HEIDI GROUP INCORPORATED v. TEXAS HEALTH AND HUMAN SERVICES COMMISSION OIG OIG OIG OIG (2025)

The Heidi Group, Inc., alleged that several Texas officials violated the Fourth Amendment and Texas law by conspiring with a private citizen to steal documents from a cloud-based file storage system. The officials moved for judgment on the pleadings and asserted various immunity defenses. The district court denied the motions in relevant part. We dismiss the appeal as to some claims, affirm as to most of the rest, and reverse only as to two defendants on one claim.

I

A

In 2016, the State of Texas—through the Texas Health and Human Services Commission (“THHSC”)—implemented two programs to provide reproductive healthcare services to indigent women across the State: Healthy Texas Women (“HTW”) and the Family Planning Program (“FPP”).¹ These programs were part of the State's effort to ensure that no money from the State fisc was used to fund abortion.

The Heidi Group, Inc. (“Heidi”), a prominent pro-life network of clinics and providers, quickly applied to become a contractor for both programs. It did so because its goal of “providing quality, life-affirming health care to Texas women ․ was natural and synergistic” with “those of the Legislature in creating the Programs as an alternative to abortion-supporting clinics.” ROA.27. Heidi had never operated as a state contractor, so it recognized it would face “inevitable challenges” in carrying out its responsibilities under the programs. ROA.27–28. But state officials assured Heidi that “assistance would be both abundant and encouraged,” so Heidi was “confident” in its ability to effectuate the programs' goals. ROA.28.

That confidence was short lived. In the summer of 2016, Heidi submitted proposals for both programs. THHSC approved the proposals and awarded Heidi contracts that were supposed to run from the date of signing through August 2017. But THHSC did not sign the FPP contract for almost six months, which “seriously hobbl[ed]” Heidi's ability to comply with both contracts' requirements. Ibid. Moreover, THHSC employees failed to answer Heidi's questions, and supplied “virtually no guidance” to Heidi about how the programs were supposed to operate. ROA.29.

Even so, the parties renewed the contracts through August 2018. During the course of the second contract year, THHSC deployed auditors from its Fiscal Monitoring Unit to review Heidi's activities. The audit revealed Heidi had made several minor errors in executing the contracts. THHSC and Heidi resolved the issues, and Heidi agreed to repay about $30,000.

Heidi's errors were so minor that in July 2018, THHSC renewed Heidi's contract for another year. But some THHSC employees were not satisfied; they used the audit findings to undermine Heidi's efforts and to suggest its contracts should be terminated. Then, in September, the Texas Observer ran a “hit piece” attacking Heidi for a variety of supposed short-comings, including failure to meet its target number of total patients. ROA.33–34. The article contained numerous falsehoods. For example, it said Heidi served only 3,300 patients in its first contract year. In reality, Heidi served more than three times that number. But that did not matter. Two weeks after the article was published, THHSC terminated Heidi's contracts for “convenience.” ROA.34.

At least some of the false information contained in the article was given to the Observer by THHSC employees. Heidi contends those employees leaked the information to provide public cover for the agency's decision to terminate the contracts, notwithstanding that THHSC's Associate Commissioner thought Heidi “was performing adequately.” ROA.35–36. That decision was the culmination of a “plot from within” THHSC and the Office of the Inspector General of THHSC (“OIG”) “to discriminate against Heidi for its pro-life religious beliefs” and to “destroy Heidi as a national force in the pro-life movement.” ROA.35.

The hit piece was just one element in THHSC's larger “plot” against Heidi and its leadership. Ibid. Those efforts “to compile alleged ‘dirt’ ” began when a disgruntled former Heidi employee named Phyllis Morgan contacted THHSC to inform officials that she could obtain information from Heidi's computers. ROA.35, 37. Heidi had neglected to remove Morgan's access to its Dropbox folder after terminating her. A THHSC employee referred Morgan to OIG “based on ‘the nature of [their] earlier telephone and email communications.’ ” ROA.39 (emphasis omitted). Morgan then contacted Gaylon Dacus, a senior OIG investigator, to inform him that she could provide access to Heidi's Dropbox folder.

Dacus encouraged Morgan to obtain confidential information from Heidi for the State. For example, on August 22, Morgan emailed Dacus to say: “You mentioned that if I were to get more information to send [it to] you so that the organization can appropriately evaluate the spending within the organization and the misuse of taxpayer dollars.” ROA.40. Dacus responded: “Thank you for the additional information. Much appreciated.” Ibid. Then, on December 4, Dacus emailed Morgan to ask whether “someone at Heidi accidentally link[ed] your account to theirs” and to confirm that she “still” had “access to all [Heidi's] information.” Ibid. Morgan responded by assuring Dacus she still had access and attached thumbnails of items in the Drop-box folder, including Heidi's budget and various worksheets, to prove it. Morgan also “emphasized that she even had access to patient records.” ROA.41.

Eventually, Morgan blew her own cover: She accidentally altered files, alerting Heidi's administrator to her unauthorized Dropbox access. Heidi notified the Round Rock Police Department, which investigated. The investigation revealed that over the course of roughly eleven months, Morgan had accessed the Dropbox folder on 34 occasions after Heidi terminated her employment. Morgan initially denied sharing documents with the State, but she changed her tune when a detective confronted her with evidence suggesting otherwise. At that point, Morgan admitted that she provided all the documents she obtained to the State, and that “everybody at the State” knew she was accessing Heidi's Dropbox. ROA.38. She did all this even though Heidi's employment agreement barred post-employment access of its Dropbox folder. The breach was so severe that Morgan was arrested, booked, and released on bail for the crime of Computer Security Breach, though the county attorney ultimately decided not to pursue prosecution.

Some of the information OIG obtained from Morgan made its way into a 2019 report issued by THHSC and OIG. That report recounted the errors uncovered by auditors in 2018 and added that Heidi had made four purportedly questionable payments for professional services. It concluded that Heidi owed the State $1.56 million. But after additional investigative work—including interviews with Heidi's leader and other employees—OIG concluded that Heidi billed for just $136,755.42 of unallowable or inadequately supported costs and decided not to seek any recovery.

B

1

Heidi filed suit in Texas state court. It asserted a variety of claims against a variety of parties, but only four of those claims are relevant here.

First, Heidi brought a claim for money damages under 42 U.S.C. § 1983 against Dirk Johnson, Jennifer Kaufman, and Gaylon Dacus in their individual capacities (“the individual capacity defendants”).² It alleged these defendants violated Heidi's Fourth Amendment rights by conspiring with a private citizen to unlawfully obtain documents from a secure Dropbox folder.

Second, Heidi brought a claim for declaratory and prospective injunctive relief under 42 U.S.C. § 1983 against Dirk Johnson, Jennifer Kaufman, Gaylon Dacus, Sylvia Kauffman, and Cecile Erwin Young in their official capacities (“the official capacity defendants”).³ The factual allegations underlying this claim are essentially the same as those underlying Heidi's § 1983 claim against the individual capacity defendants.⁴

Third, Heidi brought a claim for money damages against the individual capacity defendants under a Texas statute that prohibits “knowingly access[ing] a computer, computer network, or computer system without the effective consent of the owner.” Tex. Penal Code § 33.02(a); see also Tex. Civ. Prac. & Rem. Code § 143.001(a) (creating a private cause of action). It alleged the individual capacity defendants violated § 33.02(a) for substantially the same reasons they violated the Fourth Amendment. We call this Heidi's unlawful-access claim.

Fourth, Heidi brought a claim for equitable relief against the official capacity defendants, THHSC, and OIG under a Texas law that bans religious discrimination in the dispensing of public benefits. See Tex. Civ. Prac. & Rem. Code § 106.001(a); id. § 106.002(a) (authorizing “preventive relief”). Heidi alleged these defendants violated § 106.001(a) by terminating its HTW and FPP contracts and refusing to allow it to participate in those programs “due to its pro-life religious beliefs.” ROA.63. We call this Heidi's religious-discrimination claim.

2

The defendants timely removed to federal court. Removal was proper. See 28 U.S.C. § 1441(a) (providing that removal is proper if the case falls within the jurisdiction of the federal district courts). The district court had jurisdiction over Heidi's Fourth Amendment claims under 28 U.S.C. § 1331, and it had supplemental jurisdiction over Heidi's state law claims under 28 U.S.C. § 1367.

The defendants moved for judgment on the pleadings on each of Heidi's claims. They asserted the following defenses:

• The individual capacity defendants asserted Heidi's individual capacity Fourth Amendment claim was barred by qualified immunity.

• The official capacity defendants asserted that Heidi was not entitled to relief on its official capacity Fourth Amendment claim because Heidi failed to allege a constitutional violation.

• The individual capacity defendants asserted that Heidi's unlawful-access claim was barred by Texas official immunity.

• The official capacity defendants, THHSC, and OIG asserted that Heidi's religious-discrimination claim failed because it was not plausible on its face.

A magistrate judge recommended that the motions should be denied as to these claims. The district court overruled the defendants' objections to the report and recommendation and adopted it in full, thus allowing Heidi's claims to proceed. The defendants timely appealed.

II

“Jurisdiction is always first.” Carswell v. Camp, 54 F.4th 307, 310 (5th Cir. 2022) (quotation omitted). There are four distinct groups of orders at issue in this appeal: (1) the district court's orders denying the individual capacity defendants' assertions of qualified immunity on Heidi's Fourth Amendment claim; (2) the district court's orders denying judgment on the pleadings on Heidi's official capacity Fourth Amendment claim; (3) the district court's orders denying the individual capacity defendants' assertions of state law immunity on Heidi's unlawful-access claim; and (4) the district court's orders denying judgment on the pleadings on Heidi's state law religious-discrimination claim.

None of these orders is final. See Vantage Health Plan, Inc. v. Willis-Knighton Med. Ctr., 913 F.3d 443, 448 (5th Cir. 2019) (“A final decision is one that ends the litigation on the merits and leaves nothing more for the court to do but execute the judgment.” (quotation omitted)). So we have jurisdiction to review each order only if it is collateral or pendent to some collateral order. See Carswell, 54 F.4th at 310 (collateral orders); Escobar v. Montee, 895 F.3d 387, 391 (5th Cir. 2018) (pendent orders).

Applying that rule, we (A) establish our jurisdiction over the individual capacity defendants' appeals. Then we (B) hold that we lack jurisdiction over the religious-discrimination claim and decline to exercise pendent appellate jurisdiction over the official capacity Fourth Amendment claim.

A

We have appellate jurisdiction over Heidi's Fourth Amendment claim against the individual capacity defendants. Orders denying qualified immunity are classic collateral orders. Carswell, 54 F.4th at 310.

Fifth Circuit precedent also requires our jurisdiction over the unlawful-access claim. “Orders premised on the denial of official immunity under Texas state law are appealable in federal court to the same extent as district court orders premised on the denial of federal law immunity.” Ramirez v. Martinez, 716 F.3d 369, 373 (5th Cir. 2013) (brackets omitted).⁵

B

Next, the official capacity defendants, THHSC, and OIG. Heidi brought two kinds of claims against those defendants: a Fourth Amendment claim (against the official capacity defendants) and a religious-discrimination claim (against the official capacity defendants, THHSC, and OIG). Each defendant moved to dismiss each claim, and the district court denied the motions as to these claims. Those orders are not collateral and so are not, standing alone, immediately appealable.

The defendants nonetheless contend we have pendent appellate jurisdiction over their appeals. We disagree. We (1) lack pendent appellate jurisdiction over Heidi's religious-discrimination claim. And as to Heidi's official capacity Fourth Amendment claim, we (2) decline to exercise pendent appellate jurisdiction even if we have it.

1

Pendent appellate jurisdiction is “disfavor[ed],” Johnson v. Bowe, 856 F. App'x 487, 491 (5th Cir. 2021) (quotation omitted), and exists only in “rare and unique circumstances,” Escobar, 895 F.3d at 392 (quotation omitted). Pendent appellate jurisdiction exists over an order only if: (1) that decision is “inextricably intertwined” with a decision over which we have jurisdiction, or (2) review of that decision is “necessary to ensure meaningful review of” a decision over which we have jurisdiction. Id. at 391 (quoting Swint v. Chambers Cnty. Comm'n, 514 U.S. 35, 51, 115 S.Ct. 1203, 131 L.Ed.2d 60 (1995)).

We have found that an order is “inextricably intertwined” with or “necessary to ensure meaningful review” of an order within our appellate jurisdiction in only four situations: when (1) our decision on the proper interlocutory appeal will “necessarily dispose[ ] of the pendent claim”; (2) deciding the pendent claim will “further the purpose of officer-immunities by helping the officer avoid trial”; (3) the pendent claim will be “otherwise unreviewable”; or (4) each claim involves “precisely the same facts and elements.” Id. at 392–93.

We are especially reticent to find pendent appellate jurisdiction where, as here, the underlying order is a collateral one. See Pickett v. Tex. Tech Univ. Health Scis. Ctr., 37 F.4th 1013, 1027 (5th Cir. 2022). And the Supreme Court has suggested that collateral orders might never give rise to pendent appellate jurisdiction. See Microsoft Corp. v. Baker, 582 U.S. 23, 39, 137 S.Ct. 1702, 198 L.Ed.2d 132 (2017) (“[P]endent appellate jurisdiction in [the] collateral-order context would undermine § 1292(b).” (citing Swint, 514 U.S. at 46, 115 S.Ct. 1203)).⁶

The defendants have satisfied none of the recognized doctrinal bases for pendent appellate jurisdiction over Heidi's religious-discrimination claim.

First, a decision on Heidi's unlawful-access claim or the individual capacity Fourth Amendment claim (the claims over which we have jurisdiction) will not “dispose[ ] of” Heidi's religious-discrimination claim (the pendent claim). Heidi's religious-discrimination claim requires it to prove the defendants intentionally discriminated against it on the basis of religion. See Tex. Civ. Prac. & Rem. Code § 106.001. Neither of the other two claims includes a similar requirement. So any decision on those claims will have no effect on Heidi's religious-discrimination claim.

Second, exercising jurisdiction over Heidi's religious-discrimination claim will not “further the purpose of” any “officer-immunities.” Heidi brought its religious-discrimination claim against THHSC, OIG, and the officers in their official capacities. This claim is thus against the State itself, see Kentucky v. Graham, 473 U.S. 159, 166, 105 S.Ct. 3099, 87 L.Ed.2d 114 (1985), so the officers are not entitled to any officer immunities, see Zarnow v. City of Wichita Falls, 500 F.3d 401, 406 (5th Cir. 2007).

Third, the defendants' defense to Heidi's religious-discrimination claim will not be “otherwise unreviewable.” That claim “will inexorably terminate in a final judgment,” which may then be appealed. Pickett, 37 F.4th at 1028. “Nothing but time would be lost by waiting.” Ibid.

Fourth, as already noted, Heidi's religious-discrimination claim does not involve “precisely the same facts and elements” as her Fourth Amendment and unlawful-access claims. Although some of the overarching facts “do overlap,” each claim “has unique elements and relevant facts.” Gros v. City of Grand Prairie, 209 F.3d 431, 437 (5th Cir. 2000). The central facts relevant to Heidi's religious-discrimination claim concern whether the State's termination of its contract with Heidi was motivated by religious animus. But the key facts in analyzing both the Fourth Amendment claim and the unlawful-access claims revolve around the State's surreptitiously accessing Heidi's Dropbox. Although the background facts are the same, the essential facts—and the required elements—for the religious-discrimination claim differ from those of the other two claims.

So we do not have pendent appellate jurisdiction over Heidi's religious-discrimination claim.

2

As to Heidi's Fourth Amendment claim against the defendants in their official capacities, we decline to exercise discretionary pendent appellate jurisdiction over them, assuming we even have it.

Whether to “exercise” pendent appellate jurisdiction is “a matter of discretion.” Mi Familia Vota v. Ogg, 105 F.4th 313, 333 (5th Cir. 2024). We must “exercise” our ability to hear such claims “with caution.” Morin v. Caire, 77 F.3d 116, 119 (5th Cir. 1996). Indeed, our discretion “should be used sparingly.” 16 CHARLES ALAN WRIGHT & ARTHUR R. MILLER, FEDERAL PRACTICE & PROCEDURE § 3937 (3d ed.). All the more so in the collateral-order context. See Baker, 582 U.S. at 39, 137 S.Ct. 1702.

Heidi requests four different forms of relief in its official capacity claim: (1) a “declaration” that the defendants “violated” Heidi's Fourth Amendment rights; (2) “equitable relief enjoining further violations thereof”; (3) a “prospective mandatory injunction or other equitable order restoring [Heidi] to its pre-contract termination position as an active member of the Programs”; and (4) an “order compelling [the defendants] to issue a statement retracting their public criticism of [Heidi].” ROA.51.

These remedies raise several issues not implicated by Heidi's individual capacity claim. Consider two. First, Heidi's official capacity claim seeks prospective relief, but it does not appear that there are any ongoing or threatened future harms. Second, it is not obvious that the final form of requested relief remedies any harm.

We take no position on these questions at this juncture. We merely raise them to show some of the distinct questions the official capacity claim implicates. The district court has not yet addressed these questions, so we decline to exercise pendent appellate jurisdiction to answer them at this time. See Ficher v. Bickham, 70 F.4th 257, 260 (5th Cir. 2023) (“[W]e are a court of review, not first view.”).⁷

*

We do not have pendent appellate jurisdiction over Heidi's religious-discrimination claim. And we decline to exercise whatever pendent appellate jurisdiction we might have over Heidi's official capacity Fourth Amendment claim. But since our jurisdiction does extend to Heidi's individual capacity Fourth Amendment and unlawful-access claims, we now proceed to the merits of those claims.

III

We begin with Heidi's individual capacity Fourth Amendment claim. We (A) hold that only Gaylon Dacus engaged in state action. Then we (B) hold that Dacus is not entitled to qualified immunity. Finally, we (C) dispatch Dacus's counterarguments.

A

The Fourth Amendment “proscrib[es] only governmental action.” United States v. Jacobsen, 466 U.S. 109, 113, 104 S.Ct. 1652, 80 L.Ed.2d 85 (1984). So a “wrongful search or seizure by a private party” cannot violate a person's Fourth Amendment rights. United States v. Cordova-Espinoza, 49 F.4th 964, 968 (5th Cir. 2022) (per curiam). “But, of course, the Government cannot use private individuals as agents to circumvent Fourth Amendment protections.” Ibid. If a government official uses a private individual as an agent in conducting a search, both the agent and the government official have engaged in state action constituting a search. See Watts v. Northside Indep. Sch. Dist., 37 F.4th 1094, 1096–97 (5th Cir. 2022).

Our circuit has not yet determined the proper test to analyze whether a private person acts as an agent of the government for purposes of the Fourth Amendment. Two distinct tests have emerged—the Miller test and the Bazan test. Cordova-Espinoza, 49 F.4th at 968–69. The tests overlap considerably, and under either one, (1) neither Dirk Johnson nor Jennifer Kaufman used Morgan as an agent. But (2) Heidi sufficiently alleged that Gaylon Dacus used Phyllis Morgan as an agent to search Heidi's files and records.

1

First, Johnson and Kaufman. Heidi's conclusory allegations that there was a conspiracy between Morgan and others at THHSC and OIG “do not permit the court to infer more than the mere possibility” that Johnson and Kaufman used Morgan as an agent to search Heidi. See Iqbal, 556 U.S. at 679, 129 S.Ct. 1937. Nor do Heidi's allegations that Johnson and Kaufman were biased against Heidi. So Johnson and Kaufman are entitled to qualified immunity from Heidi's Fourth Amendment claim. See Morrow v. Meachum, 917 F.3d 870, 874 (5th Cir. 2019) (explaining that overcoming qualified immunity requires establishing that “the officer violated a constitutional right”).

2

Dacus, on the other hand, used Morgan as an agent to search Heidi's files and records. Both (a) the Miller test and (b) the Bazan test support that conclusion.

a

The Miller test asks whether Dacus “knew [of] or acquiesced in the intrusive conduct” and whether Morgan “intended to assist law enforcement efforts or to further [her] own ends.” United States v. Blocker, 104 F.3d 720, 725 (5th Cir. 1997) (citing United States v. Miller, 688 F.2d 652, 657 (9th Cir. 1982)).

It is indisputable on this record that Dacus, at the very least, significantly encouraged Morgan's search. “[K]nowledge or acquiescence arises when the Government is either a direct participant or indirect encourager.” Cordova-Espinoza, 49 F.4th at 969. Morgan informed Dacus that she had access to Heidi's Dropbox account, despite having been terminated. Dacus, in response, specifically requested that Morgan “send” him any new “information” about Heidi. ROA.40. What's more, Dacus thanked Morgan for sending Heidi's information and then later prodded Morgan to send more information. This conduct constitutes encouragement.

Morgan's motives were mixed. Morgan quickly “became extremely hostile and threatening” toward Heidi after it terminated her for poor work performance. ROA.37. But she also expressed an intent to help the officers “appropriately evaluate the spending within the organization and the misuse of taxpayer dollars.” ROA.40. In any event, the first Miller factor weighs heavily in favor of finding an agency relationship, so we conclude Morgan acted as Dacus's agent.

b

We reach the same conclusion under the Bazan test. This test considers three factors: whether the government (1) offered any “form of compensation to an informant”; (2) “initiate[d] the idea that the informant would conduct a search”; and (3) possessed “specific knowledge that the informant intended a search.” Cordova-Espinoza, 49 F.4th at 969 (citing United States v. Bazan, 807 F.2d 1200, 1204 (5th Cir. 1986)). “[O]ur discussion of the Miller factors unsurprisingly weighs heavily in our Bazan analysis.” Id. at 971.

First, there are no allegations that Dacus offered Morgan any compensation. That, of course, is not dispositive.

Second, who initiated the search? Although Morgan accessed the Dropbox before reaching out to Dacus, Dacus specifically requested that Morgan “send” him any new “information” about Heidi. ROA.40. Morgan obliged. Then later, Dacus again suggested that Morgan should access the Dropbox and share its contents with him. ROA.40. And again, Morgan obliged. So this factor weighs in favor of agency—at least for every search occurring after Morgan's first post-employment access.

Third, Dacus had “specific knowledge that [Morgan] intended a search.” Cordova-Espinoza, 49 F.4th at 969. As explained above, Dacus knew that Morgan had already accessed Heidi's Dropbox post-termination. Then Dacus at least twice requested Morgan to access it again and share private information with him, which Morgan happily did. Dacus clearly knew about Morgan's searches and played an integral part in them.

Considering each factor, we conclude that under the Bazan test, like the Miller test, Morgan was acting as Dacus's agent. See 1 Wayne R. LaFave, Search & Seizure: A Treatise on the Fourth Amendment § 1.8(b) (6th ed.) (“Quite clearly, a search is not private in nature if it has been ordered or requested by a government official.”).

B

Dacus is not entitled to qualified immunity.

The Fourth Amendment protects the “right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.” U.S. Const. amend. IV. These protections extend to corporations and their books and records. Okla. Press Publ'g Co. v. Walling, 327 U.S. 186, 205–06 (1946) (citing Silverthorne Lumber Co. v. United States, 251 U.S. 385, 40 S.Ct. 182, 64 L.Ed. 319 (1920)). Searches of corporate books and records generally constitute administrative searches because they ordinarily “serve a ‘special need’ other than conducting criminal investigations,” such as “ensur[ing] compliance with” recordkeeping, reporting, or contractual requirements. City of Los Angeles v. Patel, 576 U.S. 409, 420, 135 S.Ct. 2443, 192 L.Ed.2d 435 (2015).

It is clearly established that “for an administrative search to be constitutional, the subject of the search must be afforded an opportunity to obtain precompliance review before a neutral decisionmaker.” Ibid. (citations omitted). This means that the government must usually obtain a subpoena before accessing a corporation's books and records. See id. at 421, 135 S.Ct. 2443; Donovan v. Lone Steer, Inc., 464 U.S. 408, 415, 104 S.Ct. 769, 78 L.Ed.2d 567 (1984). But simply obtaining a subpoena is not enough. The government must enforce the subpoena in a manner that permits the private party to object before turning over its books and records. E.g., Cotropia v. Chapman, 978 F.3d 282, 287 (5th Cir. 2020); Zadeh v. Robinson, 928 F.3d 457, 464 (5th Cir. 2019).

Dacus complied with none of these requirements. Dacus did not attempt to secure an administrative subpoena to access Heidi's documents, even though it would have been easy to do so. See Patel, 576 U.S. at 421–23, 135 S.Ct. 2443. Instead, he used a disgruntled former employee to surreptitiously access Heidi's books and records. In short, Heidi did not have “any opportunity whatsoever” to obtain precompliance review before a neutral arbiter. Id. at 420–21, 135 S.Ct. 2443. And to top it off, Dacus's eleven-month-long secret investigation into Heidi does not resemble the areas in which qualified immunity is most justifiable. See Hughes v. Garcia, 100 F.4th 611, 620 n.1 (5th Cir. 2024) (explaining that the core areas of qualified immunity “involve excessive force, or split-second decisions, or the chaos of a chase”). Dacus's conduct is precisely the type of “arbitrary invasion[ ]” of privacy the Fourth Amendment was meant to protect against. Carpenter v. United States, 585 U.S. 296, 303, 138 S.Ct. 2206, 201 L.Ed.2d 507 (2018) (quoting Camara v. Mun. Ct. of the City & Cnty. of S.F., 387 U.S. 523, 528, 87 S.Ct. 1727, 18 L.Ed.2d 930 (1967)).

Dacus violated Heidi's clearly established Fourth Amendment rights. He is not entitled to qualified immunity.

C

Dacus offers two counterarguments. The upshot of both is that Heidi had no reasonable expectation of privacy in its own documents and records, so no search was conducted. We disagree.

1

Dacus first argues that Heidi had no reasonable expectation of privacy in its documents under the third-party doctrine because they were uploaded to Dropbox. We disagree.

A Fourth Amendment search occurs when the government intrudes on a person's reasonable expectation of privacy. Carpenter, 585 U.S. at 304, 138 S.Ct. 2206. But the third-party doctrine teaches that generally “a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.” Id. at 308, 138 S.Ct. 2206 (quoting Smith v. Maryland, 442 U.S. 735, 743–44, 99 S.Ct. 2577, 61 L.Ed.2d 220 (1979)). Start with Ex parte Jackson, 96 U.S. 727, 24 L.Ed. 877 (1878), perhaps the first Fourth Amendment case. See Orin S. Kerr, Applying the Fourth Amendment to the Internet: A General Approach, 62 Stan. L. Rev. 1005, 1022 (2010). There, the Court held that the “outward form and weight” of “[l]etters and sealed packages ․ in the mail” were not protected by the Fourth Amendment. Ex parte Jackson, 96 U.S. at 733. About a century later, the Court similarly held that there was no reasonable expectation of privacy “regarding the numbers ․ dialed” on a phone. Smith, 442 U.S. at 742, 99 S.Ct. 2577.

But the third-party doctrine generally does not reach the content of information that is merely stored or transmitted by an intermediary without being exposed to the general public. See Kerr, supra, at 1038. Thus, while the “outward form and weight” of sealed letters and packages are not protected by the Fourth Amendment, their content is protected just “as if they were retained by the parties forwarding them in their own domiciles.” Ex parte Jackson, 96 U.S. at 733; accord Jacobsen, 466 U.S. at 114, 104 S.Ct. 1652. Likewise, there is no reasonable expectation of privacy “regarding the numbers ․ dialed” on a phone, Smith, 442 U.S. at 742, 99 S.Ct. 2577, but there is a reasonable expectation of privacy in “the words [one] utters into the mouthpiece” of that phone, Katz v. United States, 389 U.S. 347, 352, 88 S.Ct. 507, 19 L.Ed.2d 576 (1967); see also Smith, 442 U.S. at 741, 99 S.Ct. 2577 (“[A] pen register differs significantly from the listening device employed in Katz, for pen registers do not acquire the contents of communications.” (emphasis in original)). In both cases, the content of communications not intended to “be broadcast to the world” was entitled to Fourth Amendment protection. See Katz, 389 U.S. at 352, 88 S.Ct. 507.

Cases applying the Fourth Amendment to new technologies have drawn the same distinction. As our court has already explained, “[c]ommunications content, such as the contents of letters, phone calls, and emails, which are not directed to a business, but simply sent via that business, are generally protected” by the Fourth Amendment. In re Application of the U.S. for Hist. Cell Site Data, 724 F.3d 600, 611 (5th Cir. 2013).⁸ Similarly, “the to/from addresses of e-mail messages, the IP addresses of websites visited and the total amount of data transmitted to or from an account” receive no Fourth Amendment protection, but the information embodied in an email—that is, the content of an email—is protected. United States v. Forrester, 512 F.3d 500, 510–11 (9th Cir. 2008); see also Johnson v. Duxbury, 931 F.3d 102, 108 n.5 (1st Cir. 2019) (content of emails protected); United States v. Maher, 120 F.4th 297, 307 (2d Cir. 2024) (same); United States v. Warshak, 631 F.3d 266, 288 (6th Cir. 2010) (same). Some courts have also applied this content-focused principle to hold that “Facebook and other social media users have a reasonable expectation of privacy in content that they exclude from public access, such as private messages.” United States v. Zelaya-Veliz, 94 F.4th 321, 333–34 (4th Cir. 2024); accord United States v. Bledsoe, 630 F. Supp. 3d 1, 18 (D.D.C. 2022). And other courts have extended this reasoning to cover content stored electronically, where that information is not publicly accessible. See, e.g., Vista Mktg., LLC v. Burkett, 812 F.3d 954, 969 (11th Cir. 2016) (holding that the Fourth Amendment protects “the content of stored electronic communications”).

Applying these principles here, Heidi has a reasonable expectation of privacy in its documents and files uploaded to Dropbox. Heidi's records are analogous to letters, phone calls, emails, and social media messages: Each contains information content transmitted through or stored with an intermediary that is not intended to “be broadcast to the world.” See Katz, 389 U.S. at 352, 88 S.Ct. 507. As such, Heidi's records are protected by the Fourth Amendment. Perhaps the government might not have conducted a search had it simply requested that Dropbox provide it with information such as whether Heidi had an account or when Heidi had used its account. But the government cannot access the content of Heidi's documents and files without implicating the Fourth Amendment.

And even assuming United States v. Miller, 425 U.S. 435, 96 S.Ct. 1619, 48 L.Ed.2d 71 (1976), extends the third-party doctrine to the content of some information shared with an intermediary, that case is not to the contrary. There, the government subpoenaed the defendant's banks, requesting checks, deposit slips, and financial statements. See id. at 437–38, 96 S.Ct. 1619. The Supreme Court held that the defendant did not have a reasonable expectation of privacy in those items and records. Id. at 442, 96 S.Ct. 1619. The situation here is far afield. Contrary to the defendant in Miller, Heidi can assert “ownership” and “possession” in its documents on Dropbox because they are Heidi's business records, not Dropbox's. See id. at 440, 96 S.Ct. 1619. In addition, the content of Heidi's files on Dropbox is not “exposed” to Dropbox's “employees in the ordinary course of business.” See id. at 442, 96 S.Ct. 1619. Moreover, Heidi's documents are much more like “confidential communications” than like the “negotiable instruments to be used in commercial transactions” in Miller. See ibid. And finally, the government can gather a vast and diverse amount of sensitive information through documents and files uploaded on Dropbox. See Carpenter, 585 U.S. at 310–11, 138 S.Ct. 2206 (distinguishing Miller in part based on the amount and type of information collected).

Dacus searched Heidi's documents on Dropbox. The third-party doctrine does not dictate otherwise.⁹

2

Dacus next argues that Heidi had no reasonable expectation of privacy in its documents and files because Heidi's contract with Texas gave the State the right to access Heidi's information. We disagree.

In effect, Dacus argues that Heidi's contract with the State provided consent for the State to access Heidi's records in any way and at any time, so Heidi no longer had a reasonable expectation of privacy in its records. To support his argument, Dacus points to two contractual provisions. They provide: (1) Heidi “will permit ․ unrestricted access to and the right to examine any site where business is conducted or Services are performed, and all records,” ROA.157, and (2) Heidi “will provide access to records, books, and documents in reasonable comfort and will provide any furnishings, equipment, or other conveniences necessary to enable complete and unfettered access to records, books, and documents to [T]HHSC,” ROA.176.

But it is implausible to read these provisions to grant a freewheeling right to every Texas official to access all of Heidi's records at any time, in any place, and in any way. The contract states that Heidi “will permit” access and “will provide access” to government officials. This implies that Heidi will, in the future, do so when the government requests or demands it. The contract nowhere states that the government will inspect or access Heidi's records unannounced, at will, and in any way the government chooses. It would be absurd to say that this contract gave Texas officials the right to break into Heidi's office at night and physically remove Heidi's records. Likewise, it would be absurd to conclude that Texas officials had an unlimited right to surreptitiously break into Heidi's online folders. Cf. Florida v. Jardines, 569 U.S. 1, 8–9, 133 S.Ct. 1409, 185 L.Ed.2d 495 (2013) (concluding that a search was conducted because there are limits, implied by custom, in the scope of the license to approach someone's home).

*

Heidi plausibly alleged that Dacus violated Heidi's clearly established Fourth Amendment rights. Dacus could have requested Heidi turn over information for investigatory purposes. Or he could have easily procured a subpoena. Instead, Dacus chose to use a disgruntled ex-employee to spy on Heidi. The Fourth Amendment does not countenance such conduct.

IV

Finally, we turn to Heidi's unlawful-access claim against the individual capacity defendants—Dirk Johnson, Jennifer Kaufman, and Gaylon Dacus. Texas law prohibits “knowingly access[ing] a computer, computer network, or computer system without the effective consent of the owner.” Tex. Penal Code § 33.02(a); see Tex. Civ. Prac. & Rem. Code § 143.001(a) (creating a private right of action). On appeal, the only issue is whether the individual capacity defendants are entitled to immunity under state law from this claim. They are not.

Under Texas law, a government employee asserting an official immunity defense bears the burden of showing that he (1) performed “discretionary duties” (2) in “good faith” (3) while “acting within the scope of [his] authority.” City of Lancaster v. Chambers, 883 S.W.2d 650, 653 (Tex. 1994). We focus only on the good-faith requirement. An official acts in good faith if “a reasonably prudent official, under the same or similar circumstances, could have believed that his conduct was justified based on the information he possessed when the conduct occurred.” Ballantyne v. Champion Builders, Inc., 144 S.W.3d 417, 426 (Tex. 2004).

Heidi plausibly alleged that the individual capacity defendants did not act in good faith. The defendants' sole argument is that a reasonable officer could have believed he accessed these records with Heidi's effective consent because of the State's contract with Heidi. But as explained above, Heidi obviously did not consent to allowing either Morgan or state officials to secretly access its Dropbox folder. Under the contract, officials could have requested that Heidi send its documents to the State. Or they could have obtained a subpoena ordering Heidi to do so. But instead, the individual capacity defendants chose to use an ex-employee to surreptitiously retrieve Heidi's documents. This was not a good-faith act. The individual capacity defendants are not entitled to immunity.

* * *

We DISMISS for lack of jurisdiction OIG, THHSC, and the official capacity defendants' appeal of the denial of their motion for judgment on the pleadings as to Heidi's religious-discrimination claim. In addition, we DISMISS the official capacity defendants' appeal as to Heidi's Fourth Amendment claim and as to Heidi's claim under Tex. Const. art. I, § 9.

We REVERSE the district court's denial of Johnson and Kaufman's motion for judgment on the pleadings as to Heidi's individual capacity Fourth Amendment claim, and we REMAND for further proceedings consistent with this opinion. But we AFFIRM the district court's denial of Dacus's motion for judgment on the pleadings as to that claim.

Finally, we AFFIRM the denial of the individual capacity defendants' motion for judgment on the pleadings as to Heidi's unlawful-access claim.

FOOTNOTES

FOOTNOTE.  

1.   This appeal arises from a motion for judgment on the pleadings. So we take the following well-pleaded facts as true. See Gentilello v. Rege, 627 F.3d 540, 543–44 (5th Cir. 2010) (applying “the same standard as a motion to dismiss under Rule 12(b)(6)”); Ashcroft v. Iqbal, 556 U.S. 662, 677–78, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009).

2.   At the time Heidi filed its complaint, Dacus was a Senior Investigator for OIG, Johnson was Chief Counsel for OIG, and Kaufman was Director of Internal Affairs (and former Senior Counsel) for OIG.

3.   At the time Heidi filed its complaint, Sylvia Kauffman was the Inspector General for OIG and Young was the Commissioner of THHSC.

4.   Heidi also brought a claim for prospective relief against the official capacity defendants under the Texas counterpart to the Fourth Amendment. See TEX. CONST. art. I, § 9.

5.   It is not obvious why. The collateral-order doctrine is an atextual exception to the longstanding final-judgment rule embodied in 28 U.S.C. § 1291. See Midland Asphalt Corp. v. United States, 489 U.S. 794, 798, 109 S.Ct. 1494, 103 L.Ed.2d 879 (1989). Thus, the Supreme Court has consistently warned that “the class of collaterally appealable orders must remain narrow and selective.” Mohawk Indus., Inc. v. Carpenter, 558 U.S. 100, 113, 130 S.Ct. 599, 175 L.Ed.2d 458 (2009) (quotation omitted). Our precedent sits in tension with this warning. Moreover, there seems to be little doctrinal basis for our court's precedent. The Supreme Court has held that collateral orders are immediately appealable only if the issues are “too important to be denied review.” Mitchell v. Forsyth, 472 U.S. 511, 524, 105 S.Ct. 2806, 86 L.Ed.2d 411 (1985). The denial of a federal “immunity from suit,” such as qualified or absolute immunity, is a classic example of such an issue. See id. at 525–26, 105 S.Ct. 2806. That makes sense. These immunities are federal defenses, so there is a federal interest in federal courts ensuring they are not undermined. Cf. Trump v. United States, 603 U.S. 593, 635–37, 144 S.Ct. 2312, 219 L.Ed.2d 991 (2024) (holding that the President may immediately appeal the denial of a defense of absolute immunity from criminal prosecution because of the important federal interests at stake). But there is no apparent federal interest—at least not one making the issues “too important to be denied review”—involved in the denial of state-law immunities. Post-Erie, federal courts merely guess how the highest court of the relevant State would answer substantive state-law questions. And the Court has stated that an immunity from suit falls within the collateral-order doctrine only if it derives from a federal “statutory or constitutional guarantee.” Midland Asphalt, 489 U.S. at 801, 109 S.Ct. 1494. State immunities obviously do not derive from either. Thus, it is puzzling why federal courts should bend federal jurisdictional rules to vindicate state immunities—especially when States might not even permit such interlocutory appeals. See Johnson v. Fankell, 520 U.S. 911, 917–18, 117 S.Ct. 1800, 138 L.Ed.2d 108 (1997).

6.   Neither 28 U.S.C. § 1291 nor § 1292 provides a plausible textual hook for the doctrine of pendent appellate jurisdiction. See Pickett, 37 F.4th at 1027; Swint, 514 U.S. at 45, 115 S.Ct. 1203 (reasoning that pendent appellate jurisdiction “drift[s] away from the statutory instructions Congress has given to control the timing of appellate proceedings”). This judge-made doctrine thus expands our jurisdiction on “dubious” grounds. See Gates v. Cook, 234 F.3d 221, 232 (5th Cir. 2000) (Jones, J., dissenting). As such, it is in tension with two fundamental premises: The text is the alpha and omega of interpretation, Matter of DeBerry, 945 F.3d 943, 947 (5th Cir. 2019), and federal courts “are courts of limited jurisdiction,” Home Depot U.S.A., Inc. v. Jackson, 587 U.S. 435, 437, 139 S.Ct. 1743, 204 L.Ed.2d 34 (2019) (quotation omitted); see also Am. Fire & Cas. Co. v. Finn, 341 U.S. 6, 17, 71 S.Ct. 534, 95 L.Ed. 702 (1951) (“The jurisdiction of the federal courts is carefully guarded against expansion by judicial interpretation ․”). The tension is further exacerbated when pendent appellate jurisdiction would serve as a prophylactic to the already prophylactic collateral-order doctrine. See Pickett, 37 F.4th at 1027. Thus, the Supreme Court has suggested “pendent appellate jurisdiction in [the] collateral-order context would undermine § 1292(b).” Baker, 582 U.S. at 39, 137 S.Ct. 1702.

7.   The parties dispute whether Heidi's claim under the Texas counterpart to the Fourth Amendment is properly before this court. We need not resolve that disagreement, for we decline to exercise pendent appellate jurisdiction over that claim for the same reasons stated above.

8.   That opinion ultimately held that there is no reasonable expectation of privacy in historical cell site location information. In re Application for Hist. Cell Site Data, 724 F.3d at 610–12. Although that holding has obviously been abrogated by Carpenter, the Supreme Court's decision did not cast doubt on the content-focused principle central to this case.

9.   Nor does it matter that a former employee of Heidi, Morgan, had access to Heidi's Dropbox folder and its contents. True, Morgan was another third party that could access these documents. But Morgan lacked authorization to access these documents—in fact, Morgan's employment agreement with Heidi prohibited such access. Thus, Morgan was not an intended confidant, but a prying eavesdropper like the officials in Katz. See Katz, 389 U.S. at 351–53, 88 S.Ct. 507 (holding that electronically listening in to a private phone call constitutes a search).

Andrew S. Oldham, Circuit Judge:* FN* Judges Richman and Ramirez concur in all of this opinion except footnote 5.