also] provide significant additional rights, such as providing notice by mail of a report filed in the [NPDB] to the ... individual [who is the subject of the report] and allowing the ... individual to request that the disputed information be entered into a `disputed' status and be reported to inquirers as being in a `disputed' status." Id. (citing 45 C.F.R. §§ 60.14(a), (b)(2)). The defendant also states that "[b]oth the Privacy Act and the NPDB regulations allow an individual to request [that a record be amended], to request review of a refusal to amend a record, and also permit[s] an individual to file a statement setting forth the reasons for the disagreement that is included in the record." Id. The defendant therefore opines that the regulations for disputing a report in the NPDB, comply with the Privacy Act. Id.

However, when comparing the Privacy Act to the procedures promulgated for challenging a record submitted to the NPDB, it is readily apparent that the NPDB procedures provide less protection than the procedures required by the Privacy Act. For example, the Privacy Act requires that "prior to disseminating any record about an individual to any person other than an agency ... [, the agency must] make reasonable efforts to assure that such records are accurate, complete, timely, and relevant for agency purposes." 5 U.S.C. § 552a (e)(6). On the other hand, the NPDB regulations only require the DHHS to place a "disputed" notice on any report if information it contains is in dispute, and does not require a "reasonable" check for, among other requirements, accuracy prior to its dissemination. 45 C.F.R. 60.14. Moreover, when reviewing a disputed record pursuant to the NPDB regulation, the Secretary of DHHS only checks the record for accuracy, not its completeness, timeliness and relevance as required by the Privacy Act. Id. Thus, the DHHS' regulation which applies to the NPDB fall short of providing an individual with the same level of protection afforded by the Privacy Act in two respects: first, by authorizing the dissemination of the record while information it contains is being disputed, and second, by not requiring that the record be reviewed for completeness, timeliness and relevance.

In addition, the defendant's argument concerning the rule of statutory construction that a later enacted statute supersedes an earlier enacted statute is inapplicable here. In Detweiler v. Pena, 38 F.3d 591, 594 (D.C.Cir.1994), the Circuit Court noted that there is no need to apply canons of statutory construction when there is no irreconcilable conflict between the statutes. Here, this Court cannot find any irreconcilable conflict between the two statutes. While the Privacy Act provides specific procedures for an agency to follow when a record is disputed, the HCQIA only requires that the "Secretary shall, by regulation, provide for ... procedures in the case of disputed accuracy of the information." 42 U.S.C. § 11136. Therefore, it appears that the HCQIA is simply not as comprehensive as the Privacy Act when records become the subject of a dispute. Moreover, the Supreme Court has established the standard for determining when one statute supercedes another in the absence of an express repeal or modification. As articulated in Blanchette v. Connecticut Gen. Ins. Corp., 419 U.S. 102, 133-134, 95 S. Ct. 335, 42 L. Ed. 2d 320 (1974), the standard is "positive repugnancy between the provisions of the statutes which cannot be reconciled." Here, as just noted, there is no positive repugnancy between the HCQIA and the Privacy Act. Furthermore, it was clearly the intent of the DHHS to adhere to the Privacy Act when adopting the NPDB regulations pursuant to the authority of 42 U.S.C. § 11136. For example, the NPDB Guidebook recognizes this objective by specifically stating that "[t]he Privacy Act protects the contents of Federal systems of records on individuals, like those in the NPDB from disclosure without the individual's consent...." Compl. ¶ 21 (quoting NPDB Guidebook p. H-2). Thus, the DHHS itself in recognizing the congruent purpose of the Privacy Act and the NPDB contradicts its position that the Privacy Act was superceded by the HCQIA.

The Court reaches this conclusion despite the statement of this Court's Eastern District of Pennsylvania colleague in Doe that "I am in agreement with the defendants' position that the specific reporting provisions encompassed in the HCQI Act supercedes any claims Dr. Doe might have under the Privacy Act." Doe, 871 F.Supp. at 814-15. This statement was made without any substantive analysis and appears to have been just a passing remark at the conclusion of the opinion that was not central to the resolution of the case. Moreover, the factual context in Doe was quite different from the situation here. Doe concerned a situation where the information sought to be removed from the NPDB (a criminal conviction) was factual and a matter of public record. Id. at 814. On the other hand, here the plaintiff is challenging information about him that conceivably could be construed as reflecting negatively on his professional fitness, when in fact the truth of the matter indicates nothing to that effect. Further, another District Court reached the opposite conclusion concerning the applicability of the Privacy Act, Azmat v. Shalala, 186 F. Supp. 2d 744, 748-749 (W.D.Ky.2001), albeit without having conducted any substantive analysis either. Therefore, to the extent Doe supports the defendant's position, its persuasiveness is neutralized by Azmat.

In sum, this Court concludes that the DHHS must adhere to the requirements of the Privacy Act when considering a dispute to a record in the NPDB. Therefore, the plaintiff is entitled to partial summary judgment in regards to the DHHS's failure to adhere to the provisions of the Privacy Act.

C. Is this action barred by the applicable statute of limitations?

The defendant argues that the plaintiff's claims are barred by the applicable statutes of limitations. Def.'s Mem. at 10. First, the defendant argues that the plaintiff's claims are barred by the 60 day limitation period of 45 C.F.R. Part 60.14(b). Id.^[1] The defendant further contends that the plaintiff received notice of his NPDB Report in May of 1994 and by his own admission did not seek to amend his record until March of 2002, well beyond the 60 days required by the regulation. Id. Therefore, the defendant argues that the plaintiff's claims are time-barred. Id. Furthermore, the defendant argues that even if the plaintiff's claims are analyzed under the Privacy Act, they are still barred by its two year limitation period.

The Privacy Act provides that "[a]n action to enforce any liability created under this section may be brought in the district court ... within two years from the date on which the cause of action arises." 5 U.S.C. § 552a(g)(5). The defendant contends that this two-year statute of limitations starts to run when the plaintiff knows or should have known of the alleged violation of the Act. Def.'s Mem. at 10. Thus, the defendant concludes that since the plaintiff received notice of the NPDB revised Report in May of 1994 and did not dispute the revised Report until March of 2002, nearly eight years after the cause of action arose, the plaintiff's claims are clearly time barred. Id.

The plaintiff, on the other hand, asserts that he acted within the applicable two year statute of limitations of the Privacy Act. Pl.'s Resp. at 8; 5 U.S.C. § 552a (g)(5). The plaintiff alleges that the DHHS violated 5 U.S.C. § 552a (e)(6) ^[2] and he interprets this provision as creating a violation of the Privacy Act each time the report about him was disseminated by the DHHS after it received notice that a challenge to the report was being raised and the DHHS did not make "reasonable efforts" to assure the accuracy, relevance, completeness, or timeliness of the record prior to its disclosure. Pl.'s Resp. at 12. The plaintiff opines that under 5 U.S.C. § 552a (e)(6), an agency has a duty to examine a record and make appropriate corrections prior to any further dissemination "when a private person provides evidence to the agency which reasonably supports the possibility that the information being disseminated about the individual is inaccurate, irrelevant, incomplete, or untimely." Id. at 11-12. The plaintiff contends that he provided the agency with such evidence eight months prior to filing his complaint in this action when he sent a letter to the NPDB in March of 2002. Id. at 9. The plaintiff claims that after notifying the DHHS of the alleged problem in regard to his revised Report, dissemination of his record continued prior to the agency reviewing it. Id. at 12. The plaintiff therefore draws the conclusion that every dissemination of his record which occurred after he notified the DHHS about the alleged problem, and before the DHHS reviewed his record, creates a new cause of action and therefore this case was initiated within the two-year statute of limitations period. Id. at 13.

Under the Privacy Act, a plaintiff has two years to bring an action "from the date on which the cause of action arises ..." 5 U.S.C. § 552a (g)(5) is when. The critical issue in determining whether the plaintiff's action is barred by 5 U.S.C. § 552a (g)(5) is when the plaintiff first knew or had reason to know that the private records were being maintained. Tijerina v. Walters, 821 F.2d 789, 798 (D.C.Cir.1987); see also Diliberti v. United States of America, 817 F.2d 1259 (7th Cir.1987). Here, the plaintiff received notice of the revised Report in May of 1994, Def.'s Mem. at 10, but his complaint in this action was not filed until November of 2002, six years after the defendant contends the statute of limitations expired.

Despite this lapse of time, the plaintiff argues that a new cause of action was created each time the DHHS disseminated his revised Report after it had been placed on notice of a potential problem and before it reviewed the revised Report for accuracy, relevance, completeness, and timeliness. Pl.'s Resp. at 8-9. Based on this interpretation, the plaintiff concludes that his complaint filed in November of 2002 is timely since the DHHS disseminated his record five times after it received notice of a potential problem in March 2002. Id. at 9. The plaintiff's position is not supported by applicable case law. "A Privacy Act claim is not tolled by continuing violations." Davis v. Dep't of Justice, 204 F.3d 723, 726 (7th Cir.2000) (citing Diliberti, 817 F.2d at 1261). Accordingly, a former member of this Court found that "new causes of action do not arise each and every time there is a subsequent adverse determination based on the alleged incorrect records." Szymanski v. U.S. Parole Comm., 870 F. Supp. 377, 378 n. 4 (D.D.C.1994) (citing Diliberti, 817 F.2d at 1264). Therefore, it is wholly irrelevant when the plaintiff notified the DHHS of the alleged problem. As indicated already, the relevant factor for the Court to assess in deciding when the statute of limitations has expired is to determine when the plaintiff knew or should have known of the alleged inaccuracy in the NPDB revised Report. Tijerina, 821 F.2d at 798; Diliberti, 817 F.2d at 1262. In Diliberti the Court found that "the hearsay and rumors which the plaintiff heard were enough to put him on notice of the possible existence of the records at issue ... [and] impose[d] upon him a duty to inquire into the veracity of those rumors for purposes of bringing an action under the Privacy Act." 817 F.2d at 1263. The Court was unmoved by the plaintiff's argument that individuals pursuing future Privacy Act claims would "be forced to file suit upon the mere suspicion of the existence of an improper record, thus opening the floodgates to meritless litigation." Id. The Diliberti Court found that the Privacy Act "allows a plaintiff a period of two years after he first has reason to believe that a government [agency] is maintaining an inaccurate record to investigate whether there are reasonable factual and legal bases for bringing a suit under the Privacy Act and then ultimately bring the suit." Id.

Here, the plaintiff was mailed and actually received notice of the revised Report which the DHHS maintained in the NPDB. Def.'s Mem. at 10. It was upon receipt of that notice that he had two years to investigate the matter and then initiate a Privacy Act suit. Diliberti, 817 F.2d at 1263. To allow the plaintiff to bring suit now under the continuing violation doctrine would, "in practical effect, mean that the two-year statute would never run." Bergman v. United States, 751 F.2d 314, 317 (10th Cir.1984); Diliberti, 817 F.2d at 1263.

Finally, the statute of limitations of a Privacy Act claim can only be tolled where an agency has materially and willfully misrepresented any information required under this section to be disclosed to an individual and the information so misrepresented is material to establishment of the liability of the agency to the individual under this section, the action may be brought at any time within two years after discovery by the individual of the misrepresentations.

5 U.S.C. § 552a (g)(5); see also Armstrong v. United States Bureau of Prisons, 976 F. Supp. 17, 21 (D.D.C.1997). Here, it is clear that the DHHS never materially and willfully misrepresented any information it had received about the plaintiff. As discussed above, the DHHS notified the plaintiff about the record and its contents in 1994 when the record was first created. Def.'s Mem. at 10. Additionally, at the plaintiff's request, the defendant changed the record twice in an effort to produce an accurate record. This is hardly the act of an agency that was acting in bad faith. Therefore, this Court concludes that even though the Privacy Act applies to the plaintiff's claims, the defendant's motion for summary judgment must be granted because the applicable statute of limitations long ago expired. It is clear that "the statutory time limitation ... is unquestionably an integral condition of the sovereign's consent to be sued under the Privacy Act. Accordingly, ... a plaintiff's failure to file suit within the time period specified ... deprives the federal courts of subject matter jurisdiction over the action." Diliberti, 817 F.2d at 1262. This Court is therefore without authority to entertain this lawsuit.

III. Conclusion

In conclusion, summary judgment is awarded to the plaintiff, in part, because the Court concludes that the Privacy Act applies to the NPDB. However, the plaintiff cannot pursue his Privacy Act claims because they are barred by the running of the Privacy Act's two year statute of limitations, and accordingly summary judgment must be granted in favor of the defendant. This action is therefore dismissed with prejudice.^[3]

NOTES

[1] References to the "Compl." are to Plaintiff's First Amended Complaint for Injunctive and Declaratory Relief filed on June 23, 2003.

[2] Hospitals are required every two years to request that the Secretary of the DHHS or his or her designee advise them of any information reported to the NPDB "concerning any physician or such practitioner who is on the medical staff (courtesy or otherwise) of, or has been granted clinical privileges at, the hospital." 42 U.S.C. § 11135(a)(2); see also 42 U.S.C. § 11134(b).

[3] These procedures for disputing information contained in the NPDB, found at 45 C.F.R. 60.14, are:

(1) Informing the Secretary and the reporting entity, in writing, of the disagreement, and the basis for it,

(2) Requesting simultaneously that the disputed information be entered into a "disputed" status and be reported to inquirers as being in a "disputed" status, and

(3) Attempting to enter into discussion with the reporting entity to resolve the dispute.

[4] In the plaintiff's first amended complaint, he also objected to the original revision of his revised Report St. John's submitted to the NPDB. Compl. ¶ 146. The DHHS then asked St. John's for a clarification of their revision of the revised Report. Def.'s Mem. at 9. The language quoted above is the most current version of the information contained in the plaintiff's NPDB file. Id. at 9-10.

[1] Having concluded that the Privacy Act is applicable to this situation, its two-year statute of limitations provision governs when a court case must be initiated after a cause of action has occurred. 5 U.S.C. ¶ 552a (g)(5). Thus, the applicable statute of limitations is two years, and not the 60 day period established by the DHHS regulations. In any event, even if the Court were to decide that 45 C.F.R. Part 60.14(b) and the requisite 60 day limitation period did apply, the plaintiff's claims would also be barred pursuant to that regulation.

[2] 5 U.S.C. 552a (e)(6) states, "Each agency that maintains a system of records shall prior to disseminating any record about an individual to any person other than an agency, unless the dissemination is made pursuant to subsection (b)(2) of this section, make reasonable efforts to assure that such records are accurate, complete, timely, and relevant for agency purposes."

[3] The plaintiff's request for attorney's fees pursuant to the Privacy Act is denied because the plaintiff did not prevail on his Privacy Act claim. See Blazy v. Tenet, 194 F.3d 90, 94 (D.C.Cir.1999) ("[P]arties who prevail against the Government on claims under the [Privacy Act] may seek reasonable attorney fees and other litigation costs.").