FACTS

In 2020, Taft sued David West in the Los Angeles Superior Court (No. 2OSTCV02326) (the West case), alleging personal injuries he sustained in a traffic accident caused by West. The law firm Veatch Carlson, LLP and Leslie Burnet represented West and issued subpoenas to VCMC to obtain Taft’s medical records. Taft filed a motion to quash the subpoenas. He claimed the subpoena issued to medical provider Elisabeth Bertoline for his medical records on June 15, 2020, was invalid because he did not receive notice of the subpoena until August 23, 2020, “eighteen days after the subpoenaed documents were produced.” The trial court denied his motion and found Taft had “not met his burden” and had not produced “any evidence supporting [his] motion.” Taft voluntarily dismissed that action on December 9, 2020. Taft then sued VCMC in the federal district court for the Central District of California (No. CV 20-7856-MWF) (Taft v. VCMC). He alleged VCMC violated HIPAA by releasing his medical records that did not comply with his authorization for a “limited release” of information. The federal district court

All statutory references are to the Civil Code unless 1

otherwise stated.

2 dismissed this case on January 6, 2021, finding Taft had no private right of action under HIPAA. Taft sought to amend the complaint to allege a claim against the County under the federal Privacy Act (5 U.S.C. § 552a). The court denied the request to amend and ruled the Privacy Act “does not provide a private right of action for disclosure of medical records.” It also ruled that it “declines to exercise supplemental jurisdiction over the remaining state law claims.” The Current Case On February 24, 2021, Taft sued Veatch Carlson, LLP, Leslie Burnet, VCMC, and County employee “Karen” in the trial court alleging “illegal acquisition and unauthorized disclosure of medical information.” (Boldface and capitalization omitted.) He claimed the June 15, 2020, subpoena Veatch Carlson and Burnet issued to medical provider Bertoline was invalid because he did not receive notice of that subpoena until “after [August 23].” He alleged that by releasing his medical records in response to the invalid subpoena, the County violated, among other things, section 56.10, HIPAA (45 C.F.R. 164.502), and the federal Privacy Act (5 U.S.C. § 552a). He sought “monetary damages.” The County demurred claiming Taft failed to state facts sufficient to state a cause of action because: 1) the subpoena was proper under section 56.10, subdivision (b)(3); 2) the section 56.10 cause of action was “barred by the litigation privilege set forth in [section] 47”; 3) Taft’s claim that the June 15th subpoena was invalid was resolved against him when the Los Angeles Superior Court in the West case denied his motion to quash service of that subpoena on December 9, 2020; 4) Taft attached a copy of the June 15th subpoena to his complaint and it contains a declaration of service showing service by mail on him at his

3 address; and 5) Taft had no private right of action under HIPAA or the federal Privacy Act. The trial court sustained the demurrer without leave to amend. It found: 1) Taft’s medical records “were obtained pursuant to a valid subpoena which affords them the protection of the litigation privilege,” 2) Taft has no private right of action under HIPAA and the federal Privacy Act, and 3) the court granted the County’s motion for sanctions against Taft.

DISCUSSION

Section 56.10 Section 56.10, subdivision (a) prohibits a provider of health care from “disclosing medical information regarding a patient” without “first obtaining an authorization.” But that section also provides that a provider of health care “shall disclose medical information if the disclosure is compelled” pursuant “to a subpoena, subpoena duces tecum.” (§ 56.10, subd. (b)(3), italics added.) The word “shall” shows a mandatory duty to release the information subpoenaed. (Doe v. Albany Unified School Dist. (2010) 190 Cal.App.4th 668, 676.) Here the County produced the records in response to the subpoena. There is normally immunity from liability for releasing records to comply with a subpoena. (Heller v. Norcal Mutual Ins. Co. (1994) 8 Cal.4th 30, 45; Nelson v. Tucker Ellis, LLP (2020) 48 Cal.App.5th 827, 848.) The statute protects the privacy of Taft’s medical records, but this protection is not absolute. Section 56.10 “enumerates numerous instances where disclosure of confidential information is either mandatory or permissive.” (McNair v. City and County of San Francisco (2016) 5 Cal.App.5th 1154, 1165.) Taft sued West for injuries suffered and those injuries were at issue in that

4 lawsuit. The Veatch Carlson law firm represented West and conducted discovery. “A plaintiff seeking to recover damages arising out of a particular injury cannot claim the physician- patient privilege with respect to that injury because plaintiff’s action tenders the issue.” (Manela v. Superior Court (2009) 177 Cal.App.4th 1139, 1149.) Taft claims the June 15th subpoena was not valid because he was not served notice of that subpoena. He is correct that notice is required to be given to the patient when his medical records are subpoenaed. But he has not shown how the County is liable under section 56.10 because it was the Veatch Carlson law firm that allegedly did not comply with proper notice of service. Nor has Taft shown that the Legislature intended to impose liability on medical providers who comply with their statutory duty to release records in response to a facially valid subpoena. (California School Employees Assn. v. Governing Bd. of South Orange County Community College Dist. (2004) 124 Cal.App.4th 574, 587-588.) Taft attached a copy of the June 15th subpoena as an exhibit to his complaint. It contains a declaration of service showing service of a copy of that subpoena on Taft at his address. “[F]acts appearing in exhibits attached to the complaint will also be accepted as true and, if contrary to the allegations in the pleading, will be given precedence.” (Dodd v. Citizens Bank of Costa Mesa (1990) 222 Cal.App.3d 1624, 1627.) We also previously rejected Taft’s claim that the subpoena was defective for non-service in his prior appeal. (Taft v. Veatch Carlson, LLP (Oct. 12, 2022, B315479) [nonpub. opn.].) As the County notes, Taft’s claim that he was not served with the June 15th subpoena was also barred by collateral estoppel because “this issue had been adjudicated adversely to Taft by the Los

5 Angeles Superior Court in connection with Taft’s motion to quash” in the prior West case. (Ayala v. Dawson (2017) 13 Cal.App.5th 1319, 1326.) The Litigation Privilege (§ 47) The trial court did not err by ruling the County also fell within the protection of the litigation privilege. (§ 47.) “The ‘principal purpose’ of the litigation privilege is ‘to afford litigants and witnesses . . . the utmost freedom of access to the courts without fear of being harassed subsequently by derivative tort actions.’ ” (Foothill Federal Credit Union v. Superior Court (2007) 155 Cal.App.4th 632, 636-637.) The privilege is absolute. (Id. at pp. 635-636, 638.) It “bars all tort causes of action except malicious prosecution.” (Jacob B. v. County of Shasta (2007) 40 Cal.4th 948, 960.) It bars “a privacy cause of action whether labeled as based on common law, statute, or Constitution.” (Id. at p. 962.) The litigation privilege “is applied broadly, and doubts are resolved in favor of the privilege.” (McNair v. City and County of San Francisco, supra, 5 Cal.App.5th at p. 1162.) It applies to lawsuits claiming deficient service or noncompliance with subpoena rules. (Jacob B., at pp. 960, 962; Foothill Federal Credit Union, at pp. 634, 638.) “ ‘[A]pplication of the litigation privilege gives the recipient of a subpoena duces tecum freedom to respond to that subpoena without fear of being harassed subsequently by derivative tort actions.’ ” (Nelson v. Tucker Ellis, LLP, supra, 48 Cal.App.5th at p. 848, italics added.) This is true even where the subpoena “was deficient because of insufficient notice to the affected consumers.” (Foothill Federal Credit Union v. Superior Court, supra, 155 Cal.App.4th at p. 642, italics added.)

6 Taft contends the “general litigation privilege cannot shield defendants from violations of [Code of Civil Procedure section] 1985.3 [the subpoena notice provisions]. If it did, it would render [Code of Civil Procedure section] 1985.3 useless and inoperable.” But in rejecting this claim the Foothill court said, “We fail to see this as a likely result in light of the continued existence of opportunities for consumers to quash or modify subpoenas seeking their personal records.” (Foothill Federal Credit Union v. Superior Court, supra, 155 Cal.App.4th at p. 642, fn. 2.) A HIPAA Cause of Action Congress enacted HIPAA to “address concerns about the confidentiality of health information.” (Johnson v. Quander (D.C. 2005) 370 F.Supp.2d 79, 100.) But “HIPAA itself provides no private right of action.” (Webb v. Smart Document Solutions, LLC (9th Cir. 2007) 499 F.3d 1078, 1081; see also Dodd v. Jones (8th Cir. 2010) 623 F.3d 563, 569; United States v. Streich (9th Cir. 2009) 560 F.3d 926, 935 (conc. opn. of Kleinfeld, J.); Acara v. Banks (5th Cir. 2006) 470 F.3d 569, 571-572 [no private right of action for a patient for a doctor’s alleged violation of the confidentiality provisions of HIPAA].) HIPAA authorizes the Secretary of the Department of Health and Human Services to pursue offenders, but “not a private individual.” (Johnson, at p. 100; see also Y.C. v. Superior Court (2021) 72 Cal.App.5th 241, 257; McNair v. City and County of San Francisco, supra, 5 Cal.App.5th at p. 1166, fn. 5.) The Federal Privacy Act (5 U.S.C. § 552a) The Privacy Act prevents the unauthorized disclosure of information involving individuals by federal agencies. (St. Michael’s Convalescent Hospital v. State of California (9th Cir. 1981) 643 F.2d 1369, 1373.) The County is not a federal agency.

7 This federal “statute applies only to the federal government, not to state or local government agencies.” (Huling v. City of Los Banos (E.D.Cal. 2012) 869 F. Supp.2d 1139, 1154; see also United States v. Streich, supra, 560 F.3d at p. 935.) This act does not authorize a private cause of action against the County. (Ibid; see also Sutton v. Providence St. Joseph Medical Center (9th Cir. 1999) 192 F.3d 826, 844.) VCMC and the Exception to the Federal Agency Requirement Taft notes there is an exception to the federal agency requirement for entities that are not federal agencies but fall within the Privacy Act because they are controlled by the federal government. (Lengerich v. Columbia College (N.D.Ill. 2009) 633 F.Supp.2d 599, 605-606.) To fall within this exception the “courts will analyze the connections between the entity and the federal government, considering specifically: (1) the federal government’s control over the entity; and (2) the entity’s independent authority to make decisions.” (Id. at p. 606.) Taft claims VCMC “receives federal funding through Medi- Cal and Medicare,” its receipt of federal money is highly regulated by the federal government, and VCMC should be deemed to fall under the federal Privacy Act. But there must be a showing that the federal government has control over the entity’s day-to-day operations, “ ‘and not just the exercise of regulatory authority necessary to assure compliance with the goals of the federal grant.’ ” (Lengerich v. Columbia College, supra, 633 F.Supp.2d at p. 606.) VCMC is a county hospital supervised and controlled by County officials and the County’s board of supervisors. (Guzman v. County of Los Angeles (1991) 234 Cal.App.3d 1343, 1350.) Hospitals like VCMC do not fall within the Privacy Act because of

8 their receipt of federal funds. (St. Michael’s Convalescent Hospital v. State of California, supra, 643 F.2d at pp. 1373-1374.) The act “unambiguously defines the term ‘agency’ as an agency of the federal government” (Schmitt v. City of Detroit (6th Cir. 2005) 395 F.3d 327, 329), and Congress rejected a bill that would have included “state authorities” within the act (ibid.) “ ‘to foreclose private enforcement’ ” against entities such as VCMC. (Polchowski v. Gorris (7th Cir. 1983) 714 F.2d 749, 752.) The Federal Civil Rights Act (42 U.S.C. § 1983) Taft contends the trial court “did not address [his] claim that 42 U.S.C. 1983 provides a private cause of action for the HIPAA violations.” Taft claims he should be given leave to amend to plead a title 42 United States Code section 1983 (section 1983) cause of action. “Although section 1983 does on its face apply to both federal constitutional and federal statutory rights, if there is no basis for a private right of action under the particular federal statute, that statute does not create a federal right for purposes of section 1983.” (Huling v. City of Los Banos, supra, 869 F.Supp.2d at p. 1154; see also Gonzaga University v. Doe (2002) 536 U.S. 273, 286 [153 L.Ed.2d 309, 322-323].) Taft wishes to file a section 1983 violation based on “HIPAA violations,” but “HIPAA provides no private right of action.” (Huling, at p. 1154; Dodd v. Jones, supra, 623 F.3d at p. 1154.) A HIPAA violation therefore cannot provide the basis for a section 1983 claim. (Ibid.) Leave to Amend Taft claims he “should be granted leave to amend.” “ ‘If the plaintiff cannot show an abuse of discretion, the trial court’s order sustaining the demurrer without leave to amend must be

9 affirmed.’ ” (Balikov v. Southern Cal. Gas Co. (2001) 94 Cal.App.4th 816, 820.) Taft filed a motion for reconsideration but did not show he could amend to plead a valid cause of action. Taft also claims the trial court erred by awarding sanctions against him. But he has not made a showing of abuse of discretion.

DISPOSITION

The judgment is affirmed. Costs are awarded to respondent.

NOT TO BE PUBLISHED.

GILBERT, P. J.

We concur:

YEGAN, J.

BALTODANO, J.

10 Jeffrey G. Bennett, Henry J. Walsh, Judges

Superior Court County of Ventura

______________________________

Foster Taft, in pro. per., for Plaintiff and Appellant. Clinkenbeard, Ramsey, Spackman & Clark, Hugh S. Spackman and Cathy Anderson for Defendants and Respondents.

11