482 P.3d 390
Ariz.2021Background
- Plaintiff Greg Shepherd received an E.D. medication sample from his doctor and was later told a full prescription had been filled at Costco Pharmacy.
- Shepherd twice told Costco employees he did not want the E.D. prescription and asked it be canceled; Costco acknowledged at least one cancellation request but did not cancel the prescription.
- Shepherd’s ex-wife picked up his prescriptions; Costco gave her both the regular and the E.D. prescription, she declined the E.D. prescription, then disclosed the medication to others, ending a reconciliation attempt.
- Costco’s corporate response acknowledged a HIPAA and privacy-policy violation; Shepherd sued for negligence and several privacy-related torts.
- The superior court dismissed the complaint with prejudice, concluding Costco was immune under A.R.S. § 12-2296 and that HIPAA precluded the claims; the court of appeals affirmed dismissal except for the negligent-disclosure claim.
- The Arizona Supreme Court granted review to decide (1) whether a plaintiff must plead/allege bad faith to overcome § 12-2296 immunity and (2) whether HIPAA may inform the negligence standard of care.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether plaintiff must plead bad faith or rebut § 12-2296’s good-faith presumption in the complaint | Shepherd: not required to anticipate or plead against an affirmative defense; notice pleading suffices | Costco: complaint must allege facts showing bad faith or else dismissal under § 12-2296 | Court: plaintiff need not plead bad faith or rebut the presumption in the complaint; dismissal was error unless facts establishing the immunity appear on the face of the complaint |
| Proper definition of “good faith” under § 12-2296 | Shepherd: prefer UCC-like definition (honesty + objective commercial reasonableness) | Costco: prefer Ramirez-style definition (honest belief; absence of malice/design to defraud) | Court: adopts Ramirez definition—good faith means acting under an honest belief, without malice or design to defraud or seek an unconscionable advantage |
| Whether HIPAA creates a private right of action or preempts state tort claims | Shepherd: HIPAA violations can inform negligence standard; state tort claims are available | Costco: HIPAA provides no private right and therefore cannot be used to support state tort claims or standard of care | Court: HIPAA does not create a private right but does not preclude state-law tort claims; HIPAA may inform the standard of care in negligence actions |
| Whether corporate policies/regulations or HIPAA can be used to establish standard of care | Shepherd: referenced HIPAA, pharmacy regs, and Costco policy to inform negligence standard | Costco: company policies cannot establish the standard; relying solely on HIPAA would be impermissible negligence per se | Court: internal policies and applicable regulations may inform the standard of care (though they cannot alone create negligence per se); referencing HIPAA to inform standard is permissible |
Key Cases Cited
- Cullen v. Auto-Owners Ins. Co., 218 Ariz. 417 (Ariz. 2008) (Rule 12(b)(6) de novo review and notice-pleading standard)
- Shepherd v. Costco Wholesale Corp., 246 Ariz. 470 (App. 2019) (court of appeals decision addressing negligent-disclosure claim)
- Ramirez v. Health Partners of S. Ariz., 193 Ariz. 325 (App. 1998) (definition of good faith under statutory qualified-immunity context)
- Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C., 102 A.3d 32 (Conn. 2014) (state common-law claims for wrongful disclosure not inconsistent with HIPAA)
- Garmon v. County of Los Angeles, 828 F.3d 837 (9th Cir. 2016) (HIPAA itself provides no private right of action)
- Lombardo v. Albu, 199 Ariz. 97 (Ariz. 2000) (administrative regulations may form the basis for a standard of conduct in negligence)