PUBLISHED

UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT

No. 18-7030

CHRISTOPHER N. PAYNE,

Plaintiff - Appellant,

v.

JAHAL TASLIMI, Medical Doctor at Armor Health Serv.; MS. SMITH, LPN, HAS Armor Health Serv.,

Defendant - Appellee.

Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Liam O’Grady, Senior District Judge. (1:18-cv-00587-LO-IDD)

Argued: September 9, 2020 Decided: May 27, 2021

Before THACKER, RICHARDSON, and QUATTLEBAUM, Circuit Judges.

Affirmed by published opinion. Judge Richardson wrote the opinion, in which Judge Thacker and Judge Quattlebaum joined.

ARGUED: Gilbert Charles Dickey, MCGUIREWOODS LLP, Washington, D.C., for Appellant. Christopher Fitzjames Quirk, SANDS ANDERSON, PC, Richmond, Virginia, for Appellee. ON BRIEF: Matthew A. Fitzgerald, MCGUIREWOODS LLP, Richmond, Virginia, for Appellant. Edward J. McNelis, III, SANDS ANDERSON, PC, Richmond, Virginia, for Appellees. RICHARDSON, Circuit Judge:

While incarcerated in a prison medical unit, Christopher Payne’s doctor came to his

bedside and reminded Payne, within the earshot of others, that he had not taken his human

immunodeficiency virus (“HIV”) medication. Payne asserts that the doctor’s conduct

violated his Fourteenth Amendment right to privacy and the Health Insurance Portability

and Accountability Act of 1996 (“HIPAA”),

Stat. 1936 (codified at

et seq.).

We first reject Payne’s claim that the doctor’s statement violated the Fourteenth

Amendment because he lacks a reasonable expectation of privacy in this information while

incarcerated in a prison medical center. We also reject Payne’s HIPAA claim because

HIPAA does not create a private right of action that Payne may avail himself of. So we

affirm the dismissal of his complaint.

I. Background

In 2018, Payne was incarcerated at Deep Meadow Correctional Center in State

Farm, Virginia. Dr. Jahal Taslimi approached Payne’s bed in the medical unit and told

Payne that he had “not take[n] [his] HIV medications” that day. J.A. 16. According to

Payne, the medical unit is an “open dorm,” so other staff, offenders, and civilians were

close enough to overhear Dr. Taslimi’s statement. J.A. 6. Payne alleges that some of those

nearby “stopped talking and looked” at him.

Dr. Taslimi evidently apologized, but

Payne alleges that the damage was done: other prison staff and inmates had learned that

Payne was on HIV medication. Payne filed an array of grievances, which failed to provide

relief.

2 Payne then turned to federal court, filing a pro se action against Dr. Taslimi. See

. 1 The district court dismissed Payne’s complaint under 28 U.S.C.

§ 1915A(b) for failure to state a claim. Payne timely appealed, and we have jurisdiction.

See

. Exercising that jurisdiction, we review de novo the district court’s

dismissal. Jehovah v. Clarke,

(4th Cir. 2015).

II. Fourteenth Amendment Due Process Claim

A. Stare decisis and precedent

We do not address Payne’s Fourteenth Amendment privacy claim on a blank slate.

Instead, we write on the ever-present background of stare decisis.

At the Supreme Court, stare decisis “is a principle of policy” and neither “a

mechanical formula of adherence” nor an “inexorable command.” Payne v. Tennessee,

(1991) (quoting Helvering v. Hallock,

(1940)). The

Supreme Court balances various factors, including the quality of the precedent’s reasoning,

the workability of the established rule, the reliance interests it has engendered, its

consistency with related decisions, and the developments since its prior decision. See

Janus v. Am. Fed’n of State, Cnty. & Mun. Emps., Council 31,

, 2478–79

(2018). For the Supreme Court, the decision of whether to follow precedent is a difficult

1 Along with his Fourteenth Amendment and HIPAA claims, Payne raised various other claims that lack merit. Payne sued Ms. Smith, the nurse who took Payne’s complaint. But Payne alleged no facts about how Ms. Smith “‘acted personally in the deprivation of [his]’ rights,” so those claims are not cognizable under § 1983. Wilcox v. Brown,

(4th Cir. 2017) (quoting Vinnedge v. Gibbs,

(4th Cir. 1977)). Nor do Payne’s allegations that Dr. Taslimi failed to abide by the procedures of the Virginia Department of Corrections give rise to a claim under § 1983. See Wright v. Collins,

(4th Cir. 1985). 3 one, but they have “never felt constrained to” do so. Payne,

(quoting Smith

v. Allwright,

(1944)).

But as an inferior court, the Supreme Court’s precedents do constrain us. See

Agostini v. Felton,

(1997). In looking up to the Supreme Court, we may

not weigh the same factors used by the Supreme Court to evaluate its own precedents in

deciding whether to follow their guidance. We must simply apply their commands. So

even were we to correctly conclude that a Supreme Court precedent contains many

“infirmities” and rests on “wobbly, moth-eaten foundations,” it remains the Supreme

Court’s “prerogative alone to overrule one of its precedents.” State Oil Co. v. Khan,

(1997) (quoting Khan v. State Oil Co.,

(7th Cir. 1996)

(Posner, J.)). It is beyond our power to disregard a Supreme Court decision, even if we are

sure the Supreme Court is soon to overrule it.

Similarly, when a panel of our Court looks horizontally to our own precedents, we

must apply their commands as a mechanical mandate. For even though a Fourth Circuit

panel possesses the statutory and constitutional power to overrule another panel, we do not

do so “as a matter of prudence.” McMellon v. United States,

(4th Cir.

2004) (en banc). And that prudential judgment is categorical, so a panel of judges “cannot

overrule a decision issued by another panel.”

at 332–34 (emphasis added); see also

(noting that where two panels conflict, we must “follow the earlier of the conflicting

opinions”). Only by granting en banc review may we apply stare decisis balancing to

overrule precedent set by a prior panel (or a prior en banc court). See

; see also

(noting that most other circuits follow the same practice). Thus, unlike the

4 discretionary application of stare decisis by the Supreme Court, we are bound by prior

panel decisions. 2

That is not to say that everything said in a panel opinion binds future panels. 3 We

recognize that where we “assum[e] without deciding the validity of antecedent

propositions” those assumptions “are not binding in future cases that directly raise the

questions.” United States v. Norman,

(4th Cir. 2019) (quoting United

States v. Verdugo-Urquidez,

(1990)); see also Webster v. Fall,

(1925). And we also recognize that dictum is not binding. See Pittston Co. v.

United States,

(4th Cir. 1999). Dictum is a “statement in a judicial

opinion that could have been deleted without seriously impairing the analytical foundations

of the holding—that, being peripheral, may not have received the full and careful

consideration of the court that uttered it.”

(quoting United States v. Crawley,

(7th Cir. 1988) (Posner, J.)); see also Cohens v. State of Virginia,

,

2 To state the obvious, this means we must follow a prior panel decision even if it had abysmal reasoning, put forward unworkable commands, engendered no reliance interests, lacked consistency with other decisions, and has been undermined by later developments. Indeed, for this principle to mean anything, we must do so in exactly those cases. 3 Determining the scope of this horizontal precedent often presents its own perplexing problems. See Charles W. Tyler, The Adjudicative Model of Precedent, 87 U. CHI. L. REV. 1551 (2020) (discussing different models for determining the scope of prior intra-circuit decisions). And similar problems exist when we look vertically to the Supreme Court’s precedents. See Richard M. Re, Narrowing Supreme Court Precedent from Below, 104 GEO. L.J. 921 (2016) (discussing how lower courts treat Supreme Court precedent). 5 399–400 (1821). If necessary to the outcome, a precedent’s reasoning must be followed;

otherwise, we are not so bound. 4

B. Constitutional right to privacy

Shepherded by these principles, we turn to Payne’s claimed constitutional right to

privacy. The Supreme Court’s guidance is less than illuminating. In its most recent

decision on the matter, the Court “assume[d], without deciding, that the Constitution

protects a[n informational] privacy right of the sort mentioned in Whalen [v. Roe,

(1977)] and Nixon [v. Administrator of General Services,

(1977)].”

NASA v. Nelson,

, 138 (2011) (emphasis added). The Court also recognized

that this was its “approach in Whalen”: assume a constitutional right to privacy exists but

find that any existing right was not violated. Id. at 147. 5

4 Of course, our own prudential decision to follow prior panel decisions (horizontal stare decisis) is overcome by our mandate as an inferior court to follow the Supreme Court’s commands (vertical stare decisis). Thus, we are not bound by previous panels where “the prior opinion has been overruled by an intervening opinion from . . . the Supreme Court.” McMellon,

. So where subsequent Supreme Court decisions “clearly undermine[]” a panel precedent, we need not follow that panel precedent. United States v. Williams,

(4th Cir. 1998). 5 Nixon charted a similar course. There, the Court acknowledged that “public officials . . . are not wholly without constitutionally protected privacy rights.” Nixon,

. It went on to “assume . . . for the purposes of [that] case” that the withholding personal or financial information from presidential libraries and congressional acquiescence to that practice “g[ave] rise to [President Nixon’s] legitimate expectation of privacy in such materials.”

at 457–58 (citing Katz v. United States,

, 351– 53 (1967)). Some of our own cases have followed the same path. See Watson v. Lowcountry Red Cross,

, 487–88 (4th Cir. 1992) (assuming that a blood donor has a right to confidentiality in his identity but rejecting the argument that a mere possibility of public disclosure of private information could violate that right); Taylor v. Best,

, (Continued) 6 Although this Court’s guidance has not been the model of clarity, we have gone

beyond assuming. In Walls v. City of Petersburg, Walls claimed that the information

required by an employment questionnaire violated her right to privacy.

, 189–

90 (4th Cir. 1990). We first agreed that “[t]he constitutional right to privacy extends

to . . . ‘the individual interest in avoiding disclosure of personal matters.’” Id. at 192 (citing

Whalen, 429 U.S. at 599–600). But that “right to privacy” protected “only information

with respect to which the individual has a reasonable expectation of privacy.” Id. at 193;

see also id. at 192 (“Personal, private information in which an individual has a reasonable

expectation of confidentiality is protected by one’s constitutional right to privacy.”).

Walls, we held, lacked a “reasonable expectation of privacy” in information that

was “freely available in public records,” including marriages, divorces, children, and

arrests or convictions of family members. Id. at 193–94. We suggested that she maintained

a reasonable expectation of privacy in details that were “not part of the public record

concerning a divorce, separation, annulment, or the birth of children.” Id. at 193. But

those non-public details were not implicated in the case because they were not covered by

the questionnaire. Id. at 193–94. 6

225 (4th Cir. 1984) (assuming that an inmate has a right to privacy in their family background, but finding that “the compelling public interests in assuring the security of prisons and in effective rehabilitation clearly outweigh[ed]” the inmates interest in keeping that information confidential). 6 We also found information about same-sex sexual relations unprotected because, at that time, “[t]he Court [had] explicitly rejected ‘the proposition that any kind of private sexual conduct between consenting adults is constitutionally insulated from state proscription.’” Walls, 895 F.2d at 193 (quoting Bowers v. Hardwick,

(Continued) 7 Turning to the “[f]inancial information [] requested in the questionnaire,” we held

that it was “protected by a right to privacy.”

. As Walls possessed a right to

privacy in the financial information, we weighed her privacy interest against the

government’s interest in disclosure to guard against potential corruption. We found that

the government’s interest was compelling and determined that it outweighed her right to

privacy. We thus concluded that the required disclosure of financial information did not

violate her right to privacy.

Walls thus adopted a two-part inquiry, asking first whether “the information sought

is entitled to privacy protection,” like the financial information from that case.

. And, if a right to privacy existed, then asking whether “a compelling governmental

interest in disclosure outweighs the individual’s privacy interest.”

. For the first

inquiry, we explained that information is protected only where there is a “reasonable

expectation of privacy” in it.

. It is this inquiry that binds us today.

This “reasonable expectation of privacy” language emanates from Justice Harlan’s

famous concurrence in Katz v. United States,

(1967). There, Justice Harlan

explained that the Fourth Amendment protects people where they have a “reasonable

expectation of privacy,” that is, a place where the person has “an actual (subjective)

(1986)). Bowers has since been overturned by the Supreme Court. Lawrence v. Texas,

(2003). So to add some dictum to an opinion about dicta, this part of Walls is no longer good law. 8 expectation of privacy” and “the expectation [is] one that society is prepared to recognize

as ‘reasonable.’”

at 360–61 (Harlan, J., concurring). 7

Since Walls, we have applied this “reasonable expectation of privacy” test to

evaluate whether information is protected by a constitutional right to privacy. In Condon

v. Reno, we found that drivers lacked any constitutionally protected right to privacy in their

personal information stored in motor-vehicle records.

, 465 (4th Cir. 1998),

rev’d on other grounds, Reno v. Condon,

(2000) (upholding the Driver's

Privacy Protection Act of 1994 under Congress’s Commerce Clause power). We reasoned

that driver’s records were “the very sort of information to which individuals do not have a

reasonable expectation of privacy.”

at 464–65 (emphasis added). The existence of

“‘pervasive schemes of regulation’ . . . must ‘necessarily lead to reduced expectations of

privacy.’”

at 465 (quoting California v. Carney,

(1985), a Fourth

Amendment case). And these motor-vehicle records are traditionally public and easily

accessible.

As drivers lacked a “reasonable expectation of privacy,” we held they

lacked a constitutionally protected right to privacy that Congress could enforce under

Section 5 of the Fourteenth Amendment.

7 We were not the first court to consider the Fourth Amendment in this area. The Supreme Court, in assuming that a right to privacy existed in Nixon, cited Katz. See Nixon,

. And in determining whether the government had a sufficient interest in invading that right, the Court cited Terry v. Ohio,

(1968), a seminal Fourth Amendment case, along with other Fourth Amendment cases. Nixon, 433 U.S. at 458–63. See also Walls, 895 F.2d at 192 (relying on Justice Brandeis’s dissent in Olmstead v. United States,

(1928), another seminal Fourth Amendment opinion). 9 While Condon looked to the reasonable expectation of privacy to reject the claimed

right to privacy, it also “note[d]” that “the Supreme Court has limited the ‘right to privacy’

to matters of reproduction, contraception, abortion, and marriage.”

(internal

citations omitted). This descriptive statement was unnecessary to Condon’s holding, which

turned on the lack of a reasonable expectation of privacy based on the pervasive regulation

and public nature of the information. See

at 464–65. It is thus dictum that does not

control our analysis.

Even so, we later appeared to rely on this dictum from Condon. See Edwards v.

City of Goldsboro,

(4th Cir. 1999) (citing Condon,

). In

Edwards, the plaintiff brought seventeen causes of action against a city and its officials,

claiming that they could not punish him for teaching a handgun safety class when he was

not authorized to do so.

at 239–40. One of those causes of action invoked, without

elaboration, his “right to privacy.” Id. at 240, 252. We rejected that claim because the case

did not involve “matters of reproduction, contraception, abortion, and marriage.” Id. at

252. But this proposition conflicts with Walls’s holding that information within an

individual’s reasonable expectations of privacy—including financial information—falls

within the right to privacy. Walls, 895 F.2d at 192–94. So, under our rules of horizontal

stare decisis, we are required “to follow the earlier of the conflicting opinions” rather than

decide which precedent is correct. McMellon,

. 8

8 In Greenville Women’s Clinic v. Comm’r, S.C. Dep’t of Health and Env’t Control,

(4th Cir. 2002), we considered a South Carolina law that required abortion clinics to record certain information and report each abortion to the South Carolina (Continued) 10 Because no subsequent panel could overrule Walls and the Supreme Court has done

little to clarify the scope of the constitutional right to privacy, we follow Walls. We must

thus ask (1) whether a “reasonable expectation of privacy” in the information exists as to

entitle it to privacy protection and, if so, (2) whether “a compelling governmental interest

in disclosure outweighs the individual’s privacy interest.” Walls, 895 F.2d at 192. We

decide that Payne lacked a reasonable expectation of privacy in his HIV medication and

diagnosis. He thus lacked a right to privacy in that information and we need not consider

part two of the Walls test.

C. As an inmate, Payne lacked a reasonable expectation of privacy in information about his HIV status

We first look to Payne’s claimed “reasonable expectation of privacy.” Id. at 193.

Dr. Taslimi disclosed Payne’s HIV status while Payne was a patient in a prison medical

center. And a prisoner’s reasonable expectations of privacy are limited.

In Hudson v. Palmer, the Supreme Court held that a prison inmate lacked a

reasonable expectation of privacy in his prison cell.

, 525–26 (1984). The

Court found that “any subjective expectation of privacy that a prisoner might have in his

prison cell” was not one that society would recognize as legitimate or reasonable.

at

526–27. Balancing the prisoner’s interest in privacy against “the interest of society in the

security of its penal institutions,” the Court held that any subjective desire for privacy was

Department of Health and Environmental Control.

at 367–71. We found that because South Carolina had an adequate governmental interest in instituting this reporting requirement and provided safeguards to prevent the disclosure of this information, the rights of the clinic’s patients were not violated.

Like Whalen, Greenville Women’s Clinic assumed that the privacy right at interest in that case existed. 11 “incompatible” with the need to “ensure institutional security and internal order.”

at

527–28; see also

(“[l]oss of freedom of choice and privacy are inherent incidents of

confinement” (quoting Bell v. Wolfish,

(1979))).

Although Hudson discussed an inmate’s right to privacy based on the need for

institutional safety, we have rejected the claim that the Government can only search a

detainee’s cell where the search advances legitimate penological needs. In United States

v. Jeffus, the plaintiff claimed that the government had searched his cell to obtain evidence

against him and thus the search “had ‘nothing whatever to do with security, safety, or

sanitation’ at the jail.”

(4th Cir. 1994). We rejected his claim, reasoning

that the government’s rationale for conducting the search did not matter for Fourth

Amendment purposes because the detainee lacked any reasonable expectation of privacy

in his cell.

In other words, if a detainee does not have a reasonable expectation of

privacy, the reason the detainee lacks it and the reason for the government’s search need

not be the same.

That is not to say that prisoners have no “reasonable expectations of privacy” in

prison. But those expectations are quite limited. For example, we found a “reasonable

expectation of privacy” in “bodily privacy and integrity” to be violated by surgery to

remove a cosmetic implant from an inmate’s genitals. King v. Rubenstein,

,

214–15 (4th Cir. 2016); but cf. Jones v. Murray,

(4th Cir. 1992)

(permitting drawing blood from a pretrial detainee because detainees “lose a right of

privacy from routine searches of the cavities of their bodies and their jail cells”). That

interest in “bodily integrity involve[d] the ‘most personal and deep-rooted expectations of

12 privacy’” and many sexually invasive searches will involve an “objectively extreme”

intrusion on those expectations of privacy. King, 825 F.3d at 215–16 (quoting Winston v.

Lee,

(1985)).

As an inmate in a prison medical center, Payne lacked a reasonable expectation of

privacy in his HIV status and his compliance with his treatment plan. Payne does not claim

a reasonable expectation of privacy in the initial disclosure of his HIV diagnosis and

medical records to prison officials. See Dunn v. White,

(10th Cir.

1989) (testing prison inmates for AIDS does not violate the Fourth Amendment); see also

Jones,

. Payne instead challenges the secondary disclosure from prison

officials to prison guards and inmates in the medical ward. But just as he lacks a reasonable

expectation of privacy in the initial disclosure of his communicable-disease diagnosis to

the prison officials, so too does he lack a reasonable expectation of privacy in the secondary

disclosure of his diagnosis. Where an inmate lacks a reasonable expectation of privacy, he

lacks it for all purposes. Jeffus,

. Whatever desire he may have to keep that

information purely private is “incompatible” with the needs of an institution, and therefore

not reasonable. Hudson,

; see Anderson v. Romero,

(7th

Cir. 1995) (Posner, J.) (Even if prisoners had a right to the confidentiality of their medical

records in general, “it would not follow that a prisoner had a right to conceal his HIV

status” because of the “great difference . . . between a communicable and a

noncommunicable disease.”).

Information about an inmate’s HIV diagnosis and medication is unlike the

expectations of privacy that we have found protected in prison. Unlike an inmate’s bodily

13 integrity, one’s communicable-disease diagnosis lacks any deep roots in the expectation of

privacy and falls far from the most personal invasions into an inmate’s body. See King,

. Disclosure of Payne’s diagnosis and medication information simply does

not implicate the same Fourth Amendment concerns as forcing someone to, for example,

undergo surgery or subject themselves to invasive medical procedures. 9

The limits on an inmate’s expectations of privacy are particularly strong where the

information he seeks to protect relates to the institutional safety of the prison. See Hudson,

. Here, both the location and the type of information reduces any possible

expectation of privacy that Payne might have had in this information. First, Payne was

told that he had not taken his medicine within the prison medical unit, the most relevant

place for such information to be shared and where it might be difficult to ensure others

would not hear. Second, the information Dr. Taslimi relayed to Payne dealt with his

communicable disease and whether he was taking his medication, which is especially

relevant in a prison where disease can spread rapidly (as seen by the COVID-19 pandemic).

While HIV and its spread can be controlled by medicine, an inmate’s expectation of privacy

in his diagnosis is still unreasonable during treatment because there remains a risk of

transmission to prison workers and other inmates. For example, a prisoner might forgo

9 Nor is Payne’s communicable-disease status equivalent to an inmate’s expectation of privacy in legal mail, which “is widely recognized to be privileged and confidential.” Haze v. Harrison,

(4th Cir. 2020); see also Sarah A. Rana, Restricting the Attorney-Client Privilege: Necessary Limitations or Distorting the Privilege?, 32 SUFFOLK U. L. REV. 687, 689–93 (1999) (tracing the history of the attorney-client privilege to the common law and discussing its relationship to the Fifth Amendment).

14 taking the medicine and thus become contagious again, just as Payne apparently did here.

So it is hard to see how Payne would have a reasonable expectation of privacy in his

communicable-disease status within a medical unit.

In sum, Payne has a reduced expectation of privacy in prison and, as we conclude

here, no reasonable expectation of privacy in his HIV diagnosis and treatment. No matter

how much a prisoner subjectively would like to keep that information to himself, we must

ask whether that expectation is “one that society is prepared to recognize as ‘reasonable.’”

Katz,

(Harlan, J., concurring); accord Hudson, 468 U.S. at 525–26. And

any subjective expectation of privacy in this information that Payne has is simply not

reasonable. See Anderson, 72 F.3d at 522–23; Tokar v. Armontrout,

(8th Cir. 1996). 10 Because we decide that this information is not “within [Payne’s]

reasonable expectations of confidentiality,” we need not go further to address whether Dr.

Taslimi had a “compelling government interest in disclos[ing Payne’s HIV status that]

outweigh[ed Payne’s] privacy interest.” Walls, 895 F.2d at 192.

D. HIPAA does not create a private cause of action

Finally, Payne alleged that Dr. Taslimi violated HIPAA. HIPAA provides that “[a]

person who knowingly . . . discloses individually identifiable health information to another

person” without authorization shall be fined, imprisoned, or both. 42 U.S.C. § 1320d-

10 The circuits that have found a right to privacy in this context have done so by finding that privacy right to be “completely different” than the rights “extinguished” by Hudson’s reasonable-expectation-of-privacy test. Doe v. Delie,

, 316–17 (3d Cir. 2001); accord Powell v. Schriver,

, 112 n.3 (2d Cir. 1999). Whatever the merits of that position, we are constrained to apply our holding in Walls to the contrary. 15 6(a)(3), (b). Even if Dr. Taslimi violated this provision, a plaintiff seeking a remedy under

§ 1983 “must assert the violation of a federal right, not merely a violation of federal law.”

Planned Parenthood S. Atl. v. Baker,

(4th Cir. 2019) (quoting Blessing

v. Freestone,

(1997)). Thus, for Payne to recover under HIPAA, the

statute must create a private right to sue that may be enforced under § 1983. Every circuit

court to consider whether HIPAA created a private right to sue has found that it does not.

See Meadows v. United Servs., Inc.,

, 244 (2d Cir. 2020); Stewart v. Parkview

Hosp.,

(7th Cir. 2019); Dodd v. Jones,

(8th Cir.

2010); Wilkerson v. Shinseki,

, 1267 n.4 (10th Cir. 2010); United States v.

Streich,

(9th Cir. 2009); Acara v. Banks,

, 571–72 (5th Cir.

2006); see also Faber v. Ciox Health, LLC,

, 596–97 (6th Cir. 2019) (stating,

in dictum, that HIPAA does not create a private right of action). This is because HIPAA

does not expressly allow for a private cause of action but delegates enforcement authority

to the Secretary of the Department of Health and Human Services, reflecting Congress’s

intent to forgo creating a private remedy. Meadows, 963 F.3d at 244; see also Alexander

v. Sandoval,

(2001) (disfavoring implied causes of action when

Congress has provided other methods of enforcing the statute’s mandate). We see no

reason to chart a different course from our sister circuits. Payne has no private right of

action under HIPAA.

* * *

We limit our decision today to the question before us: Did Payne have a “reasonable

expectation to privacy” in his HIV status while in a prison medical unit? We hold that he

16 did not. When Dr. Taslimi disclosed his HIV status, Payne was in prison, a place where

individuals have a curtailed expectation of privacy. Whatever expectations remain fail to

include the diagnosis of or medication for HIV, a communicable disease. The judgment

below is therefore

AFFIRMED.

17