An Arizona man who submitted a legal action against Costco in relation to a privacy violation and had the lawsuit thrown out by the trial court has had the decision overturned by the Court of Appeals, which ruled that the patient can sue the pharmacy for negligence in relation to a violation of the Health Insurance Portability and Accountability Act (HIPAA).
The privacy violation in question took place in 2016. The man had was sent a sample of an erectile dysfunction drug in January 2016 and was contacted by telephone by Costco advising him know that his full prescription was ready to be collected. The man cancelled the prescription but when he got in touch with the pharmacy a month later about a different prescription, he discovered the cancellation had not been completed. He then cancelled the prescription another time but, again, the prescription was not cancelled.
The man subsequently authorized his ex-wife to pick up his regular prescription. While at the pharmacy, the pharmacist made a comment to his ex-wife about the uncollected erectile dysfunction prescription. The man was trying to reconcile with his ex-wife at the time. The man claims that the impermissible disclosure to his ex-wife was the reason that attempt failed.
The man got in touch with to Costco about the privacy violation and received a letter as a response stating the pharmacist had breached Costco policies and HIPAA Rules by sharing details of the prescription to his ex-wife. The man then sued Costco claiming a variety of tort claims relating to the failure to cancel the prescription and the privacy violation, but the lawsuit was thrown out by the trials court.
The ruling was appealed and was partially overturned in the Arizona Court of Appeals. Presiding Judge Jennifer M. Perkins overturned the decision on the negligence and punitive damages claims, although affirmed the dismissal of all other allegations.
Judge Perkins ruled that Costco had a duty of care towards the plaintiff arising from Costco’s privacy policies and HIPAA laws and that the duty of care was violated. The overturning of the trial court ruling will see the case sent to a lower court for additional proceedings.
There is no private cause of action allowed in HIPAA, so it is rare for lawsuits to be submitted in relation to HIPAA violations. In most instances where patient privacy has been breached and legal action is taken, legal actions are submitted for violations of state laws. The ruling is the first in the state of Arizona to allow a negligence claim based on violations of HIPAA Rules.
The Judge, in her ruling, wrote: “HIPAA does not preempt state-law negligence claims for wrongful disclosure of medical information. Accordingly, we hold HIPAA’s requirements may inform the standard of care in state-law negligence actions just as common industry practice may establish an alleged tortfeasor’s duty of care and to the extent such claims are permitted under [state law] A.R.S. § 12-2296.”
