In 2019, a lawsuit was filed against Express Scripts by five independent pharmacies alleging improper use of patient data in violation of HIPAA.
Express Scripts is the largest pharmacy benefits manager in the United States with its own retail pharmacies and pharmacy service. The five pharmacies were part of the Express Scripts network and were required to submit detailed claims to Express Scripts for processing and reimbursement before dispensing drugs. The pharmacies also needed to include information about the medications in their claims, along with the contact information of their customers.
In the lawsuit, the pharmacies alleged that Express Scripts was in breach of contract and good-faith and fair-dealing covenants, and in violation of HIPAA and the HITECH Act. The pharmacies were required to provide Express Scripts with information about their customers, which it is alleged was then used to switch the customers to Express Script’s mail order service. The pharmacies alleged there was no need to supply that information to confirm coverage and for reimbursement.
“The Pharmacies maintain that [Express Scripts] is using their confidential customer information without authorization to switch their customers to [Express Scripts] own mail-order service when [Express Scripts] should only use the information to confirm customers’ coverage and to reimburse the Pharmacies,” according to the court filing. The pharmacies also alleged the pharmacy benefits manager was engaged in unfair competition and “shared the Pharmacies’ trade secrets with its affiliates in order to steal the Pharmacies’ customers.”
The district court dismissed the lawsuit stating the information provided was not protected and the agreements the pharmacies entered into with Express Scripts allowed the pharmacy benefits manager to pursue mail-order prescription arrangements without violating any good faith agreements or contracts. The district court also ruled that the pharmacies could not sue for a HIPAA violation as there is no private cause of action in HIPAA.
In their appeal against the decision of the district court to dismiss the lawsuit, the pharmacies explained that the decision to dismiss the lawsuit for lack of standing was incorrect as they were not attempting to sue for a HIPAA violation. They also asked for the courts alternative reasoning – “that HIPAA only allows the Pharmacies’ customers, not the Pharmacies, to authorize the use of their confidential health information” – be disregarded. Express Scripts argued that even if it were possible to state a claim under HIPAA, the pharmacies had failed to provide sufficient facts to demonstrate a past or ongoing HIPAA violation.
The pharmacies also claimed in their appeal that Express Scripts was only entitled to received information after claims had been processed, and that the collection of customer information was unnecessary and was only being collected out of self-interest.
The 8th U.S. Circuit Court of Appeals affirmed the lower court’s ruling that it is not possible to sue for a HIPAA violation, that the information provided to Express Scripts was not protected, and the terms of the pharmacies contracts with Express Scripts allowed the pharmacy benefits manager to offer mail-order prescription arrangements to the pharmacies’ customers. The contracts entered into by the pharmacies stated they agreed to cooperate with Express Scripts for the coordination of their customers’ benefits, and mail service dispensing – even through Express Script’s own service – falls within the category of benefits provided to any member.
The Court of Appeals also affirmed the lower courts dismissal of the pharmacies attempted monopolization claim, ruling “the Pharmacies did not plead sufficient facts to meet their “burden of alleging a relevant market in order to state a plausible antitrust claim.”
The post Express Scripts HIPAA-Based Lawsuit Dismissed by Court of Appeals appeared first on HIPAA Journal.