Case Information
IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF SOUTH CAROLINA CHARLESTON DIVISION
J.R., individually and on behalf of her minor )
children A.R. and H.K., J.H., B.Y., and J.S., )
individually and on behalf of all others similarly )
situated, )
)
Plaintiffs, )
) No. 2:19-cv-00446-DCN vs. )
) ORDER WALGREENS BOOTS ALLIANCE, INC. and )
WALGREEN CO., )
)
Defendants. )
_______________________________________)
The following matter is before the court on defendants Walgreens Boots Alliance, Inc. (“WBA”) and Walgreen Co.’s (collectively, “Walgreens”) motion to dismiss the amended complaint and to dismiss WBA for lack of personal jurisdiction, ECF No. 135. For the reasons set forth below, the court grants the motion.
I. BACKGROUND
This case arises from Walgreens’s alleged violation of plaintiffs J.R., J.H., B.Y., and J.S.’s (collectively, “plaintiffs”) privacy rights by unlawfully using, disclosing, and disseminating plaintiffs’ personally identifiable information (“PII”) through Walgreens’s 340B Complete® services (“340B Complete”). Plaintiffs are all residents of Charleston, South Carolina and customers of Walgreens pharmacies. Plaintiffs allege that WBA uses three divisions to conduct its operations: Retail Pharmacy USA, Retail Pharmacy International, and Pharmaceutical Wholesale. Walgreen Co. is the wholly-owned subsidiary of WBA that operates the Retail Pharmacy USA division of WBA, meaning Walgreen Co. operates all of the Walgreens pharmacy locations in South Carolina.
A. Walgreens Pharmacy Operations in South Carolina Plaintiffs begin by explaining that each Walgreens pharmacy is required to comply with South Carolina’s Prescription Information Privacy Act (“PIPA”), the South Carolina Pharmacy Practice Act (“PPA”), and the American Pharmaceutical Association Code of Ethics. In addition, South Carolina law requires each Walgreens pharmacy to operate with a pharmacist-in-charge, who is responsible for compliance with the law and management of the pharmacy and its personnel. Walgrеens uses a Notice of Privacy Practices (“NPP”) in its pharmacies, and plaintiffs allege that the NPP contains no mention of 340B Complete.
Plaintiffs allege that Walgreens pharmacy customers provide their PII to Walgreens’s pharmacies for the purpose of obtaining their individual prescriptions and to allow Walgreens’s pharmacy to seek third-party payment for those prescriptions. In doing so, Walgreens inputs pharmacy customers’ PII into a “proprietary computer software system” called IntercomPlus, which is accessible by all nationwide retail, mail service, and specialty Walgreens pharmacies. Am. Compl. ¶ 42. The PII that is collected and inputted into IntercomPlus includes the pharmacy customer’s name, address, date of birth, payment information, allergies, health conditions, drug information, and physician information.
B. 340B Complete
In 1992, Congress enacted the 340B Drug Discount Program (“340B Program”), which requires drug manufacturers to provide certain medications at discounted prices to eligible healthcare entities that primarily serve low-income patients (“Covered Entities”). Because not all Covered Entities have in-house pharmacy services, Covered Entities contract with third-party pharmacies (“contract pharmacies”) to dispense 340B drugs on their behalf. When doing so, Covered Entities are still responsible for ensuring compliance with the 340B Program. Walgreens has entered into multiple contracts with Covered Entities in South Carolina to servе as contract pharmacies.
Around 2010, Walgreens created an allegedly separate department, division, or unit within its corporate structure known as 340B Complete and began marketing its 340B Complete services to help Covered Entities administer the 340B Program and to ensure compliance. Plaintiffs allege that Walgreens operates 340B Complete “as an independent line of business, separate from its retail, photo, health clinic, or pharmacy lines of business, and functions on its own” and promotes 340B Complete “as a ‘prescription eligibility verification solution’ with ‘comprehensive’ and ‘advanced online reporting and data-capture tools,’ providing a single vendor ‘end-to-end contract pharmacy solution.’” Am. Compl. ¶ 56. Plaintiffs allege that Walgreens markets access to its entire database of pharmacy customers’ PII to potentially capture all patients who received care from a Covered Entity and would therefore be eligible for 340B discounted drugs.
Walgreens’s alleged 340B Complete process is as follows. Walgreens allegedly transfers on a daily basis all of its pharmacy customers’ PII from IntercomPlus to a “corporate central repository” called Enterprise Data Warehouse (“EDW”). Am. Compl. ¶ 68. Plaintiffs allege that EDW is not a secure platform and that “unauthorized persons and other Walgreens’ departments, divisions, and/or units can and do unlawfully access pharmacy customers’ PII сontained therein.” Id. ¶ 69. Plaintiffs allege that 340B Complete receives and scans EDW, compares it to the patient database received by Covered Entities, and then transfers PII of those patients of the Covered Entities into 340B Complete.
According to plaintiffs, one of the business purposes behind 340B Complete is to acquire 340B drugs for resale at Walgreens’s pharmacies at prices significantly below the price that Walgreens pays in the wholesale market. Walgreens allegedly performs a financial analysis to determine whether a profit margin on a 340B drug exceeds the Covered Entity’s fees paid to Walgreens, and if it does, 340B Complete will generate a purchase order for the drug. If the profit margin does not exceed the fee, 340B Complete will not generate a purchase order for the 340B drug, will not charge fees to the Covered Entity, and will retain its usual non-340B profit margin. Plaintiffs allege that 340B Complete is outside of the scope of Walgreens’s pharmacies’ normal operations, and that these administration services are not provided to its pharmacy customers. Covered Entities compensate Walgreens for its provision of services through 340B Complete, and Walgreens allegedly realizes substantial profits from 340B Complete.
There are 160 employees in Walgreens’s 340B Complete department, and plaintiffs allege that those employees all have unauthorized and unconsented access to pharmacy customers’ PII. Those employees are allegedly not registered with South Carolina’s State Board of Pharmacy, do not maintain pharmacy licensure in South Carolina, and do not provide pharmacy care services.
Plaintiffs filed their complaint and a motion for a preliminary injunction on February 14, 2019. After briefing and limited discovery, the court held a two-day evidentiary hearing on the motion for a preliminary injunction and issued an order denying the motion. This order is currently on appeal.
After appealing the court’s order, plaintiffs filed an amended complaint. ECF No. 128. The amended 56-page, 280-paragraph complaint brings claims for: (1) invasion of privacy: wrongful appropriation; (2) invasion of privacy: wrongful publicizing of private affairs; (3) violation of the Fair Credit Reporting Act (“FCRA”); (4) negligence per se based on violations of FCRA, the Health Insurance Portability and Accountability Act (“HIPAA”), and the Federal Trade Commission Act (“FTCA”); (5) negligence per se based on violations of PIPA; (6) breach of contract; (7) declaratory relief pursuant to 28 U.S.C. § 2201; (8) negligence based on professional standards; (9) negligence based on PPA; (10) respondeat superior; (11) negligent training and supervision; and (12) unjust enrichment. Walgreens filed a motion to dismiss the amended complaint and to dismiss Walgreens Boots Alliance, Inc. (“WBA”) for lack of personal jurisdiction on January 9, 2020. ECF No. 135. Plaintiffs responded on February 24, 2020, ECF No. 143, and Walgreens replied on April 8, 2020, ECF No. 147. On May 18, 2020, plaintiffs filed additional exhibits to their response brief that were not discussed in the brief, ECF No. 154, and on May 19, 2020, plaintiffs filed a “request that the court take judicial notice of facts contained in plaintiffs’ additional exhibits in support of” their response brief, ECF No. 155. The court held a hearing on the motion on May 19, 2020.
II. STANDARD
A. Motion to Dismiss for Lack of Personal Jurisdiction
When the defendant challenges personal jurisdiction, the plaintiff has the burden
of showing that jurisdiction exists. See In re Celotex Corp.,
B. Motion to Dismiss for Failure to State a Claim
A Rule 12(b)(6) motion for failure to state a claim upon which relief can be
granted “challenges the legal sufficiency of a complaint.” Francis v. Giacomelli, 588
F.3d 186, 192 (4th Cir. 2009) (citations omitted); see also Republican Party of N.C. v.
Martin,
III. DISCUSSION
Walgreens argues that each cause of action in the amended complaint should be dismissed, and it also argues that WBA should be dismissed for lack of personal jurisdiction. The court first addresses the personal jurisdiction issue and then turns to Walgreens’s motion to dismiss.
A. Motion to Dismiss for Lack of Personal Jurisdiction Walgreens argues that this court lacks personal jurisdiction over WBA. In response, plaintiffs first argue that WBA has waived any personal jurisdiction defense and then contends that even if WBA has not waived the defense, the court has personal jurisdiction over WBA through the alter ego theory of jurisdiction. The court addresses each in turn.
a. Waiver Plaintiffs argue that WBA has waived its jurisdictional defense because it hаs participated in this litigation for over a year, including conducting limited discovery, participating in the two-day preliminary injunction hearing, and agreeing to the confidentiality order, and only now asserts its jurisdictional defense. Plaintiffs note that both WBA and Walgreen Co. have included in their filings a footnote reserving any and all defenses, but that Rule 12(h) requires WBA to raise its jurisdictional defense, not merely to reserve it. According to plaintiffs, WBA should have already raised its defense but failed to do so, meaning that the defense has been waived.
The problem with this argument is that it is contrary to the plain language of Rule 12 of the Federal Rules of Civil Procedure. Pursuant to Rule 12(h)(1), a party must raise its lack of personal jurisdiction defense in its answer to the complaint or in a motion under the rule, such as the instant motion. While litigation has been ongoing for the past year, the procedural posture of the case is such that the court is just now considering Walgreens’s motion to dismiss. Indeed, the court entered an order on March 11, 2019 giving Walgreens 14 days following the court’s ruling on the motion for a preliminary injunction to respond to the complaint. The court’s ruling took place on October 4, 2019, and Walgreens filed its motion to dismiss on October 18, 2019, in which WBA raised its jurisdictional defense. [1] As such, WBA has complied with Rule 12(h) and has not waived its defense.
Plaintiffs argue that WBA should have raised its jurisdictional defense at the
preliminary injunction hearing, but doing so would contradict Rule 12(h)(1). Rule
12(h)(1) requires a party to raise its jurisdictional dеfense in its answer or its motion to
dismiss. Plaintiffs’ argument about WBA’s participation in the preliminary injunction
adjudication sticks WBA between Scylla and Charybdis. Either WBA doesn’t participate
in limited discovery and the hearing on the preliminary injunction in order to preserve its
jurisdictional defense but sacrifices its opportunity to defend itself from a preliminary
injunction or WBA defends itself but waives its chance to assert its jurisdictional defense.
That is an untenable position. Finally, the cases cited by plaintiffs are inapposite. In
Ashley II of Charleston, LLC v. PCS Nitrogen, Inc., the court found that a party waived
several defenses because the party failed to substantively argue them until after judgment
was entered, which is clearly not the case here.
b. Alter Ego Theory Walgreens argues that the court does not have general or specific personal jurisdiction over WBA. Walgreens contends that general personal jurisdiction does not exist because WBA is incorporated under the laws of Delaware and its headquarters/principal place of business are in Illinois, and there is no specific personal jurisdiction because WBA does not operate Walgreens pharmacies in South Carоlina. Instead, it is Walgreen Co., a subsidiary of WBA, that operates the pharmacies, contracts with Covered Entities, and administers 340B Complete in South Carolina. In response, plaintiffs do not dispute these arguments but instead contend that the court has personal jurisdiction over WBA through the alter ego theory, in that WBA is the alter ego of Walgreen Co.
Before diving into the substance of the parties’ arguments, the court first addresses plaintiffs’ late filing of additional exhibits related to this issue and their request that the court take judicial notice of the facts contained within the exhibits. On the day before the hearing, plaintiffs filed additional exhibits to their response brief that they did not address in the brief, and on the morning of the hearing, plaintiffs submitted another filing requesting that the court take judicial notice of the facts within those exhibits. The exhibits consist of press releases, pages from WBA’s website, and a settlement order, all of which well pre-date plaintiffs’ response brief and thus could have been timely filed with the response brief. Instead, and presumably based on some strategy [2] , plaintiffs filed these additional exhibits at the eleventh hour. At the hearing, Walgreens objected to the court’s consideration of these untimely exhibits, argued that the exhibits do not support a finding of personal jurisdiction based on the alter ego theory, and requested the opportunity to provide supplemental briefing on the issue.
While the court certainly does not condone the questionable tactic оf failing to file all available exhibits with a party’s brief, the court will consider plaintiffs’ additional exhibits. The issue of personal jurisdiction is one of the utmost importance, and the court feels obligated to consider all of the evidence before it when making its ruling. Walgreens was able to respond to these eleventh hour exhibits at the hearing, and the court is able to resolve the issue of personal jurisdiction without the need for supplemental briefing. However, the court stresses that it does not view this gambit favorably, and should plaintiffs try something like this again, the court will not be as generous.
In determining whether to exercise jurisdiction based on the alter ego theory, the
court considers the following factors: (1) common ownership; (2) financial independence;
(3) degree of selection of executive personnel and failure to observe corporate
formalities; and (4) the degree of control over marketing and operational policies.
Builder Mart of America, Inc. v. First Union Corp.,
Plaintiffs argue in their response brief that WBA is the alter ego of Walgreen Co.
because WBA identifies its Retail Pharmacy USA operations as a “division” of WBA, and Walgreen Co. is the WBA subsidiary that conducts the Retail Pharmacy USA operations. Plaintiffs explain that in WBA’s most recent 10-K filing, WBA touts itself as “a market leader in the United States” that operates 9,560 retail stores within its Retail Pharmacy USA division and holds pharmacy licenses. ECF No. 143-1 at 8, 13, 34. Plaintiffs also argue that WBA and Walgreen Co. share the same principal place of business and that WBA guarantees Walgreen Co.’s debt and matches employee contributions to Walgreen Co.’s profit-sharing retirement plan, all of which indicate WBA’s alter ego status. Am. Compl. ¶¶ 11, 14; ECF No. 143-1 at 92 n.4, 107.
The additional exhibits submitted by plaintiffs include press releases, personnel biographies from WBA’s website, and a settlement stipulation order. There is a December 31, 2014 press release announcing that Walgreen Co. and Alliance Boots GmbH completed Step 2 of their merger to form WBA; a December 10, 2014 press release announcing that the Walgreen Co. president and chief executive officer would retire once the merger between Walgreen Co. and Alliance Boots was complete and that the Walgreen Co. Chariman would become WBA’s executive chairman; a June 9, 2016 press release announcing various changes in senior management following the Walgreen Co. and Alliance Boots merger; and a February 3, 2020 press release announcing changes to WBA’s IT systеm. ECF Nos. 154-1, 154-3, 154-4, 154-9. Plaintiffs also include biographies of various WBA executives who currently hold or have held positions at both WBA and Walgreen Co. ECF No. 154-2, 154-5, 154-6, 154-7. Finally, plaintiffs include a December 20, 2018 settlement stipulation and order from the Southern District of New York to which WBA is a party to show that WBA admitted to conduct related to IntercomPlus and that Walgreen Co.’s general counsel signed the agreement. ECF No. 154-8.
This evidence is insufficient to show that WBA exercises the degree of control
over Walgreen Co. such that WBA is its alter ego. The facts cited by plaintiffs simply
show that Walgreen Co. is a subsidiary of WBA that operates a division of WBA. This
court has previously held that a parent company referring to “its subsidiary companies by
the informal title of ‘division’ rather than emphasizing these are distinct corporate entities
does not give rise to jurisdiction.” Wright v. Waste Pro USA Inc.,
Plaintiffs provide no evidence to suggest that WBA and Walgreen Co. fail to
observe corporate formalities. This alone is fatal to their argument. Builder Mart of
Am., Inc.,
Finally, plaintiffs argue that WBA and Walgreen Co. share a principal place of
business and “WBA and Walgreen Co. jointly conduct business through South Carolina
under the ‘Walgreens’ trade name,” ECF No. 143 at 38, but “unified marketing and
advertising and holding out to the public as a single entity, without more, insufficient to
confer jurisdiction,” Builder Mart of Am., Inc.,
Plaintiffs requested for the first time at the hearing that the court permit jurisdictional discovery. The court declines to entertain this belated request. Therefore, the court dismisses WBA from this case, leaving Walgreen Co. as the only remaining defendant. As such, the court will only refer to Walgreen Co. moving forward.
B. Motion to Dismiss for Failure to State a Claim
Next, Walgreen Co. рresents various arguments as to why each of plaintiffs’
claims should be dismissed. As an initial matter, Walgreen Co. argues that plaintiffs’
FCRA claim should be dismissed for a variety of reasons, including the fact that
Walgreen Co. is not a consumer reporting agency, Walgreen Co. does not receive
plaintiffs’ PII from a consumer reporting agency, plaintiffs’ PII is not a “consumer
report,” and the FCRA explicitly excludes plaintiffs’ PII from the definition of a
“consumer report.” Plaintiffs appeared to care so little about this claim that they failed to
mention it in their response brief. When asked at the hearing if they had abandoned their
claim, plaintiffs’ counsel said that they did not and that they failed to address the claim in
their response brief because of the page limit but planned to do so at the hearing. Local
Rule 7.05 requires memoranda to include “[t]he argument . . . relating to the matter
before the court for ruling with appropriate citations,” Local Civ. Rule 7.05(a)(3)
(D.S.C.), and failure to address a claim in an opposition memorandum constitutes waiver
of that claim. Jones v. Family Health Ctr., Inc.,
a. Invasion of Privacy: Wrongful Appropriation Walgreen Co. argues that plaintiffs’ wrongful appropriation claim must be dismissed because plaintiffs fail to allege: (1) that Walgreen Co. publicized their names or identities; (2) any appropriation of the commercial value of their names, identities, appearances, or personalities; and (3) a factual basis that Walgreen Co. processed plaintiffs’ PII without their consent. Plaintiffs take issue with each of these points, arguing that publicity is not required for wrongful appropriation, that wrongful appropriation is not limited to commercial value, and that they did not consent to Walgreen Co.’s use of their PII. The court dismisses this claim based on plaintiffs’ failure to allege publicity and therefore declines to address the other two arguments.
“In South Carolina, there are three separate and distinct causes of action for
invasion of privacy: 1) wrongful appropriation of personality; 2) wrongful publicizing of
private affairs; and 3) wrongful intrusion into private affairs.” Sloan v. S.C. Dep’t of
Pub. Safety,
defining the cause of action, stating that “[w]rongful appropriation of personality
involves the intentional, unconsented use of the plaintiff’s name, likeness, or identity by
the defendant for his own benefit.”
This and other discussions by South Carolina courts make clear that while
publicity is not explicitly stated as an element per se, it is still a fundamental requirement
of the cause of action of wrongful appropriation of personality. As South Carolina courts
have recognized, “[t]he terms ‘infringement on the right of publicity’ and ‘wrongful
appropriation of personality’ are interchangeable.” In re Wiser,
(D.S.C. Mar. 25, 2011) (“The South Carolina Supreme Court has stated that ‘wrongful
appropriation of personality’ and ‘infringement on the right of publicity’ are the same
claim under the rubric of ‘invasion of privacy.’”). Indeed, Gignilliat explained that
“[e]ncompassed in [wrongful appropriation of personality, wrongful publicizing of
private affairs, and wrongful intrusion of private affairs] is the infringement on the right
of publicity.”
Plaintiffs argue that Holloman is inapplicable because it was decided prior to
Gignilliat’s expression of the current state of the law and that the Supreme Court of South
Carolina’s statement in Sloan that “[t]he gist of [wrongful appropriation of personality] is
the violation of the plaintiff’s exclusive right at common law to publicize and profit from
his name, likeness, and other aspects of personal identity,”
Plaintiffs also argue, in a footnote, that if wrongful appropriation requires
publicity, plaintiffs have alleged that Walgreen Co. publicized their information by
transferring it from the pharmacy to the EDW database, which is “used as an information
highway for other corporate-wide, non-pharmacy business units (including 340B
Complete) to access.” ECF No. 143 at 8 n.2. Even accepting as true the factual
allegation that non-pharmacy Walgreen Co. employees can access EDW and plaintiffs’
PII, the court fails to see how this access constitutes publicity as a matter of law. As
discussed in greater detail below, the Restatement (Second) of Torts, which has been
adopted by the Supreme Court of South Carolina, has defined publicity as making the
matter public “by communicating it to the public at large, or to so many persons that the
matter must be regarded as substantially certain to become one of public knowledge.”
Swinton Creek Nursery v. Edisto Farm Credit, ACA,
b. Invasion of Privacy: Wrongful Publicizing of Private Affairs
Next, Walgreen Co. argues that plaintiffs’ wrongful publicizing of private affairs
claim fails because, like in their wrongful appropriation claim, plaintiffs fail to allege that
Walgreen Co. publicized their PII. “Wrongful publicizing of private affairs involves a
public disclosure of private facts about the plaintiff . . . in which there is no legitimate
public interest.” Snakenberg v. Hartford Cas. Ins. Co.,
Plaintiffs allege that their PII is transferred from IntercomPlus to EDW, which “is not a secure platform for pharmacy customers’ PII because unauthorized persons and other Walgreens’ departments, divisions, and/or units can and do unlawfully access pharmacy customers’ PII contained therein.” Am. Compl. ¶¶ 68–69 (emphasis added). Plaintiffs further allege that the 160 non-pharmacy employees in the 340B Complete division of Walgreen Co. have unauthorized access to plaintiffs’ PII in EDW. Id. ¶¶ 76– 78. Plaintiffs argue that this constitutes publicity, equating this alleged unauthorized access by 160 employees to “small [newspaper] circulation,” “a large number of persons,” or a “large audience.” ECF No. 143 at 11. However, plaintiffs’ focus on the number of people is misplaced. As the Supreme Court of South Carolina has made clear, the relevant distinction between publication and publicity has to do with private versus public communication, not the size of the audience. A “small [newspaper] circulation,” “a handbill distributed to a large number of persons,” and a “statement made in an address to a large audience” are all instances of communication that is dispersed to the general public. Here, plaintiffs do not allege that plaintiffs’ PII is communicated publicly or made public in any manner. Accepting plaintiffs’ allegations as true, just because plaintiffs’ PII may be accessed within Walgreen Co. by Walgreen Co. employees does not mean it is distributed or made available to the public, which is a requirement of wrongful publicizing of private affairs claim. Therefore, the court dismisses this claim.
c. Negligence Per Se Based on HIPAA, FCRA, and FTCA Walgreen Co. contends that plaintiffs’ negligence per se claim based on violations of HIPAA, FCRA, and FTCA must fail. As discussed above, the court has found that plaintiffs abandoned any arguments about the FCRA, meaning the court will only focus on negligence per se for violations of HIPAA and FTCA. Walgreen Co. argues that this claim should be dismissed because plaintiffs cannot maintain a negligence per se claim based on a statutory violation unless the statute permits a private cause of action, and neither HIPAA nor FTCA do. Walgreen Co. then argues that even if HIPAA and FTCA were to permit a private cause of action, plaintiffs have failed to allege a violation of either statute.
i. Private Cause of Action First, Walgreen Co. argues that plaintiffs’ negligence per se claim must fail because neither HIPAA nor the FTCA permit a private cause of action. In response, plaintiffs argue that while HIPAA and the FTCA do not explicitly contain a private cause of action, the statutes imply a cause of action, meaning they have properly alleged their claim.
“A statute must permit a private cause of action in order for plaintiffs to maintain
a civil suit” for negligenсe per se. Salley v. Heartland-Charleston of Hanahan, SC, LLC,
Therefore, the question becomes whether plaintiffs have adequately pleaded that
the essеntial purpose of HIPAA and the FTCA is to protect from the kind of harm
plaintiffs have allegedly suffered and whether plaintiffs are members of the class meant
to be protected by the statutes. However, the problem is that plaintiffs have not pleaded
this at all. They argued in their response brief and at the hearing that these two prongs
exist, but “[i]t is well-established that parties cannot amend their complaints through
briefing or oral advocacy.” S. Walk at Broadlands Homeowner’s Ass’n, Inc. v.
OpenBand at Broadlands, LLC,
Moreover, even if plaintiffs had included these allegations in their amended
complaint, the court is not convinced that HIPAA implies a private cause of action such
that it can form the basis of a negligence per se claim as a matter of law. Plaintiffs argue
that “[c]ourts have held that HIPAA, while not providing a private cause of action, may
be a legitimate element of a state law claim and have allowed negligence per se claims to
stand,” citing to various cases. ECF No. 143 at 19 n.4. However, several of those cases
permit the use of HIPAA to inform the standard of care in an ordinary negligence claim,
not the use of a HIPAA violation as the basis of a negligence per se claim, and the rest
are clearly inapplicable.
[5]
See Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C.,
There is a difference between using a statute to establish the standard of care in an
ordinary negligence claim and using the violation of a statute to establish the duty and
breach of duty in a negligence per se claim. Negligence per se uses a statutory violation
to establish duty and breach of duty. Rayfield v. S.C. Dep’t of Corr.,
to establish a negligence per se claim but instead addressed the issue of whether such a
claim gives rise to federal question jurisdiction.
With regard to the FTCA, Plaintiffs cite to various cases in which courts have
found an implied cause of action in the FTCA, meaning a violation of the FTCA could
serve as the basis for a negligence per se claim. See In re Equifax, Inc., Customer Data
Sec. Breach Litig.,
The FTCA prohibits “unfair or deceptive acts or practices in or affecting
commerce,” 15 U.S.C. § 45(a), and plaintiffs allege that Walgreen Co.’s failure to
maintain reasonable and appropriate data security for plaintiffs’ PII constitutes an unfair
method of competition in commerce, Am. Compl. ¶ 173. Plaintiffs rely on case law that
has interpreted the FTCA to apply tо instances in which an entity has insufficient
cybersecurity. For example, in a case cited by plaintiffs, the Third Circuit considered
whether the defendant’s failure to use certain cybersecurity measures to prevent hackers
from accessing consumers’ information violated the FTCA. F.T.C. v. Wyndham
Worldwide Corp.,
Here, plaintiffs allege that “Walgreens’ EDW is not a secure platform for pharmacy customers’ PII because unauthorized persons and other Walgreens’ departments, divisions, and/or units can and do unlawfully access pharmacy customers’ PII contained therein.” Am. Compl. ¶ 69. Plaintiffs do not allege that Walgreen Co.’s cybersecurity practices are inadequate nor do they allege any attempt by a third-party hacker to access plaintiffs’ PII. In other words, plaintiffs do not factually allege the type of FTCA violation upon which they purport to base their claim. As such, plaintiffs’ negligence per se claim based on violations of federal law must be dismissed.
d. Negligence Per Se Based on PIPA Next, Walgreen Co. argues that plaintiff’s negligence per se claim based on а violation of PIPA must be dismissed because PIPA does not create a private cause of action, PIPA only limits external transfers of information, PIPA’s exceptions cover the actions that plaintiffs challenge, and PIPA’s prohibition of disclosing PII does not apply because Walgreens does not disclose such information. Plaintiffs disagree with all of these arguments.
i. Private Cause of Action First, Walgreen Co. argues that PIPA does not create a private cause of action and can only be enforced through criminal prosecution or agency action. In response, plaintiffs argue that PIPA implies a private cause of action. Unlike their negligence per se claim based on violations of federal law, plaintiffs did allege that the purpose of PIPA was to protect from unauthorized use of PII and that plaintiffs fall within the class of person that PIPA is meant to protect, Am. Compl. ¶¶ 183–84, and they argue as much in their response brief.
As Walgreen Co. points out, neither party cites to any case that recognizes a private cause of action in PIPA. The court has also been unable to locate any instance in which a court has held that a violation of PIPA could be used to imply a cause of action such that a negligence per se claim could be sustained. Nevertheless, plaintiffs have alleged that the two requirements of negligence per se exist here, and Walgreen Co. provides no argument in opposition to those allegations. As such, the lack of an explicit private cause of action does not convince the court that this claim should be dismissed.
ii. External Transfers Next, Walgreen Co. argues that plaintiffs failed to allege a violation of PIPA because PIPA only applies to external transfers, and any use of plaintiffs’ PII is internal to Walgreens. In response, plaintiffs argue that PIPA simply prohibits any transfer of PII outside of the database in which it was entered with patients’ consent, and that defendants alter the plain language of PIPA by inserting the modifier “external” before the word “transfers.”
PIPA states that “[n]o patient prescription drug information may be transferred or received by a person without the written consent of the patient or a person authorized by law to act on behalf of the patient.” S.C. Code Ann. § 44-117-30. “Patient prescription drug information” is defined in relevant part as “any data concerning the dispensing of a drug or device that identifies a patient as having been the recipient of a prescription drug or device, whether this data is held by a practitioner, pharmacy, or another entity.” Id. § 44-117-20. The statute then lists various exceptions to this prohibition.
Walgreen Co. argues that this prohibition only applies to external data transfers, and because any transfer of data here occurs within the Walgreen Co. entity, plaintiffs have failed to allege a violation of PIPA. In response, plaintiffs argue that PIPA prohibits any transfer of PII outside of the pharmacy setting without written consent of the patient. Plaintiffs argue that this distinction between external and internal transfers is without merit. They contend that plain language of the statute states that “[n]o patient prescription drug information may be transferred or received by a person without the written consent of the patient,” S.C. Code Ann. § 44-117-30, and that the plain meaning of “transfer” is “to convey from one person, place, or situation to another.” As such, plaintiffs contend that any transfer outside of the pharmacy itself, whether within Walgreen Co. or not, without consent is prohibited by PIPA, and that any reading of PIPA that would permit a corporation that owns pharmacies to control pharmacy data is absurd. [6]
[6] This argument is somewhat puzzling since plaintiffs stated on more than one occasion that they do not object to the initial data transfer from IntercomPlus to EDW, which would be prohibited under their interpretation of PIPA. See ECF No. 98, Preliminary Injunction Hearing Day 2 Tr. 84:6–10 (“The backup from the IntercomPlus system, the actual data system into the secondary server for us is not objection as long as it’s not used for any other purpose. What happens though, and I think the evidence has been very clear, is that the 340B Complete program reaches sort of through a back door into EDW and scans that data.”); id. 81:25–82:7 (The Court: “Well, you don’t have any problem with sending to the Enterprise Data Warehouse, because that’s kind of the backup.” Mr. Moore: “No, that’s just the backup.” The Court: “Your problem is taking the Enterprise Data and running it thrоugh 340B Complete.” Mr. Moore: “Right. It reaches in, messes around, and it pulls it out.”).
However, the statute prohibits the “transfer[ ] or recei[pt] by a person.” Based on plaintiffs’ own allegations, that is not what occurs here. Instead, plaintiffs allege that PIPA prohibits Walgreen Co.’s “transfer” of plaintiffs’ PII “from its pharmacy’s IntercomPlus system to its corporate EDW repository” and Walgreen Co.’s “receipt” of plaintiffs’ PII “by its 340B Complete software and/or process from its corporate EDW
repository.” Am. Compl. ¶¶ 187–88. These are not instances of transfers or receipts by a person. Instead, they are instances of transfer and receipts by databases within the same entity, Walgreen Co. Moreover, as Walgreen Co. points out, if “transfer” was to be interpreted as narrowly as plaintiffs claim, i.e., any conveyance of information outside of the four walls of the pharmacy, then PIPA would prohibit basic functions such as transmitting information for legal, administrative, or IT services that do not occur within the four walls of the pharmacy.
The court previously interpreted the statute to prohibit external transfers of information to another entity relying in part on PIPA’s exceptions. [7] Most of PIPA’s exceptions to the prohibition of transfers that are enumerated in § 44-117-30 relate to external transfers of patient prescription drug information. Those include transmittals of a prescription drug order, id. § 44-117-30(1); communications with other health care professionals who treat the patiеnt, id. § 44-117- 30(2); information necessary to effect the recall of a defective drug, id. § 44-117-30(4); information necessary to adjudicate or process payment claims, id. § 44-117-30(6); and information for use in clinical research and medical studies, id. § 44-117-30(8)–(9). It stands to reason that if the prohibition applied to external transfers, then the exceptions to the prohibition would include external transfers. Moreover, PIPA clarifies that it does not invalidate other certain laws and authority, including the authority of a court to subpoena patient prescription drug information, the authority of a licensing or disciplinary board of the State to obtain prescription records, and the authority of the Department of Health and Environmental Control to access the records. Id. § 44-117-50. These are all authorities to which information would be transferred externally outside of the entity that holds the patient’s PII. Based on this context, the court is still convinced that PIPA does not prohibit what plaintiffs allege here—transfer of data within the same entity.
Plaintiffs cite to several portions of PIPA that they argue requires patient information to stay within the pharmacy context. They first cite to a portion of the statute that requires that “[a]ll electronic equipment for receipt of prescription drug orders communicated by way of electronic transmission must have adequate security and system safeguards and must be maintained so as to ensure patient confidentiality and to ensure against unauthorized access or an intervening person or entity having access to view, read, manipulate, alter, store, or delete the electronic prescription prior to its receipt by the pharmacy of the patient’s choice.” S.C. Code Ann. § 44-117-330 (emphasis added). However, the court understands this to stand for the proposition that a pharmacy needs security measures to make sure no one can intercept patient information prior to the pharmacist receiving it.
Next, plaintiffs cite to S.C. Code Ann. § 44-117-340(F), which requires that “[t]he facsimile machine receiving prescription drug orders must be in the prescription department of the pharmacy to protect confidentiality and security.” This provision does suggest that patient information must be kept within the pharmacy setting, as it presumably prevents a fax machine set up in, for example, the photo department from receiving prescription information. However, the court is unconvinced that this provision alone prohibits transfer of PII within the same entity. S.C. Code Ann. § 44-117-350(b) requires pharmacies “provide a mechanism to prevent the disclosure of any information, confidential or otherwise, about patients that was obtained or collected by a pharmacist or pharmacy incidental to the delivery of pharmaceutical care other than as authorized in regulation.” The court fails to see how this requirement factors into the internal/external debаte. Finally, plaintiffs point to S.C. Code Ann. § 44-117-350(c), which requires the pharmacist-in-charge to “establish and maintain written policies and procedures for maintaining the integrity and confidentiality of prescription information and patient health care information” and requires “[a]ll employees of the pharmacy with access to this information . . . to comply with the established policies and procedures.” Again, the court is not sure how this citation plays into the internal/external distinction.
In light of these arguments, the court is unconvinced that plaintiffs have sufficiently alleged a violation of PIPA. Plaintiffs allege that data is transferred between databases that are all within Walgreen Co., and the court finds no support in the language of PIPA for plaintiffs’ narrow interpretation that PIPA prohibits data transfer outside of the pharmacy setting. As such, the court dismisses the claim.
e. Breach of Contract Plaintiffs bring a claim for breach of contract in their amended complaint for Walgreen Co.’s alleged breach of the “terms of an implied contract, insurance agreements, and privacy policies” to “properly maintain and store their PII and to not transfer, receive, and/or use, disclose, or disseminate it in furtherance of its 340B Complete process(es).” Am. Compl. ¶¶ 195–96. Walgreen Co. argues that the claim should be dismissed because plaintiffs fail to identify the terms of any implied contract between Walgreen Co. and plaintiffs.
“A contract is an obligation which arises from actual agreement of the parties
manifested by words, oral or written, or by conduct.” Stanley Smith & Sons v.
Limestone Coll.,
In addition, plaintiffs allege that Walgreen Co.’s use of plaintiffs’ PII violates Walgreen Co.’s insurance agreements and Walgreen Co.’s Notice of Privacy Practices (“NPP”). Beginning with the “insurance agreements,” plaintiffs argue that Walgreen Co. pharmacies “agree to provide pharmaceutical care and services to Plaintiffs in return for claim reimbursement by Plaintiffs’ insurers.” ECF No. 143 at 23. Counsel expanded on this at the hearing, arguing that insurers pay Walgreen Co. on the premise that the patient’s information is kept confidential and as a benefit to the patient, creating an agreement between the parties. However, plaintiffs fail to allege any terms of these insurance agreements nor do they provide any argument as to how they have standing to raise a claim for breaching these supposed agreements when the agreements allegedly exist between insurance companies and Walgreen Co., not between Walgreen Co. and plaintiffs.
With regard to the NPPs, as another court has explained, NPPs “are not
contractual in nature” but instead “inform patients of their rights under federal law—
specifically [HIPAA]—and the duties imposed . . . by these statutory provisions.” Brush
v. Miami Beach Healthcare Grp. Ltd.,
f. Negligence Based on Professional Standards Next, Walgreen Co. contends that plaintiffs’ negligence claim based on breach of duties established by professional standards must be dismissed. First, Walgreen Co. argues that plaintiffs fail to identify any duty of care that Walgreen Co. has breached. Plaintiffs allege that “Walgreens breached its duty to Plaintiffs and Class Members by failing to conform to the privacy practices universally recognized and accepted in the pharmaceutical profession.” Am. Compl. ¶ 211. Plaintiffs allege that those privacy practices are prescribed by the South Carolina Board of Pharmacy, the American Pharmaceutical Association Code of Ethics, and PIPA. Id. ¶ 209. PIPA is discussed in plaintiffs’ negligence per se claim, but plaintiffs fail to cite to any portion of the American Pharmaceutical Association Code of Ethics or standard prescribed by the South Carolina Board of Pharmacy that establishes a duty. In response, plaintiffs argue that Walgreen Co. has a duty to exercise reasonable care when its actions create a risk to others and cites to several cases that plaintiffs argue recognize such a duty in this context, none of which is a South Carolina case. Plaintiffs also argue that they have sufficiently alleged the duties prescribed by the South Carolina Bоard of Pharmacy that require Walgreen Co. to protect pharmacy customers’ PII, which are promulgated in the PPA. Am. Compl. ¶ 221.
Plaintiffs fail to cite to any source of Walgreen Co.’s purported duty to “conform
to the privacy practices universally recognized and accepted in the pharmaceutical
profession.” While plaintiffs contend that the duty prescribed by the South Carolina
Board of Pharmacy is promulgated in the PPA, plaintiffs bring a separate negligence
cause of action based on the PPA, and the paragraph that they cite to, ¶ 221, is within that
cause of action, not the negligence cause of action that is the focus of this discussion.
Moreover, plaintiffs do not even mention the American Pharmaceutical Association Code
of Ethics in their response brief, and they cite to no South Carolina case law to suggest
that Walgreen Co. has any duty in this context. Finally, plaintiffs fail to cite to any South
Carolina law that applies the general proposition that anyone has a duty to exercise
reasonable care when his or her action creates a risk to others to this context. The court is
unconvinced that such a general application of basic negligence law would apply here.
Finally, to the extent plaintiffs are attempting to argue that Walgreen Co. has a common
law duty to maintain the privacy of plaintiffs’ PII, that argument directly contradicts the
Supreme Court of South Carolina’s holding that there is no common law duty of
confidentiality for pharmacists. Evans v. Rite Aid Corp.,
To be sure, something like the American Pharmaceutical Association Code of
Ethics “may be a potential source of guidance on a pharmacist’s duty of care generally,”
Evans v. Rite Aid Corp.,
g. Negligence Based on PPA Walgreen Co. argues that PPA does not establish a relevant duty of care, that PPA does not give rise to a private cause of action, and that plaintiffs fail to plausibly allege that Walgreen Co. violated PPA, meaning this claim should be dismissed. In their response brief, plaintiffs clarify that this cause of action is based on a breach of a standard of care set by PPA, not a violation of PPA. In other words, this cause of action is not a negligence per se claim. However, as discussed above, plaintiffs’ theory of a “breach of a standard of care” is not how negligence claims work. Something like PPA may inform the standard of care, but there has to first be a duty. Once a duty is established, the court looks to the standard of care, which could be informed by PPA, to determine whether that duty was breached. In other words, a negligence claim is based on a breach of a duty, which is informed by a standard of care, not based on a breach of a standard of care. The sole case on which plaintiffs rely, Bibeau v. Shortt, clearly considers violations of PPA in the context of a negligence per se claim. 2006 WL 8443485, at *9 (D.S.C. June 29, 2006) (“These acts violate clear safety standards established in the Pharmacy Practices Act and each supports a separate finding of negligence per se.”).
Plaintiffs argue that there are “PPA-established duties” but cite to no authority
suggesting that to be true. ECF No. 143 at 31. In fact, the Supreme Court of South
Carolina has held just the opposite. Evans v. Rite Aid Corp.,
h. Respondeat Superior and Negligent Training and Supervision Walgreen Co. argues that these claims should be dismissed because the causes of action underlying these claims fail. In response, plaintiffs argue that they have sufficiently alleged these causes of action because they have alleged that Walgreen Co.’s pharmacists-in-charge have allowed plaintiffs’ PII to be transferred out of the pharmacy for unauthorized purposes, failed to establish policies and procedures to maintain the confidentiality of plaintiffs’ PII, failed to maintain adequate security and systems safeguards, and failed to implement and abide by the PIPA, PPA, American Pharmaceutical Code of Ethics, and requirements set forth by the South Carolina Board of Pharmacy, all of which occurred within their scope of employment. Am. Compl. ¶¶ 255–56. Plaintiffs also allege that Walgreen Co. negligently failed to properly train and supervise its pharmacists and pharmacists-in-charge with regard to how 340B Complete operates. Id. ¶ 266.
Respondeat superior is not a cause of action; it is a theory of liability. See Austin
v. Specialty Transp. Servs., Inc.,
i. Unjust Enrichment Walgreen Co. argues that plaintiffs’ unjust enrichment claim should be dismissed because plaintiffs have failed to show that Walgreen Co. has realized any benefit from plaintiffs’ PII, to allege any harm, and to show that it would be unjust for Walgreen Co. to retain that benefit. In response, plaintiffs argue that they have sufficiently alleged that Walgreen Co.’s transfer of plaintiffs’ PII in furtherance of 340B Complete conferred a benefit on Walgreen Co. in the form of additional profits, and that it is unjust for Walgreen Co. to retain those profits because the transfer and use of plaintiffs’ PII was without plaintiffs’ knowledge or consent.
“Unjust enrichment is an equitable doctrine which permits the recovery of that
amount the defendant has been unjustly enriched at the expense of the plaintiff.” Dema
v. Tenet Physician Servs.-Hilton Head, Inc.,
The court begins with Walgreen Co.’s last argument because it is the one that
warrants dismissal of this claim. Walgreen Co. argues that plaintiffs have failed to allege
that a benefit was conferred in a circumstance in which it would be unjust for Walgreen
Co. to retain the benefit. Walgreen Co. relies on a Fourth Circuit case which states that
“three elements encompass the equitable remedy of unjust enrichment and quasi-contract:
the plaintiff must show that (1) he had a reasonable expectation of payment, (2) the
defendant should reasonably have expected to pay, or (3) society’s reasonable
expectations of person and property would be defeated by nonpayment.” Provident Life
& Acc. Ins. Co. v. Waller,
j. Declaratory Relief Walgreen Co. argues this claim should be dismissed because seeking declaratory relief under 28 U.S.C. § 2201 is not an independent cause of action and because it is premised on plaintiffs’ other failed claims. Walgreen Co. also argues that it should be dismissed as inappropriate at this stage of litigation because the merits of plaintiffs’ claims have not been adjudicated yet. Plaintiffs “seek a judicial determination of whether Walgreens has performed, and is performing, the privacy practices and obligations necessary to protect and safeguard Plaintiffs’ and Class Members’ PII from further unauthorized transfer, receipt, and/or use, disclosure, or dissemination.” Am. Compl. ¶ 202.
The Declaratory Judgment Act states that
In a case of actual controversy within its jurisdiction . . . any court of the United States, upon the filing of an appropriate pleading, may declare the rights and other legal relations of any interested party seeking such declaration, whether or not further relief is or could be sought.
28 U.S.C. § 2201. To determine whether a claim for declaratory judgment is properly
alleged, the court must ask “whether the facts alleged, under all the circumstances, show
that there is a substantial controversy, between parties having adverse legal interests, of
sufficient immediacy and reality to warrant the issuance of a declaratory judgment.”
MedImmune, Inc. v. Genentech, Inc.,
Because thе court dismisses all of plaintiffs’ other claims, plaintiffs have failed to allege an “actual controversy” upon which the court could issue a declaratory judgment. Plaintiffs allege that an actual controversy exists relating to “Walgreens’ failure to protect Plaintiffs’ and Class Members’ PII in accordance with applicable state and federal laws and agreements between the parties.” Am. Compl. ¶ 200. However, the court has found that plaintiffs have failed to allege any violation of state or federal law or any breach of an agreement between the parties. The “actual controversy” in plaintiffs’ declaratory judgment claim is premised on their other claims, all of which are dismissed. Absent sufficient allegations of wrongdoing, any declaration as to whether Walgreens was sufficiently protecting plaintiffs’ PII would be abstract and hypothetical. As such, plaintiffs have failed to allege an actual controversy, meaning their declaratory judgment claim must be dismissed.
IV. CONCLUSION For the reasons set forth above, the court GRANTS the motion.
AND IT IS SO ORDERED.
DAVID C. NORTON UNITED STATES DISTRICT JUDGE July 2, 2020
Charleston, South Carolina
Notes
[1] Walgreens originally filed a motion to dismiss the original complaint in which it argued that the court lacked personal jurisdiction over WBA. ECF No. 117. Walgreens filed a new motion to dismiss, which is the one currently before the court, after plaintiffs filed an amended complaint.
[2] In local parlance, this strategy would be called “sandbagging.”
[3] As discussed below, plaintiffs disagree with this conclusion and unsuccessfully attempt to distinguish the two causes of action.
[4] In their response brief, plaintiffs claim that they alleged these elements with regard to the FTCA, citing to several paragraphs of the amended complaint. However, plaintiffs only cite to an allegation that “Walgreens is covered by the mandates of the FTCA, which prohibits unfair and deceptive conduct affecting commerce, a law that has been enforced and interpreted to include a company’s information privacy practices,” Am. Compl. ¶ 119, and conclusory allegations that Walgreen Co. violated the FTCA, id. ¶¶ 169–74.
[5] It is not clear why plaintiffs cited to Merrell Dow Pharma. Inc. v. Thompson,
[7] The court acknowledges that its findings of fact and conclusions of law in its order denying the preliminary injunction are not binding. However, many of the issues that the court considered in that order were purely legal in nature, like its interpretation of PIPA, and absent an argument convincing it otherwise, the court stands by its previous legal analysis.