Haywood v. Novartis Pharmaceuticals Corporation
Filing
39
OPINION AND ORDER: The 35 Motion to Dismiss filed by Novartis is GRANTED. The Clerk is DIRECTED to close this case. Signed by Judge Rudy Lozano on 1/16/2018. (jss)
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF INDIANA
HAMMOND DIVISION
MICHELLE HAYWOOD,
Plaintiff,
vs.
NOVARTIS PHARMACEUTICALS
CORP.,
Defendant.
)
)
)
)
)
)
)
)
)
)
No. 2:15-CV-373
OPINION AND ORDER
This matter is before the Court on the Defendant’s Motion to
Dismiss
Plaintiff’s
First
Amended
Complaint,
filed
by
the
defendant, Novartis Pharmaceuticals Corporation, on December 27,
2016.
(DE #35.)
For the reasons set forth below, the motion to
dismiss is GRANTED.
The clerk is DIRECTED to close this case.
BACKGROUND
Plaintiff, Michelle Haywood (“Haywood”), filed her complaint
in state court on August 13, 2015.
(DE #4.)
The complaint brought
claims for negligence, negligent training and supervision, and
public disclosure of private facts; it also listed “punitive
damages” as a separate count.
(Id.)
The defendant, Novartis
Pharmaceuticals Corporation (“Novartis”), removed the matter to
1
this Court on the basis of diversity jurisdiction on September 28,
2015.
(DE #1.)
On November 2, 2015, Novartis filed a motion to
dismiss the complaint. (DE #14.) On September 27, 2016, the Court
granted the motion, dismissed the complaint without prejudice, and
granted Haywood thirty days to file an amended complaint.
#28.)
(DE
The first amended complaint was filed by Haywood on October
25, 2016.
(DE #30.)
In Count one of her complaint, Haywood
alleges that Novartis acted negligently when it disclosed personal
information
to
her
co-workers
and
supervisors
via
facsimile
transmission which violated duties it owed to her under its privacy
policy, under Indiana Code 25-26-13-15(b), and under the Health
Insurance Portability and Accountability Act (“HIPPA”).
In Count
Two, Haywood alleges that Novartis was negligent in its training
and supervision of its employees regarding the protection of
customer privacy and confidentiality.
Finally, in Count Three,
Haywood alleges that she is entitled to punitive damages because
Novartis acted with reckless indifference when it disclosed her
protected information despite being told, in writing, not to do
so.
Novartis filed the instant motion to dismiss on December 27,
2016.
(DE #35.)
(DE #37.)
Haywood filed her response on January 9, 2017.
Novartis filed its reply on January 17, 2017.
The motion is ripe for adjudication.
2
(DE #38.)
DISCUSSION
Facts
Novartis Patient Assistance NOW Oncology, a division of
Novartis, administers the GLEEVEC Co-Pay Assistance Program (the
“Program”) in which eligible patients are given a GLEEVEC Co-Pay
Card by Novartis to help offset the costs of their prescription
medication.
(DE #30, p. 1.)
Haywood applied for the Program, and
on May 19, 2015, she sent Novartis a written statement requesting
that no information regarding her application be sent to her place
of employment.
(Id. at 2.)
On July 8, 2015, Novartis disclosed
the following via facsimile transmission to Haywood’s co-workers
and supervisors: her social security number, her date of birth,
her income, her Medicare number, and information about her disease,
treatment, and medical providers.
(Id.)
According to the amended complaint, the website for the
Program includes a privacy notice that states:
Novartis Pharmaceuticals Corporation and Novartis Group
of Companies understand your personal and health
information is private.
The personal information we collect from you, including
your card or voucher usage, will be used to bring you
information about products, programs, support, and
services, to conduct market research, as required by
federal regulations. Please be assured that although we
share your personal information with our business
partners who work with us on these activities, we do not
permit them to use your personal information for their
own marketing purposes. You may unsubscribe from our
programs and services at any time by calling 1-888-6693
6682. For more information about our privacy practices,
please visit our website at www.usprivacy.novartis.com.
(“Privacy Notice”).
(Id. at 3.)
Additionally, the amended
complaint cites to the following privacy statement1 that was found
on the main Novartis website:
. . . This Privacy Statement tells you how we protect
the privacy of personal information that you may provide
to us.
As part of our commitment to privacy, Novartis has
voluntarily certified to the U.S.-EU Safe Harbor
Framework and the U.S.-Swiss Safe Harbor Framework as
set forth by the U.S. Department of Commerce . . . .
The purpose of this privacy statement is to explain what
Novartis does with personally identifiable information
that you provide to us, such as your name, address, age,
and information relating to your medical conditions. We
want you to know how your personally identifiable
information will be protected, who we may share it with,
and for what purposes.
. . . The type of information collected from you will be
based on the specific program that you register for, as
indicated at the time of your registration.
The
information that we may ask you to provide may include
your first and last name, your mailing address, your
age, birth date, gender, e-mail address, and information
about your medical conditions.
Novartis limits the
collection and processing of personal information to
what is necessary to fulfill the purposes for which it
is to be used.
. . . Many of our customers register for more than one
Novartis program or service, through our websites, by
calling Novartis, or through a third-party such as their
healthcare provider.
When you register with us more
than once, we may combine your personally identifiable
information
as
well
as
any
anonymous
computer
information collected (see below) and store it
1
The amended complaint cites to the version of the privacy statement that
was revised as of November 28, 2012.
4
collectively. This helps us keep track of all of your
preferences in one organized place, and helps us provide
information to you based on a more informed review of
your requests and medical conditions of interest.
. . . We request your consent to collect your personally
identifiable information when you seek to register for
a Novartis program or service.
In doing so, we also
explain, for that program or service, what you are
registering to receive and how we plan to use your
personal information. We also offer you the option of
discontinuing
your
consent
(‘opting
out’
or
‘unsubscribing’) if you later decide that you no longer
want to participate in that program or receive
additional information from us. If we wish to use this
information for purposes incompatible from those for
which the data was initially collected, we will offer an
effective way to opt out of the secondary use.
. . . When you provide personally identifiable
information to Novartis, it will be accessible to some
of Novartis’ business partners, such as companies we
retain to fulfill requests for information, answer
telephone calls from consumers, or provide assistance to
us on specific programs or projects such as newsletters
. . . .
Novartis requires third-parties to whom it
discloses personal data to protect personal information
using substantially similar standards to those required
by Novartis.
. . . Other departments within the Novartis group, and
other Novartis companies that may receive your
information will abide by substantially similar privacy
requirements relating to your personally identifiable
information.
. . . This Privacy Statement becomes effective on
November 28, 2012. Novartis may update this Statement
from time to time.
We encourage you to review our
Privacy Statement periodically.
(“Privacy Statement”).
(Id. at 3-4) (footnote omitted.)
Haywood
alleges that, when it disclosed her personal information to her
co-workers and supervisors via facsimile, Novartis breached duties
5
owed to her under the Privacy Notice and Privacy Statement, under
Indiana Code 25-26-13-15(b), and under HIIPA.
(Id. at 3-5.)
Analysis
In evaluating a motion to dismiss under Federal Rule of Civil
Procedure 12(b)(6), a court must accept all facts alleged in the
complaint as true and draw all reasonable inferences in the light
most favorable to the plaintiff.
520 (7th Cir. 2001).
Johnson v. Rivera, 272 F.3d 519,
A complaint is not required to contain
detailed factual allegations; however, the plaintiff must allege
facts that state a claim to relief that is plausible on its face.
Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
It is not enough
that there might be some conceivable set of facts that entitle the
plaintiff to relief.
Bell Atlantic Corp. v. Twombly, 550 U.S.
544, 553-56 (2007).
The plaintiff’s obligation “requires more
than labels and conclusions. . . .”
Id. at 555.
The Supreme Court
has provided that “[t]hreadbare recitals of the elements of a cause
of
action,
suffice.”
supported
by
mere
conclusory
statements,
do
not
Iqbal, 556 U.S. at 678.
Negligence and Negligent Training and Supervision
Novartis argues that Counts One and Two fail as a matter of
law because Haywood has not properly alleged that Novartis owed
6
her a legal duty or that any such duty, even if it existed, was
breached.
In response, Haywood asserts that Novartis owed her
“multiple duties” based on its own policies, based on Indiana
statutory law, and based on HIPPA.
In Indiana, “the tort of negligence is comprised of three
elements: (1) a duty on the part of defendant in relation to the
plaintiff; (2) the defendant’s breach of that duty; and (3) an
injury to the plaintiff resulting from that failure.”
Kolozsvari
v. Doe, 943 N.E.2d 823, 826-27 (Ind. Ct. App. 2011) (citing Miller
v. Griesel, 308 N.E.2d 701, 706 (Ind. 1974)).
“A duty to exercise
care arises as a matter of law out of some relation existing
between the parties, and it is the province of the court to
determine whether such a relation gives rise to such duty.” Id. at
827 (internal quotation marks and citation omitted).
“Absent a
duty, there can be no breach of duty and thus no negligence or
liability based upon the breach.”
736, 738 (Ind. 2004).
factors
when
relationship
In general, Indiana courts consider three
determining
between
Peters v. Forster, 804 N.E.2d
the
whether
plaintiff
a
duty
and
exists:
defendant;
“(1)
the
(2)
the
reasonable foreseeability of harm to the person injured by the
defendant’s conduct; and (3) public policy concerns.”
Kaufman, 972 N.E.2d 927, 938 (Ind. Ct. App. 2012).
is
case
specific.
Id.
Furthermore,
7
a
claim
Houser v.
This inquiry
for
negligent
supervision and training must be analyzed pursuant to the doctrine
of respondeat superior, and the court has “observe[d] that for
respondeat liability to attach, there must also be underlying
liability of the acting party.”
Walgreen Co. v. Hinchy, 21 N.E.3d
99, 109 (Ind. Ct. App. 2014).
Here,
Haywood’s
amended
complaint
alleges
that
Novartis
breached explicit duties of privacy that it owed to her as a
customer pursuant to the representations on its websites.
response
brief,
representations
Haywood
to
ensure
argues
that
that
her
she
relied
information
In her
on
would
those
remain
private when applying for the program. However, as Novartis points
out,
the
assurances
in
the
Privacy
Notice
relate
to
the
dissemination of information to its business partners who are
prohibited
from
using
customers’
personal
data
for
marketing
purposes.2
The complaint does not allege, nor is it reasonable to
infer, that the facsimile transmission sent to Haywood’s place of
employment was in any way connected with third-party marketing.
Similarly, according to its own terms, the purpose of the Privacy
Statement is to explain what Novartis does with its customers’
personally identifiable information and how it will be protected.
In relevant part, the Privacy Statement confirms that Novartis
2
“Please be assured that although we share your personal information with
our business partners who work with us on these activities, we do not permit
them to use your personal information for their own marketing purposes.” (DE
#30, p. 3.)
8
will
“limit[]
the
collection
and
processing
of
personal
information to what is necessary to fulfill the purposes for which
it
is
to
be
used”
and
will
require
third-parties
and
other
departments within the Novartis group to conform with those same
policies.
(DE #30, pp. 3-4.)
The portion of Privacy Statement
included in Haywood’s amended complaint does not set forth detailed
standards or describe Novartis’ specific obligations with regard
to
general
non-disclosure.3
However,
of
note,
the
Privacy
Statement does indicate that a customer’s consent related to the
collection of personal information is required when he or she
registers for a Novartis program or service, and it states that
Novartis will explain how the information will be used for that
particular program upon registration.
(Id. at 4.)
The Privacy
Statement goes on to indicate that, if information is to be used
“for purposes incompatible from those for which the data was
initially collected, we will offer an effective way to opt out of
the secondary use.”
(Id.)
Reading the Privacy Statement cited in
the amended complaint in conjunction with the Privacy Notice
associated with the Program, it is clear that the relevant privacy
3
The amended complaint includes a footnote that cites to the following
provision of the Privacy Statement: “Novartis takes reasonable precautions to
protect EU and Swiss personal information in its possession from loss,
misuse, unauthorized access, disclosure, alteration and destruction.” (DE
#30, p. 3, n. 3) (emphasis by Haywood in original). However, the relevance
of this provision is not clear, as Haywood has not alleged that she or the
personal information disclosed by Novartis was in any way related to the EU
or Switzerland.
9
considerations
focus
primarily
on
dissemination
to
Novartis’
partners and the subsequent intended secondary usage of that
information rather than a duty to ensure against all possible
disclosures in all circumstances.
Again, the allegations in the
complaint do not suggest, nor is it reasonable to infer, that the
facsimile transmitted to Haywood’s place of employment was related
to improper secondary usage or was anything other than routine
collection and processing by Novartis.
simply
alleges
that
“in
processing”
Rather, the complaint
the
Program
application,
Haywood’s information was disclosed by facsimile to her place of
employment, and the fact that Haywood allegedly told Novartis not
to send any information regarding her application to her place of
employment, without more, does not create a legal duty where none
previously existed.
Haywood also argues that Novartis owed her a statutory duty
to protect her personal information pursuant to Indiana Code 2526-13-15(b).
It is true that, under Indiana law, violating
statutory duties constitutes negligence
per se.
See
Kho v.
Pennington, 875 N.E.2d 208, 212 (Ind. 2007) (citing cases); Thiele
v. Norfolk & W. Ry. Co., 68 F.3d 179, 184–85 (7th Cir. 1995)
(citing French v. Bristol Myers Co., 574 N.E.2d 940, 943 (Ind. Ct.
App. 1991)).
The question here is whether the section of the code
relied upon by Haywood applies to Novartis.
10
Haywood argues that
it does because the statute clearly and unambiguously pertains to
“any ‘person’ with patient information.”
This is true, according
to Haywood, because the preceding and subsequent subsections of
the statute refer specifically to a pharmacist or pharmacy, while
the subsection in question refers more generally to a person.
Novartis argues that such an interpretation fails to consider the
statute as a whole which applies to pharmacists, pharmacies, and
drug stores rather than drug manufacturers or the public at large.
If a statute is clear and unambiguous, courts are directed to
take words and phrases in “their plain, ordinary, and usual sense”
when analyzing their applicability.
City of N. Vernon v. Jennings
N.W. Regl. Utilities, 829 N.E.2d 1, 4 (Ind. 2005) (citing Poehlman
v. Feferman, 717 N.E.2d 578, 581 (Ind. 1999)). However, when there
is more than one interpretation of a statute, it is considered
ambiguous and is subject to judicial construction.
Id. (citing
Amoco Production Co. v. Laird, 622 N.E.2d 912, 915 (Ind. 1993)).
Courts are directed to examine the statute as a whole and read its
sections in harmony to best effectuate legislative intent.
Id. at
4-5. “And we do not presume that the Legislature intended language
used in a statute to be applied illogically or to bring about an
unjust or absurd result.”
Id. at 5 (citing State ex rel. Hatcher
v. Lake Super. Ct., Rm. Three, 500 N.E.2d 737, 739 (Ind. 1986).
11
Title 25 of the Indiana Code is entitled “Professions and
Occupations,” and Article 26 within that title deals specifically
with the regulation of “Pharmacists, Pharmacies, and Drug Stores.”
Chapter 13, entitled “Regulation of Pharmacists and Pharmacies —
Creation of Board,” declares that the “practice of pharmacy” is a
matter of public interest and concern that must be subjected to
certain regulations and controls.
provides
the
definitions
that
I.C. 25-26-13-1.
apply
to
Chapter
13,
Section 2
and
“practice of pharmacy” is defined as:
a patient oriented health care profession in which
pharmacists interact with and counsel patients and with
other health care professionals concerning drugs and
devices used to enhance patients’ wellness, prevent
illness, and optimize the outcome of a drug or device,
by
accepting
responsibility
for
performing
or
supervising a pharmacist intern or an unlicensed person
under section 18.5 of this chapter to do the following
acts, services, and operations:
(1) The offering of or performing of those acts,
service operations, or transactions incidental to the
interpretation, evaluation, and implementation of
prescriptions or drug orders.
(2) The compounding, labeling, administering,
dispensing, or selling of drugs and devices, including
radioactive substances, whether dispensed under a
practitioner's prescription or drug order or sold or
given directly to the ultimate consumer.
(3) The proper and safe storage and distribution of
drugs and devices.
(4) The maintenance of proper records of the
receipt, storage, sale, and dispensing of drugs and
devices.
(5) Counseling, advising, and educating patients,
patients’ caregivers, and health care providers and
professionals, as necessary, as to the contents,
therapeutic values, uses, significant problems, risks,
and appropriate manner of use of drugs and devices.
12
the
(6) Assessing, recording, and reporting events
related to the use of drugs or devices.
(7)
Provision
of
the
professional
acts,
professional decisions, and professional services
necessary to maintain all areas of a patient’s pharmacy
related care as specifically authorized to a pharmacist
under this article.
(8) Provision of medication therapy management.
I.C. 25-26-13-2.
under
this
partnership,
A “pharmacist” is defined as “a person licensed
chapter,”
and
copartnership,
a
“person”
firm,
is
“any
company,
individual,
corporation,
association, joint stock company, trust, estate, or municipality,
or a legal representative or agent, unless this chapter expressly
provides otherwise.”
Id.
A “pharmacy” is defined as:
any facility, department, or other place where
prescriptions are filled or compounded and are sold,
dispensed, offered, or displayed for sale and which has
as its principal purpose the dispensing of drug and
health supplies intended for the general health,
welfare, and safety of the public, without placing any
other activity on a more important level than the
practice of pharmacy.
Id.
Section 15, upon which Haywood relies, mandates the
following:
(a) A pharmacist shall hold in strictest confidence all
prescriptions, drug orders, records, and patient
information. He may divulge such information only when
it is in the best interest of the patient or when
requested by the board or its representatives or by a
law enforcement officer charged with the enforcement of
laws pertaining to drugs or devices or the practice of
pharmacy.
(b) A person who has knowledge by virtue of his office
of any prescription drug order, record, or patient
information may not divulge such information except in
13
connection with a criminal prosecution or proceeding or
a proceeding before the board, to which the person to
whom the information relates is a party.
(c) A pharmacist or pharmacy is immune from civil
liability for any action based on its good faith release
of information under this section.
I.C. 25-26-13-15.
While
Haywood
argues
that
subsection
(b)
clearly
and
unambiguously pertains to “any person with patient information,”
the Court agrees with Novartis that such a reading would produce
an unjust result.
See City of N. Vernon v. Jennings N.W. Regl.
Utilities, 829 N.E.2d 1, 5 (Ind. 2005) (court proceeded to construe
a statute that appeared unambiguous at “first blush” because “a
strict interpretation” in light of the facts presented would have
produced
expressly
“an
absurd
limits
the
result”).
First,
definition
of
a
subsection
“person”
knowledge is obtained “by virtue of his office.”
(b)
to
one
itself
whose
That particular
phrase is not defined in the statute, which results in some degree
of ambiguity; however, reading the statute as a whole makes it
clear
that
the
regulations
are
intended
to
apply
to
those
associated with the “practice of pharmacy” which the legislature
has determined to be a matter of public concern.
The practice of
pharmacy is “a patient oriented health care profession” that
focuses on a pharmacist’s interactions with and counseling of
patients regarding their prescription drug needs.
14
The statute
describes
several
acts,
services,
and/or
operations
that
a
pharmacist (or those interns or unlicensed persons the pharmacist
supervises) is responsible for during the practice of pharmacy,
none of which pertain to manufacturing pharmaceutical drugs or
administering a co-payment assistance program.
Moreover, the
title of Chapter 13 itself applies directly to pharmacists and
pharmacies.
A pharmacy is a place where “prescriptions are filled
or compounded,” and its principal purpose is dispensing drug and
health supplies to the public; the definition also refers directly
back to the practice of pharmacy as being of the upmost importance.
Reading the statute to limit the applicability of its regulations
to a person acting within the realm of the practice of pharmacy is
also consistent with long-standing Indiana law recognizing the
distinction of an individual who acts by virtue of his or her
office as opposed to one who is employed more generally.
See e.g.
Wells v. State ex rel. Peden, 94 N.E. 321, 322 (Ind. 1911) (“An
office is a position or station in which a person is employed to
perform certain duties, or by virtue of which he becomes charged
with the performance of certain duties, public or private; a place
of trust.”).
Based on the foregoing, the Court finds that the
legislature intended subsection (b) to apply to a person involved
in the practice of pharmacy, rather than to “any person with
patient information” as is argued by Haywood.
15
The amended complaint describes Novartis as a “Pharmaceutical
Corporation,” with a division that administers the Program, and
also as a “provider of pharmaceuticals.” Haywood does not properly
allege, nor is it reasonable to infer, that Novartis falls within
the definition of a pharmacy, that Novartis filled or dispensed
any prescriptions to Haywood, that the person who sent Haywood’s
information to her place of employment was a pharmacist, intern,
or other unlicensed person working within a pharmacy, or that
Novartis or the Program performs acts consistent with the practice
of pharmacy as described above.4
The allegation that Novartis is
a “provider of pharmaceuticals” is not enough to bring it within
the purview of Indiana Code 25-26-13-15; thus, Novartis did not
owe Haywood a duty under that statute.
Haywood also claims that Novartis owed her a duty, under a
negligence
theory,
for
violating
HIPPA
standards.
Novartis
responds by pointing out that HIPPA provides no private cause of
action and insists that Haywood’s alleged HIPPA claims may not be
4
Indeed, as is pointed out by Novartis, it simply “researches, manufactures,
markets, and sells pharmaceuticals,” and “[u]nder federal regulations, it is
prohibited from selling its prescription drugs directly to patients.” In re
Novartis Wage and Hour Litig., 611 F.3d 141, 144 (2d Cir. 2010), abrogated by
Christopher v. SmithKline Beecham Corp., 567 U.S. 142 (2012). Rather,
“Novartis typically sells its products to wholesalers, which sell them to
individual pharmacies.” Id. See Ennenga v. Starns, 677 F.3d 766, 773-74
(7th Cir. 2012) (“A court may take judicial notice of facts that are (1) not
subject to reasonable dispute and (2) either generally known within the
territorial jurisdiction or capable of accurate and ready determination
through sources whose accuracy cannot be questioned.”); see also Henson v.
CSC Credit Servs., 29 F.3d 280, 284 (7th Cir. 1994) (finding public court
documents judicially noticeable).
16
shoehorned into a negligence action.
As this Court has noted
previously:
‘When a civil tort action is premised upon violation of
a duty imposed by statute, the initial question to be
determined by the court is whether the statute in
question confers a private right of action.’
Right
Reason Publ’ns v. Silva, 691 N.E.2d 1347, 1352 (Ind. Ct.
App. 1998) (quotation omitted); see also Dawson by
Dawson v. Long, 546 N.E.2d 1265, 1268 (Ind. Ct. App.
1989) (holding in order for the violation of a statute
or ordinance to be negligence per se, the trier of fact
must first determine whether the statute is applicable).
Chappey v. Ineos USA LLC, No. 2:08-CV-271, 2009 WL 790194, at *2
(N.D. Ind. Mar. 23, 2009).
Haywood acknowledges that there is no
private right of action under HIPPA, but she argues that courts in
Indiana and elsewhere have “permitted the use of HIPPA to establish
a breach of the standard of care owed to a patient in a negligence
action.”
She cites to Hinchy to support her position; however,
the Hinchy court discussed the tort of professional malpractice
that arose from Indiana law based on the unique “relationship
between a pharmacist and her customer that gives rise to a duty on
the pharmacist’s part” and Indiana Code 25-26-13-15(a) rather than
based on a violation of HIPPA.
See Hinchy, 21 N.E.3d at 109.
Haywood also cites to Grable & Sons Metal Products, Inc. v. Darue
Engr. & Mfg., 545 U.S. 308, 318–19 (2005), but Grable simply
recognizes the general possibility that the breach of federal
statues
may
proceedings.
support
negligence
per
se
claims
in
state
tort
It does not stand for the proposition that HIPPA
17
Id.5
itself is one of those statutes.
private right of action.
HIPPA does not provide a
See e.g. Carpenter v. Phillips, 419 Fed.
Appx. 658, 659 (7th Cir. May 4, 2011) (collecting cases); Doe v.
Board of Tr. of the Univ. of Ill., 429 F.Supp.2d 930, 944 (N.D.Ill.
2006) (“Every court to have considered the issue . . . has
concluded
that
HIPAA
does
not
authorize
a
private
right
of
action”); see also Acara v. Banks, 470 F.3d 569, 570–72 (5th Cir.
2006); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Seaton v.
Mayberg, 610 F.3d 530, 533 (9th Cir. 2010); Wilkerson v. Shinseki,
606 F.3d 1256, 1267 n. 4 (10th Cir. 2010).
As noted by the court
in Doe, “HIPAA provides civil and criminal penalties for improper
disclosures of medical information, but it does not create a
private cause of action, leaving enforcement to the Department of
Health and Human Services alone.”
Doe, 429 F.Supp.2d at 944.
Indiana state law claims that rely on HIPPA as the basis for
establishing negligence are not cognizable because utilizing them
5
Haywood also cites to several out-of-state opinions to support her
position. In one such case, the North Carolina court of appeals found that
the plaintiff had not stated a cause of action under HIPPA, but it recognized
that HIPPA was applicable to the extent that it “provid[ed] evidence of the
duty of care owed by [the defendant] with regards to the privacy of
plaintiff's medical records.” Acosta v. Byrum, 638 S.E.2d 246, 253 (N.C.
App. 2006). In another, a district court acknowledged that HIPPA does not
confer a private right of action but found that HIPPA could be used to
establish a negligence per se claim under Missouri law. I.S. v. Wash. Univ.,
No. 4:11CV235SNLJ, 2011 WL 2433585, at *2 (E.D. Mo. June 14, 2011). However,
these cases are not binding on this Court, and the Court finds their
reasoning unpersuasive in light of the weight of authority to the contrary
and the lack of any Indiana decision allowing HIPPA to be used as the basis
for a negligence claim such as this.
18
in such a way would circumvent HIPPA’s enforcement mechanisms.
See e.g. Sheldon v. Kettering Health Network, 40 N.E.3d 661, 672
(Ohio App. 2d Dist. 2015) (stating that “in our view utilization
of HIPAA as an ordinary negligence ‘standard of care’ is tantamount
to authorizing a prohibited private right of action for violation
of HIPAA itself”).
Thus, HIPPA does not create a duty or provide
a statutory basis for Haywood’s negligence claim in this case.
Finally, Haywood cites to no Indiana case, nor can the Court
find any, that would suggest that a pharmaceutical corporation has
a general duty to safeguard an individual’s personal information
from disclosure to her employer.
In cases where a duty has not
been established, Indiana courts look to the relationship between
the parties, the reasonable foreseeability of harm, and public
policy concerns to determine whether a duty should be imposed at
common law.
See Neal v. IAB Fin. Bank, 68 N.E.3d 1114, 1117-18
(Ind. Ct. App. 2017) (citations omitted); Williams v. Cingular
Wireless, 809 N.E.2d. 473, 476 (Ind. Ct. App. 2004).6
Here, the
relationship between Haywood and Novartis is described in the
amended complaint in terms of a potential customer and a co-pay
6
Because jurisdiction in this case is premised on diversity, the Court must
apply the substantive law of Indiana and attempt to predict how the Indiana
Supreme Court would decide a novel question of state law. “Where the state
supreme court has not ruled on an issue, decisions of the state appellate
courts control, unless there are persuasive indications that the state
supreme court would decide the issue differently.” See Lexington Ins. Co. v.
Rugg & Knopp, Inc., 165 F.3d 1087, 1090 (7th Cir. 1999).
19
assistance company.
Haywood alleges that she was in the process
of applying for the Program when her information was disclosed to
her employer.
She does not allege that she was in a contractual
relationship with Novartis or that she had even begun receiving or
relying on the benefits provided by the Program.
Although she
describes Novartis as a “provider of pharmaceuticals,” she does
not allege, nor is it reasonable to infer, that Novartis was a
pharmacist
or
pharmacy
that
directly
provided
her
with
pharmaceutical drugs, medical care, treatment, counseling, or the
like.
While it is well-settled that the law recognizes a duty-
bound relationship between a pharmacist and a customer, see e.g.
Forbes v. Walgreen Co., 566 N.E.2d 90, 91 (Ind. Ct. App. 1991),
that duty is premised upon a unique patient oriented health care
connection. As noted by the Supreme Court of Indiana, “pharmacists
possess expertise regarding the dispensing of prescription drugs,”
and consumers rely upon that expertise during direct interactions
with pharmacists regarding their prescription drug needs.
Superx, Inc. v. McLaughlin, 642 N.E.2d 514, 517 (Ind. 1994).
Hooks
That
special relationship has been codified by the Indiana legislature,
as described in detail above, to include the practice of pharmacy
more broadly.
See I.C. 25-26-13-1 through 25-26-13-33.
However,
the relationship between a pharmaceutical corporation and a person
seeking assistance with their co-payments is not similarly close
20
to justify imposing a duty, mainly because the direct contact,
expertise, reliance, and counseling aspects of the relationship
are wholly lacking.
As to foreseeability, courts must look to the broad type of
plaintiff and broad type of harm at issue and focus on “the general
class of persons of which the plaintiff was a member and whether
the harm suffered was of a kind normally to be expected—without
addressing the specific facts of the occurrence.”
at 1121 (citation omitted).
Neal, 68 N.E.3d
However:
because almost any outcome is possible and can be
foreseen, the mere fact that a particular outcome is
sufficiently likely is not enough to give rise to a duty.
Instead, for purposes of determining whether an act is
foreseeable in the context of duty we assess whether
there is some probability or likelihood of harm that is
serious enough to induce a reasonable person to take
precautions to avoid it.
Goodwin v. Yeakle’s Sports B. and Grill, Inc., 62 N.E.3d 384, 392
(Ind. 2016) (internal quotation marks and citations omitted).
Here, the broad type of plaintiff is a consumer seeking to enroll
in a program administered by a company, and the broad type of harm
is the damage suffered from the disclosure of the prospective
enrollee’s
personal
and
protected
person’s place of employment.
health
information
to
that
Considering the fact that much of
an employee’s personal information is likely already available to
his or her employer, and the fact that a reasonable employer and/or
co-worker would be unlikely to take negative action against an
21
employee based on the receipt of protected health information, the
likelihood of harm that is serious enough to be legally actionable
is slight.
See Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 636-
40 (7th Cir. 2007) (finding that exposure of personal data is not
a compensable injury in a negligence action under Indiana law).7
Turing to public policy concerns, the Indiana Court of Appeals
has noted that, “[s]imply because an action may have some degree
of foreseeability does not make it sound public policy to impose
a duty.”
Ct.
Williams v. Cingular Wireless, 809 N.E.2d 473, 478 (Ind.
App.
2004).
“Various
factors
play
into
this
policy
consideration, including convenience of administration, capacity
of the parties to bear the loss, a policy of preventing future
injuries, and the moral blame attached to the wrongdoer.”
Id.
(citing Ousley v. Bd. of Comm’rs of Fulton Cnty., 734 N.E.2d 290,
294
(Ind.
Ct.
App.
2000).
While
it
seems
likely
that
a
pharmaceutical company could adequately bear the loss in an action
such as this and that personal and protected health information
should ideally be protected, other elements weigh against imposing
a duty.
Assigning significant moral blame to a pharmaceutical
corporation in this situation is disproportionate to the actual
7
Moreover, while not relevant to the analysis of foreseeability, the Court
notes that Haywood’s amended complaint fails to adequately allege an injury
beyond the disclosure itself. While she states generally that she “suffered
damages to her employment, emotional distress, and physical health,” she has
not provided any details regarding such injuries and has not responded to
Novartis’ lack of damages argument in any meaningful way.
22
acts performed (i.e. negligently disclosing information to an
employer during a routine application process).
The reality is
that, for most people, the amount of sensitive personal information
readily available to third parties with whom no close relationship
exists is significant due to the nature of today’s digital society.
Imposing
a
duty
to
disclosures
upon
safeguard
any
party
information
or
entity
from
who
all
happens
possible
to
be
in
possession of the personal information of another would expand
liability in a way that has the potential to stifle the collection
of data and the routine processing of information.
As noted by
Novartis, courts have construed Indiana laws applicable to the
disclosure of private information narrowly.
Seventh
Circuit
Court
of
Appeals
For example, the
analyzed
the
Indiana
data
disclosure statute and found that there is no private right of
action
against
a
database
owner
for
negligently
disclosing
information; rather, the database owner is simply obligated to
advise potentially affected customers of a breach, and enforcement
is handled by the Indiana Attorney General.
at 636-37.
Pisciotta, 499 F.3d
And, as discussed in detail above, while duties of
non-disclosure
have
been
imposed
on
those
with
specialized
expertise (i.e. pharmacists and physicians), the nature of the
specialized
relationship
is
the
driving
force
behind
the
imposition of that duty rather than the act of disclosure itself.
23
After balancing the relevant factors, the Court concludes
that
the
general,
non-specialized
nature
of
the
relationship
between the parties and the fact that actionable harm is not
reasonably
outweighs
foreseeable
the
public
from
the
policy
type
of
disclosure
considerations
at
suggesting
issue
that
potential customers may be entitled to protection of their personal
data during an application process.
Ultimately, “[w]hen given a
choice between an interpretation of [state] law which reasonably
restricts liability, and one which greatly expands liability, we
should choose the narrower and more reasonable path (at least until
the [state] Supreme Court tells us differently).”
Pisciotta, 499
F.3d at 636 (7th Cir. 2007) (quoting Todd v. Societe Bic, S.A., 21
F.3d 1402, 1412 (7th Cir. 1994); see also Insolia v. Philip Morris
Inc., 216 F.3d 596, 607 (7th Cir. 2000) (“Federal courts are loathe
to fiddle around with state law.
Though district courts may try
to determine how the state courts would rule on an unclear area of
state law, district courts are encouraged to dismiss actions based
on novel state law claims.”).
Therefore, the Court concludes that
Novartis did not owe Haywood a duty of care in this case.
Because Haywood has failed to allege a viable negligence
claim, her claims for negligent training and supervision and
punitive damages must also fail.
(must
be
underlying
liability
of
24
See Hinchy, 21 N.E.3d at 109
acting
party
for
negligent
training and supervision claim to succeed); Wohlwend v. Edwards,
796 N.E.2d 781, 784 (Ind. Ct. App. 2003) (punitive damages proper
only when defendant acted with malice, fraud, gross negligence, or
oppressiveness which was not the result of a mistake of fact or
law, mere negligence, or other human failing).
CONCLUSION
For the aforementioned reasons, the motion to dismiss filed
by Novartis (DE #35) is GRANTED.
The clerk is DIRECTED to close
this case.
DATED: January 16, 2018
/s/ RUDY LOZANO, Judge
United States District Court
25
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?