A patient in Arizona has been granted the right to sue a pharmacy for negligence by the Court of Appeals, overturning a decision made by the trial court. The patient filed a lawsuit against Costco, claiming a violation of the Health Insurance Portability and Accountability Act (HIPAA).
The privacy violation relates to an incident in January 2016, a man was the victim of a privacy violation. He had been sent a sample of an erectile dysfunction drug and was subsequently notified by phone that his entire prescription was ready for collection. After canceling the prescription once, he contacted the pharmacy a month later to discuss a different prescription, only to find that his cancellation had not been processed. He then canceled the prescription again, but it was still not canceled. The man had given his ex-wife permission to collect his regular prescription from the pharmacy. However, the pharmacist made a joke about the man’s uncollected erectile dysfunction prescription and the man believes this caused his attempt to reconcile with his ex-wife to fail. He believes this was an inappropriate disclosure by the pharmacist. The man sued Costco after receiving a letter from them acknowledging the pharmacist had violated their policies and HIPAA Rules by disclosing details of his prescription to his ex-wife.
Despite his allegations of various tort claims relating to the failure to cancel the prescription and the privacy violation, the trial court dismissed his lawsuit. The Arizona Court of Appeals reversed the ruling in part, with Presiding Judge Jennifer M. Perkins overturning the decision on negligence and punitive damages claims. However, the dismissal of all other claims was affirmed. Judge Perkins overturned the trial court’s ruling, declaring that Costco had a duty of care to the plaintiff due to their privacy policies and HIPAA laws. This duty of care was breached, and the case will now go back to a lower court for further proceedings. It is rare for lawsuits to be filed over HIPAA violations due to the lack of a private cause of action. Instead, violations of state laws are normally the basis of legal action taken.
In her ruling, the Judge stated that HIPAA does not override state-law negligence claims for wrongful disclosure of medical information. She went on to state that HIPAA’s requirements can help determine the standard of care in state-law negligence actions, just as common industry practice can establish an alleged wrongdoer’s duty of care. Additionally, she noted that such claims are allowed under Arizona Revised Statutes § 12-2296. This is a momentous case as it is the first ruling in Arizona to accept a negligence claim based on violations of HIPAA Rules has been accepted for the first time in a court ruling.