CVS Pharmacy, Inc. et al v. Press America, Inc.
Filing
62
MEMORANDUM OPINION AND ORDER re: 44 MOTION to Dismiss Plaintiff's Amended Complaint filed by Press America, Inc. For the foregoing reasons, Defendants motion to dismiss is DENIED. The Clerk of Court is directed to close the motion at ECF No. 44. (Signed by Judge Gregory H. Woods on 1/3/2018) (mro)
UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF NEW YORK
------------------------------------------------------------------X
CVS PHARMACY, INC., and CAREMARK RX, :
LLC,
:
:
Plaintiffs, :
:
-against:
:
PRESS AMERICA, INC.,
:
:
Defendant. :
------------------------------------------------------------------X
USDC SDNY
DOCUMENT
ELECTRONICALLY FILED
DOC #: _________________
DATE FILED: 1/4/2018
1:17-cv-190-GHW
MEMORANDUM OPINION
AND ORDER
GREGORY H. WOODS, United States District Judge:
Since at least 2011, plaintiffs CVS Pharmacy, Inc. (“CVS Pharmacy”) and Caremark Rx LLC
(“Caremark”) (collectively “CVS”) have contracted to provide pharmacy benefit management
(“PBM”) services to beneficiaries of various health plans. CVS relies on Press America, Inc. (“Press
America”) to assist with the printing and mailing of information to the plans’ beneficiaries.
One of CVS’s clients is International Business Machines Corporation (“IBM”). Pursuant to
its contract with IBM, CVS is responsible for, among other things, providing beneficiaries of IBM’s
health plan with mail order pharmacy services. Press America performs the mailing on CVS’s
behalf. Given the nature of the mailings, they often contain private health information (“PHI”).
In August 2012, Press America incorrectly addressed mail containing beneficiaries’ PHI,
resulting in 41 unauthorized disclosures of IBM health plan beneficiaries’ PHI. As a result of those
disclosures, CVS credited IBM $1,845,000 and subsequently sought reimbursement from Press
America. Press America declined, and CVS filed this action on January 10, 2017. On May 18, 2017,
Press America moved to dismiss, arguing that it is not obligated to indemnify CVS for the payment
to IBM. Because CVS has sufficiently stated claims for breach of contract, contractual
indemnification, common law indemnification, and negligence, Press America’s motion to dismiss
must be denied.
1. BACKGROUND1
A. Agreements Between CVS and Press America
On or about October 1, 2011, CVS entered into a Master Service Agreement and Statement
of Work with Press America, whereby Press America agreed to provide printing and mailing services
to CVS. Am. Compl. (ECF No. 28), ¶ 13. Section 2 of the Master Service Agreement stated that
Press America would provide services that met “the minimum CVS Standards,” which were set
forth in the Statement of Work. Master Ag. § 2 (ECF No. 28-1, at 1). The parties also entered into
a second Statement of Work, ECF No. 28-1, at 23, effective May 1, 2012 through April 30, 2013,
specifically outlining the printing services for which Press America would be responsible. Am.
Compl. ¶¶ 2, 13. Both Statements of Work were incorporated into the Master Agreement
(collectively, the “Master Agreement”), which was submitted together with the Amended Complaint.
In addition, CVS entered into a Business Associate Agreement with Press America (the
“Business Associate Agreement”), ECF No. 28-2, which was intended to encourage compliance
with the relevant privacy laws, including the Health Insurance Portability and Accountability Act of
1996 (“HIPAA”). Am. Compl. ¶ 14. In the Business Associate Agreement, Press America agreed
not to use or disclose PHI except as specifically permitted by contract. Id. These provisions
reflected CVS’s “particular[] concern[]” about liability stemming from the disclosure of its clients’
PHI. Id. ¶ 16.
Moreover, each of CVS’s contracts with Press America contain indemnity provisions. Am.
Compl. ¶ 16. Under the Master Agreement, Press America “agrees (i) to indemnify and hold
harmless CVS from and against any claims, liabilities, and damages to the extent same are due to
[Press America’s] negligence, willful misconduct, or breach of this Agreement or [Press America’s]
1
Unless otherwise noted, the facts are taken from the amended complaint and are accepted as true
for the purposes of this motion. See, e.g., Carlin v. Davidson Fink LLP, 852 F.3d 207, 212 (2d Cir.
2017).
2
failure to comply with or abide by any applicable law . . . .” Master Ag. § 8.1. In addition, the
Master Agreement requires that Press America maintain insurance sufficient to cover any losses
incurred by CVS that were caused by Press America’s disclosure of PHI. Am. Compl. ¶ 18 (citing
Master Ag. § 8.3). Similarly, the Business Associate Agreement provides that Press America will:
indemnify and hold harmless CVS and any of its officers, directors, employees, or
agents from and against any claim, cause of action, liability, damage, cost, or expense
. . . arising out of or in connection with any breach of the terms of this Agreement,
any Breach of Private Information under the control of [Press America] or its agents
or subcontractors that requires notification under the HIPAA Rules or state law, or
any failure to perform its obligations with respect to Private Information by [Press
America], it[s] officers, employees, agents, or any person or entity under [Press
America’s] direction or control.
Bus. Assoc. Ag. § 6.0.
B. Agreements Between CVS and IBM
Pursuant to a “series of agreements” between CVS and IBM that were ultimately
memorialized in an agreement that went into effect on January 1, 2012 (the “IBM Contract”), CVS
“agreed to administer IBM’s managed care pharmacy program.” Am. Compl. ¶ 15. The IBM
Contract provides, among other things, that CVS would correspond with IBM employees about
their prescribed medications via U.S. Mail. Id. Pursuant to the Second Statement of Work, Press
America became responsible for “services that would be performed for CVS in connection with its
work” under the IBM Contract. Id. ¶ 13.
Most relevant for purposes of this motion, the IBM Contract requires that CVS comply with
certain “performance standards.” Am. Compl. ¶ 26 (quoting IBM Ag. § 3.13). According to the
IBM Contract, the “performance standards and any related fee adjustments are not intended to
operate as liquidated damages, a penalty, or as an exclusive remedy but rather to correspond to the
level of service being provided.” Am. Compl. ¶ 27 (quoting IBM Ag. § 3.13). One such
performance standard, entitled “Protection of Confidential Participant Information,” sets forth a fee
3
that CVS must pay to IBM in the event of a “Protection of Information Failure,” which is defined
as:
[any] use or disclosure of Confidential Participant Information, Protected Health
Information or Personal Data (collectively “Personal Information”) in the possession
or control of CVS Caremark, its employees, agents, independent contractors or
Subcontractors that is not provided for or permitted by this Agreement, including
Breaches of Unsecured Protected Health Information and certain disclosures that
would not qualify as a Breach of Unsecured Protected Health Information but that
result in disclosure of Personal Information to an improper or incorrect third party,
or that would require notice to the Participant under state or federal law as a data
breach.
Id. ¶¶ 29, 30 & Ex. D. The fee is three percent of the annual fees at risk “for each Protection of
Information Failure.” Am. Compl. ¶ 31 (emphasis in the original).
C. The PHI Disclosures
On or about August 2, 2012, Press America improperly disclosed the PHI of beneficiaries of
health plans administered by CVS, including those in the IBM health plan, when it mailed PHI to
the wrong beneficiaries. Am. Compl. ¶¶ 3, 23. It was ultimately determined that there were a total
of 41 disclosures of IBM beneficiaries’ PHI. Id. ¶¶ 23, 32. Consequently, on December 31, 2012,
CVS credited IBM $1,845,000—calculated as three percent of the annual fee amount at risk for the
performance guarantees ($45,000), multiplied by the total number of disclosures (41). Id. ¶¶ 33, 34.
Thereafter, CVS sought reimbursement from Press America. Despite CVS’s demands, however,
Press America refused to pay. Id. ¶¶ 4, 5, 38. Press America now contends, among other things,
that it is not obligated to reimburse CVS because (i) the performance standard provision of the IBM
Contract is an unenforceable penalty; and (ii) Press America could not have agreed to indemnify
CVS for it payments to IBM because Press America was unaware of the terms of the IBM Contract.
See Def.’s Mem. of Law (ECF No. 45), at 2.
4
2. LEGAL STANDARDS
A. Rule 12(b)(6)
Under Federal Rule of Civil Procedure 8(a)(2), a complaint must contain “a short and plain
statement of the claim showing that the pleader is entitled to relief.” Rule 8 “does not require
detailed factual allegations, but it demands more than an unadorned, the-defendant-unlawfullyharmed-me accusation.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). To survive a motion to dismiss
pursuant to Rule 12(b)(6), a complaint “must contain sufficient factual matter, accepted as true, to
‘state a claim to relief that is plausible on its face.’” Iqbal, 556 U.S. at 678 (2009) (quoting Bell Atl.
Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads
factual content that allows the court to draw the reasonable inference that the defendant is liable for
the misconduct alleged.” Id. (citing Twombly, 550 U.S. at 556). “To survive dismissal, the plaintiff
must provide the grounds upon which his claim rests through factual allegations sufficient ‘to raise a
right to relief above the speculative level.’” ATSI Commc’ns, Inc. v. Shaar Fund, Ltd., 493 F.3d 87, 98
(2d Cir. 2007) (quoting Twombly, 550 U.S. at 555).
Determining whether a complaint states a plausible claim is a “context-specific task that
requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S.
at 679. The court must accept all facts alleged in the complaint as true and draw all reasonable
inferences in the plaintiff’s favor. Burch v. Pioneer Credit Recovery, Inc., 551 F.3d 122, 124 (2d Cir. 2008)
(per curiam). However, a complaint that offers “labels and conclusions” or “naked assertion[s]”
without “further factual enhancement” will not survive a motion to dismiss. Iqbal, 556 U.S. at 678
(citing Twombly, 550 U.S. at 555, 557).
“In considering a motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6), a
district court may consider the facts alleged in the complaint, documents attached to the complaint
as exhibits, and documents incorporated by reference in the complaint.” DiFolco v. MSNBC Cable
L.L.C., 622 F.3d 104, 111 (2d Cir. 2010) (citations omitted). “Where a document is not
5
incorporated by reference, the court may never[the]less consider it where the complaint ‘relies
heavily upon its terms and effect,’ thereby rendering the document ‘integral’ to the complaint.” Id.
(quoting Mangiafico v. Blumenthal, 471 F.3d 391, 398 (2d Cir. 2006)). Finally, the Court may also
consider “matters of which judicial notice may be taken.” Goel v. Bunge, Ltd., 820 F.3d 554, 559 (2d
Cir. 2016) (citation omitted).
3. DISCUSSION
A. Press America Is Not Entitled to Dismissal of CVS’s Breach of Contract or
Contractual Indemnification Claims
The Master Agreement is “governed by and construed in accordance with the laws of the
State of New York, without reference to the conflict of law provisions thereof.” Master Ag. § 13.8.
“To state a claim for breach of contract under New York law, ‘the complaint must allege: (i) the
formation of a contract between the parties; (ii) performance by the plaintiff; (iii) failure of
defendant to perform; and (iv) damages.’” Orlander v. Staples, Inc., 802 F.3d 289, 294 (2d Cir. 2015)
(quoting Johnson v. Nextel Commc’ns, Inc., 660 F.3d 131, 142 (2d Cir. 2011)).
Press America does not dispute that CVS sufficiently pled these elements with respect to
both the Master Agreement and the Business Associate Agreement. See Am. Compl. ¶¶ 42-65.
However, Press America argues that it is not obligated to indemnify CVS under those agreements
for several reasons, as set forth below.
i.
The Amended Complaint Sufficiently Alleges the Existence and
Relevant Terms of the IBM Contract
Press America contends that the Amended Complaint “does not contain any factual material
regarding what contract(s) existed between CVS and IBM on the date of the incident in question.”
Not. of Mot. (ECF No. 44), at 3. However, the Amended Complaint alleges that, “[p]ursuant to a
series of agreements memorialized in the IBM Contract, which was effective January 1, 2012, CVS
through Caremark, had agreed to administer IBM’s managed care pharmacy program.” Am. Compl.
¶ 15. A copy of the IBM Contract is attached to the Amended Complaint. Furthermore, the
6
Amended Complaint sets forth the particular provision of the IBM Contract implicated by the PHI
disclosures (§ 3.13) and attaches descriptions of the relevant performance standard. As a result, the
Court finds that the Amended Complaint plausibly pleads that the IBM Contract existed and was in
effect at the time of the disclosures.
ii.
The Indemnification Provisions of the Master Agreement and
Business Associate Agreement are Broad Enough to Capture CVS’s
Payment to IBM
The language of the Master Agreement and the Business Associate Agreement, on its face, is
sufficiently broad to capture CVS’s payment to IBM. The Master Agreement provides that Press
America will “indemnify and hold harmless CVS from and against any claims, liabilities, and
damages to the extent same are due to [Press America’s] negligence.” Master Ag. § 8.1 (emphasis
added). Similarly, the Business Associate Agreement provides that Press America will “indemnify
and hold harmless CVS . . . from and against any claim, cause of action, liability, damage, cost, or
expense . . . arising out of or in connection with any breach of the terms of this Agreement, [or] any
Breach of Private Information under the control of” Press America. Bus. Assoc. Ag. § 6.0
(emphasis added). “The New York Court of Appeals has held that the phrase ‘arising out of’ is
‘ordinarily understood to mean originating from, incident to, or having connection with.’” Turner
Const. Co. v. Kemper Ins. Co., 198 F. App’x 28, 30 (2d Cir. 2006) (summary order) (quoting Maroney v.
N.Y. Cent. Mut. Fire Ins. Co., 5 N.Y.3d 467, 472 (2005) (internal quotations omitted)); see also
Burlington Ins. Co. v. N.Y.C. Transit Auth., 29 N.Y.3d 313, 324 (2017) (collecting cases). There is no
express exclusion in either of these provisions for contractual obligations that may be triggered by
Press America’s negligence. In the absence of such an exclusion, the language of the contract
encompasses the payments to IBM triggered by Press America’s negligent acts.
7
iii.
The Court Cannot Determine, at this Time, Whether the Payment
Provisions of the IBM Contract are Within the Scope of the Parties’
Intendment
According to Press America, the indemnity provisions of the Master Agreement and
Business Associate Agreement cannot be read to include payments made pursuant to the IBM
Contract because the IBM Contract did not exist when Press America entered into the agreements
with CVS. Def.’s Mem. of Law, at 15. As a result, Press America argues, neither it nor CVS could
have intended that CVS’s payment obligations under the IBM Contract would be covered by
indemnification provisions of the Master Agreement or the Business Associate Agreement.
“It is axiomatic that an indemnity contract is interpreted to effectuate the intention of the
parties as expressed in the unequivocal language of the contract.” Gibbs-Alfano v. Burton, 281 F.3d
12, 19 (2d Cir. 2002) (citing Weissman v. Sinorm Deli, Inc., 88 N.Y.2d 437, 446 (1996)). “An
indemnification agreement will not be read to impose obligations upon the indemnitor which are
neither disclosed at the time of its execution nor reasonably within the scope of [i] its terms and [ii]
the over-all intendment of the parties at the time of its making.” Tokyo Tanker Co. v. Etra Shipping
Corp., 536 N.Y.S.2d 75, 76 (1st Dep’t 1989) (emphasis added). In other words, indemnity provisions
“should not be extended to include damages which are neither expressly within its terms nor of such
character that it is reasonable to infer that they were intended to be covered under the contract.” Id.
at 78. Even accepting Press America’s assertion that no obligation to indemnify CVS for payments
to IBM was disclosed when Press America executed its agreements with CVS, the Court cannot
conclude, at this stage, that such indemnification is not “reasonably within the scope of” the
agreements’ terms or the “over-all intendment of the parties.” Id. at 76. As already discussed, the
Amended Complaint supports a plausible inference that a breach of the IBM Contract was “due to”
Press America’s negligence, such that it could be subject to the Master Agreement’s indemnification
provision and that CVS’s payment to IBM was a cost “arising out of or in connection with” a breach
8
of PHI that was within Press America’s control, which could be covered by the Business Associate
Agreement.
With respect to the parties’ “over-all intendment,” the Court acknowledges that where a
party is “under no legal duty to indemnify, a contract assuming that obligation must be strictly
construed to avoid reading into it a duty which the parties did not intend to be assumed.” Hooper
Assocs., Ltd. v. AGS Computers, Inc., 74 N.Y. 2d 487, 491 (1989) (citations omitted); see also St. Paul
Mercury Ins. Co. v. M&T Bank Corp., No. 12-cv-6322-JFK, 2014 WL 1468452, at *4 (S.D.N.Y. Apr.
11, 2014) (“Indemnification clauses should be read to implement the parties’ intentions, and must be
strictly construed to avoid inferring duties that they did not intend to create.”); Niagara Frontier
Transp. Auth. v. Tri-Delta Constr. Corp., 487 N.Y.S.2d 428, 431 (4th Dep’t 1985) (an indemnity
provision “should be construed so as to encompass only that loss and damage which reasonably
appear to have been within the intent of the parties” as evidenced by “the language, purpose or
surrounding facts and circumstances”), aff’d 65 N.Y.2d 1038 (1985). At the motion to dismiss stage,
however, the Court may consider only the allegations of the Amended Complaint and the
documents incorporated therein. As described previously, the allegations and language of the
relevant indemnification provisions are broad. Further, the Amended Complaint plausibly alleges
that the terms of the IBM Contract existed—as a series of agreements—at least by the time CVS
and Press America entered into the second Statement of Work. See Am. Compl. ¶ 13. Therefore,
taking CVS’s allegations as true and drawing all reasonable inferences in its favor, the Court cannot
determine, at this time, whether the IBM Contract’s payment provisions were intended to be
covered by the indemnity provisions of the Master Agreement and/or the Business Associate
Agreement.
9
iv.
The Court Cannot Determine, at this Time, Whether the IBM
Contract’s Payment Provision was a Proximate Cause of CVS’s
Damages
According to Press America, “[t]he penalty agreed to confidentially . . . is at most a cause in
fact, but not the proximate cause, of CVS’s claimed damages.” Not. of Motion, at 3. As a result,
Press America maintains that all causes of action arising out of the contractual provisions—namely,
Counts I, II, III, and IV—must be dismissed. This argument is premature. “[S]orting among the
potential causes and determining which parties are liable is a task for a jury, not a judge deciding a
motion to dismiss.” MF Glob. Holdings Ltd. v. PricewaterhouseCoopers LLP, 43 F. Supp. 3d 309, 315
(S.D.N.Y. 2014). “For now, it is sufficient that [the plaintiff] has ‘state[d] a claim to relief that is
plausible on its face.’” Id. (quoting Twombly, 550 U.S. at 570).
v.
Press America Does Not Have Grounds to Challenge the
Enforceability of the IBM Agreement
Press America argues at length that the provision of the IBM Contract pursuant to which
CVS made its payment is unenforceable and, therefore, that any payment by CVS was voluntary and
not subject to indemnification. However, Press America does not have a contractual right to claim
that the agreement is unenforceable, and there is no basis for the Court to conclude that it was not
enforceable at the time that CVS made its payment to IBM. “[A]bsent a contractual relationship
there can be no contractual remedy.” Suffolk Cnty. v. Long Island Lighting Co., 728 F.2d 52, 63 (2d Cir.
1984). “A non-party to a contract governed by New York law lacks standing to enforce the
agreement in the absence of terms that ‘clearly evidence[ ] an intent to permit enforcement by the
third party’ in question.” Premium Mortg. Corp. v. Equifax, Inc., 583 F.3d 103, 108 (2d Cir. 2009)
(quoting Fourth Ocean Putnam Corp. v. Interstate Wrecking Co., 66 N.Y.2d 38, 45 (1985)).
Unenforceability is an affirmative defense that may be raised by (i) a party in privity of contract with
the defendant; or (ii) a third-party beneficiary of that contract. Hillside Metro Assocs. v. JPMorgan Chase
Bank, Nat’l Ass’n, 747 F.3d 44, 49 (2d Cir. 2014) (A contractual relationship “exists if the plaintiff is
10
in privity of contract with the defendant or is a third-party beneficiary of the contract.”); see also
Karamath v. U.S. Bank, N.A., No. 11-cv-557-NGG-RML, 2012 WL 4327613, at *7 (E.D.N.Y. Aug.
29, 2012) (“plaintiff is not a party to the [Pooling and Servicing Agreement] . . . and is not a thirdparty beneficiary . . . and therefore has no standing to challenge the validity of that agreement”),
report and recommendation adopted, No. 11-cv-1557-NGG-RML, 2012 WL 4327502 (E.D.N.Y. Sept. 20,
2012). Press America could have contracted for the right to take up payment disputes or to approve
CVS’s contracts with potential clients or otherwise contracted for the right to challenge on CVS’s
behalf the enforceability of any payment obligations that might be the subject of a claim for
indemnification, but there is no indication on the current record that it did so. Press America is not
a party to or third-party beneficiary of the IBM Agreement. Therefore, Press America does not have
the capacity to attack the enforceability of the underlying agreement between IBM and CVS.
The enforceability of the IBM Contract’s payment provision may ultimately impact the
Court’s evaluation of whether CVS is entitled to indemnification. For example, Press America may
argue that it was not within the intendment of the parties for it to be liable for reimbursement of an
unenforceable penalty. But an evaluation of that argument is different from a direct attack on the
enforceability of the provision, which Press America launches here, and the Court rejects.2
2
Press America cites Broadway Houston Mack Dev. LLC v. Kohl, 870 N.Y.S.2d 748 (Sup. Ct. Suffolk
Cnty. 2008), aff’d 897 N.Y.S.2d 505 (2d Dep’t 2010) and Fed. Nat. Mortg. Ass’n v. Bridgeport Portfolio,
LLC, 150 Conn. App. 610, 617, 92 A.3d 966 (Conn. App. 2014), a case applying Connecticut state
law, for the proposition that an alleged third-party indemnitor may challenge the enforceability of
the contract giving rise to its alleged indemnification obligation. These cases are inapposite. In
Broadway Houston, the plaintiff paid the full amount of a lien rather than pursuing other, less
expensive means of discharging it. Id. at 755. The court denied the plaintiff’s summary judgment
motion, finding, in part, that “[t]o the extent that the plaintiff made a business decision” to elect
payment in full rather than the less expensive available remedies, it “knowingly assumed the risk of
possible double payment.” Id. at 756. The court also considered the fact that the plaintiff had
several options and selected the most expensive one—payment in full. Similarly, in affirming this
decision, the Second Department noted that the plaintiff “failed to demonstrate that [its] payments
were necessary to protect its legal or economic interests.” 897 N.Y.S.2d at 506. This case is
fundamentally different because, unlike in Broadway Houston, CVS had only one option with respect
to the amount owed IBM under the IBM Contract. In Bridgeport Portfolio, the court cites Connecticut
11
B. Implied Indemnity Theories
i. CVS’s Claim for Common Law Indemnification Survives the Motion to
Dismiss Because it is Adequately Pleaded and Because it is Unclear at
this Time Whether the IBM Contract is Enforceable
“Under New York law, common-law (or implied) indemnity ‘is a restitution concept which
results in a shifting of the loss because to fail to do so would result in the unjust enrichment of one
party at the expense of the other.’” Amguard Ins. Co. v. Getty Realty Corp., 147 F. Supp. 3d 212, 220
(S.D.N.Y. 2015) (quoting Facilities Dev. Corp. v. Miletta, 584 N.Y.S.2d 491, 495 (3d Dep’t 1992)
(internal quotations omitted)); see also CSC Scientific Co., Inc. v. Manorcare Health Servs., Inc., 867 F.
Supp. 2d 368, 377 (S.D.N.Y. 2011) (“Common law or implied indemnification is a ‘quasi-contract’
doctrine rooted in principles of equity and fairness conceptually related to restitution”); Mas v. Two
Bridges Assocs. by Nat. Kinney Corp., 75 N.Y.2d 680, 690 (1990) (“Implied indemnity is a restitution
concept which permits shifting the loss because to fail to do so would result in the unjust
enrichment of one party at the expense of the other.”).
“Under New York law, an indemnitor must bear some fault for the damages suffered by the
indemnitee, whether on account of negligence, equitable considerations, or statutory requirements.”
In re Sept. 11 Litig., 751 F.3d 86, 94 (2d Cir. 2014). “In New York, ‘[a] cause of action for commonlaw indemnification can be sustained only if: (1) the party seeking indemnity and the party from
whom indemnity is sought have breached a duty to a third person, and (2) some duty to indemnify
exists between them.’” Highland Holdings & Zito I, L.P. v. Century/ML Cable Venture, No. 06-cv-181GBD, 2007 WL 2405689, at *4 (S.D.N.Y. Aug. 24, 2007) (quoting Ins. Co. of State of Pennsylvania v.
HSBC Bank USA, 829 N.Y.S.2d 511, 518 (1st Dep’t 2007) (citations omitted)), aff’d sub nom. In re
Century/ML Cable Venture, 311 F. App’x 455 (2d Cir. 2009). “The duty that forms the basis for the
state law for the proposition that a personal guarantor of a mortgage had standing on the basis of his
“real interest” in a judgment of strict foreclosure. 150 Conn. App. at 617.
12
liability arises from the principle that ‘every one is responsible for the consequences of his own
negligence, and if another person has been compelled . . . to pay the damages which ought to have
been paid by the wrongdoer, they may be recovered from him.’” Raquet v. Braun, 90 N.Y.2d 177,
183 (1997) (quoting Oceanic Stream Nav. Co. v. Compania Transatlantica Espanola, 134 N.Y. 461, 468
(1892)). Significantly, “the ‘key element’ of a common law indemnification claim ‘is not a duty
running from the indemnitor to the injured party, but rather is a separate duty owed the indemnitee
by the indemnitor.’” 3 Perkins Eastman Architects, P.C. v. Thor Engineers, P.A., 769 F. Supp. 2d 322,
329-30 (S.D.N.Y. 2011) (quoting Raquet, 90 N.Y.2d at 183).
CVS’s allegations satisfy these requirements. CVS alleges that the PHI disclosures were “due
solely to Press America’s improper conduct and negligence.” Am. Compl. ¶ 78. CVS further alleges
that, although it was “in no way responsible” for the disclosures, CVS was “required to notify those
affected” which “significantly damage[d]” its reputation and goodwill with its clients. Id. ¶¶ 79, 81.
Finally—although it appears elsewhere in the Amended Complaint—CVS alleges that it was owed a
“duty of reasonable care in a manner consistent with the knowledge and ability possessed” by Press
America, a vendor of printing and mailing services. Am. Compl. ¶ 86. CVS also alleges elsewhere in
the Amended Complaint that “[b]oth Press America and CVS were well aware of the inherent risks
associated with mailing PHI and other sensitive information to patients.” Id. ¶ 16. Considering the
allegations of the Amended Complaint as a whole, the Court accepts, at this stage, that CVS has
sufficiently alleged that it is owed a duty by Press America by virtue of the nature of their
relationship, and that the duty was breached.
According to Press America, CVS “may not ‘recover in quasi contract where the parties have
a valid, enforceable contract that governs the same subject matter’ as the quasi contract claim.” Def.
Mem. of Law, at 21 (quoting Murray Bresky Consultants, Ltd. v. N.Y. Comp. Manager’s Inc., 968 N.Y.S.2d
3
Press America incorrectly asserts that the duty must run from Press America to IBM. Def. Mem.
of Law at 20; Reply at 8.
13
595, 600 (3d Dep’t 2013) and 4Kids Entm’t, Inc. v. Upper Deck Co., 797 F. Supp. 2d 236, 248-49
(S.D.N.Y. 2011)). Press America is correct that “a valid and enforceable contract generally precludes
recovery in quasi-contract for losses arising from the same subject matter.” CSC Scientific Co., 867 F.
Supp. 2d at 377; see also Int’l Techs. Mktg., Inc. v. Verint Sys., Ltd., 157 F. Supp. 3d 352, 370 (S.D.N.Y.
2016) (“plaintiff may not recover under a quasi-contractual theory when the parties had a valid
contract governing their relationship”). But here, it is too soon to determine whether there was a
“valid and enforceable” contract “governing the same subject matter.” Indeed, Press America
argues that the disclosures are not covered by the indemnification provisions in question. Cf. CSC
Scientific Co., 867 F. Supp. 2d at 378 (“Here, the parties expressly defined [defendant’s]
indemnification obligations in what is conceded to be a valid and unambiguous written agreement.”) (emphasis
added); Clark-Fitzpatrick, Inc. v. Long Island R.R. Co., 70 N.Y.2d 382, 389 (1987) (“It is impermissible
. . . to seek damages in an action sounding in quasi contract where the suing party has fully
performed on a valid written agreement, the existence of which is undisputed, and the scope of which
clearly covers the dispute between the parties.”) (emphasis added). For these reasons, the motion to
dismiss is denied, without prejudice to renewal in later summary judgment motion practice or at trial.
j.
CVS’s Claim for Negligence is Plausibly Pleaded
“Under New York law . . . a plaintiff must establish three elements to prevail on
a negligence claim: (1) the existence of a duty on defendant’s part as to plaintiff; (2) a breach of this
duty; and (3) injury to the plaintiff as a result thereof.” Aegis Ins. Servs., Inc. v. 7 World Trade Co., L.P.,
737 F.3d 166, 177 (2d Cir. 2013) (quoting Alfaro v. Wal–Mart Stores, Inc., 210 F.3d 111, 114 (2d Cir.
2000)). CVS sufficiently alleges each of these elements. See Am. Compl. ¶¶ 85-93. First, CVS
alleges that “Press America owed CVS a duty of reasonable care in a manner consistent with the
knowledge and ability possessed by such a vendor.” Id. ¶ 86. Second, CVS alleges that “Press
America breached its duty of reasonable care to CVS by, among other things, negligently disclosing
PHI.” Id. ¶ 87. Third, CVS alleges that it was damaged by Press America’s negligence because,
14
among other things, it was required to pay IBM, conduct an “exhaustive investigation” into the
extent of the disclosures, “assess the extent of various HIPAA compliance issues,” and notify the
affected customers. Id. ¶¶ 88-91.
Press America’s only argument directed at CVS’s negligence claim is that the payment
provision in the IBM Contract was not the proximate cause of CVS’s damages. However, for the
reasons previously stated, this argument is premature. Accordingly, Press America has not
demonstrated that CVS failed to plausibly plead negligence.
4. CONCLUSION
For the foregoing reasons, Defendant’s motion to dismiss is DENIED. The Clerk of Court
is directed to close the motion at ECF No. 44.
SO ORDERED.
Dated: January 3, 2018
New York, New York
_____________________________________
_____________________
_______ __ ____
___
GREGORY H. WOODS
REGORY H.
OR
OR
United States District Judge
ited
15
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?