Press America, Inc is a mail service used by CVS Pharmacy. Because of an accidental disclosure of 41 individual’s protected health information, CVS Pharmacy sued Press America, Inc. CVS Pharmacy works as a business associate of a health plan with a contract to provide mail order pharmacy service. CVS Pharmacy subcontracted Press America, Inc to perform the mailings. In this business set-up, both entities signed a business associate agreement and are bound to follow the HIPAA Rules.
Allegedly, Press America violated the HIPAA Privacy Rule when it accidentally disclosed PHI to unauthorized persons. The mismailing incident and privacy breach are the fault of Press America, but it was CVS Pharmacy that had to pay $1.8 million to the health plan for violating the performance standard stipulated in the CVS Pharmacy’s contract with the health plan. In addition, CVS Pharmacy was required to notify the 41 plan members whose PHI was improperly disclosed because of the HIPAA Privacy Rule.
As a response to the situation, CVS Pharmacy filed a lawsuit against its mail service to seek indemnification under the terms of its BAA and common law principles. The alleged mismailing was the subcontractor’s doing. Its negligence caused the privacy breach that led to the payment of $1.8 million to the health plan. CVS Pharmacy also alleged the mail service owed it a duty of reasonable care and that duty of care was breached.
Press America, Inc sought the dismissal of the claim of negligence, and in its motion the dismissal of the lawsuit. It challenged the validity of CVS Pharmacy’s contractual obligation to the health plan that demanded the $1.8 million payment. The mail service also argued that its indemnification provisions were not intended to pay for this type of payment.
But the federal court sided with CVS Pharmacy’s lawsuit and declined to dismiss the lawsuit. The court ruled that the indemnification provisions of the subcontractor were broad enough to encompass CVS Pharmacy’s payment to the health plan. Since the subcontractor was not a party or third party beneficiary to the contract, it cannot challenge the contractual obligation. The court ruled in favor of CVS Pharmacy regarding the alleged negligence based on the breach of duty.
CVS Pharmacy suffered a sizeable loss because of the mail service’s negligence. Aside from the payment to the health plan, it also covered the cost of sending notification letters to the plan members whose PHI was compromised. Hence, the court denied the motion to dismiss the case.