Opinion
1:17-cv-190-GHW
01-03-2018
CVS PHARMACY, INC., and CAREMARK RX, LLC, Plaintiffs, v. PRESS AMERICA, INC., Defendant.
MEMORANDUM OPINION AND ORDER
:
Since at least 2011, plaintiffs CVS Pharmacy, Inc. ("CVS Pharmacy") and Caremark Rx LLC ("Caremark") (collectively "CVS") have contracted to provide pharmacy benefit management ("PBM") services to beneficiaries of various health plans. CVS relies on Press America, Inc. ("Press America") to assist with the printing and mailing of information to the plans' beneficiaries.
One of CVS's clients is International Business Machines Corporation ("IBM"). Pursuant to its contract with IBM, CVS is responsible for, among other things, providing beneficiaries of IBM's health plan with mail order pharmacy services. Press America performs the mailing on CVS's behalf. Given the nature of the mailings, they often contain private health information ("PHI").
In August 2012, Press America incorrectly addressed mail containing beneficiaries' PHI, resulting in 41 unauthorized disclosures of IBM health plan beneficiaries' PHI. As a result of those disclosures, CVS credited IBM $1,845,000 and subsequently sought reimbursement from Press America. Press America declined, and CVS filed this action on January 10, 2017. On May 18, 2017, Press America moved to dismiss, arguing that it is not obligated to indemnify CVS for the payment to IBM. Because CVS has sufficiently stated claims for breach of contract, contractual indemnification, common law indemnification, and negligence, Press America's motion to dismiss must be denied.
Unless otherwise noted, the facts are taken from the amended complaint and are accepted as true for the purposes of this motion. See, e.g., Carlin v. Davidson Fink LLP, 852 F.3d 207, 212 (2d Cir. 2017).
A. Agreements Between CVS and Press America
On or about October 1, 2011, CVS entered into a Master Service Agreement and Statement of Work with Press America, whereby Press America agreed to provide printing and mailing services to CVS. Am. Compl. (ECF No. 28), ¶ 13. Section 2 of the Master Service Agreement stated that Press America would provide services that met "the minimum CVS Standards," which were set forth in the Statement of Work. Master Ag. § 2 (ECF No. 28-1, at 1). The parties also entered into a second Statement of Work, ECF No. 28-1, at 23, effective May 1, 2012 through April 30, 2013, specifically outlining the printing services for which Press America would be responsible. Am. Compl. ¶¶ 2, 13. Both Statements of Work were incorporated into the Master Agreement (collectively, the "Master Agreement"), which was submitted together with the Amended Complaint.
In addition, CVS entered into a Business Associate Agreement with Press America (the "Business Associate Agreement"), ECF No. 28-2, which was intended to encourage compliance with the relevant privacy laws, including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Am. Compl. ¶ 14. In the Business Associate Agreement, Press America agreed not to use or disclose PHI except as specifically permitted by contract. Id. These provisions reflected CVS's "particular[] concern[]" about liability stemming from the disclosure of its clients' PHI. Id. ¶ 16.
Moreover, each of CVS's contracts with Press America contain indemnity provisions. Am. Compl. ¶ 16. Under the Master Agreement, Press America "agrees (i) to indemnify and hold harmless CVS from and against any claims, liabilities, and damages to the extent same are due to [Press America's] negligence, willful misconduct, or breach of this Agreement or [Press America's] failure to comply with or abide by any applicable law . . . ." Master Ag. § 8.1. In addition, the Master Agreement requires that Press America maintain insurance sufficient to cover any losses incurred by CVS that were caused by Press America's disclosure of PHI. Am. Compl. ¶ 18 (citing Master Ag. § 8.3). Similarly, the Business Associate Agreement provides that Press America will:
indemnify and hold harmless CVS and any of its officers, directors, employees, or agents from and against any claim, cause of action, liability, damage, cost, or expense . . . arising out of or in connection with any breach of the terms of this Agreement, any Breach of Private Information under the control of [Press America] or its agents or subcontractors that requires notification under the HIPAA Rules or state law, or any failure to perform its obligations with respect to Private Information by [Press America], it[s] officers, employees, agents, or any person or entity under [Press America's] direction or control.Bus. Assoc. Ag. § 6.0.
B. Agreements Between CVS and IBM
Pursuant to a "series of agreements" between CVS and IBM that were ultimately memorialized in an agreement that went into effect on January 1, 2012 (the "IBM Contract"), CVS "agreed to administer IBM's managed care pharmacy program." Am. Compl. ¶ 15. The IBM Contract provides, among other things, that CVS would correspond with IBM employees about their prescribed medications via U.S. Mail. Id. Pursuant to the Second Statement of Work, Press America became responsible for "services that would be performed for CVS in connection with its work" under the IBM Contract. Id. ¶ 13.
Most relevant for purposes of this motion, the IBM Contract requires that CVS comply with certain "performance standards." Am. Compl. ¶ 26 (quoting IBM Ag. § 3.13). According to the IBM Contract, the "performance standards and any related fee adjustments are not intended to operate as liquidated damages, a penalty, or as an exclusive remedy but rather to correspond to the level of service being provided." Am. Compl. ¶ 27 (quoting IBM Ag. § 3.13). One such performance standard, entitled "Protection of Confidential Participant Information," sets forth a fee that CVS must pay to IBM in the event of a "Protection of Information Failure," which is defined as:
[any] use or disclosure of Confidential Participant Information, Protected Health Information or Personal Data (collectively "Personal Information") in the possession or control of CVS Caremark, its employees, agents, independent contractors or Subcontractors that is not provided for or permitted by this Agreement, including Breaches of Unsecured Protected Health Information and certain disclosures that would not qualify as a Breach of Unsecured Protected Health Information but that result in disclosure of Personal Information to an improper or incorrect third party, or that would require notice to the Participant under state or federal law as a data breach.Id. ¶¶ 29, 30 & Ex. D. The fee is three percent of the annual fees at risk "for each Protection of Information Failure." Am. Compl. ¶ 31 (emphasis in the original).
C. The PHI Disclosures
On or about August 2, 2012, Press America improperly disclosed the PHI of beneficiaries of health plans administered by CVS, including those in the IBM health plan, when it mailed PHI to the wrong beneficiaries. Am. Compl. ¶¶ 3, 23. It was ultimately determined that there were a total of 41 disclosures of IBM beneficiaries' PHI. Id. ¶¶ 23, 32. Consequently, on December 31, 2012, CVS credited IBM $1,845,000—calculated as three percent of the annual fee amount at risk for the performance guarantees ($45,000), multiplied by the total number of disclosures (41). Id. ¶¶ 33, 34. Thereafter, CVS sought reimbursement from Press America. Despite CVS's demands, however, Press America refused to pay. Id. ¶¶ 4, 5, 38. Press America now contends, among other things, that it is not obligated to reimburse CVS because (i) the performance standard provision of the IBM Contract is an unenforceable penalty; and (ii) Press America could not have agreed to indemnify CVS for it payments to IBM because Press America was unaware of the terms of the IBM Contract. See Def.'s Mem. of Law (ECF No. 45), at 2.
2. LEGAL STANDARDS
A. Rule 12(b)(6)
Under Federal Rule of Civil Procedure 8(a)(2), a complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." Rule 8 "does not require detailed factual allegations, but it demands more than an unadorned, the-defendant-unlawfully-harmed-me accusation." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). To survive a motion to dismiss pursuant to Rule 12(b)(6), a complaint "must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Iqbal, 556 U.S. at 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. (citing Twombly, 550 U.S. at 556). "To survive dismissal, the plaintiff must provide the grounds upon which his claim rests through factual allegations sufficient 'to raise a right to relief above the speculative level.'" ATSI Commc'ns, Inc. v. Shaar Fund, Ltd., 493 F.3d 87, 98 (2d Cir. 2007) (quoting Twombly, 550 U.S. at 555).
Determining whether a complaint states a plausible claim is a "context-specific task that requires the reviewing court to draw on its judicial experience and common sense." Iqbal, 556 U.S. at 679. The court must accept all facts alleged in the complaint as true and draw all reasonable inferences in the plaintiff's favor. Burch v. Pioneer Credit Recovery, Inc., 551 F.3d 122, 124 (2d Cir. 2008) (per curiam). However, a complaint that offers "labels and conclusions" or "naked assertion[s]" without "further factual enhancement" will not survive a motion to dismiss. Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 555, 557).
"In considering a motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6), a district court may consider the facts alleged in the complaint, documents attached to the complaint as exhibits, and documents incorporated by reference in the complaint." DiFolco v. MSNBC Cable L.L.C., 622 F.3d 104, 111 (2d Cir. 2010) (citations omitted). "Where a document is not incorporated by reference, the court may never[the]less consider it where the complaint 'relies heavily upon its terms and effect,' thereby rendering the document 'integral' to the complaint." Id. (quoting Mangiafico v. Blumenthal, 471 F.3d 391, 398 (2d Cir. 2006)). Finally, the Court may also consider "matters of which judicial notice may be taken." Goel v. Bunge, Ltd., 820 F.3d 554, 559 (2d Cir. 2016) (citation omitted).
3. DISCUSSION
A. Press America Is Not Entitled to Dismissal of CVS's Breach of Contract or Contractual Indemnification Claims
The Master Agreement is "governed by and construed in accordance with the laws of the State of New York, without reference to the conflict of law provisions thereof." Master Ag. § 13.8. "To state a claim for breach of contract under New York law, 'the complaint must allege: (i) the formation of a contract between the parties; (ii) performance by the plaintiff; (iii) failure of defendant to perform; and (iv) damages.'" Orlander v. Staples, Inc., 802 F.3d 289, 294 (2d Cir. 2015) (quoting Johnson v. Nextel Commc'ns, Inc., 660 F.3d 131, 142 (2d Cir. 2011)).
Press America does not dispute that CVS sufficiently pled these elements with respect to both the Master Agreement and the Business Associate Agreement. See Am. Compl. ¶¶ 42-65. However, Press America argues that it is not obligated to indemnify CVS under those agreements for several reasons, as set forth below.
i. The Amended Complaint Sufficiently Alleges the Existence and Relevant Terms of the IBM Contract
Press America contends that the Amended Complaint "does not contain any factual material regarding what contract(s) existed between CVS and IBM on the date of the incident in question." Not. of Mot. (ECF No. 44), at 3. However, the Amended Complaint alleges that, "[p]ursuant to a series of agreements memorialized in the IBM Contract, which was effective January 1, 2012, CVS through Caremark, had agreed to administer IBM's managed care pharmacy program." Am. Compl. ¶ 15. A copy of the IBM Contract is attached to the Amended Complaint. Furthermore, the Amended Complaint sets forth the particular provision of the IBM Contract implicated by the PHI disclosures (§ 3.13) and attaches descriptions of the relevant performance standard. As a result, the Court finds that the Amended Complaint plausibly pleads that the IBM Contract existed and was in effect at the time of the disclosures.
ii. The Indemnification Provisions of the Master Agreement and Business Associate Agreement are Broad Enough to Capture CVS's Payment to IBM
The language of the Master Agreement and the Business Associate Agreement, on its face, is sufficiently broad to capture CVS's payment to IBM. The Master Agreement provides that Press America will "indemnify and hold harmless CVS from and against any claims, liabilities, and damages to the extent same are due to [Press America's] negligence." Master Ag. § 8.1 (emphasis added). Similarly, the Business Associate Agreement provides that Press America will "indemnify and hold harmless CVS . . . from and against any claim, cause of action, liability, damage, cost, or expense . . . arising out of or in connection with any breach of the terms of this Agreement, [or] any Breach of Private Information under the control of" Press America. Bus. Assoc. Ag. § 6.0 (emphasis added). "The New York Court of Appeals has held that the phrase 'arising out of' is 'ordinarily understood to mean originating from, incident to, or having connection with.'" Turner Const. Co. v. Kemper Ins. Co., 198 F. App'x 28, 30 (2d Cir. 2006) (summary order) (quoting Maroney v. N.Y. Cent. Mut. Fire Ins. Co., 5 N.Y.3d 467, 472 (2005) (internal quotations omitted)); see also Burlington Ins. Co. v. N.Y.C. Transit Auth., 29 N.Y.3d 313, 324 (2017) (collecting cases). There is no express exclusion in either of these provisions for contractual obligations that may be triggered by Press America's negligence. In the absence of such an exclusion, the language of the contract encompasses the payments to IBM triggered by Press America's negligent acts.
iii. The Court Cannot Determine, at this Time, Whether the Payment Provisions of the IBM Contract are Within the Scope of the Parties' Intendment
According to Press America, the indemnity provisions of the Master Agreement and Business Associate Agreement cannot be read to include payments made pursuant to the IBM Contract because the IBM Contract did not exist when Press America entered into the agreements with CVS. Def.'s Mem. of Law, at 15. As a result, Press America argues, neither it nor CVS could have intended that CVS's payment obligations under the IBM Contract would be covered by indemnification provisions of the Master Agreement or the Business Associate Agreement.
"It is axiomatic that an indemnity contract is interpreted to effectuate the intention of the parties as expressed in the unequivocal language of the contract." Gibbs-Alfano v. Burton, 281 F.3d 12, 19 (2d Cir. 2002) (citing Weissman v. Sinorm Deli, Inc., 88 N.Y.2d 437, 446 (1996)). "An indemnification agreement will not be read to impose obligations upon the indemnitor which are neither disclosed at the time of its execution nor reasonably within the scope of [i] its terms and [ii] the over-all intendment of the parties at the time of its making." Tokyo Tanker Co. v. Etra Shipping Corp., 536 N.Y.S.2d 75, 76 (1st Dep't 1989) (emphasis added). In other words, indemnity provisions "should not be extended to include damages which are neither expressly within its terms nor of such character that it is reasonable to infer that they were intended to be covered under the contract." Id. at 78. Even accepting Press America's assertion that no obligation to indemnify CVS for payments to IBM was disclosed when Press America executed its agreements with CVS, the Court cannot conclude, at this stage, that such indemnification is not "reasonably within the scope of" the agreements' terms or the "over-all intendment of the parties." Id. at 76. As already discussed, the Amended Complaint supports a plausible inference that a breach of the IBM Contract was "due to" Press America's negligence, such that it could be subject to the Master Agreement's indemnification provision and that CVS's payment to IBM was a cost "arising out of or in connection with" a breach of PHI that was within Press America's control, which could be covered by the Business Associate Agreement.
With respect to the parties' "over-all intendment," the Court acknowledges that where a party is "under no legal duty to indemnify, a contract assuming that obligation must be strictly construed to avoid reading into it a duty which the parties did not intend to be assumed." Hooper Assocs., Ltd. v. AGS Computers, Inc., 74 N.Y. 2d 487, 491 (1989) (citations omitted); see also St. Paul Mercury Ins. Co. v. M&T Bank Corp., No. 12-cv-6322-JFK, 2014 WL 1468452, at *4 (S.D.N.Y. Apr. 11, 2014) ("Indemnification clauses should be read to implement the parties' intentions, and must be strictly construed to avoid inferring duties that they did not intend to create."); Niagara Frontier Transp. Auth. v. Tri-Delta Constr. Corp., 487 N.Y.S.2d 428, 431 (4th Dep't 1985) (an indemnity provision "should be construed so as to encompass only that loss and damage which reasonably appear to have been within the intent of the parties" as evidenced by "the language, purpose or surrounding facts and circumstances"), aff'd 65 N.Y.2d 1038 (1985). At the motion to dismiss stage, however, the Court may consider only the allegations of the Amended Complaint and the documents incorporated therein. As described previously, the allegations and language of the relevant indemnification provisions are broad. Further, the Amended Complaint plausibly alleges that the terms of the IBM Contract existed—as a series of agreements—at least by the time CVS and Press America entered into the second Statement of Work. See Am. Compl. ¶ 13. Therefore, taking CVS's allegations as true and drawing all reasonable inferences in its favor, the Court cannot determine, at this time, whether the IBM Contract's payment provisions were intended to be covered by the indemnity provisions of the Master Agreement and/or the Business Associate Agreement.
iv. The Court Cannot Determine, at this Time, Whether the IBM Contract's Payment Provision was a Proximate Cause of CVS's Damages
According to Press America, "[t]he penalty agreed to confidentially . . . is at most a cause in fact, but not the proximate cause, of CVS's claimed damages." Not. of Motion, at 3. As a result, Press America maintains that all causes of action arising out of the contractual provisions—namely, Counts I, II, III, and IV—must be dismissed. This argument is premature. "[S]orting among the potential causes and determining which parties are liable is a task for a jury, not a judge deciding a motion to dismiss." MF Glob. Holdings Ltd. v. PricewaterhouseCoopers LLP, 43 F. Supp. 3d 309, 315 (S.D.N.Y. 2014). "For now, it is sufficient that [the plaintiff] has 'state[d] a claim to relief that is plausible on its face.'" Id. (quoting Twombly, 550 U.S. at 570).
v. Press America Does Not Have Grounds to Challenge the Enforceability of the IBM Agreement
Press America argues at length that the provision of the IBM Contract pursuant to which CVS made its payment is unenforceable and, therefore, that any payment by CVS was voluntary and not subject to indemnification. However, Press America does not have a contractual right to claim that the agreement is unenforceable, and there is no basis for the Court to conclude that it was not enforceable at the time that CVS made its payment to IBM. "[A]bsent a contractual relationship there can be no contractual remedy." Suffolk Cnty. v. Long Island Lighting Co., 728 F.2d 52, 63 (2d Cir. 1984). "A non-party to a contract governed by New York law lacks standing to enforce the agreement in the absence of terms that 'clearly evidence[ ] an intent to permit enforcement by the third party' in question." Premium Mortg. Corp. v. Equifax, Inc., 583 F.3d 103, 108 (2d Cir. 2009) (quoting Fourth Ocean Putnam Corp. v. Interstate Wrecking Co., 66 N.Y.2d 38, 45 (1985)). Unenforceability is an affirmative defense that may be raised by (i) a party in privity of contract with the defendant; or (ii) a third-party beneficiary of that contract. Hillside Metro Assocs. v. JPMorgan Chase Bank, Nat'l Ass'n, 747 F.3d 44, 49 (2d Cir. 2014) (A contractual relationship "exists if the plaintiff is in privity of contract with the defendant or is a third-party beneficiary of the contract."); see also Karamath v. U.S. Bank, N.A., No. 11-cv-557-NGG-RML, 2012 WL 4327613, at *7 (E.D.N.Y. Aug. 29, 2012) ("plaintiff is not a party to the [Pooling and Servicing Agreement] . . . and is not a third-party beneficiary . . . and therefore has no standing to challenge the validity of that agreement"), report and recommendation adopted, No. 11-cv-1557-NGG-RML, 2012 WL 4327502 (E.D.N.Y. Sept. 20, 2012). Press America could have contracted for the right to take up payment disputes or to approve CVS's contracts with potential clients or otherwise contracted for the right to challenge on CVS's behalf the enforceability of any payment obligations that might be the subject of a claim for indemnification, but there is no indication on the current record that it did so. Press America is not a party to or third-party beneficiary of the IBM Agreement. Therefore, Press America does not have the capacity to attack the enforceability of the underlying agreement between IBM and CVS.
The enforceability of the IBM Contract's payment provision may ultimately impact the Court's evaluation of whether CVS is entitled to indemnification. For example, Press America may argue that it was not within the intendment of the parties for it to be liable for reimbursement of an unenforceable penalty. But an evaluation of that argument is different from a direct attack on the enforceability of the provision, which Press America launches here, and the Court rejects.
Press America cites Broadway Houston Mack Dev. LLC v. Kohl, 870 N.Y.S.2d 748 (Sup. Ct. Suffolk Cnty. 2008), aff'd 897 N.Y.S.2d 505 (2d Dep't 2010) and Fed. Nat. Mortg. Ass'n v. Bridgeport Portfolio, LLC, 150 Conn. App. 610, 617, 92 A.3d 966 (Conn. App. 2014), a case applying Connecticut state law, for the proposition that an alleged third-party indemnitor may challenge the enforceability of the contract giving rise to its alleged indemnification obligation. These cases are inapposite. In Broadway Houston, the plaintiff paid the full amount of a lien rather than pursuing other, less expensive means of discharging it. Id. at 755. The court denied the plaintiff's summary judgment motion, finding, in part, that "[t]o the extent that the plaintiff made a business decision" to elect payment in full rather than the less expensive available remedies, it "knowingly assumed the risk of possible double payment." Id. at 756. The court also considered the fact that the plaintiff had several options and selected the most expensive one—payment in full. Similarly, in affirming this decision, the Second Department noted that the plaintiff "failed to demonstrate that [its] payments were necessary to protect its legal or economic interests." 897 N.Y.S.2d at 506. This case is fundamentally different because, unlike in Broadway Houston, CVS had only one option with respect to the amount owed IBM under the IBM Contract. In Bridgeport Portfolio, the court cites Connecticut state law for the proposition that a personal guarantor of a mortgage had standing on the basis of his "real interest" in a judgment of strict foreclosure. 150 Conn. App. at 617.
B. Implied Indemnity Theories
i. CVS's Claim for Common Law Indemnification Survives the Motion to Dismiss Because it is Adequately Pleaded and Because it is Unclear at this Time Whether the IBM Contract is Enforceable
"Under New York law, common-law (or implied) indemnity 'is a restitution concept which results in a shifting of the loss because to fail to do so would result in the unjust enrichment of one party at the expense of the other.'" Amguard Ins. Co. v. Getty Realty Corp., 147 F. Supp. 3d 212, 220 (S.D.N.Y. 2015) (quoting Facilities Dev. Corp. v. Miletta, 584 N.Y.S.2d 491, 495 (3d Dep't 1992) (internal quotations omitted)); see also CSC Scientific Co., Inc. v. Manorcare Health Servs., Inc., 867 F. Supp. 2d 368, 377 (S.D.N.Y. 2011) ("Common law or implied indemnification is a 'quasi-contract' doctrine rooted in principles of equity and fairness conceptually related to restitution"); Mas v. Two Bridges Assocs. by Nat. Kinney Corp., 75 N.Y.2d 680, 690 (1990) ("Implied indemnity is a restitution concept which permits shifting the loss because to fail to do so would result in the unjust enrichment of one party at the expense of the other.").
"Under New York law, an indemnitor must bear some fault for the damages suffered by the indemnitee, whether on account of negligence, equitable considerations, or statutory requirements." In re Sept. 11 Litig., 751 F.3d 86, 94 (2d Cir. 2014). "In New York, '[a] cause of action for common-law indemnification can be sustained only if: (1) the party seeking indemnity and the party from whom indemnity is sought have breached a duty to a third person, and (2) some duty to indemnify exists between them.'" Highland Holdings & Zito I, L.P. v. Century/ML Cable Venture, No. 06-cv-181-GBD, 2007 WL 2405689, at *4 (S.D.N.Y. Aug. 24, 2007) (quoting Ins. Co. of State of Pennsylvania v. HSBC Bank USA, 829 N.Y.S.2d 511, 518 (1st Dep't 2007) (citations omitted)), aff'd sub nom. In re Century/ML Cable Venture, 311 F. App'x 455 (2d Cir. 2009). "The duty that forms the basis for the liability arises from the principle that 'every one is responsible for the consequences of his own negligence, and if another person has been compelled . . . to pay the damages which ought to have been paid by the wrongdoer, they may be recovered from him.'" Raquet v. Braun, 90 N.Y.2d 177, 183 (1997) (quoting Oceanic Stream Nav. Co. v. Compania Transatlantica Espanola, 134 N.Y. 461, 468 (1892)). Significantly, "the 'key element' of a common law indemnification claim 'is not a duty running from the indemnitor to the injured party, but rather is a separate duty owed the indemnitee by the indemnitor.'" Perkins Eastman Architects, P.C. v. Thor Engineers, P.A., 769 F. Supp. 2d 322, 329-30 (S.D.N.Y. 2011) (quoting Raquet, 90 N.Y.2d at 183).
Press America incorrectly asserts that the duty must run from Press America to IBM. Def. Mem. of Law at 20; Reply at 8.
CVS's allegations satisfy these requirements. CVS alleges that the PHI disclosures were "due solely to Press America's improper conduct and negligence." Am. Compl. ¶ 78. CVS further alleges that, although it was "in no way responsible" for the disclosures, CVS was "required to notify those affected" which "significantly damage[d]" its reputation and goodwill with its clients. Id. ¶¶ 79, 81. Finally—although it appears elsewhere in the Amended Complaint—CVS alleges that it was owed a "duty of reasonable care in a manner consistent with the knowledge and ability possessed" by Press America, a vendor of printing and mailing services. Am. Compl. ¶ 86. CVS also alleges elsewhere in the Amended Complaint that "[b]oth Press America and CVS were well aware of the inherent risks associated with mailing PHI and other sensitive information to patients." Id. ¶ 16. Considering the allegations of the Amended Complaint as a whole, the Court accepts, at this stage, that CVS has sufficiently alleged that it is owed a duty by Press America by virtue of the nature of their relationship, and that the duty was breached.
According to Press America, CVS "may not 'recover in quasi contract where the parties have a valid, enforceable contract that governs the same subject matter' as the quasi contract claim." Def. Mem. of Law, at 21 (quoting Murray Bresky Consultants, Ltd. v. N.Y. Comp. Manager's Inc., 968 N.Y.S.2d 595, 600 (3d Dep't 2013) and 4Kids Entm't, Inc. v. Upper Deck Co., 797 F. Supp. 2d 236, 248-49 (S.D.N.Y. 2011)). Press America is correct that "a valid and enforceable contract generally precludes recovery in quasi-contract for losses arising from the same subject matter." CSC Scientific Co., 867 F. Supp. 2d at 377; see also Int'l Techs. Mktg., Inc. v. Verint Sys., Ltd., 157 F. Supp. 3d 352, 370 (S.D.N.Y. 2016) ("plaintiff may not recover under a quasi-contractual theory when the parties had a valid contract governing their relationship"). But here, it is too soon to determine whether there was a "valid and enforceable" contract "governing the same subject matter." Indeed, Press America argues that the disclosures are not covered by the indemnification provisions in question. Cf. CSC Scientific Co., 867 F. Supp. 2d at 378 ("Here, the parties expressly defined [defendant's] indemnification obligations in what is conceded to be a valid and unambiguous written agreement.") (emphasis added); Clark-Fitzpatrick, Inc. v. Long Island R.R. Co., 70 N.Y.2d 382, 389 (1987) ("It is impermissible . . . to seek damages in an action sounding in quasi contract where the suing party has fully performed on a valid written agreement, the existence of which is undisputed, and the scope of which clearly covers the dispute between the parties.") (emphasis added). For these reasons, the motion to dismiss is denied, without prejudice to renewal in later summary judgment motion practice or at trial.
j. CVS's Claim for Negligence is Plausibly Pleaded
"Under New York law . . . a plaintiff must establish three elements to prevail on a negligence claim: (1) the existence of a duty on defendant's part as to plaintiff; (2) a breach of this duty; and (3) injury to the plaintiff as a result thereof." Aegis Ins. Servs., Inc. v. 7 World Trade Co., L.P., 737 F.3d 166, 177 (2d Cir. 2013) (quoting Alfaro v. Wal-Mart Stores, Inc., 210 F.3d 111, 114 (2d Cir. 2000)). CVS sufficiently alleges each of these elements. See Am. Compl. ¶¶ 85-93. First, CVS alleges that "Press America owed CVS a duty of reasonable care in a manner consistent with the knowledge and ability possessed by such a vendor." Id. ¶ 86. Second, CVS alleges that "Press America breached its duty of reasonable care to CVS by, among other things, negligently disclosing PHI." Id. ¶ 87. Third, CVS alleges that it was damaged by Press America's negligence because, among other things, it was required to pay IBM, conduct an "exhaustive investigation" into the extent of the disclosures, "assess the extent of various HIPAA compliance issues," and notify the affected customers. Id. ¶¶ 88-91.
Press America's only argument directed at CVS's negligence claim is that the payment provision in the IBM Contract was not the proximate cause of CVS's damages. However, for the reasons previously stated, this argument is premature. Accordingly, Press America has not demonstrated that CVS failed to plausibly plead negligence.
4. CONCLUSION
For the foregoing reasons, Defendant's motion to dismiss is DENIED. The Clerk of Court is directed to close the motion at ECF No. 44.
SO ORDERED. Dated: January 3, 2018
New York, New York
/s/_________
GREGORY H. WOODS
United States District Judge