Opinion
2:05-2015-GEB-KJM.
January 11, 2006
ORDER
This motion was determined suitable for decision without oral argument. L.R. 78-230(h).
Defendant Thrifty Payless DBA Rite Aid Corporation ("Rite Aid"), moves to dismiss Plaintiff's causes of action for violation of public policy, negligence, and invasion of privacy under Federal Rule of Civil Procedure 12(b)(6). (Def.'s Mem. of P A in Supp. of Mot. to Dismiss ("Def.'s Mem.") at 2.) Plaintiff opposes the motion.
BACKGROUND
The background section discusses the allegations in Plaintiff's First Amended Complaint, which must be accepted as true for the purposes of a motion to dismiss. (See supra page 3.)
Plaintiff worked for Defendant Mountain Valleys Health Center ("Mountain Valleys") as a physician assistant and nurse practitioner from 2002 until November 2005. (First Am. Compl. ("FAC") ¶¶ 7, 19.) While employed by Defendant Mountain Valleys, Plaintiff and other physician assistants often received prescription recommendations from doctors, transmitted the prescription to a pharmacy, and had the prescription filled for personal use. (Id. ¶ 9.) On one occasion, Plaintiff told a doctor he was extremely depressed and he had taken his girlfriend's Xanax, an anti-depressant prescription drug, on several occasions. (Id. ¶ 7.) The doctor told Plaintiff his use of the drug was appropriate and gave his approval and recommendation. (Id.) Plaintiff called a pharmacy operated by Defendant Rite Aid and told the pharmacist that the doctor recommended his continued use of Xanax. (Id. ¶ 8.) The pharmacy provided Plaintiff with twenty (20) Xanax pills. (Id.)
On August 31, 2004, an officer of the Shasta County Sheriff's Department stopped Plaintiff while he was driving a car. (Id. ¶ 11.) The officer discovered prescription drugs inside the car. (Id.) The Sheriff's Department conducted an investigation into the origin of the prescription drugs, during which it contacted Defendant Mountain Valleys and requested Plaintiff's medical records. (Id. ¶ 12.) Defendant Mountain Valleys did not have any medical records on Plaintiff. (Id ¶ 8.) Defendant Mountain Valleys subsequently called Defendant Rite Aid and obtained Plaintiff's prescription records. (Id. ¶ 14.)
On October 11, 2005, Plaintiff was placed on indefinite administrative leave pending an investigation into his alleged possession of a prescription drug without physician approval. (Id. ¶ 15.) On October 28, 2004, Plaintiff received a letter in which the administrative leave was reaffirmed and Plaintiff was informed he could resume work only if he received a satisfactory evaluation from a licensed mental health professional and/or diversion program. (Id.) Plaintiff visited a mental health professional, but did not admit himself into a substance abuse program. (Id. ¶ 17.) On November 23, 2004, Plaintiff received a letter notifying him that the Board of Directors had voted to terminate his employment. (Id. ¶ 19.)
Plaintiff has sued Defendant Rite Aid alleging that "[i]n wrongfully releasing Plaintiff's medical information, Defendant [Rite Aid] violated public policy by failing to comply with 42 U.S.C. 1320," the Health Insurance Portability and Accountability Act ("HIPAA"). (Id. ¶ 9.) In addition, Plaintiff alleges California state law claims against Defendant Rite Aid for negligence and invasion of privacy. (Id. ¶¶ 51-60.)
DISCUSSION
When considering a motion to dismiss under Rule 12(b)(6), all material allegations in the complaint must be accepted as true and construed in the light most favorable to the plaintiff.Scheuer v. Rhodes, 416 U.S. 232, 236 (1974); Cahill v. Liberty Mut. Ins. Co., 80 F.3d 336, 337-38 (9th Cir. 1996). In addition, the plaintiff is given the benefit of every reasonable inference that can be drawn from the allegations in his complaint. Retail Clerks Int'l Ass'n v. Shermahorn, 373 U.S. 746, 753 n. 6 (1963). Accordingly, a motion to dismiss must be denied "unless it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief."Conley v. Gibson, 355 U.S. 41, 45-46 (1957).
Dismissal is appropriate under Rule 12(b)(6) if the plaintiff fails to state a claim upon which relief may be granted. A plaintiff fails to state claim by either (1) failing to present a cognizable legal theory, or (2) failing to plead sufficient facts to support a cognizable legal theory. Robertson v. Dean Witter Reynolds, Inc., 749 F.2d 530, 533-34 (9th Cir. 1984). "If a complaint is dismissed for failure to state a claim, leave to amend should be granted unless the court determines that allegation of other facts consistent with the challenged pleading could not possibly cure the deficiency." Schreiber Distrib. Co. v. Serv-Well Furniture Co., 806 F.2d 1393, 1401 (9th Cir. 1986).
A. Violation of Public Policy
Defendant Rite Aid argues Plaintiff's claim for violation of public policy seeks to "impermissibly enforce HIPAA" because "the authority to enforce HIPAA resides exclusively with . . . the Secretary of Health and Human Services." (Def.'s Reply at 4.) Plaintiff alleges he "has properly stated a cause of action against Rite Aid for violating public policy by improperly disclosing Plaintiff's personal medical information without his consent as required by [HIPAA]." (Pl.'s Opp'n 4.)
"HIPAA imposes requirements on the Department of Health and Human Services, health plans, and healthcare providers involved in the exchange of health information [in order] to protect the confidentiality of such information. . . ." Johnson v. Quander, 370 F. Supp. 2d 79, 99 (D.D.C. 2005). In addition, HIPAA "provides for both civil and criminal penalties for individuals who improperly handle or disclose individually identifiable health information." Id. However, HIPAA "specifically indicates" that the Secretary of Health and Human Services "shall pursue the action against an alleged offender, not a private individual." Johnson, 370 F. Supp. 2d at 100; Logan v. Dept. of Veterans Affairs, 357 F. Supp. 2d 149, 155 (D.D.C. 2004). Accordingly, "HIPAA does not expressly provide for a private cause of action." O'Donnell v. Blue Cross Blue Shield of Wyoming, 173 F. Supp. 2d 1176, 1178 (D. Wyo. 2001); Logan, 357 F. Supp. 2d at 155.
Furthermore, HIPAA does not impliedly provide for a private cause of action. O'Donnell, 173 F. Supp. 2d at 1179; Logan, 357 F. Supp. 2d at 155; Johnson, 370 F. Supp. 2d at 100. "In order to determine whether a private cause of action is implicit in a statute not expressly providing one, the critical inquiry is whether Congress intended to create a private cause of action."O'Donnell, 173 F. Supp. 2d at 1179. By delegating enforcement of HIPAA to Secretary of Health and Human Services, Congress evinced an intent to preclude enforcement by private individuals.See Alexander v. Sandoval, 532 U.S. 275, 286-287 (2001) ("The express provision of one method of enforcing [a statute] suggests Congress intended to preclude others.") "Review of HIPAA's enforcement provisions reveals no congressional intent to create a private right or remedy." O'Donnell, 173 F. Supp. 2d at 1179.
Therefore, Plaintiff cannot maintain a claim for violation of HIPAA because no express or implied private cause of action exists under the statute. Although Plaintiff seeks to circumvent this limitation by alleging a claim for "violation of public policy" premised on Defendant Rite Aid's failure to comply with HIPAA, to recognize such a claim would be tantamount to creating a cause of action where none exists. See Alexander, 532 U.S. at 286-287 ("Raising up causes of action where a statute has not created them [is not] a proper function . . . for federal tribunals."). Therefore, Defendant Rite Aid's motion to dismiss Plaintiff's cause of action for "violation of public policy" with prejudice is granted because Plaintiff has "fail[ed] to present a cognizable legal theory,"Robertson, 749 F.2d at 533-34, and "the allegation of other facts . . . could not possibly cure the deficiency," Schreiber, 806 F.2d at 1401.
B. Negligence
Defendant Rite Aid also seeks dismissal of Plaintiff's negligence claim, arguing it did not have a duty to withhold Plaintiff's prescription records from Defendant Mountain Valleys. (Def.'s Mem. 7.) Plaintiff contends Defendant Rite Aid "improperly seeks to argue the factual merits of the case" by "giving after the fact excuses why it disclosed Plaintiff's private information." (Pl.'s Opp'n at 3.) Plaintiff asserts the motion to dismiss should be denied because he has properly alleged the existence of a duty as well as the other requisite elements of a negligence claim. (Id. at 7.)
To state a negligence claim, Plaintiff must allege "four elements: (1) duty, (2) breach, (3) causation, and (4) damages."Ileto v. Glock Inc., 349 F.3d 1191, 1203 (9th Cir. 2003). Plaintiff alleges "Defendants had a duty not to disclose medical information without adequate cause or a proper subpoena. Defendants breached this duty by disclosing Plaintiff's medical information to a third party without adequate cause or a proper subpoena. As a proximate result . . . Plaintiff has become mentally traumatized, distressed and aggravated." (FAC ¶¶ 51-54.) Therefore, Plaintiff has alleged each of the four elements of negligence. Although Defendant Rite Aid contends it does not owe Plaintiff a duty, on a motion to dismiss, all material allegations in the complaint must be accepted as true and construed in the light most favorable to the plaintiff.Scheuer, 416 U.S. at 236. Consequently, Defendant Rite Aid's motion to dismiss Plaintiff's negligence claim is denied.
C. Invasion of Privacy
Defendant Rite Aid argues Plaintiff's invasion of privacy claim should be dismissed because "Plaintiff did not have a reasonable expectation that his pharmacy records would remain private from Mountain Valleys. . . ." (Def.'s Mem. at 6.) Plaintiff contends Defendant Rite Aid "improperly seeks to argue the factual merits of the case" by "giving after the fact excuses why it disclosed Plaintiff's private information." (Pl.'s Opp'n at 3.) Plaintiff argues that the dismissal motion should be denied because he "has pled facts showing . . . [he] had a reasonable expectation of privacy in keeping confidential his personal medical information. . . ." (Id. at 8.)
To state an invasion of privacy claim, Plaintiff must allege (1) a legally protected privacy interest, 2) a reasonable expectation of privacy under the circumstances, and (3) conduct by Defendant Rite Aid amounting to a serious invasion of a protected privacy interest. Egan v. Schmock, 93 Fed. Supp. 2d 1090, 1094-95 (N.D. Cal 2000) (citing Hill v. National Collegiate Athletic Association, 7 Cal. 4th 1, 39-40 (1994)). "A `reasonable' expectation of privacy is an objective entitlement founded on broadly based and widely accepted community norms. . . . [and is] relative to the customs of the time and place, to the occupation of the plaintiff and to the habits of his neighbors and fellow citizens." Hill, 7 Cal. 4th at 37. Plaintiff alleges Defendant Rite Aid released his prescription records to his employer, Defendant Mountain Valleys, without his consent, adequate cause or proper subpoena. (FAC ¶ 56.) Giving Plaintiff "the benefit of every reasonable inference that can be drawn from . . . [his] allegations," a reasonable person could have an expectation of privacy under the circumstances alleged by Plaintiff. Therefore, Defendant Rite Aid's motion to dismiss Plaintiff's invasion of privacy claim is denied because it does not appear "beyond a doubt" that Plaintiff can prove "no set of facts in support of his claim which would entitle him to relief." Conley, 355 U.S. at 45-46.
CONCLUSION
Plaintiff's claim against Defendant Rite Aid for violation of public policy is dismissed with prejudice. Defendant Rite Aid's motion to dismiss is otherwise denied.
IT IS SO ORDERED.