Anonymous v. CVS Corp.

OPINION OF THE COURT Charles Edward Ramos, J. Motion sequence Nos. 002 and 003 are hereby consolidated for purposes of disposition. In this purported class action challenging the purchase and sale of customers’ medical and prescription information without their knowledge or consent, defendants, CVS Corporation, CVS Columbus Place, L. L. C. (CVS), Trio Drugs Corp. (Trio Drugs), and Gerald Hinderstein (Hinderstein), seek dismissal of the complaint, pursuant to CPLR 3211 (a) (7), contending it fails to allege breach of a duty to keep patient prescription information confidential. When defendants Trio Drugs, a local pharmacy, and its pharmacist, Hinderstein, decided to cease doing business in 1999, defendants CVS, a national drugstore chain, purchased Trio Drugs’ records. Those records contained its customers’ prescription records and medical profiles identifying, among other health-related information, any known allergies, chronic diseases, and drug reactions.1 They are among many customer files which CVS has purchased through its “independent file buy program” (the File Buy Program). In 1998, under the File Buy Program, CVS acquired the customer files of approximately 350 independent pharmacies that ceased doing business. Plaintiff alleges that as a condition of the File Buy Program, CVS required Trio Drugs and other independent pharmacies participating in the Program to not give advance notice to their customers of the store closing or the transfer of the customer’s medical profiles and prescription information. Diagnosed with Human Immunodeficiency Virus (HIV) in 1986, and with Acquired Immune Deficiency Syndrome (AIDS) in 1989, plaintiff alleges that he selected Trio Drugs as his pharmacy based upon an expectation of privacy. For nearly 20 — 619 — years, plaintiff allegedly used Trio Drugs, expecting it would keep all personal medical and prescription information confidential and not disclose it without his prior knowledge and consent. According to the complaint, plaintiff and the other customers of Trio Drugs were only told after the closing of Trio Drugs that their prescription and personal medication profiles were transferred to CVS. Plaintiff commenced this action claiming much of the information from the prescription files that Trio and other independent pharmacies sold to CVS has been incorporated into the CVS computer data base. According to plaintiff, the data base is networked and accessible by CVS pharmacies nationwide. He further contends that his confidential information and that of the purported class members is accessible to tens of thousands of CVS store employees and the health care plans and managed care providers that contract with CVS. Based upon these allegations, the complaint asserts that Trio Drugs violated a pharmacist’s statutory and fiduciary duty of confidentiality, a violation which CVS aided and induced. Specifically, plaintiff claims that the transfer of a customer’s HIV or AIDS related prescription and medical information is in violation of section 2782 (1) of the Public Health Law. Prescription and medical information unrelated to HIV or AIDS was allegedly transferred in violation of Public Health Law § 18 (6); 8 NYCRR 63.6 (a) (8); General Business Law § 349; and in breach of a pharmacist’s common-law duties. In seeking dismissal, defendants Trio Drugs and CVS assert that no duty of confidentiality exists, and if one does exist, they did not breach the duty by transferring the records of a discontinuing pharmacy to another licensed pharmacist or pharmacy. Defendants contend that the prescription records and medical profiles — which by statute pharmacists are required to maintain for five years — are the property of the pharmacy. They argue customers have no right to reclaim those records when a pharmacy ceases doing business. Relying on a statutory provision permitting the sale and transfer of prescription records, they further argue that discontinuing pharmacies are statutorily required to sell prescription records and profiles. Otherwise, according to defendants, discontinuing pharmacies would fail to comply with the five-year record-keeping requirement. Defendants contend that because the statutory framework requires a discontinuing pharmacy to sell its records, the Trio Drugs transaction was not done in breach of any duty or in violation of any law. — 620 — Dismissal pursuant to CPLR 3211 (a) (7) is appropriate where the facts alleged, even if accepted as true, “establish conclusively that [the] plaintiff has no cause of action.” (SRW Assocs. v Bellport Prop. Owners, 129 AD2d 328, 330 [2d Dept 1987], quoting Rovello v Orofino Realty Co., 40 NY2d 633, 636.) Under CPLR 3211 (a) (7), the standard is whether plaintiff has a cause of action, not whether plaintiff has stated one (Wiener v Lazard Freres & Co., 241 AD2d 114, 120 [1st Dept 1998]). “[A] dismissal will be warranted only in those situations in which it is conclusively established that there is no cause of action.” (Town of N. Hempstead v Sea Crest Constr. Corp., 119 AD2d 744, 746.) Here, this Court finds that the facts fail to state a claim for violations of Public Health Law § 18 (6), and state regulation 8 NYCRR 63.6 (a) (8) under the Education Law. As for the remaining claims, the laws that regulate pharmacists do not require the sale of prescription records. Nor do they necessarily exempt defendants of a duty of confidentiality, should a duty exist. Therefore, this defense does not warrant dismissal.2 However, an exemption to Public Health Law § 2782 does foreclose plaintiff’s claim against defendants for violation of Public Health Law § 2782 (1). Fiduciary Duty Although no New York court apparently has addressed the issue of whether or not pharmacists and pharmacies owe a fiduciary duty of confidentiality, it is well settled in New York that a fiduciary duty arises, even in a commercial transaction, where one party reposed trust and confidence in another who exercises discretionary functions for the party’s benefit or possesses superior expertise on which the party relied (Wiener v Lazard Freres & Co., 241 AD2d 114 [1st Dept 1998]; Societe Nationale D’Exploitation Industrielle des Tabacs et Allumettes v Salomon Bros. Intl., 251 AD2d 137 [1st Dept 1998]). A court will look to whether a party reposed confidence in another and reasonably relied on the other’s superior expertise or knowledge (Wiener v Lazard Freres & Co., 241 AD2d 114 [1st Dept 1998], supra). It is not mandatory that a fiduciary relationship be formalized in writing, and any inquiry into whether such obligation exists is necessarily fact-specific to the particular — 621 — case (id.). Here, the Court finds that pharmacists, in fact, do more than dispense a product. They are responsible for collecting otherwise confidential medical information, and providing drug advice to customers. Unlike in a traditional commercial transaction, pharmacists are required to collect otherwise confidential medical information, and are obligated to review that information before each prescription is dispensed (see 8 NYCRR 63.6 [b] [7]; see also, 188 Misc 2d 616, 618, n 1). While recognizing that communication of confidential information is insufficient “in and of itself to create a fiduciary relationship” (Wiener v Lazard Freres & Co., 241 AD2d 114, 122 [1st Dept 1998], supra), this Court notes that customers rely on pharmacists for drug advice. In fact, pharmacists are required, under 8 NYCRR 63.6 (b) (8) (i) (a) (4), to offer counseling to each patient on “matters which in the exercise of the pharmacist’s * * * professional judgment” relate to, inter alia, the administration, use, and “common severe side or adverse effects or interactions and therapeutic contraindications that may be encountered [with a drug] * * * and the action required if they occur.” It is true that the same level of dependency typically found in a physician-patient relationship is not involved in a pharmacist-customer relationship. However, in order for customers to receive reliable advice from their pharmacist, they must disclose the most personal kind of information not generally required in other transactions involving the sale of a product and they are often the last health care professional a patient may have contact with before treatment, i.e., pharmaceutical drugs are administered. Contrary to defendants’ contentions, the prescription decision and the therapeutic relationship with the physician do not always end once a customer reaches a pharmacy. Because pharmacists have a certain amount of discretion, and an obligation to collect otherwise confidential medical information, the Court must find that customers can reasonably expect that the information will remain confidential. This conclusion is supported by 8 NYCRR 29.1 (a) and (b) (8) which governs the conduct of health care professionals, including pharmacists, and provides that it is unprofessional conduct to “reveal [] * * * personally identifiable facts, data or information obtained in a professional capacity without the prior consent of the patient or client, except as authorized or required by law.” (See 8 NYCRR 29.1 [b] [8].) Defendants rely on Evans v Rite Aid Corp. (324 SC 269, 478 SE2d 846 [1996]) and Griffin v Phar-Mor, Inc. (790 F Supp — 622 — 1115 [SD Ala 1992]), where the court refused to recognize a fiduciary duty in a pharmacist-customer relationship. Aside from not being controlling authority in New York, they are both distinguishable and offer little guidance in resolving the instant motion. The facts in Griffin involved the mislabeling and misfiling of a prescription by a pharmacy. The Federal Southern District Court in Alabama found that although the “relationship between pharmacist and client is a sufficient special circumstance to impose” a duty to disclose, a duty of confidentiality did not exist. (Id., at 1117.) In Evans, an employee of a pharmacy disclosed to others that a customer’s medication was for treatment of a venereal disease, when in truth it was not. There, the court relied upon Griffin without analyzing whether or not a pharmacist has a fiduciary duty, instead finding that the plaintiff had a claim for defamation, or professional negligence. Thus, neither court fully addressed the issue of a pharmacist’s duty of confidentiality. Although the issue was considered by the Illinois Court of Appeals in Suarez v Pierard (278 Ill App 3d 767, 663 NE2d 1039 [1996]), it was within the context of an Illinois statute regulating therapists. There, plaintiff commenced an action for violation of Illinois’ Mental Health and Developmental Disabilities Confidentiality Act when her pharmacist discussed confidential information concerning plaintiff while in a tavern. In affirming a lower court’s decision, the court had to construe the statute’s definition of “therapist” to determine whether the confidentiality provision applied to pharmacists. A divided court found that “merely advising a person about the use of drugs or providing information about the drugs” did not establish the existence of a therapeutic relationship (278 Ill App 3d, at 771, 663 NE2d, at 1042; compare 278 Ill App 3d, at 774, 663 NE2d, at 1044 [concurring opn], in which Presiding Justice Breslin stated “Pharmacists do much more [than fill prescriptions]. They maintain extensive patient records and counsel patients on drug interactions * * * Surely the public has a right to expect that pharmacists will keep the health conditions and treatments of their clients in confidence”). However, no claim of a common-law fiduciary duty was alleged or considered by the court in Suarez. The only issue the court addressed was whether plaintiff had a claim for violation of a confidentiality provision under Illinois’ Mental Health Law. Much like this Court’s interpretation of the Public Health Law, the court in Suarez found that the Illinois statute did not specifically refer to pharmacists. — 623 — While the role of a pharmacist may not equal that of a physician treating a patient, surely access and the right to collect private medical information on one’s customers does not make a pharmacist merely “the dispenser of a commercial product.” (See Lutz v Houck, 263 NY 116 [1933] [where the New York Court of Appeals distinguished the role of pharmacists from that of a drug store owner].) The pharmacist has vastly superior knowledge of pharmaceuticals, a highly specialized type of goods with the potential to cause great harm to customers. Customers must place some degree of trust and confidence in the pharmacist filling their prescriptions. The transaction between a pharmacist and customer involves the principal characteristics of a fiduciary relationship — dependency and influence (see United States v Reed, 601 F Supp 685, 715). Defendants argue that a discontinuing pharmacy has a statutory obligation to sell or transfer customers’ medical information to another licensed pharmacy under Education Law § 6812. Section 6812 (1) of the Education Law merely states that “[wjhere a pharmacy is discontinued, the owner of its prescription records shall notify the [Education] department as to the disposition of said prescription records, and in no case shall records be sold or given away to a person who does not currently possess a registration to operate a pharmacy.” This section does permit a discontinuing pharmacy to sell prescription information. Read literally, however, the provision merely recognizes the sale of prescription information as an alternative means of disposing the records. Should a sale occur, all that this statute requires is a sale to another registered pharmacy. Assuming that a discontinuing pharmacy has an ongoing five-year obligation to maintain prescription records, even after discontinuing its operations, defendants have failed to identify, nor has this Court located, a statute proscribing acceptable methods of disposing prescription records. Nor must this Court address which methods are acceptable. Here, the issue is whether the method used, i.e., a sale deliberately without its customers’ knowledge and consent, violated the law. Nothing in Education Law § 6812 (1) indicates that the Legislature intended to extinguish a pharmacist’s duty of confidentiality and fiduciary duty, which might otherwise exist (see McKinney’s Cons Laws of NY, Book 1, Statutes § 74 [where a statute is silent, the court must assume that the Legislature intentionally omitted what is not included]). — 624 — General Business Law § 349 At issue on plaintiffs claim of deceptive practices in violation of General Business Law § 349 is whether a reasonable consumer would have been misled or changed their position as a result of defendants’ willful nondisclosure of its intent to sell the consumer’s prescription information. To plead a claim for violation of General Business Law § 349, a plaintiff must allege that (1) defendant’s acts have broad impact on consumers at large; (2) defendant is engaged in deceptive practices; and (3) this practice has injured plaintiff (Oswego Laborers’ Local 214 Pension Fund v Marine Midland Bank, 85 NY2d 20 [1995]). No doubt the Legislature intended General Business Law § 349 to protect against “consumer oriented” deceptive practices that “halve] a broader impact on consumers at large” (Gaidon v Guardian Life Ins. Co., 94 NY2d 330, 344 [1999]). However, several New York courts have concluded that, to recover compensatory damages, a plaintiff must allege that deceptive conduct caused them to suffer an actual injury (Oswego Laborers’ Local 214 Pension Fund v Marine Midland Bank, 85 NY2d 20 [1995], supra; Stutman v Chemical Bank, 260 AD2d 272 [1st Dept 1999]). Plaintiff claims that defendants engaged in deceptive practices because the nondisclosure was intended to lull Trio Drugs customers (who had obviously not selected CVS) into filling and refilling their prescriptions at CVS. Plaintiff claims that CVS’ involvement in the File Buy transaction is inconsistent with statements CVS made on its website. There it expresses a commitment to keeping customer information confidential, recognizing that “[s]haring confidential information with unauthorized personnel violates the patients’ trust and is illegal.” (See complaint j[ 54-57.) Based upon deceptive practices and these statements, plaintiff claims that the injury he suffered was the loss of his right to privacy. The statements made by CVS, if considered alone, are not actionable because plaintiff cannot allege that he was misled or injured by those statements. However, the practice of intentionally declining to give customers notice of an impending transfer of their critical prescription information in order to increase the value of that information appears deceptive. Whether or not a customer has the right to prior notice and to compel a discontinuing pharmacy or pharmacist to retain or transfer prescription information to another pharmacist of the customer’s choosing is at issue in this case. As discussed below, there is a statutory right to protect HIV and AIDS related in — 625 — formation. Whether a right to protection of non-HIV and AIDS related information exists depends upon the success of plaintiff’s other claims. However, assuming defendants did owe a duty of confidentiality, if prior notice had been given, plaintiff might have had an opportunity to fill, or refill his prescriptions elsewhere. Plaintiff might have also demanded Trio Drugs retain his information, or taken legal action before the disclosure. By not allowing plaintiff that opportunity, plaintiffs right to prevent the disclosure from occurring was forever impaired. Although an actual injury is required by General Business Law § 349, it need not involve a pecuniary loss (Oswego Laborers’ Local 214 Pension Fund v Marine Midland Bank, 85 NY2d 20 [1995], supra). Contrary to defendants’ allegations, a clear distinction exists between the deception being the injury and a real right being lost. Defendants’ deceptive acts were allegedly designed to and prevented plaintiff from exercising the right to take action to prevent or minimize the disclosure of his medical information. Charges that many customers of the independent pharmacies continued filling prescriptions with CVS may be evidence that some were not bothered by defendants’ actions. However, this allegation does not warrant dismissal of the claim. Under an implied contract or quasi-contract theory, this Court also finds that this cause of action is properly pleaded. To plead a claim for breach of an implied-in-fact contract, a plaintiff must show that defendant’s conduct was such that defendant’s “assent may fairly be inferred.” (D’Angelo v Hastings Oldsmobile, 89 AD2d 785, 786 [4th Dept 1982], quoting Miller v Schloss, 218 NY 400, 407 [1916].) A quasi contract or contract implied by law requires a showing that defendants were unjustly enriched at the expense of another (id.). A pharmacist’s professional obligation of nondisclosure may give rise to a contractual duty. Moreover, the facts may support a finding that Trio and CVS were unjustly enriched when the transaction allowed one defendant to receive payment for plaintiffs prescription information, and the other to realize an increase in its customer base. Public Health Law § 18 (6) Plaintiff relies on Public Health Law § 18 (6) to support claims that a pharmacist’s disclosure of non-HIV and AIDS related information without a customer’s knowledge or consent is also prohibited by law. Public Health Law § 18 (6) states: — 626 — “Whenever a health care provider, as otherwise authorized by law, discloses patient information to a person or entity other than the subject of such information or to other qualified persons, either a copy of the subject’s written authorization shall be added to the patient information or the name and address of such third party and a notation of the purpose for the disclosure shall be indicated in the file or record of such subject’s patient information maintained by the provider * * * Any disclosure made pursuant to this section shall be limited to that information necessary in light of the reason for disclosure. Information so disclosed should be kept confidential by the party receiving such information and the limitations on such disclosure in this section shall apply to such party.” Instead of arguing that defendants are “health care providers” as defined in section 18 (1) (b),3 which plaintiff concedes defendants are not, plaintiff alleges that defendants are third-party recipients4 5of patient information5 and thus under an absolute obligation to keep customer information confidential. Under plaintiff’s reading of the statute, when a customer’s physician writes or telephones a pharmacist about a prescription for medication, medical information is disclosed to a pharmacist. Although written prescriptions are delivered to a pharmacist or pharmacy by a customer, plaintiff argues that patient information contained in the prescription has been disclosed by a health care provider, and thus the pharmacist is obligated to keep the information confidential. Defendants argue that Public Health Law § 18 (6) does not apply because prescription information is not information “received from health care providers” in accordance with the statute. — 627 — Although the protection of an individual’s medical information is paramount under Public Health Law § 18 (6), and typically pharmacists possess highly sensitive information related to the medical condition and treatment of their customers, the statute does not apply to pharmacists. Application of Public Health Law § 18 (6) is limited to those individuals specifically listed in the definition of the term “health care provider.” (See 188 Misc 2d 616, 626, n 3, supra.) Instead of prohibiting all disclosures of medical information, Public Health Law § 18 (6) defines a health care provider’s obligations to keep patient information confidential, and lists specific instances in which disclosure is permitted, e.g., a provider obtains patient authorization prior to disclosure, or makes a notation in the patient’s records explaining the reason for the disclosure. Where access to patient information is granted in accordance with the reojuirements of Public Health Law § 18, the provider is afforded immunity from civil liability (see Public Health Law § 18 [12]). Plaintiff’s interpretation of Public Health Law § 18 (6) misconstrues this provision. The language regarding a third-party recipient’s obligation not to disclose is limited to information received from a health care provider. Pharmacists are not listed as health care providers. A broader reading of the section to prohibit all disclosures of patient information, regardless of its source, would place an enormous burden on health care providers, and make it virtually impossible for them to comply with the disclosure provisions. Since prescription information is typically freely and voluntarily disclosed by a customer, not by the customer’s health care provider, Public Health Law § 18 (6) cannot be so broadly construed as to apply. If so, for every written prescription, a health care provider would have to either obtain consent from a patient, or make a notation in the patient’s file naming the pharmacist or pharmacy filling the prescription. (See generally, Public Health Law § 18 [6].) The Legislature could have included pharmacists within the definition of “health care provider” if the provision was intended to regulate the disclosure of prescription information. Then, pharmacists, along with other health care providers, would have an opportunity to comply with the requirements, and obtain immunity from civil liability under Public Health Law § 18. Because pharmacists are not mentioned, Public Health Law § 18 (6) does not apply. Accordingly, this cause of action must be dismissed. Similarly, the language of 8 NYCRR 63.6 (a) (8) under the Education Law, regulating refill transfers, does not apply. — 628 — This provision applies to a one-time transfer of prescription refills, and is silent on whether or not defendants have a duty to keep such information confidential. 8 NYCRR 63.6 (a) (8) provides that “pharmacists * * * may, at the express request and approval of a patient * * * transfer prescription information to, or accept a transfer from, another registered pharmacy * * * for the exclusive purpose of providing one authorized refill per transfer.” The request and approval are for the exclusive purpose of providing one authorized refill per transfer. Thus, even assuming that the statute provides a private right of action, and that 8 NYCRR 63.6 (a) (8) requires a patient’s request and approval prior to a transfer of prescription information, 8 NYCRR 63.6 (a) (8) regulates the registration and daily operations of pharmacies, and does not address the sale and transfer of a customer’s permanent records. Nor does it mention an obligation to protect against disclosure of patients’ confidential medical or even prescription information. Much like plaintiffs claim under section 18 (6) of the Public Health Law, statutory construction of the clear language of this section requires that this Court find plaintiffs allegations fail to state a*claim for violation of 8 NYCRR 63.6 (a) (8). Section 2782 (1) of the Public Health Law and the regulations promulgated thereunder provide, in part, that “[n]o person who obtains confidential HIV related information in the course of providing any health or social service or pursuant to a release of confidential HIV related information may disclose or be compelled to disclose such information.” (See 10 NYCRR 63.5 [a].) Although certain persons are excluded under the prohibition, the type of information protected against disclosure is “any information, in the possession of a person who provides one or more health or social services or who obtains the information * * * concerning whether an individual has been the subject of an HIV related test, or has HIV infection, HIV related illness or AIDS, or information which identifies or reasonably could identify an individual as having one or more of such conditions.” (See Public Health Law § 2780 [7]; § 2782.) Obviously, pharmacists who fill or refill prescriptions of HIV positive or AIDS infected customers possess confidential information that is protected by the statute. Even if the pharmacist’s medical profile does not expressly state the medical condition of an HIV positive or AIDS customer, the type of drug prescribed often identifies the nature of the customer’s illness. However, defendants challenge whether information of an HIV or AIDS infected customer is obtained in “the course of providing any health or social service,” as required by statute (id.). — 629 — Section 2780 of the Public Health Law broadly defines “health or social service” to include any medical treatment. An essential form of medically treating HIV and AIDS is the prescription of drugs. Undoubtedly, without a pharmacist filling and refilling prescriptions, patients would not receive this kind of medical treatment. However, pharmacists merely administer the receipt of prescription drugs. They do not provide medical treatment. For this reason, section 2782 (1) does not apply. Moreover, an exemption exists which permits health care providers to access confidential HIV information when necessary to provide appropriate care (see Public Health Law § 2782 [1] [d]). Subdivision (1) (d) upon which defendants rely is silent regarding the protected individual’s authorization and consent. That provision allows a health care provider or facility to disclose, without notice or consent, “HIV related information [when it] is necessary to provide appropriate care or treatment to the protected individual.” (Id.) Thus, if this Court accepts plaintiff’s argument and assumes defendants are “providing medical services,” disclosure of prescription information to another pharmacist would still be medically necessary so that customers who might suffer grave illnesses due to HIV and AIDS can continue to receive life-saving prescription medication. Therefore, even in the most favorable light, plaintiff’s allegations do not constitute a violation of Public Health Law § 2782. Accordingly it is ordered that the motion to dismiss is granted to the extent that the first, second, seventh and eighth causes of action are dismissed. Footnotes [1] According to 8 NYCRR 63.6 (b) (7), all pharmacists must maintain a patient medical profile which includes, but not limited to “the patient’s name, address, telephone number, gender, date of birth or age, known allergies and drug reactions, chronic diseases, a comprehensive list of medications and relevant devices and other information reported to the pharmacist appropriate for counseling an individual regarding use of prescription and over-the-counter drugs.” [2] Defendant CVS does not challenge plaintiffs allegations that CVS aided or induced the alleged common-law breaches and statutory violations. Nor do defendants seek dismissal of plaintiff’s tortious interference and negligence claims. Thus, they are not the subject of the dismissal motion or this Court’s opinion. [3] Specifically, Public Health Law § 18 (1) (b) defines “health care provider” as a “health care facility” or “health care practitioner.” A “health care facility” under section 18 (1) (c) includes hospitals, HMOs, or home care agencies or organizations; and “health care practitioner” includes those listed persons under section 18 (1) (d), which does not include persons regulated by article 137 of the Education Law, the article governing pharmacists. [4] “Third parties” are defined as any “person or entity [in receipt of patient information] other than the subject of such information.” (See Public Health Law § 18 [6].) [5] “Patient information” is “any information concerning or relating to the examination * * * or treatment of an identifiable subject maintained or possessed by a health care facility or health care practitioner” who has treated or is treating such subject. (See Public Health Law § 18 [1] [e].)