441 P.3d 989
Ariz. Ct. App.2019Background
- Plaintiff Greg Shepherd received an erectile dysfunction (E.D.) medication sample and twice told Costco Pharmacy he did not want the E.D. prescription; Costco acknowledged cancellation at least once but the prescription was ultimately filled.
- Shepherd authorized his ex-wife to pick up a regular prescription; Costco gave her the regular medication and the E.D. medication (she did not pay for it) and joked about Shepherd not picking it up, after which she told others and reconciliation efforts ceased.
- Shepherd complained to Costco, which allegedly acknowledged the disclosure violated HIPAA and its privacy policy.
- Shepherd sued asserting negligence, breach of fiduciary duty, fraud, negligent misrepresentation, intentional infliction of emotional distress, intrusion upon seclusion, and public disclosure/false light; Costco moved to dismiss.
- Trial court dismissed all claims, finding statutory immunity (A.R.S. § 12-2296), HIPAA preemption, and insufficient factual allegations.
- The Court of Appeals affirmed dismissal of all claims except negligence and punitive damages; it reversed and remanded as to negligence and punitive damages and held HIPAA may inform the state-law standard of care.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether Costco breached a duty of care by disclosing the E.D. prescription | Shepherd: Costco ignored cancellation requests and disclosed protected info to his ex-wife, causing harm | Costco: Disclosure authorized by HIPAA/state statute and it had no duty breach | Court: Sufficiently pleaded duty/breach to survive 12(b)(6); negligence claim reversed and remanded |
| Whether HIPAA precludes state-law claims or private actions based on HIPAA violations | Shepherd: HIPAA and pharmacy regulations inform duty and support claims | Costco: HIPAA provides no private right of action and bars using HIPAA as basis for suit | Court: HIPAA does not preempt state tort claims; HIPAA may inform the negligence standard of care |
| Whether A.R.S. § 12-2296 immunizes Costco from suit for the disclosure | Shepherd: Costco did not act in good faith (failed to cancel; employee joked) | Costco: Statute presumes good faith and authorizes disclosures under HIPAA; thus immunity applies | Court: Immunity not appropriate at dismissal stage — good-faith presumption rebuttable; claim survives to develop facts |
| Viability of other tort claims (fiduciary duty, fraud, negligent misrepresentation, IIED, intrusion, false light) | Shepherd: Each tort arises from the disclosure and attendant conduct | Costco: Facts insufficient; some claims legally inapplicable | Court: Affirmed dismissal of these claims for failure to plead necessary elements (no fiduciary, no actionable fraud/misrep, IIED/jokes not extreme, no intrusion, no publicity for false light) |
Key Cases Cited
- Quiroz v. ALCOA Inc., 243 Ariz. 560 (stating negligence elements) (explaining duty, breach, causation, damages)
- Lasley v. Shrake’s Country Club Pharmacy, Inc., 179 Ariz. 583 (App. 1994) (pharmacy owes duty to act as reasonably prudent pharmacy)
- Webb v. Smart Document Solutions, LLC, 499 F.3d 1078 (9th Cir. 2007) (HIPAA does not create a federal private right of action)
- Hart v. Seven Resorts Inc., 190 Ariz. 272 (App. 1997) (Restatement privacy torts; false light/publicity standards)