Civil Procedure, Torts & HIPAA: Pleading Claim for Negligent Disclosure of Medical Information

Shepherd v. Costco Wholesale Corp., No. CV-19-0144-PR (March 8, 2021) (J. Montgomery) https://www.azcourts.gov/Portals/0/OpinionFiles/Supreme/2021/ASC-CV190144%20-%203-8-2021%20-%20FILED%20-%20OPINION.pdf

PLAINTIFF NEED NOT ALLEGE BAD FAITH OR REBUT THE HIPAA GOOD FAITH PRESUMPTION IN HIS COMPLAINT WHEN ASSERTING A CLAIM OF NEGLIGENT DISCLOSURE OF MEDICAL INFORMATION

Plaintiff twice informed the defendant pharmacy Costco to cancel his erectile dysfunction [E.D.] prescription. Thereafter he asked his ex-wife, with whom he was trying to reconcile, to pick up his regular medical prescription. When she went to the pharmacy, the pharmacist gave her the prescription for both the regular medication and the E.D. prescription. The two joked about it before the wife refused to accept the E.D. medication.  She then told the plaintiff she knew about the E.D. medication and no longer wanted to be with him. She later told plaintiff's children and friends about the E.D. medication. Plaintiff complained to the pharmacist and received in response an admission that the Health Insurance Portability and Accountability Act [HIPAA] and Costco's privacy policies had been violated.  Plaintiff  then sued alleging negligence, breach of fiduciary duty, fraud, negligent  misrepresentation, intentional infliction of emotional distress,  intrusion upon seclusion, and  public  disclosure of private facts based on Costco's “public  disclosure  of  an  embarrassing  medication  that  [he] twice rejected.”

The trial court granted defendant's Rule 12(b)(6) motion finding A.R.S. § 12-2296 provided defendant immunity from suit and that plaintiff's claims were all preempted but HIPAA. The Arizona Court of Appeals affirmed the dismissal except for the claim of negligent disclosure of medical information. The Arizona Supreme Court reversed in part the trial  court and remanded, while vacating in part the decision of the court of appeals.

A.R.S. § 12-2296 provides healthcare providers with immunity from liability for damages, if they acted in good faith when disclosing medical information. It is presumed healthcare providers act in good faith but this presumption will be rebutted by clear and convincing evidence of bad faith. That said, a plaintiff is not required to plead  in his complaint that the disclosure was in bad faith or that there is clear and convincing evidence to defeat the good faith presumption, provided sufficient facts are pled  to support the conclusion the disclosure was made in bad faith.

Good faith under the statute is defined as “honest belief, the absence of malice and the absence of a design to defraud or to seek an unconscionable advantage.”

Further, while HIPAA does not create a private cause of action, it likewise does not prohibit a state law claim for negligent disclosure of medical information.

While a company's policies may not establish a standard of care, they may inform it. Thus allegations in the complaint of such violations may support a factual basis for bad faith.