BASHAW v. MAJESTIC CARE OF WHITEHALL LLC (2025)

OPINION

Kirstyn Paige Bashaw was fired by her employer, Majestic Care of Whitehall. Bashaw then sued Majestic Care under Title VII and Ohio law, claiming retaliation. The district court granted Majestic Care summary judgment, holding it had provided three non-pretextual grounds for Bashaw's termination. For the reasons below, we AFFIRM.

I.

Majestic Care operates a skilled nursing home and residential facility in Ohio. Bashaw served as the Director of Social Services there from November 2021 until she was terminated in March 2022. The Director of Social Services is not a medical position. Instead, Bashaw's job was to “direct and manage[ ] the day-to-day operations of the Social Service department,” which included enhancing the psychosocial experiences of residents and their families. R. 21-1, PageID 244–46. Bashaw's role also included attending daily morning and end-of-day director meetings. The morning meeting was considered the beginning of the work day.

Bashaw worked at Majestic Care for just under four months. During a six-week span, between mid-January and early March 2022, she was tardy or late for the morning meetings eleven times and absent from work without prior authorization eight and a half days.¹ According to Edward Beatrice, Majestic Care's Executive Director and Bashaw's manager, this affected Bashaw's performance, and she fell behind in her work.

During her four months at Majestic Care, Bashaw grew concerned about resident care, which she began to document. Bashaw had specific concerns about one nurse whom Bashaw heard twice cursing at patients and who Bashaw believed was giving inadequate medical treatment to a leg wound suffered by Resident A. Bashaw reported her concerns about Resident A's care to Beatrice and the Director of Nursing, Amia Ford. These two allegedly responded by telling Bashaw not to worry about the nursing department since that was outside her purview. Soon after, Resident A's leg was amputated because of a severe infection. Bashaw raised additional concerns about patient care in mid-to-late February, including complaints about patients suffering frequent urinary tract infections, nurses' failure to provide bathing assistance, lack of staff training to handle behavioral issues, and an overall lack of adequate care.

Bashaw's concerns went beyond patient care, however. She viewed Beatrice as racially insensitive. As examples, Bashaw offered that Beatrice referred to staff as “ghetto” and “bougie.” R. 27-4, PageID 695. He commented that Muslim staff members “don't celebrate Easter.” Id. at 697. And he noted his surprise that he had liked a book by actor Will Smith. Bashaw also believed that Beatrice had engaged in sexually harassing conduct when he allegedly entered Admission Director Jailah Hopson's office while her door was closed because she was expressing breast milk for her newborn baby.

On Friday, February 25, 2022, Bashaw received a phone call from a social worker at Mt. Carmel hospital about readmitting a former patient, Resident B. Resident B had been sent to Mt. Carmel to receive emergency psychiatric care and Mt. Carmel now sought to discharge him back to Majestic Care. During the routine call, Bashaw told Mt. Carmel that she believed Resident B was suffering from hallucinations, tried to explain the nature of his psychosis and his home situation, and suggested that Majestic Care was not equipped to care for someone with Resident B's psychological issues. She claims, however, that at no time did she tell Mt. Carmel that Majestic Care would not readmit Resident B. Whatever Bashaw might have said, Mt. Carmel left the call with the impression that Bashaw had refused Resident B's readmission. After the phone call, Kathleen Stein from Mt. Carmel called Beatrice and informed him that Bashaw had refused readmission of Resident B and threatened to report Majestic Care to the Ohio Department of Health for the illegal practice of patient dumping. Beatrice, who had not been on the prior call with Bashaw, reassured Stein that Majestic Care would readmit Resident B and dissuaded Mt. Carmel from contacting the state.

The phone call with Mt. Carmel prompted Beatrice to email the department heads the next day, a Saturday. He explained that Resident B had been readmitted and that Mt. Carmel had threatened to report Majestic Care, and he reminded everyone that only he and Ford could refuse to readmit a patient.

On Tuesday, March 1, the situation deteriorated further. Bashaw met with Majestic Care's local Human Resources Representative, Chandler Kuhn, to raise her concerns about resident care and Beatrice's behavior. She had mentioned patient care concerns to Kuhn in prior informal interactions as well, although Bashaw never filed any official reports through Majestic Care's reporting system. In her meeting with Kuhn, Bashaw highlighted numerous instances of inadequate patient care in the facility. And she discussed Beatrice's “sexual[ly] inappropriate and/or harassment of a fellow coworker.” R. 27-1, PageID 633. Specifically, Bashaw reported that Beatrice “had the tendency to invade [this employee's] personal space while in her office” and ignored her closed door despite everyone knowing she was expressing breast milk. Id. at 634; R. 30-3, PageID 886. Bashaw also reported that Beatrice was culturally insensitive and gave as an example an instance where Beatrice said he would fight a staff member if he ever saw her in an alley. This staff member was a black woman. Bashaw said that she tried discussing this behavior with Beatrice, sending him links and resources for cultural competency training but he ignored them. According to Kuhn's notes, he asked Bashaw what evidence she had of Beatrice's alleged sexually harassing conduct and racial insensitivity and Bashaw claimed to be gathering “screenshots, emails, recordings, and documentation.” R. 21-7, PageID 257. She refused Kuhn's request to see her evidence; but she did reveal that she “would listen in on private conversations between [Beatrice] and the Business Office Manager” although “the voices were too muffled” for her to “record ․ on her phone.” Id.

Kuhn's notes also reveal that Bashaw told him several other things pertinent to this appeal. According to Kuhn, Bashaw began the conversation by telling him: “I am not coming to you [from] an HR standpoint, I am coming to you as a friend because I care about you.” R. 21-7, PageID 257. Bashaw then told Kuhn if he “ha[dn't] started job searching, that [he] should be,” and that “she was on her 3rd interview this week.” Id. Bashaw also admitted in her deposition testimony that she discussed interviewing with other potential employers. R. 27-1, PageID 635. She also informed Kuhn that she and “3 other managers were leaving work early to meet off-site and gather all ‘evidence’ available to provide an ultimatum to the Majestic Care home office” that the company either fire Beatrice or “lose 4 department heads.” R. 21-7, PageID 257. In her deposition, Bashaw acknowledged telling Kuhn that if Beatrice “was not released, then most, if not all, of us would be putting in our notices.” R. 27-1, PageID 635. Bashaw invited Kuhn to join the group.

Rather than join the group, Kuhn immediately reported the information to Beatrice and the regional Human Resource Director, Simone Wimberly. Wimberly began to investigate Bashaw's allegations against Beatrice. Meanwhile, after her meeting with Kuhn, Bashaw left work early without authorization. Beatrice had planned to deliver a “corrective action” to Bashaw that afternoon, highlighting her attendance issues. Because Bashaw had already left work, however, Beatrice was unable to deliver the corrective action that day. The record is unclear whether Beatrice formed the intent to cite Bashaw before or after Kuhn informed him of her allegations.

The next day everything fell apart. During the morning meeting, Bashaw, while surreptitiously recording on her phone, confronted Beatrice about Resident B's readmission. She argued that because Resident B didn't “have a diagnosis” and was “his own guardian,” Majestic Care could not keep him in a locked unit. R. 21-12, PageID 266, Transcript at 2. She questioned whether Majestic Care's plans were legal and argued that Resident B should go “in patient” or “go home.” Id. Beatrice informed Bashaw that he and Majestic Care's Medical Director, Dr. Miller, had made a clinical decision to support Resident B's re-admission and temporarily keep him in the locked unit due to his psychological issues until Miller could evaluate him. When Bashaw kept pushing back on Beatrice's decision, he asked her what she would like to do instead. She answered, “I don't know, you are the boss, you're supposed to have these solutions not me.” Id. at 3. Beatrice responded that the course they had chosen was the only viable solution at the time, although he didn't like it either. The conversation heated up and Bashaw ultimately walked out of the unfinished morning meeting, leaving the facility for the day without authorization.

After this, Beatrice contacted Majestic Care's Vice President of Human Resources, Melany Nieset, about Bashaw's behavior, the Mt. Carmel incident, and the corrective action. Nieset immediately launched an investigation, joining Wimberly's ongoing efforts. Nieset and Wimberly interviewed Bashaw on the phone about her allegations against Beatrice, the Mt. Carmel incident, and her performance issues. During the interview, Bashaw discussed what she described as the “beyond toxic into hostile work environment” at Majestic Care and volunteered that she had been making secret recordings of meetings. R. 21-13, PageID 267, Transcript at 1. One week later, Nieset terminated Bashaw's employment and concluded that her allegations against Beatrice were unfounded.

Bashaw then sued, claiming that she was fired because she had expressed concern about resident care and Beatrice's behavior. She initially alleged only retaliatory termination under Ohio Revised Code § 3721.24 and a claim for wrongful termination in violation of public policy. She later added Title VII and Ohio Revised Code § 4112 retaliation claims.² Majestic Care removed the case to federal court and the district court granted its motion for summary judgment. The court reasoned that summary judgment was appropriate because Majestic Care had offered three non-pretextual reasons for terminating Bashaw, although material fact disputes remained about a fourth. Bashaw timely appealed.

II.

“We review the district court's summary judgment decision de novo.” El-Khalil v. Oakwood Healthcare, Inc., 23 F.4th 633, 634 (6th Cir. 2022). When, as here, there is no direct evidence of discrimination, we analyze retaliation claims under the burden shifting framework set out in McDonnell Douglas Corp. v. Green, 411 U.S. 792, 93 S.Ct. 1817, 36 L.Ed.2d 668 (1973). This requires that Bashaw make a prima facie case that her employer fired her in response to protected activity. Id. at 802, 93 S.Ct. 1817. If she does that, the burden shifts to Majestic Care to set forth legitimate non-retaliatory reasons for Bashaw's termination. St. Mary's Honor Ctr. v. Hicks, 509 U.S. 502, 507, 113 S.Ct. 2742, 125 L.Ed.2d 407 (1993); Graoch Assocs. #33, L.P. v. Louisville/Jefferson Cnty. Metro Hum. Rels. Comm'n, 508 F.3d 366, 371 (6th Cir. 2007). Having done so, the burden returns to Bashaw to show that these proffered reasons were pretextual. Graoch, 508 F.3d at 371. Throughout each phase, the burden of persuasion remains with Bashaw. Id.

The district court assumed that Bashaw had established a prima facie case and resolved the case on the ground that Majestic Care had offered non-pretextual reasons for terminating her employment. Bashaw v. Majestic Care, 2024 WL 1256054, at *5 (S.D. Ohio Mar. 25, 2024). We follow the same course. See Williams v. AT&T Mobility Servs., 847 F.3d 384, 396 (6th Cir. 2017).

Bashaw “can show pretext in three interrelated ways: (1) [showing] that the proffered reasons had no basis in fact, (2) [showing] that the proffered reasons did not actually motivate the employer's action, or (3) [showing] that [the proffered reason was] insufficient to motivate the employer's action.” Jackson v. Genesee Cnty. Rd. Comm'n, 999 F.3d 333, 350–51 (6th Cir. 2021) (citation omitted). At summary judgment, she must produce evidence that would allow a jury to reject her employer's stated reasons and infer that the real reason was retaliation. See Johnson v. Kroger Co., 319 F.3d 858, 866 (6th Cir. 2003).

Even if courts find some reasons pretextual, if “at least one other is not, the defendant employer is still entitled to summary judgment.” Jones, 504 F. App'x at 477–78. This has long been the law in this circuit. See Smith v. Chrysler Corp., 155 F.3d 799, 806 (6th Cir. 1998) (“[A]n employee must demonstrate that the employer's reasons (each of them, if the reasons independently caused the employer to take the action it did) are not true.” (cleaned up)); Sims v. Cleland, 813 F.2d 790, 793 (6th Cir. 1987) (“Where two or more alternative and independent legitimate, nondiscriminatory reasons are articulated by the defendant employer, the falsity or incorrectness of one may not impeach the credibility of the remaining articulated reason(s).”); Burks v. Yellow Transp., Inc., 258 F. App'x. 867, 876 (6th Cir. 2008); Rufo v. Dave & Busters, Inc., 2007 WL 247891, at *3–4 (6th Cir. Jan. 31, 2007). In other words, if the employer proffers a single independent nondiscriminatory reason for its conduct, that can defeat a retaliation claim.

III.

Majestic Care offered four reasons in support of its decision to terminate Bashaw, all of which she now challenges on appeal: (1) “Bashaw had surreptitiously recorded work conversations and meetings”; (2) “Bashaw was often tardy or missed work”; (3) “Bashaw told Ms. Nieset that she did not want to return to work”; and (4) “Bashaw violated company policies regarding the safe discharge of a resident.” Bashaw, 2024 WL 1256054, at *5. We address each in turn.

A.

Bashaw argues that her surreptitious recording of work meetings did not actually motivate Nieset to fire her. We disagree.

To begin, Bashaw argues that Majestic Care's reason must be pretextual because it had no official policy against surreptitious recording of meetings. It is true that Majestic Care had no official policy prohibiting recording. Nor is it illegal in Ohio to secretly record conversations to which one is a party. See O.R.C. § 2933.52(4). But the lack of an official policy or law prohibiting the behavior does not itself demonstrate pretext on Majestic Care's part. See 6 W. Ltd. Corp. v. NLRB, 237 F.3d 767, 778 (7th Cir. 2001) (“No company needs to have a set procedure for what action it will take when adjudicating every single employee problem.”); Gilbert v. Des Moines Area Cmty. Coll., 495 F.3d 906, 919 (8th Cir. 2007) (“lack of an explicit policy regarding plagiarism by faculty members does not demonstrate [employer's] decision to investigate and discipline [plaintiff] for his actions was pretextual”); Hoppens v. Gen. Nutrition Ctr., 129 F.3d 608, at *3 n.1 (5th Cir. 1997) (rejecting argument that employer could not point to a “legitimate, nondiscriminatory reason ․ because it lacks a written policy clearly dealing with her case”); Martinez v. Barnhart, 177 F. App'x 796, 801 (10th Cir. 2006) (affirming district court's holding that “the absence of a policy did not create an inference of pretext”). Nieset testified that Bashaw's surreptitious recordings undermined Majestic Care's trust in her. And an employer may terminate an employee whose actions undermine the employer's trust. 6 W. Ltd. Corp., 237 F.3d at 778 (“It is also obvious that, at a bare minimum, companies must be able to trust their employees ․ [and] must be able to discharge ․ an untruthful employee.”).

The record shows that Nieset had significant concerns about Bashaw's surreptitious recording. As soon as she learned of it. Nieset told Bashaw that this was a “huge concern,” that she would have to tell the other team members, that this would undermine trust in the workplace, and she sought to terminate the conversation to speak with legal counsel. R. 21-13, PageID, 267 Transcript at 8–10. On the day that Nieset terminated Bashaw, she told upper management that the reason was “Paige's admission of using a voice recorder with no one's knowledge in morning meetings.” R. 21-11, PageID 265. And she testified that these recordings “create[ ] mistrust” and issues with “open communication between individuals once they become aware that there are recordings.” R. 27-6, PageID 807. Bashaw points us to no contradictory evidence, suggesting that these reasons were pretextual.

Bashaw's surreptitious recording not only undermined Majestic Care's trust in her, but Majestic Care reasonably believed they increased its risk of legal liability. An employer may terminate an employee for creating legal risk for the company. See, e.g., Williams v. Hous. Auth. of Savannah, Inc., 834 F. App'x 482, 489 (11th Cir. 2020) (holding that terminating an employee for losing keys that “could put residents in danger and [the employer] at risk of liability” was not pretextual); Turner v. Marathon Petroleum Co., LP, 804 F. App'x 375, 378 (6th Cir. 2020) (holding that terminating an employee for closing the wrong safety valve that created significant safety risks was not pretextual). During the morning meetings, Majestic Care's team repeatedly discussed sensitive health information, likely protected under the Health Insurance Portability and Accountability Act (HIPAA). In fact, each of the three recorded conversations reference the names and medical care of one or more patients.³ Exposure of protected information without a patient's consent could open Majestic Care up to a wide range of civil penalties. See 45 C.F.R. § 160.404. And Nieset testified that Bashaw's recordings “create[d] risk and exposure for the organization in regards to confidential information” and “patient information that might be breached.” R. 27-6, PageID 807.

Bashaw responds that her recordings are no different than her taking home written notes of the meeting to review. Even assuming that's true, it does not demonstrate that Nieset's proffered reasons were pretextual or that they were not the actual reason for her termination.

In sum, Bashaw has provided no evidence to rebut Nieset's testimony that she fired Bashaw because she reasonably believed Bashaw had undermined trust in the workplace and put the company at risk. See Niswander v. Cincinnati Ins., 529 F.3d 714, 728 (6th Cir. 2008).

B.

Bashaw next contends that her work attendance and tardiness was a pretextual reason for firing her because similarly situated employees were not also terminated. We once again disagree.

Unauthorized absences from work are a valid reason for termination. See Sukari v. Akebono Brake Corp., 814 F. App'x 108, 113 (6th Cir. 2020). As is excessive tardiness. See Keogh v. Concentra Health Servs., Inc., 752 F. App'x 316, 323 (6th Cir. 2018) (holding under the Family and Medical Leave Act that the plaintiff's firing was not pretextual in part because he was consistently late for work); Velazquez v. Yoh Servs., LLC, 2019 WL 1448716, at *13 (S.D.N.Y. Mar. 15, 2019) (holding under Title VII that “habitual tardiness” was “a perfectly valid reason to fire [the plaintiff]”). So to show that this reason was pretextual, Bashaw had to point to similarly-situated employees, known as comparators, who were not fired even though they engaged in the same or similar conduct. Tennial v. U.S. Postal Serv., 840 F.3d 292, 303–04 (6th Cir. 2016). Bashaw and her proposed comparators must be “similar in all relevant respects,” including having “engaged in acts of comparable seriousness.” Bobo v. United Parcel Serv., 665 F.3d 741, 751 (6th Cir. 2012), abrogated on other grounds by Univ. of Tex. Sw. Med. Ctr. v. Nassar, 570 U.S. 338, 133 S.Ct. 2517, 186 L.Ed.2d 503 (2013). The law does not demand “an exact correlation” between the plaintiff and the comparator, see id. at 752, but the comparator must have “engaged in substantially identical conduct.” Manzer v. Diamond Shamrock Chems., 29 F.3d 1078, 1084 (6th Cir. 1994).

Majestic Care's proffered reason for firing Bashaw was that she had been repeatedly late, tardy, and absent without authorization. Beatrice's proposed “corrective action” noted that Bashaw had been absent seven and a half days (five days counted as a single occurrence) and tardy or late eleven times, over the past six weeks. Bashaw then left work early without authorization two more times, on both March 1 and 2. So, all told, Bashaw was absent roughly eight and a half days and tardy eleven times over this six-week span.

Bashaw identified only one comparator, Jailah Hopson. Hopson testified she was “often late to the morning meeting” but “was never disciplined or given corrective action for [her] tardiness” and that “[i]t was very common for at least one team member to be late to the morning meeting each day.” R. 30-3, PageID 885–86. She added that, during her six or seven months of employment, “there were 4–5 times” she had to miss work and “was unable to give prior advanced notice.” Id. at 886. Hopson's declaration does not detail how many times she was late or tardy to the morning meeting, however, or whether any of her absences were excused after the fact. Bashaw thus “did not produce sufficient information about [Hopson's] alleged absenteeism ․ to indicate whether the absenteeism ․ [was] of ‘comparable seriousness’ to the conduct” Bashaw engaged in. Mitchell v. Toledo Hosp., 964 F.2d 577, 583 (6th Cir. 1992).

Bashaw also contends that her firing was pretextual because Beatrice's planned corrective action would have been her first warning about attendance and timeliness issues, and it stated only that “[a]dditional occurrences could result in second corrective actions.” R. 21-3, PageID 249. According to Bashaw, this shows pretext because “[a]s of March 1, 2022, Mr. Beatrice did not think that Bashaw's attendance issues warranted termination.” Appellant Br. At 37. Even if that's true, that doesn't demonstrate that Nieset's decision to terminate Bashaw based on her attendance was pretextual. Beatrice's role was merely to recommend whether to fire Bashaw. Nieset made the ultimate termination decision. Bashaw does not explain how Beatrice's purported belief that her attendance issues warranted a second chance demonstrates that Nieset's decision to fire her for attendance issues was pretextual.

In sum, Bashaw failed to provide enough information to determine whether Hopson was an adequate comparator or other evidence to show this reason was pretext for retaliation.

C.

Bashaw also argues that Majestic Care's belief that she did not want to return to work was pretextual because it was not based in fact. We again disagree.

When a plaintiff seeks to establish pretext by arguing that a stated reason was not based in fact, she must show that the facts necessary for the employer's legitimate, non-retaliatory reason were false or never happened. Macy v. Hopkins Cnty. Sch. Bd. of Educ., 484 F.3d 357, 366 (6th Cir. 2007), abrogated in part on other grounds, Lewis v. Humboldt Acquisition Corp., 681 F.3d 312 (6th Cir. 2012) (en banc). An employer can defeat a pretext argument if it can show that it “honestly believed” its proffered reason. Clay v. U.S. Parcel Serv., 501 F.3d 695, 713–14 (6th Cir. 2007). An honest belief is one formed in “reasonable reliance on the particularized facts that were before it at the time the decision was made.’ ” Wright v. Murray Guard, Inc., 455 F.3d 702, 708 (6th Cir. 2006) (emphasis added) (citation omitted). But “we do not require that the decisional process used by the employer be optimal or that it left no stone unturned.” Id.

Nieset reasonably formed an honest belief that Bashaw no longer wished to work at Majestic Care. Before interviewing Bashaw, Nieset learned that Bashaw had told Kuhn she was interviewing for other positions. And after speaking with Bashaw, Nieset testified that Bashaw “conveyed ․ she didn't feel comfortable working in the building” and that “[s]he didn't want to return to the building.” R. 27-6, PageID 795, 805. The district court considered these statements and determined that Nieset reasonably formed an honest belief that Bashaw did not wish to return to work. Bashaw, 2024 WL 1256054, at *7.

Additional facts in the record also show that Nieset's belief was honest and reasonable. Both Nieset and Wimberly knew, when they spoke to Bashaw, that she had told Kuhn that she had been interviewing for other jobs and planned to resign on March 2 if Beatrice was not terminated. And Bashaw made mixed statements during the conversation that could support Nieset's belief that Bashaw no longer wished to work at Majestic Care. For example, Bashaw claimed that Majestic Care had been “a beyond toxic [ ] hostile work environment for approximately 2 months,” that “there are very very few meetings that ․ I have been able to do or say anything without some type of kick-back,” that she was “gaslighted on a regular basis,” and that she had consistently “been ignored and/or just like told to be quiet.” R. 21-3, PageID 267, Transcript at 1–4.

Bashaw contends that Nieset could not have honestly believed that Bashaw did not wish to return to work because the recording shows that Bashaw never said she no longer wanted to work at Majestic Care. Bashaw said on the recording that she loved her job, loved taking care of the residents, that she had a “lot of hope that things would get better,” and that the “communication would change.” R. 21-13, PageID 267, Transcript at 9, 13. Based on what Nieset and Wimberly knew about Bashaw's efforts to leave Majestic Care, however, it was not unreasonable for them to believe that Bashaw no longer wished to work there.

In sum, Nieset formed an honest belief that Bashaw no longer wanted to work at Majestic Care. A jury could not find this reason was pretext for retaliation.

D.

Bashaw finally argues that the district court was right to conclude that material fact disputes remain regarding whether Majestic Care fired Bashaw for refusing to readmit Resident B. We need not reach this question, however, because Majestic Care provided three independent non-pretextual reasons for firing Bashaw. That is sufficient to defeat a retaliation claim under our caselaw. See Smith, 155 F.3d at 806; Jones, 504 F. App'x at 477–78.

***

We AFFIRM the judgment of the district court.

FOOTNOTES

1.   Majestic Care marked employees as “late” if they arrived after the 9:00 AM morning meeting starts and “tardy” if they were more than fifteen minutes late.

2.   Both parties agree that Bashaw's claims under O.R.C. §§ 3721.24 and 4112 are substantially similar to those raised under Title VII and thus rise or fall together. See Jones v. St. Jude Med. S.C., Inc., 504 F. App'x 473, 476 (6th Cir. 2012) (holding that the same analysis applies for a plaintiff's Title VII and Ohio law retaliation claims); Arnold v. City of Columbus, 515 F. App'x 524, 529 (6th Cir. 2013) (same).

3.   The U.S. Health and Human Services' HIPAA privacy rule protects all “individually identifiable health information ․ in any form or media, whether electronic, paper, or oral.” This protected data includes information “that relates to” (1) “the individual's past, present or future physical or mental health or condition”; (2) “the provision of health care to the individual”; and (3) “the past, present, or future payment for the provision of health care to the individual.” Identifying information includes a person's “name, address, birthdate, [and] Social Security Number.” See “Summary of the HIPAA Privacy Rule,” https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html (last visited Feb. 6, 2025).

LARSEN, Circuit Judge.