Notice: This opinion is subject to formal revision before publication in the
Atlantic and Maryland Reporters. Users are requested to notify the Clerk of the
Court of any formal errors so that corrections may be made before the bound
volumes go to press.
             DISTRICT OF COLUMBIA COURT OF APPEALS

                                  No. 17-CV-139

                       JESSICA VELCOFF, Ph.D., APPELLANT,

                                         V.

                       MEDSTAR HEALTH, INC., APPELLEE.

                         Appeal from the Superior Court
                          of the District of Columbia
                                (CAB-6448-16)

                       (Hon. Jeanette J. Clark, Trial Judge)

(Argued December 19, 2017                                  Decided June 21, 2018)

      Jonathan B. Nace for appellant.

      K. Nichole Nesbitt for appellee.

      Before GLICKMAN, THOMPSON, and MCLEESE, Associate Judges.

      MCLEESE, Associate Judge: Appellant Jessica Velcoff, Ph.D., brought this

action against MedStar Health, Inc., alleging that MedStar unlawfully disclosed her

sensitive mental-health information. Dr. Velcoff appeals the trial court‟s dismissal

of the complaint for failure to state a claim. We vacate the trial court‟s decision

and remand for further proceedings.
                                        2

                                        I.



      The complaint alleges the following. Dr. Velcoff suffered life-threatening

injuries in a work-related car collision.       She was admitted to National

Rehabilitation Hospital (NRH), which is owned and operated by MedStar, for

treatment that included psychological treatment.     She submitted a claim for

workers‟ compensation benefits. At some point during her inpatient treatment, she

was told that “workers‟ comp was the client, not you.” After she was discharged,

she continued outpatient psychological treatment with an NRH clinical

psychologist. During her treatment, MedStar gave her a privacy policy indicating

that her personal health information would be kept confidential and disclosed only

as required by law.



      In connection with her treatment, Dr. Velcoff shared personal and

confidential information with her psychologist, unrelated to the processing of any

workers‟ compensation claim. When her psychologist began questioning her on

topics similar to those asked by her workers‟ compensation insurance company,

Dr. Velcoff became concerned that her psychologist was not protecting her

confidential information. When Dr. Velcoff asked what her psychologist had

shared with the insurance company, her psychologist acknowledged having
                                               3

“shared everything.” At this point, Dr. Velcoff stopped treatment with NRH‟s

psychology department.           Dr. Velcoff ordered a copy of her records, which

confirmed that her psychologist had shared Dr. Velcoff‟s treatment file, including

detailed notes of her sessions, with the insurance company, without Dr. Velcoff‟s

consent.



       The complaint alleges that MedStar violated the District of Columbia

Consumer Protection Procedures Act (CPPA), D.C. Code § 28-3901 et seq. (2013

Repl. & 2017 Cum. Supp.). Under the CPPA, “[a] consumer may bring an action

seeking relief from the use of a trade practice in violation of a law of the District.”

D.C. Code § 28-3905 (k)(1)(A).           Illegal trade practices include “represent[ing]

that . . . services . . . have    characteristics . . . that   they   do   not   have”;

“misrepresent[ing] as to a material fact which has a tendency to mislead”; or

“fail[ing] to state a material fact if such failure tends to mislead.” D.C. Code § 28-

3904 (a), (e), (f). The complaint alleges that MedStar committed illegal trade

practices in violation of the CPPA by breaking its promise to protect Dr. Velcoff‟s

confidential mental-health information except as required by law. The complaint

also alleges that MedStar violated the CPPA by disclosing Dr. Velcoff‟s mental-

health information in violation of the D.C. Mental Health Information Act

(MHIA), D.C. Code § 7-1201.01 et seq. (2018 Repl.).
                                          4




      The MHIA prohibits the unauthorized disclosure of mental-health

information. D.C. Code § 7-1201.02. Under the MHIA, the following mental-

health information may in some circumstances be disclosed to third-party payors:

“(1) Administrative information; (2) Diagnostic information; (3) The status of the

client (voluntary or involuntary); (4) The reason for admission or continuing

treatment; and (5) A prognosis limited to the estimated time during which

treatment might continue.” D.C. Code § 7-1202.07 (a); see also D.C. Code § 7-

1201.01    (15)   (defining    “[t]hird-party   payor”   as   “any    person    who

provides . . . medical . . . benefits whether on an indemnity, reimbursement, service

or prepaid basis, including, but not limited to, insurance carriers, governmental

agencies and employers”). Disclosure under this provision requires the client‟s

written authorization or consent. D.C. Code §§ 7-1202.02 (a), -1202.07 (a).



      The MHIA provides additional protection to “personal notes regarding a

client.” D.C. Code § 7-1201.03. Specifically,

             such personal notes shall not be maintained as a part of
             the client‟s record of mental health information.
             Notwithstanding any other provision of this chapter,
             access to such personal notes shall be strictly and
             absolutely limited to the mental health professional and
             shall not be disclosed except to the degree that the
             personal notes or the information contained therein are
             needed in litigation brought by the client against the
                                          5

               mental health professional on the grounds of professional
               malpractice or disclosure in violation of this section.


Id. If a third-party payor questions the payment of mental-health benefits, the

MHIA provides for independent mental-health professionals to help resolve the

dispute while protecting against the disclosure of mental-health information to the

third-party payor.     D.C. Code § 7-1202.07 (b).     Additionally, pursuant to the

MHIA, “[m]ental health information may be disclosed in a civil or administrative

proceeding in which the client . . . initiates his mental or emotional condition or

any aspect thereof as to an element of the claim or defense.” D.C. Code § 7-

1204.03 (a).



      The complaint further alleges that MedStar breached its common-law duty

of confidentiality by disclosing Dr. Velcoff‟s personal mental-health information

without authorization.




                                          II.



      We review de novo a trial court‟s decision to dismiss a complaint for failure

to state a claim. Woods v. District of Columbia, 63 A.3d 551, 553 (D.C. 2013).

“To survive a motion to dismiss, a complaint must set forth sufficient facts to
                                          6

establish the elements of a legally cognizable claim.” Id. at 552-53. We take the

facts alleged in the complaint as true. Id. at 553. We conclude that the complaint

was erroneously dismissed.



      Before addressing the merits, we briefly address Dr. Velcoff‟s standing to

raise the claims at issue. It is not entirely clear whether MedStar contests Dr.

Velcoff‟s standing, but in any event we have no difficulty concluding that Dr.

Velcoff has standing. See generally Grayson v. AT&T Corp., 15 A.3d 219, 233-35

(D.C. 2011) (en banc) (D.C. Court of Appeals generally follows Article III

standing requirements, including requirement that plaintiff establish injury in fact).

With respect to the CPPA claim, Dr. Velcoff claims that MedStar violated its

promise to protect her confidential mental-health information, and she seeks,

among other things:     (a) statutory damages of $1,500 per violation or treble

damages, whichever is greater; and (b) an injunction to stop future unauthorized

disclosures of confidential information.      D.C. Code § 28-3905 (k)(2)(A), (D).

Such claims under the CPPA suffice to establish standing. See Grayson, 15 A.3d

at 248-49 (finding standing where appellant‟s claim of injury was “derived solely

from a violation or an invasion of his statutory legal rights created by the CPPA”).

As to the claim of breach of the common-law duty of confidentiality, we conclude

that an allegation that confidential mental-health information was unlawfully
                                          7

disclosed suffices to support standing. Cf. Robins v. Spokeo, Inc., 867 F.3d 1108,

1117-18 (9th Cir. 2017) (concluding that plaintiff satisfied injury-in-fact

requirement by showing that materially false information was disseminated in

violation of federal Fair Credit Reporting Act); In re Horizon Healthcare Servs.

Inc. Data Breach Litig., 846 F.3d 625, 638-41 (3d Cir. 2017) (same as to

unauthorized disclosure of private information).



      Turning to the merits, the trial court gave four reasons for dismissing the

claims at issue. First, with respect to the CPPA claim, the trial court stated that the

complaint fails to identify the specific illegal trade practices at issue. To the

contrary, the complaint clearly and specifically identifies several trade practices

that the complaint alleges are illegal, including failing to provide the promised

benefit of confidentiality, misrepresenting the degree of confidentiality provided,

and failing to state material facts about the lack of confidentiality. Although the

complaint does not cite the specific subsections of the CPPA to which each

specific allegation relates, matching allegations of the complaint to corresponding

subsections of the CPPA is a straightforward task. See, e.g., D.C. Code § 28-

3904 (a) (illegal trade practice to represent that service has characteristics or

benefits that service does not have), (e) (illegal trade practice to misrepresent

material fact that has tendency to mislead), (f) (illegal trade practice to omit
                                         8

material fact where omission has tendency to mislead). Moreover, the rules do not

explicitly require a civil complaint to cite the specific subsections upon which the

plaintiff relies. D.C. Super. Ct. Civ. R. 8 (a)(2) (complaint must contain “a short

and plain statement of the claim showing that the pleader is entitled to relief”).

Criminal charging documents do require statutory citations, but even there the

omission of such citations is not a basis for dismissal in the absence of prejudice.

D.C. Super. Ct. Crim. R. 7 (c)(1)-(2). We conclude that the complaint alleges

violations of the CPPA with adequate specificity to survive a motion to dismiss.

Cf. Johnson v. City of Shelby, Miss., 135 S. Ct. 346, 346 (2014) (per curiam)

(“Federal pleading rules call for „a short and plain statement of the claim showing

that the pleader is entitled to relief,‟ Fed. Rule Civ. Proc. 8(a)(2); they do not

countenance dismissal of a complaint for imperfect statement of the legal theory

supporting the claim asserted.”).



      Second, the trial court suggested that the alleged disclosures were lawful

under D.C. Code § 7-242 (a) (2018 Repl.), which authorizes the sharing of certain

health information among “agenc[ies]” and “service provider[s].” At least on the

current record, however, that provision does not appear to apply to MedStar and

the third-party insurer. See D.C. Code § 7-241 (1) (2018 Repl.) (“„Agency‟ means

an agency, department, unit, or instrumentality of the District of Columbia
                                          9

government.”), (9) (2018 Repl.) (“„Service provider‟ means an entity that provides

health or human services to District residents pursuant to a contract, grant, or other

similar agreement with an agency.”). Moreover, § 7-242 (a) by its terms does not

authorize disclosures that would be “specifically prohibited under District

. . . law.”   Dr. Velcoff alleges that the disclosures in the present care were

specifically prohibited by the MHIA. For these reasons, § 7-242 (a) does not

provide a basis upon which to dismiss the complaint.



       Third, the trial court concluded that the disclosures at issue were authorized

under D.C. Code § 32-1507 (i) (2012 Repl.), which provides that “[t]he employee

and employer are entitled upon request to all medical reports made pursuant to

claims arising under this chapter.” That provision, however, does not by its terms

authorize the alleged disclosures in this case, which were to a third-party insurer

rather than to an employer. Considered in isolation, therefore, § 32-1507 (i) does

not support dismissal of the complaint. (Although it is unclear whether all of the

mental-health information allegedly disclosed in this case, including detailed

session notes by Dr. Velcoff‟s psychologist, falls within the scope of the term

“medical reports,” we need not express a view on that question.)
                                           10

      Finally, the trial court concluded that Dr. Velcoff consented to the

disclosures, by seeking workers‟ compensation.             Other than § 32-1507 (i),

however, the trial court did not cite any specific statutory support for its consent

ruling. The trial court did cite a federal district court decision, but the court in that

case relied on a specific provision of Florida workers‟ compensation law that does

not appear to have a counterpart under District of Columbia law. Reed v. Ga.-Pac.

Corp., No. 3:05-CV-615-J-25TEM, 2006 WL 166534, at *3 (M.D. Fla. Jan. 23,

2006) (dismissing claim of invasion of privacy for failure to state claim, because

plaintiff seeking compensation for work-related injury “had no expectation of

privacy during his medical examination”; “„[A]n employee who reports an injury

or illness alleged to be work-related waives any physician-patient privilege with

respect to any condition or complaint reasonably related to the condition for which

the employee claims compensation.‟”) (quoting Fla. Stat. § 440.13(4)(c) (2017)).



      As we have previously indicated, under the MHIA, consent to or

authorization of disclosure of mental-health information to third-party payors must

generally be in writing.         D.C. Code §§ 7-1131.14 (6) (2018 Repl.); 7-

1201.01 (8A), -1202.02 (a), -1202.07 (a); 45 C.F.R. § 164.508(b)(1)(i), (c) (2017).

Moreover, personal notes relating to mental-health treatment are given special

protection. D.C. Code § 7-1201.03. In contrast, the Workers‟ Compensation Act
                                         11

contemplates that medical reports will be available to interested parties, which

would presumably include third-party insurers. D.C. Code § 32-1520 (g) (2012

Repl.) (“All medical reports submitted by the claimant or any other interested party

shall become part of the record, except that the Mayor shall have the discretion to

require the testimony at the hearing of any reporting physician. Copies of all

medical reports submitted shall be supplied to any party upon request.”).

Regulations specifically provide for access to medical records. 7 DCMR §§ 208.2

(2018) (“official record” in workers‟ compensation case “shall include . . . all

medical records . . . relating to the claim”), 208.6 (2018) (“Interested parties may

request copies of any document in the official record.”).



      Although Dr. Velcoff relied upon the MHIA in the complaint and cited the

MHIA in opposing the motion to dismiss, the trial court did not mention the MHIA

at all. It is not immediately apparent how to accommodate the requirements of

both the MHIA and the Workers‟ Compensation Act. This court does not appear

to have had occasion to address that issue. Nor, as far as we can tell, has the

Compensation Review Board, the “expert[]” administrative body “responsibl[e] for

administering the Workers‟ Compensation Act.” Howard Univ. Hosp. v. District

of Columbia Dep’t of Emp’t Servs., 960 A.2d 603, 606 (D.C. 2008). We decline to

attempt to resolve that significant and potentially complex issue in the first
                                         12

instance on appeal. The issue was not addressed by the trial court and has not been

fully briefed by the parties in this court. Moreover, we are particularly reluctant to

decide the issue at this juncture because potentially relevant factual circumstances

are not clear on the current record. For example, it is not clear exactly how NRH

came to be Dr. Velcoff‟s health-care provider; what consents, authorizations, or

waivers Dr. Velcoff may have signed in connection with her treatment; the nature

and circumstances of the alleged disclosures; and to what extent the disclosures

were necessary or appropriate for purposes of handling the workers‟ compensation

matter. Under the circumstances, we conclude that the prudent course is to vacate

the trial court‟s dismissal order and remand for further proceedings. Cf., e.g., van

Leeuwen v. Blodnikar, 144 A.3d 565, 569 (D.C. 2016) (“The trial court has not yet

addressed these questions and the parties have not fully briefed them.            We

therefore remand the case to the trial court to address those issues in the first

instance.”).



      MedStar also seeks affirmance on several alternative grounds not decided by

the trial court, including that Dr. Velcoff failed to adequately allege damages. We

decline, however, to address these alternative grounds at this time, particularly

given that Dr. Velcoff sought leave to amend the complaint and the trial court did

not rule on that motion.
                                     13




      For the foregoing reasons, we vacate the judgment and remand for further

proceedings.


                                                So ordered.
