Appellant Jessica Velcoff, Ph.D., brought this action against MedStar Health, Inc., alleging that MedStar unlawfully disclosed her sensitive mental-health information. Dr. Velcoff appeals the trial court's dismissal of the complaint for failure to state a claim. We vacate the trial court's decision and remand for further proceedings.
I.
The complaint alleges the following. Dr. Velcoff suffered life-threatening injuries in a work-related car collision. She was admitted to National Rehabilitation Hospital (NRH), which is owned and operated by MedStar, for treatment that included psychological treatment. She submitted a claim for workers' compensation benefits. At some point during her inpatient treatment, she was told that "workers' comp was the client, not you." After she was discharged, she continued outpatient psychological treatment with an NRH clinical psychologist. During her treatment, MedStar gave her a privacy policy indicating that her personal health information would be kept confidential and disclosed only as required by law.
In connection with her treatment, Dr. Velcoff shared personal and confidential information with her psychologist, unrelated to the processing of any workers' compensation claim. When her psychologist began questioning her on topics similar to those asked by her workers' compensation insurance company, Dr. Velcoff became concerned that her psychologist was not protecting her confidential information. When Dr. Velcoff asked what her psychologist had shared with the insurance company, her psychologist acknowledged having "shared everything." At this point, Dr. Velcoff stopped treatment with NRH's psychology department. Dr. Velcoff ordered a copy of her records, which confirmed that her psychologist had shared Dr. Velcoff's treatment file, including detailed notes of her sessions, with the insurance company, without Dr. Velcoff's consent.
The complaint alleges that MedStar violated the District of Columbia Consumer Protection Procedures Act (CPPA), D.C. Code § 28-3901 et seq. (2013 Repl. & 2017 Cum. Supp.). Under the CPPA, "[a] consumer may bring an action seeking relief from the use of a trade practice in violation of a law of the District." D.C. Code § 28-3905 (k)(1)(A). Illegal trade practices include "represent[ing] that ... services ... have characteristics ... that they do not have"; "misrepresent[ing] as to a material fact which has a tendency to mislead"; or "fail[ing] to state a material fact if such failure tends to mislead." D.C. Code § 28-3904 (a), (e), (f). The complaint alleges that MedStar committed illegal trade practices in violation of the CPPA by breaking its promise to protect Dr. Velcoff's confidential mental-health information except as *826required by law. The complaint also alleges that MedStar violated the CPPA by disclosing Dr. Velcoff's mental-health information in violation of the D.C. Mental Health Information Act (MHIA), D.C. Code § 7-1201.01 et seq. (2018 Repl.).
The MHIA prohibits the unauthorized disclosure of mental-health information. D.C. Code § 7-1201.02. Under the MHIA, the following mental-health information may in some circumstances be disclosed to third-party payors: "(1) Administrative information; (2) Diagnostic information; (3) The status of the client (voluntary or involuntary); (4) The reason for admission or continuing treatment; and (5) A prognosis limited to the estimated time during which treatment might continue." D.C. Code § 7-1202.07 (a) ; see also D.C. Code § 7-1201.01 (15) (defining "[t]hird-party payor" as "any person who provides ... medical ... benefits whether on an indemnity, reimbursement, service or prepaid basis, including, but not limited to, insurance carriers, governmental agencies and employers"). Disclosure under this provision requires the client's written authorization or consent. D.C. Code §§ 7-1202.02 (a), - 1202.07 (a).
The MHIA provides additional protection to "personal notes regarding a client." D.C. Code § 7-1201.03. Specifically,
such personal notes shall not be maintained as a part of the client's record of mental health information. Notwithstanding any other provision of this chapter, access to such personal notes shall be strictly and absolutely limited to the mental health professional and shall not be disclosed except to the degree that the personal notes or the information contained therein are needed in litigation brought by the client against the mental health professional on the grounds of professional malpractice or disclosure in violation of this section.
Id. If a third-party payor questions the payment of mental-health benefits, the MHIA provides for independent mental-health professionals to help resolve the dispute while protecting against the disclosure of mental-health information to the third-party payor. D.C. Code § 7-1202.07 (b). Additionally, pursuant to the MHIA, "[m]ental health information may be disclosed in a civil or administrative proceeding in which the client ... initiates his mental or emotional condition or any aspect thereof as to an element of the claim or defense." D.C. Code § 7-1204.03 (a).
The complaint further alleges that MedStar breached its common-law duty of confidentiality by disclosing Dr. Velcoff's personal mental-health information without authorization.
II.
We review de novo a trial court's decision to dismiss a complaint for failure to state a claim. Woods v. District of Columbia , 63 A.3d 551, 553 (D.C. 2013). "To survive a motion to dismiss, a complaint must set forth sufficient facts to establish the elements of a legally cognizable claim." Id. at 552-53. We take the facts alleged in the complaint as true. Id. at 553. We conclude that the complaint was erroneously dismissed.
Before addressing the merits, we briefly address Dr. Velcoff's standing to raise the claims at issue. It is not entirely clear whether MedStar contests Dr. Velcoff's standing, but in any event we have no difficulty concluding that Dr. Velcoff has standing. See generally Grayson v. AT & T Corp. , 15 A.3d 219, 233-35 (D.C. 2011) (en banc) (D.C. Court of Appeals generally follows Article III standing requirements, including requirement that plaintiff establish injury in fact). With respect to the CPPA claim, Dr. Velcoff claims that MedStar *827violated its promise to protect her confidential mental-health information, and she seeks, among other things: (a) statutory damages of $1,500 per violation or treble damages, whichever is greater; and (b) an injunction to stop future unauthorized disclosures of confidential information. D.C. Code § 28-3905 (k)(2)(A), (D). Such claims under the CPPA suffice to establish standing. See Grayson , 15 A.3d at 248-49 (finding standing where appellant's claim of injury was "derived solely from a violation or an invasion of his statutory legal rights created by the CPPA"). As to the claim of breach of the common-law duty of confidentiality, we conclude that an allegation that confidential mental-health information was unlawfully disclosed suffices to support standing. Cf. Robins v. Spokeo, Inc. , 867 F.3d 1108, 1117-18 (9th Cir. 2017) (concluding that plaintiff satisfied injury-in-fact requirement by showing that materially false information was disseminated in violation of federal Fair Credit Reporting Act); In re Horizon Healthcare Servs. Inc. Data Breach Litig. , 846 F.3d 625, 638-41 (3d Cir. 2017) (same as to unauthorized disclosure of private information).
Turning to the merits, the trial court gave four reasons for dismissing the claims at issue. First, with respect to the CPPA claim, the trial court stated that the complaint fails to identify the specific illegal trade practices at issue. To the contrary, the complaint clearly and specifically identifies several trade practices that the complaint alleges are illegal, including failing to provide the promised benefit of confidentiality, misrepresenting the degree of confidentiality provided, and failing to state material facts about the lack of confidentiality. Although the complaint does not cite the specific subsections of the CPPA to which each specific allegation relates, matching allegations of the complaint to corresponding subsections of the CPPA is a straightforward task. See, e.g. , D.C. Code § 28-3904 (a) (illegal trade practice to represent that service has characteristics or benefits that service does not have), (e) (illegal trade practice to misrepresent material fact that has tendency to mislead), (f) (illegal trade practice to omit material fact where omission has tendency to mislead). Moreover, the rules do not explicitly require a civil complaint to cite the specific subsections upon which the plaintiff relies. D.C. Super. Ct. Civ. R. 8 (a)(2) (complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief"). Criminal charging documents do require statutory citations, but even there the omission of such citations is not a basis for dismissal in the absence of prejudice. D.C. Super. Ct. Crim. R. 7 (c)(1)-(2). We conclude that the complaint alleges violations of the CPPA with adequate specificity to survive a motion to dismiss. Cf. Johnson v. City of Shelby, Miss. , --- U.S. ----, 135 S.Ct. 346, 346, 190 L.Ed.2d 309 (2014) (per curiam) ("Federal pleading rules call for 'a short and plain statement of the claim showing that the pleader is entitled to relief,' Fed. Rule Civ. Proc. 8(a)(2) ; they do not countenance dismissal of a complaint for imperfect statement of the legal theory supporting the claim asserted.").
Second, the trial court suggested that the alleged disclosures were lawful under D.C. Code § 7-242 (a) (2018 Repl.), which authorizes the sharing of certain health information among "agenc[ies]" and "service provider[s]." At least on the current record, however, that provision does not appear to apply to MedStar and the third-party insurer. See D.C. Code § 7-241 (1) (2018 Repl.) (" 'Agency' means an agency, department, unit, or instrumentality of the District of Columbia government."), (9) (2018 Repl.) (" 'Service provider' means an entity that provides health or human services *828to District residents pursuant to a contract, grant, or other similar agreement with an agency."). Moreover, § 7-242 (a) by its terms does not authorize disclosures that would be "specifically prohibited under District ... law." Dr. Velcoff alleges that the disclosures in the present care were specifically prohibited by the MHIA. For these reasons, § 7-242 (a) does not provide a basis upon which to dismiss the complaint.
Third, the trial court concluded that the disclosures at issue were authorized under D.C. Code § 32-1507 (i) (2012 Repl.), which provides that "[t]he employee and employer are entitled upon request to all medical reports made pursuant to claims arising under this chapter." That provision, however, does not by its terms authorize the alleged disclosures in this case, which were to a third-party insurer rather than to an employer. Considered in isolation, therefore, § 32-1507 (i) does not support dismissal of the complaint. (Although it is unclear whether all of the mental-health information allegedly disclosed in this case, including detailed session notes by Dr. Velcoff's psychologist, falls within the scope of the term "medical reports," we need not express a view on that question.)
Finally, the trial court concluded that Dr. Velcoff consented to the disclosures, by seeking workers' compensation. Other than § 32-1507 (i), however, the trial court did not cite any specific statutory support for its consent ruling. The trial court did cite a federal district court decision, but the court in that case relied on a specific provision of Florida workers' compensation law that does not appear to have a counterpart under District of Columbia law. Reed v. Ga.-Pac. Corp. , No. 3:05-CV-615-J-25TEM, 2006 WL 166534, at *3 (M.D. Fla. Jan. 23, 2006) (dismissing claim of invasion of privacy for failure to state claim, because plaintiff seeking compensation for work-related injury "had no expectation of privacy during his medical examination"; " '[A]n employee who reports an injury or illness alleged to be work-related waives any physician-patient privilege with respect to any condition or complaint reasonably related to the condition for which the employee claims compensation.' ") (quoting Fla. Stat. § 440.13(4)(c) (2017) ).
As we have previously indicated, under the MHIA, consent to or authorization of disclosure of mental-health information to third-party payors must generally be in writing. D.C. Code §§ 7-1131.14 (6) (2018 Repl.); 7-1201.01 (8A), -1202.02 (a), -1202.07 (a); 45 C.F.R. § 164.508(b)(1)(i), (c) (2017). Moreover, personal notes relating to mental-health treatment are given special protection. D.C. Code § 7-1201.03. In contrast, the Workers' Compensation Act contemplates that medical reports will be available to interested parties, which would presumably include third-party insurers. D.C. Code § 32-1520 (g) (2012 Repl.) ("All medical reports submitted by the claimant or any other interested party shall become part of the record, except that the Mayor shall have the discretion to require the testimony at the hearing of any reporting physician. Copies of all medical reports submitted shall be supplied to any party upon request."). Regulations specifically provide for access to medical records. 7 DCMR §§ 208.2 (2018) ("official record" in workers' compensation case "shall include ... all medical records ... relating to the claim"), 208.6 (2018) ("Interested parties may request copies of any document in the official record.").
Although Dr. Velcoff relied upon the MHIA in the complaint and cited the MHIA in opposing the motion to dismiss, the trial court did not mention the MHIA at all. It is not immediately apparent how to accommodate the requirements of both *829the MHIA and the Workers' Compensation Act. This court does not appear to have had occasion to address that issue. Nor, as far as we can tell, has the Compensation Review Board, the "expert[ ]" administrative body "responsibl[e] for administering the Workers' Compensation Act." Howard Univ. Hosp. v. District of Columbia Dep't of Emp't Servs. , 960 A.2d 603, 606 (D.C. 2008). We decline to attempt to resolve that significant and potentially complex issue in the first instance on appeal. The issue was not addressed by the trial court and has not been fully briefed by the parties in this court. Moreover, we are particularly reluctant to decide the issue at this juncture because potentially relevant factual circumstances are not clear on the current record. For example, it is not clear exactly how NRH came to be Dr. Velcoff's health-care provider; what consents, authorizations, or waivers Dr. Velcoff may have signed in connection with her treatment; the nature and circumstances of the alleged disclosures; and to what extent the disclosures were necessary or appropriate for purposes of handling the workers' compensation matter. Under the circumstances, we conclude that the prudent course is to vacate the trial court's dismissal order and remand for further proceedings. Cf., e.g. , van Leeuwen v. Blodnikar , 144 A.3d 565, 569 (D.C. 2016) ("The trial court has not yet addressed these questions and the parties have not fully briefed them. We therefore remand the case to the trial court to address those issues in the first instance.").
MedStar also seeks affirmance on several alternative grounds not decided by the trial court, including that Dr. Velcoff failed to adequately allege damages. We decline, however, to address these alternative grounds at this time, particularly given that Dr. Velcoff sought leave to amend the complaint and the trial court did not rule on that motion.
For the foregoing reasons, we vacate the judgment and remand for further proceedings.
So ordered.