Doctor concerned with health care law

Breaking news and expert analysis on legal and compliance issues

[Back To Home][Back To Archives]

From Health Law Daily, May 1, 2019

Costco can't use HIPAA to avoid tortious disclosure suit

By Rebecca Mayo, J.D.

HIPAA does not preempt state-law claims for tortious disclosure of healthcare information, but may instead act as a basis for the standard of care providers owe to patients.

Health Insurance Portability and Accountability act of 1996 (HIPAA) (P.L. 104-191) requirements may inform the standard of care in a negligence action for wrongful disclosure of healthcare information. An appeals court in Arizona reversed and remanded part of a patient’s lawsuit against Costco Wholesale Corporation (Costco) for disclosing prescription information to the patient’s ex-wife. The court found that many of the tort claims failed due to the patient giving Costco authorization to share information with his ex-wife, however the pharmacy owed the patient a duty of reasonable care and there was still a question as to whether Costco breached that duty (Shepherd v. Costco Wholesale Corporation, April 30, 2019, Perkins, J.).

The disclosure. At a regular check-up, a patient agreed to try a sample of an erectile dysfunction (ED) medication. The patient’s pharmacy, Costco, contacted him to let him know that his regular prescription and a full prescription of the ED medication were ready for pickup. The patient informed Costco that he did not want the ED prescription, and Costco acknowledged the cancellation. The following month, the patient called Costco to check on the status of the refill of his regular medication and was told that it was ready to pick up along with the ED medication. The patient told Costco again that he did not want the ED medication.

The patient called Costco the next day to authorize his ex-wife to pick up the refill of his regular prescription, as they were working towards reconciling. The ex-wife was given the regular prescription refill along with the ED medication which she did not pay for or accept. The ex-wife joked with a Costco employee about the medication, told the patient’s children and friends about the medication, and allegedly stopped reconciliation efforts with the patient. The patient filed multiple tort claims against Costco. The trial court granted a motion to dismiss filed by Costco and the patient appealed.

Tort claims. On appeal, the court held that the patient authorized Costco to give prescription information to his ex-wife and therefore there was no violation of HIPAA or state statutes, even if the medication was filled erroneously. However, Costco did owe the patient a duty of care to act as a reasonably prudent pharmacy would under these circumstances. Costco’s failure to cancel the prescription after the patient asked twice that it be cancelled, and the employee’s joking with the ex-wife about the medication were enough to withstand dismissal. Therefore, the trial court erred in dismissing the negligence claim.

Immunity. Under state law, a healthcare provider that acts in good faith is not liable for damages in any civil action for the disclosure of medical records. Based on the patient’s allegations that Costco failed to cancel the prescription twice, acknowledged one request but still failed to cancel, and joked with the ex-wife about the prescription, there is a question as to whether Costco acted in good faith. Therefore, Costco was not entitled to dismissal based on immunity.

HIPAA preemption. HIPAA does not create a private cause of action, however the court found that it does not prohibit a private right of action for tortious disclosure of healthcare information. A state-law negligence claim for wrongful disclosure of protected information based on a failure to abide by standard practices mandated by HIPAA does not interfere with government enforcement action authorized by HIPAA, so HIPAA does not preempt such a claim. Therefore, "HIPAA’s requirements may inform the standard of care in state-law negligence actions just as common industry practice may establish an alleged tortfeasor’s duty of care."

The case is No. 1 CA-CV 18-0072.

Attorneys: Joshua W. Carden (Joshua Carden Law Firm PC) for Greg Shepherd. Karen C. Stafford (Cavanagh Law Firm) for Costco Wholesale Corp.

Companies: Costco Wholesale Corp.

MainStory: TopStory CaseDecisions ConfidentialityNews DrugBiologicNews HIPAANews PreemptionNews ArizonaNews

Back to Top

Health Law Daily

Introducing Wolters Kluwer Health Law Daily — a daily reporting service created by attorneys, for attorneys — providing same-day coverage of breaking news, court decisions, legislation, and regulatory activity.


A complete daily report of the news that affects your world

  • View full summaries of federal and state court decisions.
  • Access full text of legislative and regulatory developments.
  • Customize your daily email by topic and/or jurisdiction.
  • Search archives for stories of interest.

Not just news — the right news

  • Get expert analysis written by subject matter specialists—created by attorneys for attorneys.
  • Track law firms and organizations in the headlines with our new “Who’s in the News” feature.
  • Promote your firm with our new reprint policy.

24/7 access for a 24/7 world

  • Forward information with special copyright permissions, encouraging collaboration between counsel and colleagues.
  • Save time with mobile apps for your BlackBerry, iPhone, iPad, Android, or Kindle.
  • Access all links from any mobile device without being prompted for user name and password.