The Arizona Supreme Court revived a HIPAA violation legal case that a man from Phoenix filed because of a privacy violation by a pharmacy worker associated with an erectile dysfunction medicine prescription.
Greg Shepherd, aged 50, had consulted his doctor for a routine medical consultation in January 2016. His physician gave him an erectile dysfunction drug sample. Later, the Costco pharmacy called him and said that he can collect all the prescriptions for the ED medication. Shepherd said that he did not like the medicine and canceled the prescription.
Shepherd gave the pharmacy a call a month later to determine whether an unrelated prescription order was ready for collection, and the pharmacy again said to him that his ED medication was still due for pick up. Shepherd refused the medication a second time and informed the pharmacy to cancel the prescription order for the second time.
Shepherd, who had been wanting to get back with his ex-wife, authorized her to get an unrelated, regular prescribed medicine refill from the drug store. When she went to the pharmacy, the pharmacy employee released both prescriptions to Shepherd’s ex-spouse, and the pharmacy staff and his ex-wife allegedly joked about the ED prescription. The ex-spouse refused the ED medication, and when she met Shepherd and gave him his regular medication, she told him that she knew about the ED medicine and said to him she won’t reconcile with him. The case additionally alleges his ex-wife talked about the ED medicine with Shepherd’s children and her buddies.
Shepherd filed with Costco a complaint regarding the privacy breach, and Costco responded and admitted that the conversation between the pharmacy employee and Shepherd’s ex-spouse concerning the ED medication breached the HIPAA Privacy Rule and pharmacy policies and sent an apology. Shepherd subsequently took legal action regarding the privacy violation, and the lawsuit cited a breach of the HIPAA Privacy Rule.
Under the Federal HIPAA legislation, there is no private cause of action, and so individuals have no right to prosecute for a HIPAA violation. The HHS’ Office for Civil Rights and state Attorneys General alone could take legal action against HIPAA-covered entities for violating the Health Insurance Portability and Accountability Act Rules.
The Maricopa County Superior Court dismissed the lawsuit, as HIPAA does not support private lawsuits and since state regulations provide immunity for healthcare organizations for privacy violations that happen when they are acting in good faith. Shepherd submitted an appeal, but the Court of Appeals reaffirmed the dismissal of Shepherd’s claims, apart from the claim of negligent disclosure of health information.
Although there’s no private cause of action in HIPAA, Supreme Court Justice William G. Montgomery said that the requirements of HIPAA may be used in state court to demonstrate the occurrence of privacy violations in negligence claims. Costco had tried to get the case dismissed based on the insufficiency of a private cause of action, however, Montgomery stated in his ruling that Shepherd’s legal action was not only filed in relation to violations of the HIPAA Privacy Regulation. The lawsuit furthermore alleged breach of pharmacy rules, consequently Superior Court Judge Aimee L. Anderson mistakenly terminated the legal action.
Costco contended that state rules give protection for organizations acting in good faith and that without a claim of bad faith it isn’t possible to prove negligence. Montgomery ruled that the case didn’t require the inclusion of a claim of bad faith since Shepherd wasn’t aware that Costco would claim immunity under state legislation.
The case was already returned to the lower court for the next proceedings. Even though the case was revived, Shepherd needs to offer clear and strong evidence that the drug store and its worker acted in bad faith when disclosing the ED medicine to his ex-wife.
Joshua Carden, Shepherd’s attorney, feels it can demonstrate that this was a case of bad faith disclosure because the prescription was canceled twice by Shepherd and it can be confirmed that the Costco pharmacy has knowledge that Shepherd did not want to get the prescription.