FILED
                                                                       United States Court of Appeals
                      UNITED STATES COURT OF APPEALS                           Tenth Circuit

                             FOR THE TENTH CIRCUIT                          February 14, 2020
                         _________________________________
                                                                          Christopher M. Wolpert
                                                                              Clerk of Court
 CASSANDRA FREIER,

       Plaintiff - Appellant,

 v.                                                          No. 19-1347
                                                 (D.C. No. 1:19-CV-00702-LTB-GPG)
 THE STATE OF COLORADO;                                       (D. Colo.)
 NORTHEAST HEALTH PARTNERS,
 LLC; BEACON HEALTH OPTIONS,
 INC.; DOES 1-100,

       Defendants - Appellees.
                      _________________________________

                             ORDER AND JUDGMENT*
                         _________________________________

Before LUCERO, PHILLIPS, and EID, Circuit Judges.
                  _________________________________


      Cassandra Freier appeals the district court’s dismissal of her claim that defendants

improperly disclosed her personal health information. Exercising jurisdiction under 28

U.S.C. § 1291, we affirm.




      *
        After examining the briefs and appellate record, this panel has determined
unanimously that oral argument would not materially assist in the determination of
this appeal. See Fed. R. App. P. 34(a)(2); 10th Cir. R. 34.1(G). The case is therefore
ordered submitted without oral argument. This order and judgment is not binding
precedent, except under the doctrines of law of the case, res judicata, and collateral
estoppel. It may be cited, however, for its persuasive value consistent with
Fed. R. App. P. 32.1 and 10th Cir. R. 32.1.
                                              I

       After Freier’s health insurance company requested her medical files from her

healthcare provider to review the claims for payment, Freier sued. She alleged that the

request violated the Health Insurance Portability and Accountability Act (“HIPAA”), 42

U.S.C. § 1320d-6, and constituted professional negligence and deceptive business

practices. Adopting the magistrate judge’s report and recommendation, the district court

dismissed Freier’s HIPAA claim with prejudice under 28 U.S.C. § 1915(e)(2)(B)(ii). It

concluded the claim was legally frivolous because HIPAA does not authorize a private

right of action. The court declined to exercise supplemental jurisdiction over Freier’s two

state-law claims. Freier timely appealed.

                                             II

       We review the district court’s dismissal under § 1915(e)(2)(B)(ii) de novo,

“look[ing] to the specific allegations in the complaint to determine whether they plausibly

support a legal claim for relief.” Kay v. Bemis, 

, 1218 (10th Cir. 2007)

(quotation omitted). Our review of the court’s dismissal of Freier’s state-law claims is

for abuse of discretion. See Nielander v. Bd. of Cty. Comm’rs, 

, 1172

(10th Cir. 2009). Because Freier proceeds pro se, we “liberally construe [her] pleadings,”

Requena v. Roberts, 

, 1205 (10th Cir. 2018), but “do not assume the role of

advocate,” Yang v. Archuleta, 

, 927 n.1 (10th Cir. 2008) (quotation

omitted).

       As an initial matter, Freier failed to submit timely and specific objections to the

magistrate judge’s report and recommendation. Parties who do so generally waive

                                              2
appellate review of factual and legal questions. Moore v. United States, 

,

659 (10th Cir. 1991). This firm-waiver rule does not apply, however, “when (1) a pro se

litigant has not been informed of the time period for objecting and the consequences of

failing to object, or when (2) the ‘interests of justice’ require review.” Morales-

Fernandez v. I.N.S., 

, 1119 (10th Cir. 2005). Freier argues that the second

exception applies because the district court committed plain error in its interpretation of

HIPAA and dismissal of her state-law claims.1 We hold the district court did not err.

       We have previously concluded that HIPAA does not confer a private right of

action. Wilkerson v. Shinseki, 

, 1267 n.4 (10th Cir. 2010) (“HIPAA

does not create a private right of action for alleged disclosures of confidential

medical information.”). This holding is consistent with those of our sibling circuits

to have considered the issue. See Stewart v. Parkview Hosp., 

, 1015

(7th Cir. 2019); Dodd v. Jones, 

, 569 (8th Cir. 2010); Seaton v.

Mayberg, 

, 533 (9th Cir. 2010); Acara v. Banks, 

, 571 (5th

Cir. 2006). “Those courts have reasoned that Congress, by delegating enforcement

authority to the Secretary of Health and Human Services, did not intend for HIPAA

to include or create a private remedy.” 

. Moreover,

“HIPAA’s focus on the conduct of those with access to medical information—as




       1
         Because the magistrate judge notified Freier that failure to object in writing
to the report and recommendation within fourteen days may bar any appeal, the first
exception does not apply.
                                              3
opposed to the rights of individual patients—also weighs against finding an implied

private right of action.” 

that Wilkerson is no longer good law following a 2009 amendment

to HIPAA, contending that the amended version of § 1320d-6 creates a right of action

because it sets forth an “offense.” We disagree. The amendment added the following

sentence to § 1320d-6:

              For purposes of the previous sentence, a person (including an
              employee or other individual) shall be considered to have
              obtained or disclosed individually identifiable health
              information in violation of this part if the information is
              maintained by a covered entity (as defined in the HIPAA
              privacy regulation described in section 1180(b)(3)) and the
              individual obtained or disclosed such information without
              authorization.

See Am. Recovery & Reinvestment Act of 2009, Pub. L. No. 111-5, § 13409, 123 Stat.

115, 271 (2009) (codified at § 1320d-6(a)).2 The amendment merely adds language

specifying what constitutes a HIPAA violation. It does not add any “rights-creating

language.” Boswell v. Skywest Airlines, Inc., 

, 1267 (10th Cir. 2004)

(citation omitted). And contrary to Freier’s argument that the provision creates a private

right of action because it sets forth an offense, the use of the word “offense” predates the




       2
         The amendment took effect in February 2010, 

123 Stat. at 276,
after the events that gave rise to the suit in 

.
                                             4
amendment. See HIPAA, Pub. L. No. 104-191, § 1177, 110 Stat. 1936, 2029 (1996)

(codified as amended at § 1320d-6).

       Moreover, the amendment provides that state attorneys general, in addition to the

Secretary, can enforce HIPAA violations. See Am. Recovery & Reinvestment Act,

§ 13410(e)(1), 123 Stat. at 274-75 (codified at § 1320d-5(d)). This broadening of

enforcement authority underscores Congress’ intent to limit HIPAA enforcement as

specified in the statute. See Alexander v. Sandoval, 

, 290 (2001) (“The

express provision of one method of enforcing a substantive rule suggests that Congress

intended to preclude others.”). Thus, the amendment does not change our conclusion that

HIPAA does not provide a private right of action for the alleged disclosure of

confidential medical information.3

       We also affirm the district court’s dismissal of Freier’s two state-law claims for

lack of jurisdiction. Neither of these claims presents a federal question. Because Freier

and defendant Northeast Health Partners are both citizens of Colorado, the case does not

satisfy the requirements of diversity jurisdiction. See Grynberg v. Kinder Morgan



       3
         Although HIPAA does not provide a private right of action, an individual
may file a complaint with the Department of Health and Human Services (“HHS”)
alleging a HIPAA violation. 45 C.F.R. § 160.306. If HHS finds the complaint
meritorious after an investigation, it may refer the case to the Department of Justice
for prosecution under HIPAA’s criminal provisions; obtain voluntary compliance,
corrective action, or a resolution agreement; or issue a formal finding of a violation
and impose a civil penalty. § 160.312(a); HHS, Enforcement Process,
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-
process/index.html (last visited Jan. 31, 2020). If civil penalties are imposed, the
entity on which they are imposed may request a hearing before an administrative law
judge. § 160.504.
                                             5
Energy Partners, L.P., 

, 905 (10th Cir. 2015) (“Diversity jurisdiction

requires complete diversity—no plaintiff may be a citizen of the same state as any

defendant.”). Given its dismissal of Freier’s HIPAA claim, the district court did not

abuse its discretion in declining to exercise supplemental jurisdiction over the remaining

state-law claims. See Smith v. City of Enid ex rel. Enid City Comm’n, 

,

1156 (10th Cir. 1998) (“When all federal claims have been dismissed, the court may, and

usually should, decline to exercise jurisdiction over any remaining state claims.”).

                                            III

       AFFIRMED. Freier’s motion to proceed in forma pauperis is GRANTED.

                                              Entered for the Court


                                              Carlos F. Lucero
                                              Circuit Judge




                                             6