An Arizona patient received a free sample for an erectile dysfunction (“ED”) medication from his doctor. Later, his pharmacy, Costco, called the patient to tell him that his full prescription was ready. The patient told Costco that he did not want the prescription and would not be picking it up.
One month later, the patient called Costco about another prescription. Costco again told the patient that his ED prescription was ready, and the patient again told Costco he did not want that prescription. The next day, the patient called Costco to give his ex-wife permission to pick up is prescription. The patient and his ex-wife were considering reconciling. A Costco employee gave the ex-wife the patient’s prescription – and the ED prescription, and joked with the ex-wife about the patient taking so long to pick it up. The ex-wife ended reconciliation attempts with the patient.
The patient sued Costco for negligence and other claims. The trial court granted Costco’s motion to dismiss, But, on appeal, the Arizona Court of Appeals reversed the trial court’s decision, and found that “HIPAA’s requirements may inform the standard of care in a negligence action for wrongful disclosure of healthcare information.”
This case is noteworthy. States vary in the extent to which they allow patients to sue for HIPAA related violations. This case moves the line closer to the patient’s point of view – at least in Arizona. Arizona is now one more state where plaintiffs can bring a privacy right negligence claim at the state level – and, HIPAA can be used as the standard to prove that negligence.