The Arizona Supreme Court Joins Other States in Ruling that HIPAA Can Be Used to Establish the Standard of Care in a Negligent Disclosure Case

By Paul J. Giancola and Claudia E. Stedman

On March 8, 2021, the Arizona Supreme Court held in Shepherd v. Costco¹ that the plaintiff, Greg Shepherd, was permitted to bring a negligence claim for wrongful disclosure of medical information and that the Health Insurance Portability and Accountability Act (HIPAA) can inform the standard of care, reversing in part and vacating in part the lower courts’ decisions.

The issues before the Court is what a plaintiff must allege as a claim of negligent disclosure of medical information to withstand a motion to dismiss based on the immunity provision of A.R.S. § 12-2296 provided to a healthcare provider and the extent that HIPAA can be the basis for a claim of negligence.

The suit arose following an incident where Shepherd filled his usual prescription at a Costco pharmacy. His doctor also gave Shepherd a sample medication for erectile dysfunction (ED), which the Costco pharmacist filled alongside his regular prescription. Shepherd did not want to fill the ED prescription and, on two separate occasions, instructed the Costco pharmacist to cancel it—on both occasions, the Costco employee had acknowledged the cancellation.

During this time, Shepherd was trying to reconcile with his ex-wife. She went to Costco to pick up Shepherd’s usual prescription. While there, the Costco employee also gave her the ED medication. After picking up the prescriptions, Shepherd’s ex-wife informed Shepherd that she no longer wanted to reconcile as a result of the ED medication and told his friends and family members about the prescription as well.

Shepherd complained to Costco and received an apology and an acknowledgement that the company had violated HIPAA and its own privacy policy in the disclosure of the ED prescription to his ex-wife. Not satisfied, Shepherd sued Costco for, among other things, negligence, intentional infliction of emotional distress, fraud and breach of fiduciary duty. Costco moved to dismiss the complaint on the basis that Shepherd failed to state a claim and that his negligence claims were precluded by HIPAA. Costco also asserted immunity from suit.

The immunity provisions of the Arizona Revised Statutes state that a provider who: "acts in good faith . . . is not liable for damages in any civil action for the disclosure of . . . information contained in medical records . . . that is made pursuant to this article or as otherwise provided by law."² The healthcare provider . . . is "presumed to have acted in good faith."³

The presumption of immunity may be rebutted only by clear and convincing evidence. In addressing the parties’ arguments as to how “good faith” should be defined, the Court concluded that “a healthcare provider acts in good faith where it acts under an honest belief, without malice or a design to defraud or to seek an unconscionable advantage."

The Court rejected Costco’s argument that permitting a HIPAA-based cause of action undermines the immunity afforded by § 12-2296. Instead, the Court left the door open for discovery on whether Costco acted in bad faith. Concluding that if Shepherd is unable to rebut by clear and convincing evidence the “presumption that Costco acted in good faith,” Costco “will be immune from liability for damages due to any negligent disclosure of medical information.^"4

As for the HIPAA component of Shepherd’s argument, the Court agreed with Costco, as well as the other courts that have addressed the issue, that HIPAA does not create a private right of action. However, that does not mean that HIPAA preempted, or precluded Shepherd’s state law tort claim for negligent disclosure of medical information. The Court agreed with Shepherd and the other courts who have addressed the issue that a plaintiff can use HIPAA as evidence of the standard of care for the safeguarding of protected health information in a negligence claim and that the trial court “erred in granting Costco’s motion to dismiss on this basis."⁵

In Shepherd v. Costco, the Arizona Supreme Court for the first time ruled, as healthcare attorneys have long suspected, that HIPAA standards and rules can be used to establish the standard of care for the use and disclosure of protected health information. Patients like Mr. Shepherd who suffer an unauthorized disclosure of protected health information may still file a complaint with the Office of Civil Rights of the Department of Health and Human Services. Such complaints may result in a monetary penalty assessed against the provider that is paid to the agency, but not to the patient. Now the patient has what may be a more powerful remedy—a civil lawsuit that may result in money damages assessed against the provider, but paid to the patient.