Key Points

  • The First Circuit affirmed the Rule 12(b)(6) dismissal of a former HealthEquity employee's Title VII, Chapter 151B and Massachusetts wrongful termination claims.
  • Assuming that self-help discovery is protected conduct, the court held that a retaliation plaintiff must plead facts showing the employer knew she gathered documents to support a discrimination claim; knowledge that she emailed files to herself was not enough.
  • Gendered remarks by colleagues with no alleged role in the termination decision did not make a sex discrimination claim plausible.
  • Raising internal concerns about HIPAA compliance, without an allegation that the law required the employee's actions, falls outside the Massachusetts public-policy exception to at-will employment.
  • The court did not decide whether self-help discovery is protected under federal law, an issue it said it has yet to resolve, or under Chapter 151B.

A federal appeals court on Monday upheld the dismissal of a lawsuit by a former HealthEquity Inc. data architect who said she was fired for forwarding work documents to her personal email account to preserve evidence of sex discrimination, holding that she never alleged the company knew why she had sent them.

A three-judge panel of the U.S. Court of Appeals for the First Circuit affirmed a ruling by U.S. District Judge Allison D. Burroughs of the District of Massachusetts that threw out Tracy Grygiel's claims of sex discrimination and retaliation under Title VII of the Civil Rights Act and Chapter 151B of the Massachusetts General Laws, along with a state-law wrongful termination claim. Judge Rikelman wrote for the panel, which also included Judges Howard and Dunlap.

The retaliation ruling turned on what the employer knew. The court assumed, without deciding, that "self-help discovery" is protected conduct, an issue the First Circuit has yet to resolve under federal law. Even so, the panel held, a worker who says she was fired for that conduct must plead facts showing the employer knew her purpose.

According to the complaint, Grygiel began working remotely in May 2023 as a senior data architect for HealthEquity, a Utah-based Health Savings Account provider. Weeks later, at the request of her manager, Darek Easterly, she audited the security of a company database to evaluate its compliance with the Health Insurance Portability and Accountability Act, or HIPAA. She said the database failed, and that Easterly and the employee responsible for it "vociferously demanded she drop her concerns entirely." She kept raising the issue with the data security and tech support teams anyway.

Grygiel alleged that a project manager, Ajay Sahu, called her a "token woman" and "Miss Know-It-All." Easterly put her on two performance improvement plans in July 2023 and April 2024. At the second meeting, Jordan Griggs, the company's vice president of human resources, told her the chief complaint was that she was a know-it-all who would "not stay in [her] lane."

In late April 2024, "[t]o preserve evidence for potential claims," Grygiel forwarded both improvement plans, her training certifications and "important email correspondence" to her personal account. When HealthEquity learned of the emails, it placed her on administrative leave and fired her on May 7, 2024, telling her she had violated its "Security and People" policy.

On appeal, Grygiel argued that her firing one week after she sent the emails supported an inference that the company acted to retaliate. Judge Rikelman wrote that such an inference is available only when there are facts suggesting that the employer knew of the protected conduct, and that the complaint did not include "any facts indicating that HealthEquity knew, or had any way of knowing, that Grygiel was acting in support of a discrimination claim when she emailed the documents."

Grygiel never alleged that she told the company why she needed the files or that their contents made her purpose apparent, the court said. The panel wrote that it did "not see how HealthEquity could have fired Grygiel because of 'a desire to retaliate against' her for pursuing a discrimination claim when it did not know that she was pursuing such a claim."

The court also rejected Grygiel's argument in her reply brief that the company's knowledge that she had emailed the files to herself was enough. Being fired "on grounds unrelated to preparing a discrimination case would not give rise to a retaliation claim," Judge Rikelman wrote. Her statement at the second improvement-plan meeting that she was "being set up for failure" was not enough to put the company on notice of a gender discrimination claim "as opposed to flagging general frustration with her supervisor," the court said in a footnote.

On the discrimination claim, Grygiel argued that the trial judge had wrongly required her to prove the elements of a discrimination case at the pleading stage and had weighed her allegations piecemeal. The panel disagreed on both points. It held that the gendered remarks came from colleagues she never alleged had any role in her firing, and that Easterly's failure to reprimand Sahu in a meeting did not make it more than "merely 'conceivable' that Easterly fired Grygiel because of her sex almost a year later." The allegations were "consistent with" sex discrimination, the panel wrote, but did not move the claim "across the line from possible to plausible."

The panel likewise affirmed the dismissal of Grygiel's claim that HealthEquity fired her in violation of Massachusetts public policy for raising HIPAA concerns. Massachusetts allows at-will employees to be fired for almost any reason, subject to a narrow exception for terminations that violate clearly established public policy. The court held that the exception did not cover Grygiel because she did not allege that HIPAA or another law required her to act as she did.

Recognizing protection for concerns "generally related to legal compliance" would "expand the 'doing what the law requires' prong of this exception beyond the confines that Massachusetts courts have recognized," Judge Rikelman wrote. Grygiel's conduct may have been "appropriate and 'socially desirable,'" but that "is not enough, as a matter of Massachusetts law, to grant her the protection that she seeks," the opinion said.

Grygiel sued in Massachusetts state court in June 2025, and HealthEquity removed the case to federal court. Judge Burroughs dismissed it for failure to state a claim in October 2025. Grygiel did not appeal the dismissal of a separate interference claim.

Joseph L. Sulman of the Law Office of Joseph L. Sulman represented Grygiel. Jennifer L. Markowski of Freeman Mathis & Gary, LLP represented HealthEquity.

The First Circuit affirmed the district court's order in full, leaving the dismissal of all of Grygiel's appealed claims in place. The court expressly left open whether self-help discovery qualifies as protected conduct under Title VII or Chapter 151B.