from the Superior Court in Maricopa County No. CV2017-052615
The Honorable Aimee L. Anderson, Judge Retired
Carden Law Firm PC, Scottsdale By Joshua W. Carden Counsel
Cavanagh Law Firm, Phoenix By Karen C. Stafford, Cassandra V.
Meyer Counsel for Defendant/Appellee
Presiding Judge Jennifer M. Perkins delivered the opinion of
the Court, in which Judge Lawrence F. Winthrop joined. Judge
Jon W. Thompson dissented in part and concurred in part.
Greg Shepherd challenges the dismissal of his complaint
against Costco Wholesale Corporation ("Costco")
alleging numerous tort claims stemming from Costco's
alleged failure to cancel an unwanted prescription and
disclosure of the prescription information to his ex-wife. We
reverse and remand for further proceedings on Shepherd's
negligence and punitive damages claims but affirm the
dismissal of his other claims. Further, we hold that HIP A
A's requirements may inform the standard of care in a
negligence action for wrongful disclosure of healthcare
AND PROCEDURAL BACKGROUND
Because Shepherd appeals from the grant of a motion to
dismiss, we state the facts alleged in his operative
complaint and must assume they are true for purposes of this
appeal. Southwest Non-Profit Housing Corp. v. Nowak,
234 Ariz. 387, 389, ¶ 4 (App. 2014).
Shepherd saw his physician in January 2016 for a check-up and
a refill of his usual prescription. During that visit, his
physician offered him an erectile dysfunction
("E.D.") medication sample, which he accepted.
Shortly thereafter, Costco told Shepherd that his regular
prescription and a full prescription of the E.D. medication
were ready for pickup. Shepherd told Costco he did not want
the E.D. prescription, and Costco acknowledged his
Approximately one month later, Shepherd called Costco to
check on another refill of his regular prescription and was
told it and a full prescription of the E.D. medication were
ready for pickup. Shepherd again told Costco he did not want
the E.D. medication.
Shepherd called Costco again the next day to authorize his
ex- wife, with whom he was exploring possible reconciliation,
to pick up his regular prescription. Costco gave her the
regular prescription and the E.D. medication. She did not
accept or pay for the E.D. medication but joked with a Costco
employee about Shepherd "not picking it up yet" and
told Shepherd's children and some friends about the
medication. She also stopped reconciliation efforts with
Shepherd complained to Costco headquarters and received a
written response that allegedly acknowledged the disclosure
of medical information to his ex-wife violated both the
Health Insurance Portability and Accountability Act of 1996
then sued Costco alleging negligence, breach of fiduciary
duty, fraud, negligent misrepresentation, intentional
infliction of emotional distress, intrusion upon seclusion,
and public disclosure of private facts based on Costco's
"public disclosure of an embarrassing medication that
[he] twice rejected."
Costco moved to dismiss the complaint. The trial court
granted the motion, finding (1) Costco was entitled to
immunity from suit under Arizona Revised Statutes
("A.R.S.") section 12-2296, (2) HIPAA preempted the
claims, and (3) Shepherd failed to allege sufficient facts to
support his claims. Shepherd now appeals.
We review the dismissal of a complaint pursuant to Arizona
Rule of Civil Procedure 12(b)(6) de novo. Coleman v. City
of Mesa, 230 Ariz. 352, 355, ¶ 7 (2012).
We are required to accept as true all well-pled facts and
give Shepherd the benefit of all reasonable inferences
arising therefrom. Botma v. Huser, 202 Ariz. 14, 15,
¶ 2 (App. 2002). We will affirm the dismissal only if
Shepherd would not have been entitled to relief under any
facts susceptible of proof in his complaint.
Coleman, 230 Ariz. at 356, ¶ 8.
A plaintiff must prove four elements to establish a
negligence claim: (1) a duty requiring the defendant to
conform to a certain standard of care, (2) the
defendant's breach of that standard, (3) a causal
connection between the defendant's conduct and the
resulting injury, and (4) actual damages. Quiroz v. ALCOA
Inc., 243 Ariz. 560, 563-64, ¶ 7 (2018).
In his complaint, Shepherd alleged Costco's duty of care
arose from "the regulations governing pharmacy conduct,
appeal, he again contends Costco violated HIPAA and A.R.S.
§§ 12-2291 to -2297.
A. Statutory Authorization
Under Arizona law, "all medical records and payment
records, and the information contained in medical records and
payment records, are privileged and confidential."
A.R.S. § 12-2292(A). But this information may be
disclosed "without the written authorization of the
patient or the patient's health care decision maker as
otherwise authorized by state or federal law, including
[HIPAA] privacy standards." A.R.S. § 12-2294(C).
HIPAA, in relevant part, allows covered entities such as
Costco to "disclose to . . . any . . . person identified
by the individual, the protected health information directly
relevant to such person's involvement with the
individual's health care." 45 C.F.R. §
Here, Costco disclosed the E.D. prescription to
Shepherd's ex- wife, whom he had expressly authorized to
receive prescription information. Shepherd contends HIPAA
only authorizes the disclosure of "filled
prescriptions," but even assuming Shepherd's
contention is correct, the E.D. prescription was filled,
Shepherd also contends he objected to such disclosure when he
requested that the E.D. prescription be cancelled but he
bases this contention on a HIPAA provision that applies only
to disclosures that take place in the presence of the
patient. 45 C.F.R. § 164.510(b)(2)(ii). The portion of
the relevant regulation addressing disclosures made when the
individual is not present grants covered entities such as
Costco the ability to use professional judgment to reasonably
infer the individual's best interest in allowing another
to act on his behalf to pick up filled prescriptions. 45
C.F.R. § 164.510(b)(3). Costco did not need to exercise