UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

JENNIFER L. LOMBRANO,

Plaintiff,

v. No. 21-cv-872 (DLF)

DEPARTMENT OF THE AIR FORCE,

Defendant.

MEMORANDUM OPINION

Jennifer Lombrano brings this action against the Department of the Air Force under the

Privacy Act, 5 U.S.C. § 552a. Lombrano alleges that the Air Force impermissibly disclosed

information from her medical records to her workplace, resulting in both her termination from

that workplace and her early retirement from a related government agency. Before the Court is

the Air Force’s Motion to Dismiss her complaint pursuant to Federal Rule of Civil Procedure

12(b)(6). Dkt. 14. For the reasons that follow, the Court will deny the motion.

I. BACKGROUND

When considering a motion to dismiss, the Court takes the well-pleaded factual

allegations in the complaint as true. See Ashcroft v. Iqbal,

(2009). At the time

of the events at issue, Lombrano was a commissioned officer in the United States Public Health

Service, First Am. Compl. (Compl.) ¶ 3, Dkt. 12-4, serving as an oral and maxillofacial surgeon,

id. ¶ 15. Per a Memorandum of Agreement, she had been assigned to the SouthCentral

Foundation (SouthCentral) in Anchorage, Alaska. Id. ¶ 16. SouthCentral is a “nonprofit health

care organization serving nearly 65,000 Alaska Native and American Indian people.” Id. ¶ 17. Lombrano intended to stay with SouthCentral after her retirement from the Public Health

Service. Id. ¶ 18.

However, in August 2020, Lombrano “was suffering from severe panic attacks resulting

from personal and professional issues.” Id. ¶ 20. As a Public Health Service officer, Lombrano

receives healthcare at Department of Defense Medical Treatment Facilities, such as the hospital

at Joint Base Elmendorf-Richardson. Id. ¶ 22. On approximately August 14, 2020, Lombrano

visited “the on-call outpatient mental health care provider at Joint Base Elmendorf-Richardson

with whom [Lombrano] confided that she had intended to seek treatment” at a ten-day alcohol

and drug rehabilitation treatment facility in Seattle. Id. ¶ 23.

The outpatient treatment provider advised Lombrano to stay the night for medical

attention given her health history (specifically, a cardiac ablation approximately a year earlier).

Id. ¶ 24. The outpatient provider also “told her that the next day she would be able to make her

treatment arrangements” and that she would be provided “options for treatment programs that

were covered by Tricare insurance.” Id. ¶ 25. However, Lombrano was placed in the “inpatient

Behavioral Health Unit, essentially . . . a psych ward behind locked doors.” Id. ¶ 26. As part of

an inventory of Lombrano’s belongings, “hospital officials seized three 2 milligram Gummy

Bears infused with THC, the metabolite for marijuana.” Id. ¶ 29.

The next day, on August 15, 2020, Lombrano “met with Colonel Christine Campbell,

USAF, the attending psychiatrist, in the inpatient Behavioral Clinic at Joint Base Elemendorf-

Richardson.” Id. ¶ 31. “Colonel Campbell disclosed that she had already contacted

SouthCentral Foundation, that she ha[d] spoken with [Lombrano’s] supervisor and that she had

disclosed [Lombrano’s] medical condition and her current mental state.” Id. ¶ 32. One day later,

on August 16, 2020, Lombrano’s supervisor at SouthCentral informed her that Campbell “in fact

2 had contacted the HR department and told them that she was impaired, mentally unstable, had an

alcohol problem and now had a drug charge for possession of an illegal substance.” Id. ¶ 33.

SouthCentral terminated Lombrano’s assignment in a letter dated September 2, 2020. Id.

¶ 36. Lombrano alleges that this termination was “[b]ased upon the unlawful disclosures by Air

Force personnel.” Id. Lombrano further alleges that she was “forced to retire early” from the

Public Health Service and lost “the difference in salary versus her retired pay.” Id. ¶ 45. After

her termination, she alleges that “she could only find employment on a part-time, two-day per

week basis.” Id. Finally, she alleges that “[h]er future employment prospects are jeopardized

because she will have to reveal circumstances behind the dismissal to future employers.” Id.

II. LEGAL STANDARDS

Rule 12(b)(6) of the Federal Rules of Civil Procedure allows a defendant to move to

dismiss the complaint for “failure to state a claim upon which relief can be granted.” Fed. R.

Civ. P. 12(b)(6). To survive a Rule 12(b)(6) motion, a complaint must contain factual matter

sufficient “to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly,

(2007). A facially plausible claim is one that “allows the court to draw the

reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal,

. This standard does not amount to a specific probability requirement, but it does require

“more than a sheer possibility that a defendant has acted unlawfully.” Id.; see also Twombly,

(“Factual allegations must be enough to raise a right to relief above the

speculative level.”). A complaint need not contain “detailed factual allegations,” but alleging

facts that are merely consistent with a defendant’s liability . . . stops short of the line between

possibility and plausibility.” Iqbal,

(internal quotation marks omitted).

3 The Court must “accept as true” all the factual allegations in the plaintiff’s complaint,

, and “grant[] the benefit of all inferences that can be derived from the facts alleged,”

Hettinga v. United States,

(D.C. Cir. 2012) (internal quotation marks omitted).

The Court need not accept, however, any “legal conclusion [that is] couched as a factual

allegation.” Iqbal,

(internal quotation marks omitted). Likewise, the Court will

not credit an “unadorned, the-defendant-unlawfully-harmed-me accusation,” or a “[t]hreadbare

recital[] of the elements of a cause of action, supported by mere conclusory statements.”

Ultimately, “[d]etermining whether a complaint states a plausible claim for relief [is] a context-

specific task that requires the reviewing court to draw on its judicial experience and common

sense.”

.

III. ANALYSIS

The Privacy Act “contains a comprehensive and detailed set of requirements for the

management of confidential records held by Executive Branch agencies.” FAA v. Cooper,

(2012). It “safeguards the public from unwarranted collection, maintenance, use

and dissemination of personal information contained in agency records.” In re OPM Data Sec.

Breach Litig.,

, 61–62 (D.C. Cir. 2019) (quoting Henke v. Dep’t of Com.,

(D.C. Cir. 1996)). To that end, the Privacy Act prohibits agencies from disclosing

“any record which is contained in a system of records by any means of communication to any

person, or to another agency, except pursuant to a written request by, or with the prior consent

of, the individual to whom the record pertains,” unless certain exceptions apply. 5 U.S.C.

§ 552a(b).

The Privacy Act contains a private right of action against agencies that improperly

disclose such records. See id. § 552a(g)(1)(D). “To unlock the Privacy Act’s waiver of

4 sovereign immunity and state a cognizable claim for damages, a plaintiff must allege that (i) the

agency ‘intentional[ly] or willful[ly]’ violated the Act’s requirements for protecting the

confidentiality of personal records and information; and (ii) she sustained ‘actual damages’ (iii)

‘as a result of’ that violation.” In re OPM,

(quoting 5 U.S.C. § 552a(g)(4)).

The Air Force moves to dismiss Lombrano’s complaint on two grounds. See Mot. to

Dismiss at 6, Dkt. 14. First, the Air Force argues that Lombrano failed to plausibly allege the

disclosure violated the Privacy Act. Id. at 6. Second, the Air Force argues that Lombrano failed

to sufficiently plead actual damages. Id. at 10. Both arguments fail.

A. Improper Disclosure

1. The Alleged Disclosure

Lombrano has sufficiently alleged the elements required to state a claim for improper

disclosure. “Privacy Act claims for monetary damages based on improper disclosure . . . have

four elements: ‘1) the disclosed information is a record contained within a system of records; 2)

the agency improperly disclosed the information; 3) the disclosure was willful or intentional; and

4) the disclosure adversely affected the plaintiff.’” Doe v. DOJ,

, 44–45

(D.D.C. 2009) (quoting Logan v. Dep’t of Veterans Affs.,

(D.D.C.

2004)). In this case, Lombrano has alleged that her information was contained in her medical

records, see, e.g., Compl. ¶ 44, which were maintained within a system of records protected by

the Privacy Act, see id. ¶¶ 38, 44.1 Lombrano has identified the recipients of the information,

see id. ¶¶ 32–33, 42, 44; the person who allegedly disclosed the information, see id.; and the time

1 The Air Force argues that Lombrano failed to allege that Campbell accessed the records through the use of Lombrano’s name or another identifier. See Def.’s Reply at 3, Dkt. 17. But one can infer that medical records would include identifying information, 5 U.S.C. § 552a(a)(4), and be “retrieved by the name of the individual” or by some other identifier, id. § 552a(a)(5).

5 period—a span of one day—during which the information was disclosed, see id. ¶¶ 23, 31–32.

In addition, Lombrano has alleged that she had never spoken with Campbell before the

disclosure to SouthCentral and that Campbell “was not present when Plaintiff was admitted to

the hospital.” Id. ¶ 44. Finally, she has alleged that she lost her job and was forced to retire

early as a result of the disclosure. Id. ¶ 45; see infra III.B.

The facts here resemble those in Feldman v. CIA,

(D.D.C. 2011). In

Feldman, a CIA employee alleged that the agency improperly disclosed information regarding an

investigation relating to his travel reimbursements. See

. As relevant

here, the employee under investigation based this claim on allegations that other employees

“learned of the investigation despite having no official connection to it.”

. The CIA

argued that the other employees may have gained their knowledge from independent sources,

such as “other employees who were interviewed by the CIA OIG investigators,” rather than from

protected records.

. However, the Court stated that reliance on a “res ipsa loquitur

inference . . . at the pleading stage may be sufficient to survive a motion to dismiss, depending

on the facts alleged.”

. In Feldman, it was enough at the motion to dismiss stage that

the plaintiff had alleged that the record at issue was protected by the Privacy Act; that the

employees who learned the information had “no official connection to the investigation”; that

Feldman had “identified these employees by name”; and that Feldman had “identified the

approximate time period in which they learned about the investigation.”

Similar to Feldman, Lombrano’s assertion that Campbell “could only have” obtained the

disclosed information “by reading the medical record that was created when Plaintiff entered the

hospital at Joint Base Elmendorf-Richardson” is plausible. Compl. ¶ 44. It rests on a single

“reasonable inference,” Iqbal,

, not, as the Air Force contends, “a series of

6 speculative assumptions,” Mot. to Dismiss at 7. It is true that Lombrano’s inference, see Compl.

¶ 44, will likely be “inadequate to sustain a Privacy Act claim on the merits.” Feldman,

(discussing Armstrong v. Geithner,

(D.C. Cir. 2010)); see

Armstrong, 608 F.3d at 857–61. But Lombrano is not required to connect all the dots now.

“Indeed, in the typical case, a plaintiff can hardly be expected to know the full details behind an

improper disclosure prior to discovery, since those details are most likely to be under the control

of the defendant.” Feldman,

.

Even though Campbell may have obtained Lombrano’s disclosed information without

accessing any medical record, see Mot. to Dismiss at 7, dismissal of her complaint is not

warranted at this early stage. “[A] complaint survives a motion to dismiss even [i]f there are two

alternative explanations, one advanced by [the] defendant and the other advanced by [the]

plaintiff, both of which are plausible.” VoteVets Action Fund v. U.S. Dep’t of Veterans Affs.,

(D.C. Cir. 2021) (quoting Banneker Ventures, LLC v. Graham,

(D.C. Cir. 2015) (internal quotation marks omitted)). The Air Force contends that

Campbell “naturally would have discussed patients” with her colleagues due to her role as “the

attending (i.e., supervising) psychiatrist at the behavioral clinic.” Mot. to Dismiss at 7; see also

Doe v. U.S. Dep’t of Treasury,

(D.D.C. 2009) (noting that, as a general

matter, “[t]he disclosure of information derived solely from independent sources is not

prohibited by the statute even though identical information may be contained in [a] system of

records” (citation omitted)). But Lombrano has offered a plausible explanation for how

Campbell learned the relevant information. Lombrano “will need to amass sufficient evidence to

meet [her] burden of proof as the case proceeds,” but she “need not do so at the pleading stage.”

Kelley v. FBI,

(D.D.C. 2014).

7 2. The Routine Use Exceptions

The Air Force argues that even if Campbell obtained the allegedly disclosed information

from Lombrano’s records, Lombrano has failed to show that the Privacy Act’s exceptions do not

apply. See Mot. to Dismiss at 8. Specifically, the Air Force argues that the alleged disclosure

was permissible under two of the Privacy Act’s “routine use” exceptions. 5 U.S.C. § 552a(b)(3);

see Mot. to Dismiss at 8.

By way of background, a “routine use” is a “disclosure of a record . . . which is

compatible with the purpose for which [the record] was collected.” 5 U.S.C. § 552a(a)(7). All

agencies that “maintain[] a system of records” are required to publish a notice in the Federal

Register whenever they create a new, or revise an existing, system of records. Id. § 552a(e)(4).

This system of records notice (SORN) must include “each routine use of the records contained in

the system, including the categories of users and the purpose of such use.” Id. § 552a(e)(4)(D).

The law enforcement routine use, which applied at the relevant time throughout the

Department of Defense, provides:

If a system of records maintained by a DoD Component to carry out its functions indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature, and whether arising by general statute or by regulation, rule, or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the agency concerned, whether Federal, State, local, or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, rule, regulation, or order issued pursuant thereto.

Department of Defense Privacy Program,

, 18,784 (Apr. 13, 2007) (codified

as amended at 32 C.F.R. pt. 310 app. A); see also Privacy Act of 1974; Technical Amendment,

, 64,368 (Nov. 18, 2021) (reinstating the above routine use after it was

“erroneously deleted” in 2019 from the Code of Federal Regulations). The Air Force has

specifically subjected its Medical Records System to this routine use. See Privacy Act of 1974;

8 System of Records,

, 34,711 (June 18, 2010) (incorporating all the

Department of Defense’s “Blanket Routine Uses” by reference).

The routine use for law enforcement does not apply here. Although Lombrano’s

possession of the gummy bears containing marijuana was arguably relevant to her employment,

see Mot. to Dismiss at 8; Def.’s Reply at 4, the routine use allows only disclosures to agencies

charged with either “enforcing or implementing” the relevant law or “investigating or

prosecuting” violations thereof. 72 Fed. Reg. at 18,784. The Public Health Service is not a law

enforcement agency, and the Air Force has not suggested that it is charged with enforcing or

implementing laws prohibiting marijuana.

The Air Force’s reliance on a second routine use, which pertains to disclosures made

when requesting information, also fails. See Def.’s Reply at 5. This routine use states:

A record from a system of records maintained by a Component [of the Department of Defense] may be disclosed as a routine use to a Federal, State, or local agency maintaining civil, criminal, or other relevant enforcement information or other pertinent information, such as current licenses, if necessary to obtain information relevant to a Component decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant, or other benefit.

72 Fed. Reg. at 18,784 (codified as amended at 32 C.F.R. pt. 310 app. A). This routine use also

does not apply because SouthCentral and the Public Health Service, the entities that made the

relevant retention decisions, are not components of the Department of Defense. See 42 U.S.C.

§§ 201–203 (noting that the Public Health Service falls within the Department of Health and

Human Services). Moreover, even if this routine use applied, the Air Force has forfeited this

argument by raising it for the first time in its reply brief. It is well settled that the exceptions in

the Privacy Act are affirmative defenses, which defendants must either timely raise or eventually

forfeit. See Kelley,

n.15 (reading Doe v. FBI,

(D.C. Cir.

1991); Richardson v. Bd. of Governors of Fed. Rsrv. Sys.,

(D.D.C.

9 2017). And under the “ordinary rules of forfeiture,” arguments are generally “forfeited if [they

are] raised for the first time in reply.” Twin Rivers Paper Co. v. SEC,

(D.C.

Cir. 2019) (citation omitted). Because the Air Force raised its second routine use in that manner,

it cannot prevail on that exception here.

The Air Force’s remaining arguments are red herrings. First, the Air Force argues that

Lombrano’s complaint focuses on “express[ing] disagreement with the Air Force’s action with

respect to Plaintiff’s termination” and that “[t]he Privacy Act . . . is not a vehicle for amending

the judgments of federal officials that are reflected in records maintained by federal agencies.”

Mot. to Dismiss at 9. However, Lombrano’s complaint clearly alleges improper disclosure under

the Privacy Act. See, e.g., Compl. ¶¶ 42–43. Whether Lombrano’s complaint also indicates

disagreement with her termination or judgments reflected in her medical records is irrelevant.

Second, the Air Force argues that “[t]o the extent . . . that Plaintiff bases her claim upon HIPAA .

. . the Court should reject Plaintiff’s use of the Privacy Act in the disguise of a HIPAA claim.”

Mot. to Dismiss at 9. While Lombrano’s complaint includes a reference to HIPAA, see Compl.

¶ 34, it focuses on and states a claim under the Privacy Act, see

¶¶ 40–46.

B. Actual Damages

To state a claim under the Privacy Act, a plaintiff must also allege “actual damages,” 5

U.S.C. § 552a(g)(4)(A), a phrase that requires a “pecuniary” harm, Cooper, 566 U.S. at 295–96.

Lombrano has met that standard by alleging that Campbell’s disclosure caused both the

termination of her SouthCentral assignment and her forced retirement from the Public Health

Service. See Compl. ¶¶ 36, 45. Clearly, the loss of employment creates at least some pecuniary

harm. See Hill v. DOD,

(D.D.C. 2014). And although the Air Force

objects that Lombrano has failed to provide the specific amount of the difference between her

10 salary and retirement pay, see Mot. to Dismiss at 11; Def.’s Reply at 6, she is not required to do

so at this stage of the proceeding.2 See Hill,

(plaintiff not required to

quantify specific pecuniary harms to “survive a Rule 12(b)(6) . . . motion”). To state a claim for

relief under the Privacy Act, it is enough to plausibly “some pecuniary harm, no matter how

slight.” Cooper,

. Because Lombrano has cleared that bar, her claim survives the

Air Force’s motion to dismiss.

CONCLUSION

For the foregoing reasons, the Air Force’s motion to dismiss is denied. An order

consistent with this decision accompanies this memorandum opinion.

________________________ DABNEY L. FRIEDRICH United States District Judge February 9, 2022

2 This conclusion is consistent with Richardson v. Board of Governors of the Federal Reserve System,

(D.D.C. 2018), as the alleged disclosures in that case occurred only after the plaintiff’s termination,

. See Mot. to Dismiss at 11 (discussing the case).

11