This week, the Arizona Supreme Court revived a HIPAA violation lawsuit filed by a Phoenix man over a privacy violation by a pharmacy employee related to an erectile dysfunction medication prescription.
Greg Shepherd, 50, had visited his doctor for a routine medical appointment in January 2016 and his doctor provided him with a erectile dysfunction medication sample. He received a call from the Costco pharmacy later and was told that the full prescription for the ED medication was available to collect. Shepherd explained that he did not want the medication and cancelled the prescription.
Shepherd called the pharmacy a month later to check whether an unrelated prescription was ready to collect, and the pharmacy informed again him that his ED prescription was still waiting to be collected. Shepherd declined the medication a second time and told the pharmacy to cancel the prescription for the second time.
Shepherd, who had been trying to reconcile with his ex-wife, authorized her to collect an unrelated, regular prescription refill from the pharmacy. When she visited the pharmacy, the pharmacy worker provided both prescriptions to Shepherd’s ex-wife, and the pharmacy worker and his ex-wife allegedly joked about the ED medication. The ED medication was refused by his ex-wife, and when she returned to Shepherd and gave him his regular medication, she informed him that she knew about the ED medication and told him there was no chance of reconciliation. The lawsuit also alleges his ex-wife discussed the ED medication with Shepherd’s children and her friends.
Shepherd filed a complaint with Costco about the privacy violation, and Costco responded and admitted that the discussion between the pharmacy worker and Shepherd’s ex-wife about the ED medication was in violation of the HIPAA Privacy Rule and company policies and issued an apology. Shepherd then took legal action over the privacy violation, with the lawsuit citing a violation of the HIPAA Privacy Rule.
There is no private cause of action in the Federal HIPAA legislation, which means individuals do not have the right to sue for a HIPAA violation. Only the HHS’ Office for Civil Rights and state Attorneys General can take legal action against HIPAA-covered entities for violations of the Health Insurance Portability and Accountability Act Rules.
The lawsuit was dismissed by the Maricopa County Superior Court, as HIPAA does not permit private lawsuits and because state laws provide immunity for healthcare providers over privacy violations that occur when they are acting in good faith. Shepherd appealed, but the Court of Appeals affirmed the dismissal of Shepherd’s claims, aside from the claim of negligent disclosure of medical information.
While there is no private cause of action in HIPAA, Supreme Court Justice William G. Montgomery ruled that the standards of HIPAA can be used in state court to establish privacy violations have occurred in negligence claims. Costco had sought to dismiss the lawsuit based on the lack of a private cause of action, but Montgomery said in his ruling that Shepherd’s lawsuit was not solely filed over violations of the HIPAA Privacy Rule. The lawsuit also alleged violations of regulations governing pharmacies, therefore Superior Court Judge Aimee L. Anderson had dismissed the lawsuit in error.
Costco argued that state laws provide protection for companies acting in good faith, and that without a claim of bad faith it is not possible to show negligence. Montgomery ruled that the lawsuit did not have to include a claim of bad faith, as Shepherd was not aware that Costco would claim immunity under state law.
The case has now been returned to the lower court for further proceedings. While the case has been revived, Shepherd must provide clear and convincing evidence that the pharmacy and the pharmacy worker acted in bad faith by making the disclosure about the ED medication to his ex-wife.
Shepherd’s attorney, Joshua Carden, believes it is possible to demonstrate that this was a bad faith disclosure, as the prescription was cancelled twice by Shepherd and it can be proven that the Costco pharmacy was aware that Shepherd did not want the prescription.
The post Arizona High Court Revives Privacy Lawsuit Stemming from Pharmacy ED Medication Disclosure appeared first on HIPAA Journal.