HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Arizona Court of Appeals Rules Patient Can Proceed with Negligence Claim Based on HIPAA Violation

An Arizona man who sued Costco over a privacy violation and had the lawsuit dismissed by the trial court has had the decision overturned by the Court of Appeals, which ruled that the patient can sue the pharmacy for negligence based on a violation of the Health Insurance Portability and Accountability Act (HIPAA).

The privacy violation in question occurred in 2016. The man had received a sample of an erectile dysfunction drug in January 2016 and received a telephone call from Costco letting him know that his full prescription was ready to be collected. The man cancelled the prescription but when he contacted the pharmacy a month later about a separate prescription, he discovered the cancellation had not been processed. He then cancelled the prescription for a second time but, again, the prescription was not cancelled.

The man subsequently authorized his ex-wife to collect his regular prescription. While at the pharmacy, the pharmacist joked with his ex-wife about the uncollected erectile dysfunction prescription. The man was attempting to reconcile with his ex-wife at the time. The man alleges the impermissible disclosure to his ex-wife was the reason that attempt failed.

The man complained to Costco about the privacy violation and received a letter in reply stating the pharmacist had violated Costco policies and HIPAA Rules by disclosing details of the prescription to his ex-wife. The man subsequently sued Costco alleging a variety of tort claims relating to the failure to cancel the prescription and the privacy violation, but the lawsuit was dismissed by the trials court.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

The ruling was appealed and was partially overturned in the Arizona Court of Appeals. Presiding Judge Jennifer M. Perkins reversed the decision on the negligence and punitive damages claims, although affirmed the dismissal of all other claims.

Judge Perkins ruled that Costco had a duty of care to the plaintiff arising from Costco’s privacy policies and HIPAA laws and that the duty of care was breached. The overturning of the trial court ruling will see the case returned to a lower court for further proceedings.

There is no private cause of action in HIPAA, so it is rare for lawsuits to be filed over HIPAA violations. In most cases where patient privacy has been violated and legal action is taken, lawsuits are filed for violations of state laws. The ruling is the first in the state of Arizona to accept a negligence claim based on violations of HIPAA Rules.

“HIPAA does not preempt state-law negligence claims for wrongful disclosure of medical information. Accordingly, we hold HIPAA’s requirements may inform the standard of care in state-law negligence actions just as common industry practice may establish an alleged tortfeasor’s duty of care and to the extent such claims are permitted under [state law] A.R.S. § 12-2296,” wrote the Judge in her ruling.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.