Opinion
No. CV-19-0144-PR
03-08-2021
Greg SHEPHERD, Plaintiff/Appellant, v. COSTCO WHOLESALE CORPORATION, Defendant/Appellee.
Joshua W. Carden (argued), Joshua Carden Law Firm, P.C., Scottsdale, Attorney for Greg Shepherd Karen C. Stafford (argued), Cassandra V. Meyer, The Cavanagh Law Firm, P.A., Phoenix, Attorneys for Costco Wholesale Corporation
Joshua W. Carden (argued), Joshua Carden Law Firm, P.C., Scottsdale, Attorney for Greg Shepherd
Karen C. Stafford (argued), Cassandra V. Meyer, The Cavanagh Law Firm, P.A., Phoenix, Attorneys for Costco Wholesale Corporation
JUSTICE MONTGOMERY authored the opinion of the Court, in which CHIEF JUSTICE BRUTINEL, VICE CHIEF JUSTICE TIMMER and JUSTICES BOLICK and LOPEZ joined.
Justice Andrew Gould and Justice James P. Beene have recused themselves from this matter.
JUSTICE MONTGOMERY, opinion of the Court:
¶1 We are called upon in this case to determine what a plaintiff must allege for a claim of negligent disclosure of medical information to withstand a motion to dismiss based on the immunity provided by A.R.S. § 12-2296, and the extent to which the Health Insurance Portability and Accountability Act ("HIPAA") may be relied on for a claim of negligence.
¶2 Section 12-2296 affords healthcare providers immunity from liability for damages if they acted in good faith when disclosing medical information pursuant to applicable law. While acting in good faith is presumed, the presumption may be rebutted by clear and convincing evidence. We hold that a plaintiff does not have to allege bad faith or rebut the good faith presumption in his complaint when asserting a claim of negligent disclosure of medical information. We also hold that HIPAA may inform the standard of care in a negligence claim.
I. Background
¶3 Greg Shepherd visited his physician for a check-up and a refill of his usual prescription. He also received a sample of an erectile dysfunction ("E.D.") medication. Thereafter, Shepherd went to Costco Pharmacy ("Costco") to pick up his regular prescription and was notified that a full prescription of the E.D. medication was ready, too. Shepherd said that he did not want the E.D. prescription and instructed the Costco employee to cancel it. The employee acknowledged the request.
This case comes to us on appeal from a motion to dismiss pursuant to Arizona Rule of Civil Procedure 12(b)(6), we therefore take as true the facts set forth in Shepherd's operative complaint. Cullen v. Auto-Owners Ins. Co. , 218 Ariz. 417, 419 ¶ 7, 189 P.3d 344, 346 (2008).
¶4 Shepherd called Costco the next month to check on his regular prescription refill. An employee told him that the regular and E.D. prescriptions were ready. Shepherd again stated that he did not want the E.D. prescription and, again, his request was acknowledged.
¶5 Shepherd called back the next day, asking if his ex-wife, with whom he was exploring possible reconciliation, could pick up his regular prescription. The employee stated she could and that it was ready. The employee did not tell Shepherd, though, that the E.D. prescription was still available for pick up, as well.
¶6 When Shepherd's ex-wife went to Costco, the employee gave her both prescriptions. However, she did not accept the E.D. prescription, and the two joked about it. Upon returning to Shepherd, she told him she knew about the E.D. medication and no longer wanted to be with him, ending any reconciliation effort. She later told Shepherd's children and friends about the E.D. medication.
¶7 Shepherd complained to Costco headquarters about the disclosure of the E.D. prescription and received a written response acknowledging a violation of HIPAA and Costco's privacy policy. Shepherd then sued Costco, alleging negligence, breach of fiduciary duty, fraud, negligent misrepresentation, intentional infliction of emotional distress, intrusion upon seclusion, and public disclosure of private facts based on Costco's "public disclosure of an embarrassing medication that [he] twice rejected." Shepherd further alleged that had he known Costco failed to cancel the E.D. prescription, he would not have sent his ex-wife to pick up his regular prescription.
¶8 Costco moved to dismiss Shepherd's complaint pursuant to Arizona Rule of Civil Procedure 12(b)(6), asserting that § 12-2296 provided immunity from all his claims and that the claims were also precluded by HIPAA. The trial court granted the motion and dismissed the entire complaint with prejudice, finding that Costco was entitled to immunity from suit under § 12-2296, that the claims were preempted by HIPAA, and that Shepherd failed to allege sufficient facts to support his claims.
¶9 The court of appeals affirmed the dismissal of all Shepherd's claims, except his claim for negligent disclosure of medical information. Shepherd v. Costco Wholesale Corp. , 246 Ariz. 470, 479 ¶ 38, 441 P.3d 989, 998 (App. 2019). With respect to this claim, the court referenced Shepherd's allegations of trying to cancel the prescription, Costco's acknowledgment of at least one of the requests, and the exchange between the Costco employee and Shepherd's ex-wife to conclude that Shepherd "may be able to prove some set of facts showing Costco did not act in good faith." Id. at 478 ¶ 31, 441 P.3d at 997. The court also held that HIPAA did not preclude his negligence claim for wrongful disclosure of medical information and that HIPAA's requirements may inform the standard of care in a negligence action. Id. at ¶ 34.
¶10 We accepted review of Costco's petition to consider the extent to which the provisions of § 12-2296 provide immunity from a claim of negligent disclosure of medical information and whether HIPAA can inform the standard of care in a negligence claim, which are issues of first impression and statewide importance. We have jurisdiction under article 6, section 5(3) of the Arizona Constitution.
II. Discussion
¶11 We review de novo the dismissal of a complaint pursuant to Rule 12(b)(6), Conklin v. Medtronic, Inc. , 245 Ariz. 501, 504 ¶ 7, 431 P.3d 571, 574 (2018), as well as issues of statutory interpretation, Nicaise v. Sundaram , 245 Ariz. 566, 567 ¶ 6, 432 P.3d 925, 926 (2019).
¶12 Costco argues that Shepherd's negligence claim should be dismissed as a matter of law given the qualified immunity provided by § 12-2296 and because HIPAA does not permit a private right of action. We address each argument in turn.
A. Qualified Immunity
¶13 Costco's main argument is that Shepherd's complaint fails to plead facts establishing bad faith by Costco. Therefore, he has failed to rebut the good faith presumption in § 12-2296, leaving Costco immune from his claim of negligence and requiring dismissal as a matter of law.
¶14 We note at the outset that a complaint need not set forth every fact that may be associated with a claim. Anserv Ins. Servs., Inc. v. Albrecht , 192 Ariz. 48, 49 ¶ 5, 960 P.2d 1159, 1160 (1998). Instead, "Arizona follows a notice pleading standard, the purpose of which is to ‘give the opponent fair notice of the nature and basis of the claim and indicate generally the type of litigation involved.’ " Cullen , 218 Ariz. at 419 ¶ 6, 189 P.3d at 346 (2008) (quoting Mackey v. Spangler , 81 Ariz. 113, 115, 301 P.2d 1026 (1956) ); Ariz. R. Civ. P. 8(a)(2) (requiring a plaintiff to set forth "a short and plain statement of the claim showing that the pleader is entitled to relief").
¶15 We next note that Costco raised the immunity afforded by § 12-2296 as an affirmative defense in a motion to dismiss. See Ariz. R. Civ. P. 12(b)(6) ; Chamberlain v. Mathis , 151 Ariz. 551, 554, 729 P.2d 905, 908 (1986) (noting that immunity is an affirmative defense which can be raised in a motion to dismiss). But because "[a] complaint need not anticipate an affirmative defense," Shepherd was not required to specifically address § 12-2296 in his complaint. Keck v. Kelley , 16 Ariz. App. 163, 166, 492 P.2d 412 (1972) (citing Bohmfalk v. Vaughan , 89 Ariz. 33, 39–40, 357 P.2d 617 (1960) ); see also Foremost-McKesson Corp. v. Allied Chem. Co. , 140 Ariz. 108, 112, 680 P.2d 818, 822 (App. 1983) ("A plaintiff in a negligence action cannot be required to affirmatively plead and prove the negative of an affirmative defense, e.g., that it was not contributorily negligent." (citing Merit Ins. Co. v. Colao , 603 F.2d 654, 659 (7th Cir. 1979) )). Therefore, given the minimal requirements of Arizona's notice pleading standard and the lack of any requirement to address an affirmative defense, it is clear that Shepherd's complaint was not deficient due to a failure to allege bad faith on the part of Costco or to rebut the good faith presumption of § 12-2296. It was therefore error for the trial court to grant the motion to dismiss on this basis.
¶16 Our conclusion does not mean that the qualified immunity under § 12-2296 may never be successfully raised in a motion to dismiss. To raise an affirmative defense in a motion to dismiss, though, the facts to establish the defense must appear in the complaint. Chamberlain , 151 Ariz. at 554, 729 P.2d at 908 (confirming that "[d]efendant properly raised the immunity defense in his motion to dismiss because its factual framework was established in plaintiffs’ complaint"); Sierra Madre Dev., Inc. v. Via Entrada Townhouses Ass'n , 20 Ariz. App. 550, 552, 514 P.2d 503 (1973) ("Affirmative defenses, such as privilege, may be raised and determined on a motion to dismiss where the facts constituting the defense appear ... on the face of the complaint or counterclaim." (citations omitted)). Yet, rather than establishing the affirmative defense under § 12-2296, Shepherd's complaint contains allegations from which he "may be able to prove some set of facts showing Costco did not act in good faith." Shepherd , 246 Ariz. at 478 ¶ 31, 441 P.3d at 997. Shepherd's pleadings thus establish that dismissal of his claim was error.
¶17 Finally, we observe that some amount of discovery may need to occur in most cases to permit a plaintiff to develop clear and convincing evidence to rebut the good faith presumption as the statute explicitly permits. Regardless, we express no opinion as to the actual merits of Shepherd's claim or whether Costco may successfully reassert the immunity afforded by § 12-2296 in a motion for summary judgment following remand.
B. Good Faith
¶18 Because what constitutes good faith pursuant to § 12-2296 will arise on remand and the parties have briefed the issue, we proceed to define the term. Big D Const. Corp. v. Court of Appeals , 163 Ariz. 560, 563, 789 P.2d 1061, 1064 (1990) (noting that "reluctance to consider a moot or abstract question is solely a matter of prudential or judicial restraint").
¶19 Section 12-2296 states:
A health care provider ... that acts in good faith under this article is not liable for damages in any civil action for the disclosure of ... information contained in medical records ... that is made pursuant to this article or as otherwise provided by law. The health care provider ... is presumed to have acted in good faith. The presumption may be rebutted by clear and convincing evidence.
While several terms within § 12-2296 are defined elsewhere in article 7.1, good faith is not.
"Healthcare provider" is defined by A.R.S. § 12-2291(5), what constitutes "medical information" is defined by A.R.S. § 12-2291(6), and what "is made pursuant to this article or as otherwise provided by law" is set forth in A.R.S. §§ 12-2292 and -2294 and codified in HIPAA's privacy standards at 45 C.F.R. § 164.510.
¶20 Our goal in statutory interpretation is to effectuate the legislature's intent. State ex rel. DES v. Pandola , 243 Ariz. 418, 419 ¶ 6, 408 P.3d 1254, 1255 (2018). "The best indicator of that intent is the statute's plain language. ..." SolarCity Corp. v. Ariz. Dep't of Revenue , 243 Ariz. 477, 480 ¶ 8, 413 P.3d 678, 681 (2018). In construing a specific provision, we may also consider similar statutes for guidance, Stambaugh v. Killian , 242 Ariz. 508, 509 ¶ 7, 398 P.3d 574, 575 (2017), and we may consider dictionary definitions where a statute does not define a term, DBT Yuma, L.L.C. v. Yuma Cnty. Airport Auth. , 238 Ariz. 394, 396 ¶ 9, 361 P.3d 379, 381 (2015).
¶21 The parties and courts below differ on the source for and substance of a definition of good faith. The court of appeals used dictionary definitions as well as our definition of good faith from Stewart v. Thornton , 116 Ariz. 107, 110, 568 P.2d 414, 417 (1977) : "honesty in fact in the conduct or transaction concerned." Shepherd , 246 Ariz. at 477–78 ¶ 30, 441 P.3d at 996–97. Stewart involved the determination of the rights of a holder of a promissory note in the context of an interstate real estate transaction. Stewart , 116 Ariz. at 108, 568 P.2d at 415. Given the context of the transaction and the issues under review, we used the Uniform Commercial Code ("UCC") to define the operative terms, including good faith. Id. at 109–10, 568 P.2d at 416–17 (citing UCC § 1-210(19), now § 1-210(20), codified at A.R.S. § 47-1201(20) ).
¶22 Shepherd argues that a definition of good faith should have subjective and objective components similar to the UCC definition of good faith at A.R.S. § 47-8102(A)(10), which "for purposes of the obligation of good faith in the performance or enforcement of contracts or duties within this chapter, means honesty in fact and the observance of reasonable commercial standards of fair dealing." Citing to Concord Servicing Corp. v. JPMorgan Chase Bank, N.A ., to underscore his point, he insists that a definition limiting good faith to "honesty in fact" is insufficient to provide protection for medical records privacy because that would only require "a pure heart and an empty head." No. CV-12-00438-PHX-JAT, 2014 WL 2865557, at *6 (D. Ariz. June 24, 2014) (considering whether bank acted in good faith in paying fraudulently endorsed checks where it had no knowledge of the fraud (quoting First Interstate Bank of Or., N.A. v. Wilkerson , 128 Or.App. 328, 876 P.2d 326, 330 (1994) )). He thus urges us to adopt a definition of good faith that includes a requirement that a healthcare provider act in a commercially reasonable manner.
¶23 Costco, on the other hand, cites Ramirez v. Health Partners of S. Ariz. , 193 Ariz. 325, 972 P.2d 658 (App. 1998), to define good faith. Ramirez considered whether a hospital was entitled to qualified immunity under what is now A.R.S. § 36-856(A), which is part of the Revised Uniform Anatomical Gift Act ("UAGA"). Id. at 326 ¶ 1, 972 P.2d at 659. Like this case, Ramirez addressed qualified immunity with a statutory presumption of good faith where the term was not defined. Id. at 329–30 ¶ 15, 972 P.2d at 662–63. Ramirez , quoting Nicoletta v. Rochester Eye & Human Parts Bank, Inc. , 136 Misc.2d 1065, 519 N.Y.S.2d 928, 930 (N.Y. Sup. Ct. 1987) (Good faith, Black's Law Dictionary 623 (5th ed. 1979)), observed that courts had consistently defined good faith under the UAGA as an "honest belief, the absence of malice and the absence of a design to defraud or to seek an unconscionable advantage." Ramirez , 193 Ariz. at 330 ¶ 15, 972 P.2d at 663 (internal quotation marks omitted); see also Bond v. Messerman , 162 Md.App. 93, 873 A.2d 417, 432 (2005) (reviewing disclosure of medical records and utilizing the same definition with reference to Black's Law Dictionary ).
¶24 Between the UCC definition of good faith and the definition provided in Ramirez , we conclude that Ramirez ’s definition is better suited for determining qualified immunity under § 12-2296. The UCC definition, as illustrated by its application in Stewart and Concord Servicing Corp. , is necessarily concerned with the commercial nature of a transaction. Similarly, Shepherd's proffered definition is specifically focused on "good faith in the performance or enforcement of contracts or duties within this chapter," which addresses investment securities. A.R.S. § 47-8102(A)(10).
¶25 However, the disclosure of medical records addressed by § 12-2296 can occur outside of the context of a commercial transaction. For example, § 12-2294(C) discusses disclosure to a healthcare provider to provide diagnosis or treatment to a patient, to an ambulance attendant for transferring or providing services to a patient, to a legal representative to obtain legal advice, and to a patient's third party payor or contractor. Therefore, a definition that is focused on the conduct of a healthcare provider, regardless of the nature of the context in which the disclosure occurs, is more appropriate. Furthermore, "[b]ecause both statutes use the term ‘[good faith]’ for a common purpose, it is proper to apply a common definition to that term." State v. Buhman , 181 Ariz. 52, 56, 887 P.2d 582, 586 (App. 1994). We thus conclude that a healthcare provider acts in good faith where it acts under an honest belief, without malice or a design to defraud or to seek an unconscionable advantage.
C. HIPAA
¶26 Costco also argues that Shepherd's negligence claim fails as a matter of law because HIPAA does not provide for a private right of action. Therefore, it cannot support a negligence per se claim or be used to establish the standard of care for negligence. Additionally, permitting a HIPAA cause of action undermines the immunity afforded by § 12-2296. For the following reasons, we disagree.
1. Private Right of Action
¶27 Costco is correct that HIPAA does not provide a private right of action. Garmon v. Cnty. of Los Angeles , 828 F.3d 837, 847 (9th Cir. 2016) ("HIPAA itself provides no private right of action." (quoting Webb v. Smart Document Sols., LLC , 499 F.3d 1078, 1081 (9th Cir. 2007) )). No court has held otherwise, and neither do we. But, as the court of appeals noted, HIPAA does not preclude state law tort claims. Shepherd , 246 Ariz. at 478 ¶ 33, 441 P.3d at 997 (citing R.K. v. St. Mary's Med. Ctr., Inc. , 229 W.Va. 712, 735 S.E.2d 715, 724 (2012) ("[S]tate common-law claims for the wrongful disclosure of medical or personal health information are not inconsistent with HIPAA. Rather ... such state-law claims compliment HIPAA by enhancing the penalties for its violation and thereby encouraging HIPAA compliance.")). Other jurisdictions have reached the same conclusion, as well. Lawson v. Halpern-Reiss , 210 Vt. 224, 212 A.3d 1213, 1217 ¶ 10 (2019) ("HIPAA ... does not preempt causes of action arising under state common or statutory law imposing liability for ‘health care providers’ breaches of patient confidentiality.’ " (quoting Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C. , 314 Conn. 433, 102 A.3d 32, 35, 45–48 (2014) )); Yath v. Fairview Clinics, N.P. , 767 N.W.2d 34, 50 (Minn. Ct. App. 2009) ("Rather than creating an ‘obstacle’ to HIPAA, Minnesota Statutes section 144.335 supports at least one of HIPAA's goals by establishing another disincentive to wrongfully disclose a patient's health care record."); Sheldon v. Kettering Health Network , 40 N.E.3d 661, 672 (Ohio Ct. App. 2015) (concluding that a state common law claim "enhances the protection of confidentiality of medical information"); see also Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,582 (Dec. 28, 2000) (characterizing a private right of action as "a greater penalty" for purpose of comparing state laws to HIPAA provisions and concluding that "the fact that a state law allows an individual to file a lawsuit to protect privacy does not conflict with the HIPAA penalty provisions"). While it is clear that HIPAA does not provide for a private right of action, it is equally clear that it does not prohibit a state law claim for negligent disclosure of medical information and thus does not preclude Shepherd's negligence claim.
2. Negligence Per Se
¶28 Costco argues that Shepherd solely relies on HIPAA for his claim of negligence, which amounts to an impermissible negligence per se claim. However, in addition to HIPAA, the complaint references regulations governing pharmacies and Costco's privacy policy.
Costco has cited to Shepherd's reference to negligence per se in his appellate briefs. Our review, though, is limited to what we find in Shepherd's complaint.
¶29 With respect to its privacy policy, Costco asserts that it cannot be used to establish the standard of care. While Costco is correct that a company's policies may not establish the standard of care, they may inform it. Costco's own citations prove the point. See Bryan v. S. Pac. Co ., 79 Ariz. 253, 260, 286 P.2d 761 (1955) (stating "that ‘[w]hile a violation of [an employer's safety] rule would not constitute negligence per se, it would be a circumstance for the jury to consider on the issue of respondent's negligence’ " (quoting Powell v. Pac. Elec. Ry. Co. , 35 Cal.2d 40, 216 P.2d 448, 453 (1950) )); Quijano v. United States , 325 F.3d 564, 568 (5th Cir. 2003) (concluding that under Texas law, "a hospital's internal policies and bylaws may be evidence of the standard of care ," even though these rules alone cannot establish it (emphasis added)); Wal-Mart Stores, Inc. v. Wittke , 202 So. 3d 929, 930–31 (Fla. Dist. Ct. App. 2016) ("Internal policies and procedures may be admissible if they are relevant to the standard of care. ..."); Bedell v. Williams , 2012 Ark. 75, 386 S.W.3d 493, 500 (2012) (addressing whether an internal policy can create a legal duty). Shepherd's reference to Costco's company policies thus provides an additional source to inform the standard of care beyond the sole provisions of HIPAA, as does his reference to regulations governing pharmacies. Lombardo v. Albu , 199 Ariz. 97, 100–01 ¶ 15, 14 P.3d 288, 291–92 (2000) (stating that "an administrative regulation may form the basis for a standard of conduct even where it does not so provide" (citing Restatement (Second) of Torts § 285 (Am. Law Inst. 1965) )). Therefore, the argument that Shepherd is relying solely on HIPAA to establish the standard of care for his negligence claim is incorrect.
Costco also cites to FFE Transp. Servs., Inc. v. Fulgham , 154 S.W.3d 84, 92–93 (Tex. 2004), but that case simply concluded that a company's policies cannot establish the standard of care, which is not the same as informing it.
¶30 Consequently, Costco's citation to Skinner v. Tel-Drug, Inc. for the proposition that " ‘permit[ting] HIPAA regulations to define per se the duty and liability for breach is no less than a private action to enforce HIPAA, which is precluded,’ " is inapposite. No. CV-16-00236-TUC-JGZ (BGM), 2017 WL 1076376, at *3 (D. Ariz. Jan. 27, 2017) (quoting Sheldon , 40 N.E.3d at 674 ) Skinner specifically addressed dismissal of a negligence per se claim and, as discussed above, we otherwise agree with Skinner ’s conclusion that HIPAA does not provide for a private right of action.
3. Standard of Care
¶31 To the extent Costco argues that any use of HIPAA to inform the standard of care in a negligence claim is precluded, we disagree. While some courts have concluded otherwise, we find the weight of authority permitting the use of HIPAA to inform the standard of care persuasive. See Placencia v. I-Flow Corp. , No. CV10-2520 PHX DGC, 2012 WL 5877624, at *6 (D. Ariz. Nov. 20, 2012) (noting that "Arizona law permits Plaintiffs to present evidence of federal law violations as part of proving state-law tort claims" (citing Wendland v. AdobeAir, Inc. , 223 Ariz. 199, 205 ¶ 22, 221 P.3d 390, 396 (App. 2009) ) (holding that OSHA standards could provide evidence of the standard of care and collecting cases from other jurisdictions reaching same result)); Fung-Schwartz v. Cerner Corp. , No. 17-CV-233 (VSB), 2018 WL 4386087, at *8 (S.D.N.Y. Sept. 13, 2018) (finding that HIPAA can be used to establish standard of care in a negligence claim); Byrne , 102 A.3d at 47 (noting that "several [courts] have determined that HIPAA may inform the relevant standard of care"); Henry v. Cmty. Healthcare Sys. Cmty. Hosp. , 134 N.E.3d 435, 438 (Ind. Ct. App. 2019) (finding " ‘HIPAA and its implementing regulations may be utilized to inform the standard of care’ " (quoting Byrne , 102 A.3d at 49 )); Acosta v. Byrum , 180 N.C.App. 562, 638 S.E.2d 246, 251 (2006) ("Here, defendant has been placed on notice that plaintiff will use the [hospital's] rules and regulations ... and HIPAA to establish the standard of care. Therefore, plaintiff has sufficiently pled the standard of care in her complaint."); see also Restatement § 288B cmt. d ("[T]he requirements of administrative regulations are not adopted by the court as defining a definite standard of conduct in negligence actions, but are accepted as affording relevant evidence."); but see Sheldon , 40 N.E.3d at 672 ("[I]n our view utilization of HIPAA as an ordinary negligence ‘standard of care’ is tantamount to authorizing a prohibited private right of action for violation of HIPAA itself."); Young v. Carran , 289 S.W.3d 586, 588–89 (Ky. Ct. App. 2008) (declining to permit use of HIPAA in a state law negligence per se claim). We conclude that Shepherd permissibly referenced HIPAA in his complaint to inform the standard of care in his negligence claim. The trial court thus erred in granting Costco's motion to dismiss on this basis.
4. Immunity under § 12-2296
¶32 Costco further argues that permitting Shepherd to allege negligence with reference to HIPAA undermines the immunity afforded healthcare providers for good faith conduct under § 12-2296. We disagree. Shepherd must still rebut by clear and convincing evidence the statutory presumption that Costco acted in good faith. See § 12-2296. If he cannot, Costco will be immune from liability for damages due to any negligent disclosure of medical information.
III. Conclusion
¶33 Shepherd was not required to anticipate Costco's affirmative defense of qualified immunity under § 12-2296 in his complaint and allege bad faith, let alone allege clear and convincing evidence to rebut the good faith presumption. Shepherd also permissibly referenced HIPAA to inform the standard of care for his negligence claim. Consequently, we reverse the trial court's order granting Costco's motion to dismiss and remand for proceedings consistent with this opinion. We vacate the court of appeals opinion at ¶¶ 25–35 and the segment of ¶ 38 addressing Shepherd's negligence claim.