Heidi Group v. TX Hlth Human Svc
138 F.4th 920 (2025)
Rule of Law:
A government official engages in a Fourth Amendment search when they encourage a private individual to act as their agent to obtain information without consent or legal process, even if the information is stored with a third-party provider, and such conduct is not protected by qualified immunity if it violates clearly established rights. State official immunity from unlawful computer access claims under Texas law is defeated if the official fails to act in good faith by surreptitiously obtaining records rather than requesting them or using legal process.
Facts:
- In 2016, the Texas Health and Human Services Commission (THHSC) contracted with The Heidi Group, Inc. (Heidi), a pro-life organization, to provide reproductive healthcare services to indigent women through two state programs.
- Heidi experienced difficulties with contract compliance due to THHSC's delays in signing one contract and lack of guidance, though THHSC renewed Heidi's contracts through August 2018 and again for another year in July 2018.
- After an audit revealed minor errors, some THHSC employees used the findings to undermine Heidi, and the Texas Observer published a 'hit piece' containing false information, leading THHSC to terminate Heidi's contracts for 'convenience' in September 2018.
- A disgruntled former Heidi employee, Phyllis Morgan, who had been terminated for poor performance, contacted THHSC and later OIG investigator Gaylon Dacus, informing him she still had unauthorized access to Heidi's Dropbox folder.
- Dacus encouraged Morgan to obtain confidential information from Heidi's Dropbox for the State, thanking her for information provided and later asking if she still had access and to send more, which she did, including patient records.
- Morgan accidentally altered files, alerting Heidi, which led to a police investigation revealing Morgan accessed the Dropbox 34 times after termination and admitted providing all documents to the State, with 'everybody at the State' knowing.
- Heidi's employment agreement barred Morgan's post-employment access to its Dropbox folder.
- Information obtained from Morgan made its way into a 2019 THHSC/OIG report, which initially concluded Heidi owed $1.56 million, though later investigative work reduced this to $136,755.42, and no recovery was ultimately sought.
Procedural Posture:
- The Heidi Group, Inc. filed suit in Texas state court against Texas Health and Human Services Commission (THHSC), Office of the Inspector General of THHSC (OIG), and several individuals in their official and individual capacities.
- Defendants timely removed the case to federal court, the United States District Court for the Western District of Texas.
- Defendants moved for judgment on the pleadings, asserting qualified immunity on Heidi’s individual capacity Fourth Amendment claim, arguing no constitutional violation on Heidi’s official capacity Fourth Amendment claim, asserting Texas official immunity on Heidi’s unlawful-access claim, and arguing Heidi’s religious-discrimination claim was not plausible.
- A magistrate judge recommended denying the motions as to these claims.
- The district court overruled the defendants’ objections to the report and recommendation and adopted it in full, allowing Heidi’s claims to proceed.
- Defendants appealed the district court's denial of their motions to the United States Court of Appeals for the Fifth Circuit.
Premium Content
Subscribe to Lexplug to view the complete brief
You're viewing a preview with Rule of Law, Facts, and Procedural Posture
Issue:
1. Does a state official violate the Fourth Amendment and lose qualified immunity by conspiring with a former employee to surreptitiously access a contractor's private cloud-stored documents without legal process? 2. Are state officials entitled to Texas official immunity for unlawful computer access under state law when they encourage a former employee to secretly retrieve a contractor's documents without consent or legal process?
Opinions:
Majority - Andrew S. Oldham
For Dirk Johnson and Jennifer Kaufman: No, they are entitled to qualified immunity from Heidi's Fourth Amendment claim because Heidi's allegations that they conspired with Morgan to unlawfully obtain documents were conclusory and did not plausibly allege they used Morgan as an agent. Overcoming qualified immunity requires establishing an officer violated a constitutional right, and Heidi provided insufficient factual content to infer an agency relationship with Johnson or Kaufman. For Gaylon Dacus: Yes, Dacus violated the Fourth Amendment and is not entitled to qualified immunity because he encouraged a private individual (Phyllis Morgan) to act as his agent to surreptitiously access Heidi's private cloud-stored documents without legal process, which constituted an unreasonable search of clearly established protected information. The Fourth Amendment proscribes governmental action, and an agency relationship exists when a government official uses a private individual as an agent. Both the Miller and Bazan tests support this conclusion, as Dacus significantly encouraged Morgan's unauthorized access and had specific knowledge of her intent to search by explicitly requesting and thanking her for information and prodding for more. Corporations and their records are protected by the Fourth Amendment, and a reasonable expectation of privacy exists for the content of information stored or transmitted by an intermediary (like Dropbox) that is not intended for public broadcast, distinguishing it from non-content information often covered by the third-party doctrine. Heidi's documents were analogous to sealed letters or private emails where content is protected. The contractual provisions allowing the State to 'permit' or 'provide' access did not grant a 'freewheeling right' for officials to surreptitiously access records without request or legal process, as this would be an arbitrary invasion of privacy. Dacus's conduct violated Heidi's clearly established Fourth Amendment rights, as he failed to secure a subpoena or seek precompliance review, which were clearly established requirements for administrative searches. For all individual capacity defendants (Johnson, Kaufman, Dacus) on the unlawful-access claim: No, they are not entitled to Texas official immunity for unlawful computer access under state law because they failed to act in good faith by using an ex-employee to surreptitiously retrieve Heidi’s documents without consent, rather than requesting them or using legal process. Texas official immunity requires an official to perform discretionary duties in good faith and within the scope of their authority. 'Good faith' means a reasonably prudent official could have believed their conduct was justified. The court found it implausible that a reasonable officer would believe they had 'effective consent' to secretly access Heidi’s Dropbox through a former employee, as the contract only implied formal requests for access. The choice to use underhanded methods was not a good-faith act.
Analysis:
This case clarifies the application of the Fourth Amendment's 'government agent' doctrine in the context of digital information stored in the cloud, particularly distinguishing content from non-content data under the third-party doctrine. It reinforces that a reasonable expectation of privacy exists for private electronic files not intended for public dissemination, even when stored with an intermediary. Furthermore, the decision underscores the limits of contractual provisions for government access, preventing their interpretation as a blanket waiver of constitutional rights or authorization for surreptitious, non-consensual access, and sets a precedent for what constitutes 'good faith' in state official immunity claims for computer access.
