Affirmed in part, reversed in part, and remanded by published opinion. Judge Traxler wrote the opinion, in which Chief Judge Wilkinson joined. Judge Williams wrote an opinion concurring in part and dissenting in part.

John Doe brought an action against Detective Garrett G. Broderick, see 42 U.S.C.A. § 1983 (West Supp 1998), alleging that Detective Broderick violated Doe's rights under the Fourth Amendment and under federal statutory law when Detective Broderick, without probable cause, entered the file room of a substance abuse treatment clinic and searched Doe's confidential treatment records along with numerous other patients' records. Doe also sought to impose municipal liability upon Fairfax County, Detective Broderick's employer. The district court denied Detective Broderick qualified immunity at the summary judgment stage, but dismissed Doe's claim against Fairfax County. We affirm in part, reverse in part, and remand the matter for trial.

In August 1998, a jewelry store reported a grand larceny to the Fairfax County Police Department. Detective Broderick was among those assigned to investigate the matter. The report submitted by the jewelry store indicated that the suspect, a white male, asked a sales clerk to show him a diamond engagement ring. When she handed the ring over for inspection, the suspect ran from the store and then fled the scene in a vehicle parked nearby and driven by an accomplice. The sales clerk, however, was able to obtain the tag number for the vehicle. Broderick determined that the suspect had escaped in a car stolen from a parking garage located in the same vicinity as the jewelry store. The parking garage was also situated near the Fairfax Methadone Treatment Center ("the methadone clinic" or "clinic"), a facility that provided treatment for a wide variety of substance abuse problems.

Based on these facts, and his belief that drug addicts often engage in criminal activity to support their habits, Detective Broderick hypothesized that the suspect may have been a patient at the nearby methadone clinic. He concluded that it would aid his investigation if he could establish the identities of the patients who had been receiving treatment at the methadone clinic during or near the time that the grand larceny occurred. Accordingly, Detective Broderick telephoned the clinic and indicated that he wanted to examine records that would reveal who was at the clinic at the time of the grand larceny. The clinic refused, however, to disclose any information in the absence of a court order.

As a result, Detective Broderick consulted Assistant Commonwealth Attorney Ian Rodway for advice on how to proceed. According to Detective Broderick, he explained to Rodway why he believed that the suspect could have come from the methadone clinic and asked Rodway how he could obtain access to the clinic's records. Rodway, however, remembers that Detective Broderick indicated that he wanted only to examine the entries in the clinic's log book. In any event, Rodway told him that it would be necessary for him to get a search warrant. They did not discuss whether Detective Broderick's theory established probable cause.

Detective Broderick then prepared a proposed search warrant that directed that the clinic be searched for "records, documents and photographs." J.A. 227. He also drafted a supporting affidavit in which he requested that the search include the following:

the full names of all patients, dates of birth, social security numbers, photographs, home addresses and work locations if available[,] the opening of any file cabinets, desks, clos ets, locked safes, boxes, bags, compartments or things in the nature ther[e]of, found in or upon said premises to include any and all electronically stored computer data.

J.A. 232. The affidavit explained that, based on his training and experience, Detective Broderick believed that the grand larceny suspect was potentially someone who was receiving treatment at the methadone clinic:

Based upon your Affiant's training, experience and partici pation in other criminal investigations [of] offenses concern ing Grand Larcen[ies] your Affiant knows:

That it is common for people who have addictions[to] vari ous narcotics to include but not limited to heroin, cocaine, methadone, and other schedule one and schedule two nar cotics to engage in these kinds of criminal activities to sup port [their] daily drug addictions. It is your Affiant's experience that heroin and cocaine addicts will obtain stolen vehicles and go on crime spree[s] stealing various merchan dise which is easily sold on the streets for [ ] quick cash to support [their] drug addictions.

Based on [these] facts, it is your Affiant's belief that... (the methadone treatment) clinic holds information on possible suspects. J.A. 232. After circulating the affidavit and proposed warrant to other officers for feedback, Detective Broderick submitted the materials to a magistrate judge, who issued a search warrant.

Armed with the warrant, Detective Broderick and five other Fairfax County officers entered the methadone clinic to execute the search warrant. Even though the police officers had a search warrant, an employee of the clinic initially refused to open the door to the room where the files were kept. She eventually relented, however, when the officers threatened to charge her with obstruction of justice. A number of items were then seized from the clinic, including the clinic's log book, files containing biographical information for seventy-nine male patients being treated at the clinic, photographs of these patients, and a large number of dosage sheets that detailed how much methadone was being administered to a given patient. The file of appellee John Doe ("Doe") was among the records seized, and it included his name, photograph, address, methadone dosage information, urine screen history, and confidences Doe shared with his counselors at the clinic. Doe's file contained only information that had been compiled by the clinic staff during Doe's treatment at the clinic. Although Doe was receiving treatment from the clinic during this general time frame, he was not present at the clinic at the time of the search.

The patients' files were taken to the Fairfax County Police Department and stored in Detective Broderick's office. Detective Broderick went through the files in order to match the photographs of the patients with the background information contained in the clinic records. Photocopies were made of the patient photographs. Otherwise, the material seized from the clinic was undisturbed. About two weeks following the execution of the search warrant, Fairfax County police returned the seized material and the photocopies to the clinic.

Doe brought this civil rights action against Detective Broderick and Fairfax County, alleging that Broderick lacked probable cause to seize his patient files maintained at the clinic and, therefore, violated his right to be free from unreasonable searches and seizures under the Fourth Amendment. See 42 U.S.C.A. § 1983 (West Supp. 1998). Doe also alleged a section 1983 claim against the defendants on the alternate basis that Detective Broderick failed to comply with the requirements of a federal statute that regulates the disclosure of drug treatment records. See 42 U.S.C.A. § 290dd-2 (West Supp. 1998).1

Asserting that he was entitled to qualified immunity, Detective Broderick moved for summary judgment on Doe's section 1983 claims against him in his individual capacity. The district court denied Broderick's motion. The court concluded that Doe had a reasonable expectation of privacy in his records at the methadone clinic, and that Broderick lacked probable cause to conduct the search, thus violating the Fourth Amendment and 42 U.S.C.A. § 290dd-2.2 The court then determined that the law was clearly established at the time that Broderick's search of Doe's files stored at the clinic violated his rights under section 290dd-2. The district court also apparently concluded, but did not expressly state, that Detective Broderick's conduct violated clearly established Fourth Amendment law because the court ultimately denied Detective Broderick's motion for summary judgment based on qualified immunity. Detective Broderick immediately appealed the denial of qualified immunity.

Fairfax County also moved for summary judgment. The district court granted the motion, concluding that the record contained no evidence that the alleged deprivation occurred because of a custom or practice. Doe appeals from the district court's grant of summary judgment to Fairfax County.

We turn first to Detective Broderick's invocation of qualified immunity, which protects government officials performing discretionary functions "from liability for civil damages insofar as their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known." Harlow v. Fitzgerald, 457 U.S. 800, 818 (1982). Qualified immunity exists fundamentally to protect officers in the performance of their duties unless they are "plainly incompetent" or they "knowingly violate the law." Malley v. Briggs, 475 U.S. 335, 341 (1986).

To determine whether Detective Broderick is entitled to qualified immunity, we follow a two-step analytical process. First, we must determine whether Doe has alleged the deprivation of a constitutional or statutory right in the first place. See Wilson v. Layne, 526 U.S. 603, 609 (1999). If so, we may proceed to determine whether Detective Broderick is entitled to qualified immunity or whether, because he ran afoul of clearly established constitutional rights, he is to be held personally accountable for his unlawful conduct. See id.; Harlow, 457 U.S. at 818.

Accordingly, we begin with the first inquiry and address Doe's argument that Detective Broderick abridged his rights under both 42 U.S.C.A. § 290dd-2 and the Fourth Amendment to the United States Constitution. We consider these rights in turn.

Doe first contends that Congress has afforded him an individual statutory right under 42 U.S.C.A. § 290dd-2, which prohibits, except in limited circumstances, the disclosure of "[r]ecords of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research." 42 U.S.C.A.§ 290dd-2(a). The statute sharply limits the availability of such records for use in criminal proceedings: "Except as authorized by a court order granted under subsection (b)(2)(C) of this section, no record referred to in subsection (a) of this section may be used to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient." 42 U.S.C.A. § 290dd-2(c). In turn, subsection (b)(2)(C) permits disclosure only upon an "application showing good cause therefor, including the need to avert a substantial risk of death or serious bodily harm."3 Significantly, the statute imposes criminal sanctions on those who transgress it, providing that "[a]ny person who violates any provision of this section or any regulation issued pursuant to this section shall be fined in accordance with Title 18." 42 U.S.C.A. § 290dd-2(f).

There is no question that the confidentiality and disclosure provisions contained in section 290dd-2 were not satisfied. But, Detective Broderick's failure to observe the requirements of section 290dd-2, or any other federal statute, does not automatically give rise to a civil rights claim pursuant to section 1983. This is because "[s]section 1983 itself creates no rights; rather it provides `a method for vindicating federal rights elsewhere conferred.'" Kendall v. City of Chesapeake, 174 F.3d 437, 440 (4th Cir. 1999) (quoting Albright v. Oliver, 510 U.S. 266, 271 (1994)). "In order to seek redress through § 1983... a plaintiff must assert the violation of a federal right, not merely a violation of federal law." Blessing v. Freestone, 520 U.S. 329, 340 (1997) (emphasis in original). Even if a civil rights plaintiff has shown that a federally-created right has been abridged, section 1983 is still unavailable as a remedy if "Congress has foreclosed such enforcement of the statute in the enactment itself." Wright v. City of Roanoke Redevelopment & Hous. Auth., 479 U.S. 418, 423 (1987). Congress can foreclose recourse to section 1983 by expressly forbidding it in the statute or by impliedly doing so through the creation of a comprehensive scheme to enforce the statute. See Blessing, 520 U.S. at 341.

Thus, the violation of a federal statute is not actionable under section 1983 if one of the following is true: (1) "the statute d[oes] not create enforceable rights, privileges, or immunities within the meaning of § 1983," or (2) "Congress has foreclosed such enforcement of the statute in the enactment itself." Wright, 479 U.S. at 423. Detective Broderick argues that both are true in this case. We agree that section 290dd-2 does not create individual entitlements that can be enforced via section 1983.

The district court considered three factors, identified by the Supreme Court in Blessing, in assessing whether a statute creates an actionable federal right. Blessing tells us that the following questions are relevant to the determination of whether a statute creates an individual, enforceable right: Did Congress intend the statutory provision to benefit plaintiff? Is the ostensible right so"vague and amorphous" that its enforcement would prove difficult? And, is the statutory provision at issue phrased in mandatory rather than discretionary terms? See Blessing, 520 U.S. at 340-41. The district court's application of Blessing led it to conclude that Congress intended to provide Doe a right against disclosure of his drug treatment records, except as specifically delineated in § 290dd-2, that is enforceable through civil litigation.

In our view, Congress did not enact section 290dd-2 for the principal benefit of Doe and others who receive treatment at drug rehabilitation facilities. To begin with, we note that this statute is an unlikely spot for Congress to establish an actionable right, and we say this primarily because section 290dd-2 imposes criminal sanctions on wouldbe violators. See 42 U.S.C.A. § 290dd-2(f). The Supreme Court historically has been loath to infer a private right of action from "a bare criminal statute," Cort v. Ash, 422 U.S. 66, 80 (1975), because criminal statutes are usually couched in terms that afford protection to the general public instead of a discrete, well-defined group. See California v. Sierra Club, 451 U.S. 287, 294 (1981) (rejecting the view that "a victim of any crime would be deemed an especial beneficiary of the criminal statute's proscription"); Cannon v. University of Chicago, 441 U.S. 677, 690 (1979).

Significantly, the fact that criminal statutes do not ordinarily create individual rights led the Seventh Circuit Court of Appeals to conclude that section 290dd-2 does not confer rights on any specific group of beneficiaries because it is a criminal provision that was enacted for the good of the public at large. See Chapa v. Adams, 168 F.3d 1036, 1038 (7th Cir.), cert. denied, 120 S. Ct. 104 (1999). We find Chapa's reasoning persuasive:

Section 290dd-2 is a criminal prohibition, and it has been a long time since the Supreme Court used a criminal law as the basis of a private civil action. Some statutes defining crimes also authorize agencies to file civil suits, and the Court has occasionally held that these may be supplemented by private enforcement--though [such] decisions... have been in bad odor since the late 1970s. Today the principal question is whether the statute creates rights in favor of identified persons. If yes, a private action to enforce these rights is apt to be inferred; otherwise not. Criminal statutes, which express prohibitions rather than personal entitlements and specify a particular remedy other than civil litigation, are accordingly poor candidates for the imputation of private rights of action.

Personal rights could in principle be derived from crimi nal statutes. The rule "do not rob a bank" implies that a bank has a right not to be robbed. But the Supreme Court has been unwilling to treat criminal laws as implying private entitlements in this fashion and has held that the victims of crime therefore lack any legal right to compel a criminal prosecution. That reluctance to form private entitlements from criminal prohibitions blocks the judicial creation of private rights of action as well.

Chapa, 168 F.3d at 1037-38 (citations omitted).

We recognize, of course, that determining whether a statutory violation may be enforced through section 1983 "is a different inquiry than that involved in determining whether a private right of action can be implied from a particular statute." Wilder v. Virginia Hosp. Ass'n, 496 U.S. 498, 508 n.9 (1990); see Former Spec. Project Emp. Ass'n v. City of Norfolk, 909 F.2d 89, 91-94 (4th Cir. 1990). These inquiries overlap, however. In either case, we are required to determine whether Congress has created a right that can be enforced. Compare Blessing, 520 U.S. at 341 (a section 1983 plaintiff must "demonstrate[ ] that a federal statute creates an individual right"), with Cort, 422 U.S. at 78 (a private right of action exists for the violation of a federal statute only if "the statute create[s] a federal right in favor of the plaintiff"). Cf. Suter v. Artist M., 503 U.S. 347, 363 (1992) ("Having concluded that § 671(a)(15) does not create a federally enforceable right... under § 1983, the conclusion of the Court of Appeals that the Adoption Act contains an implied right of action for private enforcement... may be disposed of quickly.").

There is nothing in the text of section 290dd-2 to indicate that Congress had in mind the creation of individual rights. For example, instead of providing patients with the right to maintain the privacy of their records, subsection (a) establishes a broad proscription against the disclosure of substance abuse treatment records maintained not only for rehabilitation but for education, training, and research. See 42 U.S.C.A. § 290dd-2(a). Subsection (b) permits disclosure pursuant to a court order that balances "the public interest and the need for disclosure against the injury to the patient, to the physician-patient relationship, and to the treatment services." See 42 U.S.C.A. § 290dd2(b)(2)(C) (emphasis added). The language used in section 290dd-2 suggests that Congress was concerned primarily with fostering programs aimed at curtailing our nation's staggering substance abuse problems. The primary beneficiary is the public. Ensuring the confidentiality of patient records encourages voluntary participation in such programs which, in turn, improves public health. See Chapa, 168 F.3d at 1038 ("Like other criminal statutes,§ 290dd-2 creates rights in favor of society, not just particular members of society.... Addicts will be more likely to accept treatment-- and the rest of society therefore will be better off -- if treatment is confidential."). Legislative history, moreover, confirms that Congress enacted the section as part of an effort to combat the American public's drug abuse problem and that Congress intended to encourage individuals to seek treatment. See H.R. Conf. Rep. No. 92-775, at 28 (1972), reprinted in 1972 U.S.C.C.A.N. 2045, 2072 (explaining the confidentiality provisions in the predecessor to section 290dd-2 were necessary because "[w]ithout that assurance, fear of public disclosure of drug abuse or of records that will attach for life will discourage thousands from seeking the treatment they must have if this tragic national problem is to be overcome."); S. Rep. No. 102-131, at 2 (1992), reprinted in 1992 U.S.C.C.A.N. 277, 278 (The Alcohol, Drug Abuse and Mental Health Administration Reorganization Act, of which section 290dd-2 was a part, was aimed at fighting "drug abuse, alcohol abuse, and mental illness."); see generally Ellison v. Cocke County, Tenn., 63 F.3d 467, 470-71 (6th Cir. 1995).

Only the Sixth Circuit Court of Appeals has considered the precise issue before us -- whether 42 U.S.C.A. § 290dd-2 establishes rights that are enforceable through section 1983. See Ellison, 63 F.3d at 471-72. Ellison concluded that "Congress did not `unambiguously confer' upon the patient-beneficiaries the right to enforce the statute's confidentiality provision through a Section 1983 claim." Id. at 472 (quoting Suter, 503 U.S. at 363). We agree. We hold that section 290dd-2 does not create "enforceable rights, privileges, or immunities within the meaning of § 1983." Wright, 479 U.S. at 423.

Accordingly, we reverse the judgment of the district court to the extent it permits Doe to pursue a section 1983 claim based on Detective Broderick's failure to comply with section 290dd-2.

Doe next alleges that Detective Broderick trenched upon his Fourth Amendment rights when Broderick seized his records from the methadone clinic without probable cause. The district court concluded that Doe had a legitimate expectation of privacy in his files that were held by the methadone clinic, giving rise to the Fourth Amendment's protection against unreasonable searches and seizures. See United States v. Miller, 425 U.S. 435, 440 (1976) ("[N]o interest legitimately protected by the Fourth Amendment is implicated by governmental investigative activities unless there is an intrusion into a zone of privacy." (internal quotation marks omitted)). The district court found that Detective Broderick's search of Doe's clinic records lacked probable cause and therefore violated Doe's Fourth Amendment rights. Turning to the question of qualified immunity, the district court observed -- without elaborating further -- that Doe's Fourth Amendment right against the search of his clinic files in the absence of probable cause "was arguably not clearly established under existing law at the time of [Detective] Broderick's search." J.A. 539. Nevertheless, the district court apparently concluded that this right was clearly established because the court ultimately denied Detective Broderick's motion for summary judgment.

We first consider Doe's claim that Detective Broderick violated his Fourth Amendment rights by obtaining and examining his patient file during the search of the methadone clinic without probable cause. We conclude that Doe has stated a claim under the Fourth Amendment. Indeed, at oral argument Detective Broderick conceded this point. However, we are obliged to address this point to"promote[ ] clarity in the legal standards for official conduct, to the benefit of both the officers and the general public." Wilson, 526 U.S. at 609.

The protections of the Fourth Amendment are triggered when an individual seeking refuge under the Fourth Amendment"has a legitimate expectation of privacy in the invaded place" or the item seized. Rakas v. Illinois, 439 U.S. 128, 143 (1978); see United States v. Rusher, 966 F.2d 868, 873-74 (4th Cir. 1992). Thus, searches and seizures conducted in the absence of probable cause and a warrant are impermissible only if the officer encroaches upon a legitimate expectation of privacy. See California v. Greenwood, 486 U.S. 35, 39 (1988). A legitimate expectation of privacy exists when the individual seeking Fourth Amendment protection maintains a"subjective expectation of privacy" in the area searched that"society [is] willing to recognize... as reasonable." California v. Ciraolo, 476 U.S. 207, 211 (1986); see Oliver v. United States, 466 U.S. 170, 177-78 (1984) (explaining that the legitimacy of a reasonable expectation of privacy under the Fourth Amendment is determined by "our societal understanding").

There is no question that Doe maintained a genuine subjective expectation of privacy in his records and files kept at the methadone clinic.4 The more interesting issue is whether a patient's expectation of privacy -- Doe's expectation of privacy -- in his treatment records and files maintained by a substance abuse treatment center is one that society is willing to recognize as objectively reasonable and thus comes within ambit of the Fourth Amendment's protections. See Greenwood, 486 U.S. at 39. We think it is.

Section 290dd-2 is relevant to the determination of whether there is a "societal understanding" that Doe has a legitimate expectation of privacy in his treatment records. In United States v. Miller, 425 U.S. 435, 442-43 (1976), the Supreme Court observed that"[t]he lack of any legitimate expectation of privacy concerning the information kept in bank records was assumed by Congress in enacting the Bank Secrecy Act, the express purpose of which is to require records to be maintained because they `have a high degree of usefulness in criminal, tax, and regulatory investigations and proceedings.'" The relevant statute here, 42 U.S.C.A. § 290dd-2, does quite the opposite, making access to the records more difficult for criminal investigation purposes. Under these circumstances, we think that the statute is a fitting indication that society is willing to recognize Doe's expectation of privacy as objectively reasonable. See Florida v. Riley, 488 U.S. 445, 451 (1989) (plurality opinion) (analyzing defendant's expectation of privacy by reference to FAA regulations); cf. Greenwood, 486 U.S. at 43-44 (rejecting the argument that a reasonable expectation of privacy can be determined solely by state law because the analysis turns on "our societal understanding" of what deserves Fourth Amendment protection) (internal quotation marks omitted). The reason for this is apparent: medical treatment records contain intimate and private details that people do not wish to have disclosed, expect will remain private, and, as a result, believe are entitled to some measure of protection from unfettered access by government officials. We are satisfied that Doe maintained a legitimate expectation of privacy in his substance abuse treatment records for Fourth Amendment purposes.

Having concluded that the Fourth Amendment protects Doe's legitimate privacy interest in his substance abuse treatment records, we turn briefly to consider whether Detective Broderick's admitted conduct amounted to a violation of the Fourth Amendment. To be constitutional, a search must be "reasonable." See Vernonia School Dist. v. Acton, 515 U.S. 646, 653 (1995). When law enforcement officials are searching for evidence of a crime, reasonableness requires probable cause and a warrant unless one of the exceptions to the warrant requirement applies. See Katz v. United States, 389 U.S. 347, 357 (1967) (calling "per se unreasonable" any search conducted without a warrant issued by a judge or magistrate pursuant to a showing of probable cause and in the absence of an exception).

The fundamental constitutional principle that search warrants must be founded upon probable cause derives from the language of the Fourth Amendment itself, which provides that "no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." U.S. Const. amend. IV; see United States v. Harris, 403 U.S. 573, 577 (1971). A police officer seeking the issuance of a search warrant must present an affidavit containing facts sufficient to "provide the magistrate with a substantial basis for determining the existence of probable cause." Illinois v. Gates, 462 U.S. 213, 239 (1983). Probable cause exists when "there are reasonably trustworthy facts which, given the totality of the circumstances, are sufficient to lead a prudent person to believe that the items sought constitute fruits, instrumentalities, or evidence of crime and will be present at the time and place of the search." United States v. Suarez, 906 F.2d 977, 984 (4th Cir. 1990). The officer's supporting affidavit must make it apparent, therefore, that there is some nexus between the items to be seized and the criminal activity being investigated. See Warden v. Hayden, 387 U.S. 294, 307 (1967).

By contrast, Detective Broderick's affidavit does not identify a single fact that would suggest to a reasonable person that there was any link whatsoever between the methadone clinic and the jewelry theft. We agree with the district court that "if Broderick's premise -- that drug addicts steal to finance their addictions -- were enough for probable cause, it would allow him to search any location where drug addicts might congregate during his investigation of any local theft.... [H]e ostensibly could conduct routine, general searches of Fairfax County." J.A. 535. The effect of issuing a warrant based on Detective Broderick's hypothesis was to sanction an exploratory search through clinic records based on a hunch, which is impermissible. See Andresen v. Maryland, 427 U.S. 463, 480 (1976) (explaining the Fourth Amendment is designed specifically to prohibit the use of general warrants whereby the authorities engage in"a general, exploratory rummaging in a person's belongings.").

In sum, Detective Broderick's affidavit offered nothing more than a guess, based not on specific and reliable facts but on a broad generalization, that drug addicts are prone to steal things to support their drug habits. Because a mere hunch that illegal activity is afoot will not provide a valid foundation for the issuance of a search warrant, see United States v. Sokolow, 490 U.S. 1, 7 (1989), we conclude -and Detective Broderick does not dispute -- that there was no probable cause justifying the search and seizure of patient records from the methadone clinic, and that no reasonable officer in his shoes could have believed otherwise.5

Thus, we find that Detective Broderick's search of the clinic's records and files without probable cause violated Doe's rights under the Fourth Amendment, as Detective Broderick candidly admits.

We turn now to the question of qualified immunity. Detective Broderick argues that he is protected by qualified immunity because it was not clearly established in August 1998 that patients in drug treatment facilities had a legitimate expectation of privacy in their files stored at those facilities and, therefore, that it was not clearly established that an officer would violate their Fourth Amendment rights by entering a clinic and conducting a search of confidential patient files and records without a warrant or the slightest hint of probable cause. In view of the admitted lack of probable cause in his warrant to search a private area within the clinic for closely held treatment information, we think Detective Broderick misses the mark when he argues that his immunity from suit hinges on Doe's expectation of privacy in his treatment records.

Qualified immunity exists to balance two significant, but incompatible, policy considerations. See Anderson v. Creighton, 483 U.S. 635, 638 (1987). Section 1983 allows an aggrieved citizen to hold state and local law enforcement officers liable for violating his federally protected rights; monetary liability "`may offer the only realistic avenue for vindication of constitutional guarantees.'" Id. (quoting Harlow v. Fitzgerald, 457 U.S. 800, 814 (1982)). Subjecting officers to civil liability, however, creates the undesirable possibility that they would be "unduly inhibit[ed]... in the discharge of their duties," id., and that government would be "excessive[ly] disrupt[ed]," Harlow, 457 U.S. at 818, by officers who are concerned primarily with avoiding personal liability. As this court has previously observed, "[t]he police must have the ability to move swiftly to solve crimes or to apprehend dangerous criminals before evidence is destroyed or becomes stale, witnesses die or vanish, or a suspect has a chance to escape or to repeat the crime." Porterfield v. Lott, 156 F.3d 563, 567 (4th Cir. 1998).

Therefore, police officers who are investigating criminal wrongdoing are accorded qualified immunity to "shield[ ] [them] from liability for civil damages insofar as their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known." Harlow, 457 U.S. at 818. "Qualified immunity thus provides a `safe-harbor' from tort damages for police officers performing objectively reasonable actions in furtherance of their duties." Porterfield, 156 F.3d at 568 (emphasis added). This "safe-harbor" ensures that officers will not be liable for "bad guesses in gray areas" but only for "transgressing bright lines." Maciariello v. Sumner, 973 F.2d 295, 298 (4th Cir. 1992). Of course, officers are not afforded protection when they are "plainly incompetent or... knowingly violate the law." Malley, 475 U.S. at 341. But, in gray areas, where the law is unsettled or murky, qualified immunity affords protection to an officer who takes an action that is not clearly forbidden -- even if the action is later deemed wrongful. Simply put, qualified immunity exists to protect those officers who reasonably believe that their actions do not violate federal law.

Officer Broderick was not operating in a murky area of the law. Firmly-rooted precedent would have made it apparent to a reasonable officer that Detective Broderick's conduct was unlawful under the Fourth Amendment. It is safe to say that in August 1998, it was clear that law enforcement officials were not free to barge into an area within a place of business where the public was not invited and over the objection of the proprietors conduct a general search for evidence of a crime without the slightest hint of probable cause. The expectation that one generally remains free from warrantless searches in the privacy of the home is at the heart of the Fourth Amendment, see Silverman v. United States, 365 U.S. 505, 511-12 (1961), but the Supreme Court has long recognized that searches of office buildings and commercial premises in the absence of a search warrant grounded upon probable cause are unreasonable as well, see Marshall v. Barlow's, Inc., 436 U.S. 307, 311 (1978); G.M. Leasing Corp. v. United States, 429 U.S. 338, 353 (1977); See v. City of Seattle, 387 U.S. 541, 543 (1967). And, it is not a new concept that even in a public facility, government officials cannot search for evidence of a crime, absent probable cause, in areas that are closely guarded and private. See Katz, 389 U.S. at 351 ("What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected." (citations omitted)). Thus, not surprisingly, the Supreme Court has determined that a search of desk drawers and locked file cabinets located in a workplace is almost always unreasonable if it fails to conform to the warrant requirement. See Mancusi v. DeForte, 392 U.S. 364 (1968); Go-Bart Importing Co. v. United States, 282 U.S. 344 (1931); cf. Lo-Ji Sales, Inc. v. New York, 442 U.S. 319 (1979) ("[T]here is no basis for the notion that because a retail store invites the public to enter, it consents to wholesale searches and seizures that do not conform to Fourth Amendment guarantees.").

The proposition that police officers should obey the Fourth Amendment before searching private areas concealed by locked cabinets and doors remains valid when the doors and cabinets are found in a medical facility, and the Supreme Court has acknowledged as much. In O'Connor v. Ortega, 480 U.S. 709 (1987) (plurality opinion), the Court examined the appropriate limits of an administrative search conducted by a public hospital during a fraud investigation of one of its physician-employees. The search encompassed the physician's desk and file cabinets, which he did not share with anyone, and yielded documents relating to the doctor's private affairs. A majority of the Court reached the conclusion that, at the very least, the doctor had a reasonable expectation of privacy in his desk and file cabinets against invasion by his employer, see id. at 714-19; id. at 730 (Scalia, J., concurring), and the plurality noted that the expectation of privacy is even greater where the search is conducted by the police, see id. at 717 ("The operational realities of the workplace... may make some employees' expectations of privacy unreasonable when an intrusion is by a supervisor rather than a law enforcement official."). Although the plurality determined that the probable cause standard was inappropriate for such intrusions by public employers who are investigating work-related misconduct, see id. at 725-26, it drew a distinction between searches conducted by public employers on work-related matters and searches conducted by law enforcement officials for evidence of a crime. It is clear that probable cause is required for invasions of the latter variety -- a principle that a majority of the Court accepted. See id. at 719-22; id. at 730 (Scalia, J., concurring) ("[O]ne's personal office is constitutionally protected against warrantless intrusions by the police, even though employer and co-workers are not excluded."). Prior to O'Connor, in Pembaur v. City of Cincinnati, 475 U.S. 469 (1986), the Court observed that a state prosecutor "directly caused the violation of petitioner's Fourth Amendment rights," id. at 484, when he instructed officers who were standing in the public reception area of a medical clinic to forcibly enter, without a search warrant, the private portion of the clinic which was closed off by a door. The officers did so even though clinic employees locked the door when the officers entered the reception area and asked the officers to leave. See id. at 472-73.

There is no dispute in the case before us that the room in the methadone treatment center containing the patients' records was a private room and not a place where the general public was welcome. Before he even attempted to obtain the search warrant, Detective Broderick was aware of an incident in which a clinic supervisor told police officers, who were called to the clinic to investigate a possible overdose, that the clinic had not called them, that the police were not welcome, and that the clinic would not provide any information. Accordingly, Detective Broderick was well aware that the clinic considered the type of information he sought to be confidential. Detective Broderick confirmed this during his investigation of the larceny when he telephoned the clinic about the possibility of acquiring patient information. The clinic informed him that it would not relinquish any information to the police without a court order. As a result, Detective Broderick applied for and obtained the search warrant, suggesting to us that he knew, as any reasonable officer in his shoes would have known, that the clinic's record room and the records contained therein were sufficiently private to necessitate probable cause to search. Finally, when Detective Broderick executed the search warrant, one of the clinic's employees initially locked herself inside the record room to protect the confidentiality of the files and relented only after she was threatened with arrest for obstruction of justice.

A search warrant based upon probable cause was clearly necessary for law enforcement officers to enter the clinic's file room and to examine the information contained in the clinic's patient records, rendering Detective Broderick's search in the absence of probable cause a violation of clearly established Fourth Amendment principles. To be clearly established, the law must be "sufficiently clear that a reasonable official would understand that what he is doing violates that right." Anderson, 483 U.S. at 640. "This is not to say that an official action is protected by qualified immunity unless the very action in question has previously been held unlawful, but it is to say that in the light of pre-existing law the unlawfulness must be apparent." Id. (citation omitted); see Buonocore v. Harris, 65 F.3d 347, 357 (4th Cir. 1995) (explaining that the requirement that the law prohibiting an officer's conduct be clearly established "includes not only specifically adjudicated rights but those manifestly included within more general applications of the core constitutional principle invoked." (internal quotation marks omitted)).

In August 1998, clearly established Fourth Amendment principles prohibited officers from searching private areas within commercial or business premises, or even private areas within public places, without probable cause. We believe it would have been apparent to a reasonable officer that these limitations encompassed a locked, patientrecords room within a methadone clinic that contained confidential patient files, and that, if nothing else, Detective Broderick knew (or should have known) that his actions violated the Fourth Amendment rights of every person who had an expectation of privacy in the records room or the records contained there. The fact that he may not have known the identities of the persons wronged, or their precise numbers, is not determinative, for it was obvious that the files were not public, but were private, and that what he was doing violated the rights of all persons having a privacy interest in them. See Anderson, 483 U.S. at 640. Thus, by searching without probable cause, Detective Broderick clearly violated the Fourth Amendment, subjecting himself to suit by all persons vested with a legitimate expectation of privacy under the Fourth Amendment.

Although "the very action in question... [may not have] previously been held unlawful," we are satisfied that"in light of pre-existing law the unlawfulness... [was] apparent." Id. Consequently, Detective Broderick cannot cloak his clearly unconstitutional conduct with qualified immunity simply because a question may have existed as to whether Doe, in particular, had a legitimate expectation of privacy in his methadone treatment records. Detective Broderick engaged in actions which he knew or should have known were unacceptable and violative of the Fourth Amendment, leaving no principled reason why he should be immune from suit. By conducting his search without probable cause, Detective Broderick had already "transgress[ed] bright lines," Maciariello, 973 F.2d at 298, marking the limits of his qualified immunity protection.6 We therefore affirm the district court in its rejection of this defense.

Doe cross appeals the district court's dismissal of Fairfax County from his action. The district court found no evidence that Detective Broderick conducted his search pursuant to an official policy or a custom maintained by Fairfax County. See Monell v. Department of Soc. Servs., 436 U.S. 658, 690-91 (1978). The district court likewise rejected Doe's claim that Fairfax County failed to train Broderick properly to adhere to the requirements of section 290dd-2 because, even assuming Fairfax County had not properly trained Detective Broderick, it found no evidence that the failure to do so was a result of Fairfax County's deliberate indifference to Doe's rights. See City of Canton v. Harris, 489 U.S. 378, 388-89 (1989).

Doe points to no written or formal policy that would have caused his deprivation, see Monell, 436 U.S. at 690, nor does Doe argue that the search was the result of "affirmative decisions of individual policymaking officials," Carter v. Morris, 164 F.3d 215, 218 (4th Cir. 1999) (citing Pembaur v. City of Cincinnati, 475 U.S. 469, 483-84 (1986)). Moreover, we see nothing in the record that suggests Detective Broderick's search was the result of a "persistent and widespread" practice such that Fairfax County could be held liable. Monell, 436 U.S. at 691. The search of the methadone clinic was an odd, isolated incident that was the first of its kind at the Fairfax County Police Department. Isolated, unprecedented incidents such as this one are insufficient to create municipal liability. See Carter, 164 F.3d at 220 (A "meager history of isolated incidents" does not establish a municipal custom).

Doe also contends that Fairfax County is liable because it failed to adequately train Detective Broderick and other Fairfax County law enforcement officers. In making this argument, Doe highlights the fact that Fairfax County concedes it did not make its law enforcement officers aware of 42 U.S.C.A. § 290dd-2 prior to August 1999. Doe points to nothing else that would undermine the adequacy of Fairfax County's training of law enforcement officers. A municipality's failure to train its officers can result in liability under section 1983 only when such failure reflects "deliberate indifference" to the rights of its citizens. See Harris, 489 U.S. at 388. That is, "[o]nly where a failure to train reflects a `deliberate' or `conscious' choice by a municipality -- a `policy' as defined by our prior cases-- can a city be liable for such failure under § 1983." Id. at 389. There is simply nothing in the record to suggest that Fairfax County's lack of instruction of its officers on this federal statute was the result of an affirmative, conscious decision. Moreover, because this was a single incident, the need for training with regard to the confidentiality of drug treatment records was not so "plainly obvious" to the policymakers that the failure to instruct on section 290dd-2 can be said to be deliberately indifferent. See id. at 390 n.10. In sum, Doe advances his failure-to-train theory of municipal liability merely by reference to this single incident involving Detective Broderick; however, the Supreme Court has rejected the notion that "a § 1983 plaintiff [can]... establish municipal liability without submitting proof of a single action taken by a municipal policymaker." City of Oklahoma City v. Tuttle, 471 U.S. 808, 821 (1985). Accordingly, we affirm the judgment of the district court dismissing Fairfax County from the action.

For the foregoing reasons, we affirm the district court's denial of qualified immunity to Detective Broderick on Doe's Fourth Amendment claim, and we remand for further proceedings on that issue. We affirm the dismissal of Fairfax County from the action. We reverse the district court's denial of qualified immunity to Detective Broderick on Doe's claim that Detective Broderick violated 42 U.S.C.A. § 290dd-2.

AFFIRMED IN PART, REVERSED IN PART, AND REMANDED

WILLIAMS, Circuit Judge, concurring in part and dissenting in part:

Although I agree with much of the majority opinion, I have a fundamental disagreement with the analysis employed in Part III. Because I am convinced that Doe's legitimate expectation of privacy in his drug treatment center records needed to be clearly established at the time of Broderick's search in order for the defense of qualified immunity to be unavailable, and because I am further convinced that such an expectation was not clearly established, I respectfully dissent from the majority's conclusion that Broderick is not entitled to qualified immunity.

As the majority recognizes in Part II.B of its opinion, a determination that police conduct violates one's Fourth Amendment right to be free from unreasonable searches requires an affirmative answer to two subordinate questions. First, did the individual"seeking refuge under the Fourth Amendment `ha[ve] a legitimate expectation of privacy in the invaded place'"? Ante at 450 (quoting Rakas v. Illinois, 439 U.S. 128, 143 (1978)). Second, did the search fail to comply with the warrant requirement or an exception thereto? See ante at 451. Although the first question was once considered a question only of "standing," the Supreme Court has long held that whether one has a legitimate expectation of privacy in the invaded area is a question"more properly subsumed under substantive Fourth Amendment doctrine." Rakas, 439 U.S. at 139; see also Rawlings v. Kentucky, 448 U.S. 98, 104-06 (1980) (confirming that after Rakas there is no longer any separate standing inquiry). In Illinois v. Andreas, 463 U.S. 765 (1983), the Supreme Court clearly articulated the concept:

The Fourth Amendment protects legitimate expectations of privacy rather than simply places. If the inspection by police does not intrude upon a legitimate expectation of privacy, there is no "search" subject to the Warrant clause. The threshold question, then, is whether an individual has a legitimate expectation of privacy in the [invaded place].

Id. at 771 (internal citations omitted).

In addition, as alluded to in this quoted passage from Andreas, the Fourth Amendment serves to protect individual rights, and, therefore, a Fourth Amendment violation is inextricably tied to the specific individual who is alleging the violation. See Minnesota v. Carter, 525 U.S. 83, 88 (1998) (noting that the Fourth Amendment's language "indicates that [it] is a personal right that must be invoked by an individual"). In other words, there is no such thing as a Fourth Amendment violation "in the air"; only when the individual "seeking refuge under the Fourth Amendment `has a legitimate expectation of privacy in the invaded place' or the item seized," ante at 450 (quoting Rakas, 439 U.S. at 143), can a colorable Fourth Amendment claim, or, as here, a § 1983 claim premised upon a Fourth Amendment violation, exist. Without such an individual interest, no protectible Fourth Amendment interest is implicated.

These principles illuminating the contours of the Fourth Amendment are well settled, and, as I have noted, the majority correctly adheres to them in considering whether Doe has alleged a violation of his Fourth Amendment rights. See ante Part II.B.1. As the Supreme Court has instructed, courts must first determine whether a § 1983 plaintiff has alleged a violation of his constitutional or statutory rights at all, before considering whether those rights were clearly established so as to deprive an offending officer of a qualified immunity defense. See Wilson v. Layne, 526 U.S. 603, 609 (1999). Like the majority, I agree that, as a matter of first impression, Doe has properly asserted a violation of his Fourth Amendment rights.1 As I discuss below, however, I do not believe that Doe's Fourth Amendment right to be free from an unreasonable search of his drug treatment center records was clearly established at the time of Detective Broderick's search.

After relying upon the well-settled principle that a search violates the Fourth Amendment only when (1) the individual asserting the claim has a legitimate expectation of privacy in the invaded area and (2) the search runs afoul of the requirements of the Warrant Clause, the majority proceeds to abandon this two-part inquiry in analyzing whether Doe's rights were clearly established in Part III of its opinion. Instead of applying this same framework, the majority works under the premise that whether Doe's legitimate expectation of privacy in his records was clearly established is inconsequential. Because it was clear in August 1998 that police officers could not search "private areas" without a warrant supported by probable cause, the majority concludes that Detective Broderick cannot be afforded qualified immunity. See ante at 455. The majority's approach thus frames the issue in such a way that it completely ignores whether the answer to "the threshold question" was clear. See Illinois v. Andreas, 463 U.S. 765, 771 (1983). After skipping past this essential step in Fourth Amendment analysis, the majority goes on to assume that the area was private and then addresses the very general question of whether Broderick needed probable cause to search an area in which someone might have a legitimate expectation of privacy. The majority's error in declining to consider whether Doe's legitimate expectation of privacy was clearly established is underscored by this level of extreme generality at which the majority is forced to couch its inquiry.

As the Supreme Court's and this Circuit's precedents make clear, "[i]n analyzing the applicability of a qualified immunity defense, we must first identify the specific right that the plaintiff asserts was infringed by the challenged conduct at a high level of particularity." Edwards v. City of Goldsboro, 178 F.3d 231, 250-51 (4th Cir. 1999) (citing Anderson v. Creighton, 483 U.S. 635, 639 (1987)). The Eleventh Circuit has further explained this particularity principle in a manner that is especially prescient in light of the majority's approach in this case:

[C]courts must not permit plaintiffs to discharge their burden by referring to general rules and to the violation of abstract "rights".... The line is not to be found in abstractions - to act reasonably, to act with probable cause, and so forth -- but in studying how these abstractions have been applied in concrete circumstances.

Lassiter v. Alabama A&M Univ., Bd. of Trustees, 28 F.3d 1146, 1150 (11th Cir. 1994) (en banc) (internal quotation marks omitted) (emphasis added). In this case, however, the majority does nothing more in Part III of its opinion than state the unremarkable proposition that it was clearly established that police officers must act with probable cause in searching private areas.2

In contrast to the majority's approach, I maintain that the particular right that must be clearly established to defeat Broderick's qualified immunity defense is the same as the particular right at issue in considering whether Doe has alleged a Fourth Amendment violation at all. That is, in answering the two distinct questions that Wilson v. Layne, 526 U.S. 603, 609 (1999), instructs us to determine, the actual right at issue remains the same and the majority's characterization of the right in Part III should have traced the explanation of the right it provided in Part II.B.3 The question in Part III of the majority opinion should have been whether it was clearly established that a patient has the right to be free from a search of his records kept at a drug treatment center covered by § 290dd-2, in the absence of probable cause. Nevertheless, the majority insists that "Detective Broderick cannot cloak his clearly unconstitutional conduct with qualified immunity simply because a question may have existed as to whether Doe, in particular, had a legitimate expectation of privacy in his methadone treatment records."4 Ante at 455. Because Broderick's conduct would not have been unconstitutional had Doe failed to show that he had a legitimate expectation of privacy in his records, I simply cannot understand how Broderick's conduct could have been"clearly unconstitutional" without the supporting conclusion that Doe's legitimate expectation of privacy was itself "clear."

Notably, the majority cites no case in support of its novel approach, in which it disregards a crucial substantive aspect of Doe's Fourth Amendment rights5 while determining that those rights were clearly established. In contrast, at least one prior case from this Court directly supports (if not mandates) application of the fairly modest precept that if an individual's expectation of privacy in an area searched is not clearly established, then an officer is entitled to qualified immunity for his conduct. In Tarantino v. Baker, 825 F.2d 772 (4th Cir. 1987), we considered the question of whether a police officer was entitled to qualified immunity in a case in which the officer, without a search warrant, peered through cracks in the wall of a building to confirm an anonymous tip that the building's occupant, Tarantino, was growing marijuana plants. See id. at 773. In that case, a district court originally suppressed evidence stemming from this "search" and the Government did not challenge the suppression on appeal, opting instead to drop its case. See id. After the charges were dropped against Tarantino, however, he brought a § 1983 claim against the police officer, alleging that the officer had violated his Fourth Amendment rights. See id. at 773-74. We recognized that "[u]nless Tarantino had a `reasonable expectation of privacy' in the interior of his marijuana storage facility which was clear as a matter of law, [the searching officer] cannot be liable for damages for looking inside without a warrant." Id. at 775. We concluded that because Tarantino failed to demonstrate that he had a clearly established legitimate expectation of privacy in the invaded area, the officer did not "violate[ ] a `clearly established' constitutional standard" and was thus entitled to qualified immunity. See id. at 779. I see no principled manner in which to distinguish Tarantino from this case.6 In Tarantino, despite the officer's failure to obtain a warrant before looking inside the building, we rested our analysis on the fact that Tarantino's legitimate expectation of privacy in the area was not clearly established. Similarly, although Detective Broderick failed to obtain a warrant supported by probable cause in this case, I believe that we must consider whether Doe's legitimate expectation of privacy in the area searched was clearly established before we can determine that Broderick violated a clearly established constitutional standard.7

In my view, Doe did not have a clearly established legitimate expectation of privacy in his drug treatment center records. As the district court acknowledged, it was at the very least "arguably not clearly established under existing law at the time of Broderick's search" that his conduct violated Doe's Fourth Amendment rights.8 (J.A. at 539.) No court has ever held that a patient in Doe's position has a legitimate expectation of privacy in his drug treatment center records based upon § 290dd-2. Nor am I aware of any decision from the United States Supreme Court, this Court, a federal district court in Virginia, or the Supreme Court of Virginia that has held that patients in a more general sense have a legitimate expectation of privacy in their medical records. Cf. Edwards v. City of Goldsboro, 178 F.3d 231, 251 (4th Cir. 1999) ("In determining whether a right was clearly established at the time of the claimed violation, courts in this circuit [ordinarily] need not look beyond the decisions of the Supreme Court, this court of appeals, and the highest court of the state in which the case arose." (alteration in original) (internal quotation marks omitted)). Moreover, had Detective Broderick perused the case law from other states and federal courts of appeals he would have found some decisions strongly suggesting that patients in Doe's position would not have a protectible Fourth Amendment interest in their medical files. See, e.g., Young v. Murphy, 90 F.3d 1225, 1236 (7th Cir. 1996) (concluding that a nursing home patient failed to assert a violation of his clearly established Fourth Amendment rights based upon state examination of his records); United States v. Burzynski Cancer Research Inst., 819 F.2d 1301, 1311 (5th Cir. 1987) (determining that Texas's physician-patient privilege failed to provide patients with a legitimate expectation of privacy in the medical records maintained by their doctor sufficient to challenge the search and seizure of the records); State v. Guido, 698 A.2d 729, 733-34 (R.I. 1997) (holding that a patient had no legitimate expectation of privacy in his medical records kept at hospital). In light of the utter absence of case law suggesting that a patient at a drug treatment center covered by § 290dd2 has a legitimate expectation of privacy in his records, Doe's expectation was in no way clearly established.

When we review claims of qualified immunity, the Supreme Court has instructed us to first determine whether the plaintiff has alleged a deprivation of a constitutional right at all and then to determine whether that right was clearly established at the time of the conduct in question. See Wilson v. Layne, 526 U.S. 603, 609 (1999). Therefore, just as it is essential for Doe to demonstrate that he had a legitimate expectation of privacy in his drug treatment center records before we can conclude that he alleged a violation of his Fourth Amendment rights at all, so, too, is it necessary to show that such an expectation was clearly established at the time of Broderick's conduct before we can conclude that Broderick is not entitled to the defense of qualified immunity. Because Doe did not have a clearly established legitimate expectation of privacy in his drug treatment center records, I would hold that Detective Broderick is entitled to a defense of qualified immunity in this case. Accordingly, I respectfully dissent from Part III of the majority opinion denying Detective Broderick's qualified immunity defense.