C. v. District of Columbia

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

V.C., et al., Plaintiffs, v. Civil Action No. 23-1139 (CKK) DISTRICT OF COLUMBIA, Defendant.

MEMORANDUM OPINION (May 4, 2026) This matter comes before the Court on Plaintiffs’ [64] Motion to Strike Defendant’s [62] Sealed Opposition to Plaintiffs’ [8] Motion to Certify Class and accompanying [57] Motion for Leave to File a Supplemental Brief in support thereof. Plaintiffs argue that the Court should strike Defendant’s Opposition because it discloses protected health information in violation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Upon consideration of the parties’ submissions, the relevant legal authority, and the entire record, the Court determines that Defendant’s use of protected health information in its sealed filing does not violate HIPAA and shall therefore DENY Plaintiffs’ [64] Motion to Strike.

I.

Plaintiffs are individuals incarcerated at facilities operated by the District of Columbia Department of Corrections (“DOC”). See Compl., Dkt. No. 1. They bring this action against the District of Columbia (the “District”) alleging that DOC provides constitutionally inadequate healthcare. Id. Plaintiffs did not sue DOC directly because DOC is “not an entity capable of being sued separate from the District of Columbia.” Carter-El v. D.C. Dep’t of Corr., 893 F. Supp. 2d 243, 247 (D.D.C. 2012) (RBW), aff’d, No. 12-5357, 2013 WL 3367416 (D.C. Cir. July 5, 2013);

D.C. Code § 1-603.01 (providing that DOC is a subordinate agency of the District of Columbia Government, which means it is “under the direct administrative control of the Mayor”).

In April 2023, Plaintiffs moved to certify this action as a class action on behalf of “all people who are or will be incarcerated in [DOC] facilities who have serious medical needs.” Pls.’

Mot. for Certification, Dkt. No. 8. This matter was then stayed at the parties’ joint request to allow the parties to engage in mediation.

In March 2026, the parties informed the Court that they had reached an impasse in their mediation discussions and asked that the stay be lifted. Joint Status Report, Dkt. No. 55. Plaintiffs then moved for leave to file a supplemental brief in support of their motion for class certification.

Pls.’ Supp. Mot., Dkt. No. 57. Through their supplemental brief, Plaintiffs seek to add seven new proposed class representatives and submit five additional declarations in support of their motion to certify a class. Id. The District opposes Plaintiffs’ motion for class certification and their motion for leave to file a supplemental brief. In its opposition to Plaintiffs’ motion for class certification, the District filed a sealed brief and supporting papers that contained the protected health information of Plaintiffs’ proposed class representatives and other members of the putative class. See Dkt. No. 62. These sealed filings were accompanied by redacted filings on the public docket. See Dkt. No. 63. The District indicated that it had asked Plaintiffs’ consent to file and reference this protected health information and that Plaintiffs had not consented to the District doing so.

Plaintiffs quickly moved to strike the District’s filings. See Dkt. No. 64. Plaintiffs argue that the Court should strike the District’s filings because they disclose protected health information in violation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

II. LEGAL STANDARD A. The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) HIPAA regulates persons and entities “that have access to individually identifiable medical information and who conduct certain electronic health care transactions.” Hill v. Smoot, 308 F. Supp. 3d 14, 23 (D.D.C. 2018) (RBW) (quoting Acara v. Banks, 470 F.3d 569, 571 (5th Cir. 2006)) (explaining that HIPAA does not confer a private right of action). HIPAA generally prohibits covered entities from using or disclosing protected health information. See Murphy v. Dulay, 768 F.3d 1360, 1368-69 (11th Cir. 2014) (quoting 45 C.F.R. § 164.508(a)(1)). But there are a variety of exceptions to this general rule.

When a covered entity is a party to a litigation, for instance, it may use or disclose protected health information for purposes of that litigation. Under the HIPAA regulations, a covered entity “may use or disclose protected health information for its own . . . health care operations.” 45 C.F.R. § 164.506(c)(1). The regulations define the term “health care operations” to include “[c]onducting or arranging for . . . legal services.” 45 C.F.R. § 164.501(4). Accordingly, guidance from the Department of Health and Human Services provides that “[w]here a covered entity is a party to a legal proceeding, such as a plaintiff or defendant, the covered entity may use or disclose protected health information for purposes of the litigation as part of its health care operations.” 1 In doing so, however, the covered entity must make reasonable efforts to limit such uses and

U.S. Dep’t of Health and Hum. Serv.’s, FAQ’s, May a covered entity that is a plaintiff or defendant in a legal proceeding use or disclose protected health information for the litigation?, https://perma.cc/NKD8-8YYU; see also Bedard v. LeBlanc, No. 5:20-CV-161-GWC-KJD, 2022 WL 22972442, at *2 (D. Vt. Nov. 8, 2022) (quoting Givens v. Saint Louis Cnty., No. 4:18-CV-1732 SPM, 2020 WL 4334942, at *3 (E.D. Mo. July 28, 2020)) (“. . . a health care provider ‘can use or disclose patient medical records for their own legal services, such as [the provider's] defense in ... litigation.’”); id. at *3 (“. . . HIPAA permits a health care provider—without first obtaining a patient's consent—to disclose a patient's private information to its counsel in defending against a patient's claims of improper or inadequate care.”); McDowell v. United States, Case No. EDCV 19-631 JBG, 2019 WL 8750360, at *1 (C.D. Cal. Dec. 11, 2019) (observing that “a covered entity may disclose health records to defend itself in litigation as part of “health care operations”); Kraft v. Essentia Health, No. 3:20-CV-121, 2021 WL 12326274, at *4 (D.N.D. July 16, 2021). disclosures to the minimum necessary to accomplish the intended purpose. Id. (citing 45 CFR §§ 164.502(b), 164.514(d)).

If a covered entity is not a party to a litigation, then the HIPAA regulations permit disclosure for litigation purposes in two scenarios. First, the covered entity may disclose protected health information in response to an order of the court, so long as the covered entity discloses only the protected health information expressly authorized by such order. 45 C.F.R. § 164.512(e)(1)(i).

Second, the covered entity may disclose protected health information in response to lawful process that is not accompanied by an order of the court, so long as the covered entity receives satisfactory assurance from the party seeking the information that (a) the subject of the protected health information that has been requested has been given notice of the request, or (b) reasonable efforts have been made by such party to secure a qualified protective order from the court. Id. at § 164.512(e)(1)(ii). A covered entity disclosing protected health information in either scenario must make “efforts to limit” the disclosure “to the minimum necessary.” 45 C.F.R. § 164.502(b).

B. Motions to Strike “[M]otions to strike, as a general rule, are disfavored.” Stabilisierungsfonds Fur Wein v. Kaiser Stuhl Wine Distribs. Pty. Ltd., 647 F.2d 200, 201 (D.C. Cir. 1981). Striking a filing or a portion thereof is an “extreme remedy” that is reserved for filings that are “indefensible, harassing, or detract from the dignity of the Court.” Brigida v. Chao, No. CV 16-2227 (DLF), 2018 WL 11389503, at *3 (D.D.C. May 31, 2018) (quoting Fay v. Perles, 59 F. Supp. 3d 128, 134 (D.D.C. 2014) (CRC)). The moving party bears the burden of showing that a motion to strike is justified, and courts will “resolve all doubts in favor of denying the motion to strike.” Bond v. U.S. Dep’t of Just., 828 F. Supp. 2d 60, 71–72 (D.D.C. 2011) (RCL) (quoting Nwachukwu v. Karl, 216 F.R.D. 176, 178 (D.D.C. 2003) (RMU)).

III. ANALYSIS Plaintiffs argue that the District violated HIPAA by disclosing protected health information in its opposition filings “(i) without authorization of the subject individual, (ii) in the absence of a Court order, (iii) in the absence of a subpoena, discovery request, or other lawful process, (iv) without providing any notice, much less reasonable notice, to the individuals whose health information they disclosed, and (v) in the absence of any protective order, much less a HIPAA- qualified protective order.” Pls.’ Mem., Dkt. No. 64-1 at 4. Plaintiffs also argue that the District failed to limit the disclosure to the “minimum necessary.” Id. The District argues that its disclosure of the protected health information at issue was permissible because HIPAA allows a covered entity to use or disclose protected health information to defend itself in litigation. And it maintains that it has limited the use of this protected health information to the “minimum necessary” by filing the information under seal.

The parties’ dispute therefore centers on whether the relevant records in question belong to the District or DOC. If they belong to the District, then the District may use them in this litigation without a prior court order or other lawful process, so long as that use is reasonable. If they do not belong to the District, then the District may only use them if they first obtain a court order or some other lawful process. For the following reasons, the Court determines that the records at issue belong to the District and that the District’s use of those records was reasonable.

*** The Court determines that the records in question belong to the District. Under D.C. law, DOC is a subordinate agency to the D.C. Government. D.C. Code § 1-603.01. This means that DOC is “under the direct administrative control” of the D.C. Government. Id. It also means that DOC is “not an entity capable of being sued separate from the District of Columbia.” Carter-El, 893 F. Supp. 2d at 247. Accordingly, for purposes of this litigation, DOC is not treated as a separate entity from the District of Columbia. The District can therefore use the relevant records to defend itself in this litigation.

Plaintiffs appear to suggest that allowing the District to use the records in question when they were originally created by DOC equates to a finding that “all other facets of the District of Columbia government are entitled to open access to an incarcerated individual’s protected health information unbridled by the protections of HIPAA.” Pls.’ Mem., Dkt. No. 64-1 at 5 n. 5 (arguing that this result “strains credulity”). But this is not the case. The D.C. Government is designated as a “hybrid entity” under HIPAA because its activities and components include both covered and non-covered activities and components. 45 C.F.R. § 164.103. As a hybrid entity, the D.C. Government must ensure that its health care components—like DOC—comply with HIPAA, which includes ensuring that its health care components “do[] not disclose protected health information to another component” of the D.C. Government. 45 C.F.R. § 164.105(a)(2)(ii).

Accordingly, the Court’s ruling here in no way undermines the HIPPA’s protections for Plaintiffs’ protected health information.

The District’s use of the records in question was also reasonable under HIPAA. As the District explains, Plaintiffs’ claims put their medical histories at issue. The records of Plaintiffs’ medical histories are therefore directly relevant to the issues involved in this litigation.

Furthermore, the District took steps to limit the disclosure of Plaintiffs’ protected health information to the minimum necessary. The District moved to file Plaintiffs’ protected health information under seal and has requested that the Court further direct the parties to maintain the information filed under seal confidential, not to use or disclose it for any purpose other than this proceeding, and to return or destroy the material at the conclusion of this proceeding. The District also took the step of filing redacted versions of its filings on the public docket. See Dkt. No. 63.

Finally, before filing the protected health information, the District reached out to Plaintiffs' counsel to ask if they had a position on how the protected health information should be filed. See Dkt. No. 64-2.

IV. CONCLUSION In sum, the District's use of Plaintiffs' protected health information did not violate HIPAA because it involved the District's reasonable use of its own records to defend itself in litigation.

The Court, however, is not blind to the privacy concerns implicated by the disclosure of sensitive health information, even when that disclosure complies with HIPAA. Accordingly, while the Court shall DENY Plaintiffs' [64] Motion to Strike, it will also ORDER the parties to confer and file a joint proposed protective order to govern the handling of the health information disclosed by the District. The details of this joint proposal along with the entirety of the Court's ruling are contained in the accompanying Order.

Dated: May 4, 2026

COLL�46L��E� United States District Judge