McLAUGHLIN, District Judge.
The plaintiffs, Arthur Steinberg and the Philadelphia Federation of Teachers Health and Welfare Fund ("PFTHW"), bring this action on behalf of themselves and other Pennsylvania prescription drug purchasers against CVS Caremark Corporation ("Caremark") and CVS Pharmacy, Inc., in connection with the defendants' sale of information they provided when having their prescriptions filled. The operative complaint was filed on May 31, 2011 and brings claims under the Pennsylvania Unfair Trade Practices and Consumer Protection Law ("UTPCPL") as well as theories of unjust enrichment and invasion of privacy. The defendants have moved to dismiss the complaint for failure to state a claim. The Court will grant the defendants' motion.
This case was initially brought in the Philadelphia Court of Common Pleas on March 7, 2011, and removed to this Court on April 7 under the Class Action Fairness Act of 2005. The plaintiffs filed their Amended Consumer Class Action Complaint ("CAC") on May 31, which the defendants moved to dismiss on July 25, arguing under Rule 12(b)(6) of the Federal Rules of Civil Procedure that the plaintiffs had failed to state a claim.
The CAC alleges that the defendants misused "confidential prescription information" provided by the plaintiffs when filling prescriptions. The plaintiffs bring several claims under state law for the defendants' (a) use of this data to send letters to consumers' physicians suggesting that they prescribe alternate drugs; (b) packaging and sale of certain consumer data to third parties; and (c) failure to disclose that consumers' data would be used in this manner. Steinberg brings UTPCPL and privacy claims against both defendants (Counts I & IV); both plaintiffs assert an unjust enrichment claim against Caremark (Counts II & III).
Steinberg is an individual who purchased prescription medication at a CVS pharmacy located in Richboro, Pennsylvania. PFTHW is a trust providing benefits for members, retirees, spouses, and dependents of the Philadelphia Federation of Teachers Local 3 Union, including administration of prescription drug benefit plans. Through those plans, PFTHW reimbursed its members for prescriptions filled at CVS pharmacies. CAC ¶¶ 5-6, 9. The plaintiffs assert claims on behalf of a putative class of all Pennsylvania consumers and third-party payors who filled prescriptions at CVS pharmacies and were not notified that the defendants would use and sell their information in the ways described above. CAC ¶¶ 47-49. The defendants operate retail pharmacies, and Caremark operates as a pharmacy benefits manager, providing pharmacy services to numerous entities. CAC ¶ 8.
The CAC identifies several public representations that Caremark made in connection with its handling of consumer information. First, Caremark has a "Code of Conduct" for employees that it makes available on its website. The Code of Conduct states:
CVS Caremark Code of Conduct at 8-9, CAC Ex. A.
Caremark issues a "Notice of Privacy Practices" to customers when they fill prescriptions in Pennsylvania. This document states:
Notice of Privacy Practices, CAC Ex. E (emphasis in original).
The CAC alleges that the defendants entered agreements with pharmaceutical manufacturers such as Eli Lilly and Company, Merck, AstraZeneca, and Bayer, whereby those companies funded mailings by Caremark to the physicians of the defendants' customers, urging them to consider prescribing alternative medications. The letters identified consumers by name, birth date, and the medications they had been prescribed, stating that such information had been obtained from consumers filling prescriptions at CVS pharmacies. The defendants also sold "confidential prescription information" obtained from consumers to third parties, including pharmaceutical manufacturers and data companies. CAC ¶¶ 17, 19-26.
The defendants did not state in the Code of Conduct or Notice of Privacy Practices that "confidential prescription information" would be sold to these entities, but Caremark executives admitted to the sale of this information in public pronouncements to investors and in other judicial proceedings. CAC ¶¶ 37-43; Change to Win Coalition, CVS Caremark: An Alarming Prescription (Nov.2008) at 15-16, CAC Ex. F (noting that Caremark's Chief Executive Officer told investors that the company has "more information on the consumer and their behavior than anybody else, and we share it with our over-the-counter suppliers," and that Caremark's Director of Managed Care Operations acknowledged that "the sale of data to vendors occurred and was a source of revenue").
The plaintiffs allege that the defendants' actions violate the UTPCPL because although they stated to consumers that they "maintained the confidential prescription information of ... consumers," the defendants failed to disclose their practice of packaging and selling of that information in its Notice of Privacy Practices. As a result, the plaintiffs "suffered an ascertainable loss." CAC ¶¶ 58-63, 67.
The plaintiffs further allege that they conferred a benefit on Caremark, "namely, the receipt of confidential prescription information," and Caremark has been unjustly enriched because it "sought to generate additional profits through the sale of confidential prescription information obtained through the benefits conferred" by the plaintiffs. The plaintiffs allege that "the circumstances identified with particularity" earlier in the CAC render Caremark's retention of profits from the sale of that information unjust. CAC ¶¶ 69-71, 73-75.
Finally, the plaintiffs allege that the defendants' practices worked an intentional intrusion upon their seclusion because the plaintiffs' information was sold under false pretenses, and that this intrusion would be highly offensive to a reasonable person. CAC ¶¶ 77-79.
The CAC repeatedly refers to the defendants' sale of "confidential prescription information" to pharmaceutical companies and third-party data firms, but does not elaborate on what "confidential prescription information" is or what parts of that data were in fact disclosed to third parties. The defendants argue that this characterization is conclusory and obscures the nature of the data they package and sell. In opposition to the defendants' motion, the plaintiffs refer interchangeably to the defendants' sale of "protected health information," "individually identifiable health information," and "confidential prescription information," Pl. Opp. 6, without identifying
The plaintiffs do clarify that they allege that once the data in question is collected by the defendants, it is "merged, edited, de-identified and then sold to third party data vendors and business associates." Id. The arguments made by the plaintiffs in opposition to the instant motion did not resolve the confusion over what data they allege was actually sold by the defendants.
At oral argument, the plaintiffs altered both the specificity of their factual allegations and the theory under which those facts gave rise to liability under the CAC. Specifically, the plaintiffs conceded that the information sold by the defendants to third parties was de-identified within the meaning of HIPAA.
The Court raised its concerns over the ambiguity in the CAC and plaintiffs' briefing as to the specific information they allege was sold by the defendants to third parties. Counsel for the plaintiff agreed with the Court that the CAC's averments relating to "confidential prescription information" were at least "ambiguous." Tr. Hr'g 10/27/11 at 28. Counsel acknowledged that the information that the plaintiffs allege was sold to pharmaceutical companies and third party data firms did not contain patient names, birth dates, or Social Security numbers. Instead, the information sold consisted of a combination of medical history, prescription drugs given, dates of prescriptions, diagnoses, and physician names, lacking identifying information. Id. 8-11.
Counsel conceded that the information disclosed by the defendants to pharmaceutical companies and data firms was de-identified data. He stated that the plaintiffs could still articulate a theory of liability based on a contention that the information sold by the defendants is capable of being manipulated to identify individual patients, in violation of HIPAA. Id. 11-12. Counsel also requested that if the Court dismissed the operative complaint, the plaintiffs be granted leave to amend, using a re-identification theory to establish that the information the defendants disclose is entitled to HIPAA protection. Id. at 27-28. The Court was referred to the name of an article in an academic journal discussing risks associated with re-identification of data, but counsel did not explain how or whether the theory applied to this case. Id. at 12.
Ultimately, the plaintiffs conceded that the status of the information disclosed by the defendants under health information privacy laws governed the viability of the plaintiffs' claims.
Id. at 5-6, 22-23.
The Court agrees with the plaintiffs' characterization of the case at oral argument, and because it finds that the defendants have not disclosed legally protected information, will grant the defendants' motion.
The CAC alleges that the defendants misrepresented their treatment of "confidential prescription information" provided by consumers in connection with pharmacy services. The plaintiffs' subsequent clarifications make clear that the defendants neither sold information entitled to legal protection nor made any misrepresentations on which the plaintiffs justifiably relied regarding the way that consumer information would be handled. In addition, the information the defendants sold to third parties does not carry a compensable value to the plaintiffs or constitute an invasion of privacy. The Court will, therefore, dismiss the plaintiffs' claims. Because the plaintiffs have not articulated a viable alternative theory of liability, the Court's dismissal will be with prejudice.
Steinberg argues that the defendants' failure to disclose their sale of his prescription information in the "CVS Caremark Code of Conduct," made available online, and "Notice of Privacy Practices," disclosed to Pennsylvania consumers when filling prescriptions, constitutes a deceptive practice under the UTPCPL. He alleges that the defendants' failure to disclose this practice is "fraudulent or deceptive conduct which creates the likelihood of confusion or misunderstanding." CAC ¶¶ 62, 64. This language invokes the "catch-all" provision of the UTPCPL. See 73 Pa. Stat. § 201-2(4)(xxi).
The substantive basis for the plaintiff's UTPCPL claim is that the defendants made material misrepresentations in their Notice of Privacy Practices and Code of Conduct as to how the plaintiff's information would be used. Specifically, Steinberg alleges that the defendants disclosed "Protected Health Information," as defined by HIPAA, to third parties despite their representations to the contrary.
Steinberg does not bring a claim directly under HIPAA, and indeed the federal appellate courts that have passed on the issue have held that HIPAA does not provide for a private right of action in connection with the misuse of PHI.
The "Privacy Rule," promulgated under HIPAA, governs the gathering and disclosure of healthcare information, including prescription data. 45 C.F.R. § 164.502(d)(1)-(2). These regulations define Protected Health Information by reference to their definition of "individually identifiable health information," as follows:
45 C.F.R. § 160.103.
Under the Privacy Rule, healthcare providers are permitted to "de-identify" Protected Health Information. Once information is de-identified, it is no longer considered Protected Health Information. 45 C.F.R. §§ 164.502(d)-(e), 164.514(a) ("Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information.").
The CAC's allegations suggest two types of disclosures of customer data in this case. First, the defendants, at the request of pharmaceutical companies, include information in letters to consumers' physicians — including patient names and prescriptions — in order to suggest the provision of alternate medications. CAC ¶¶ 19-22. The plaintiffs do not allege that this type of information is disclosed to any parties other than patients' existing health care providers or used for any purpose other than for informing patients of treatment alternatives. This is a permissible disclosure of PHI under HIPAA; it falls within the "health care operations" exception of Section 164.501 because it is a communication made to a health care provider with information about treatment alternatives.
The second type of disclosure is made to pharmaceutical companies and data vendors. The plaintiffs contend that this information is covered by the Privacy
The plaintiffs' allegations, as clarified, show that the defendants' practice of de-identifying and packaging consumer information for sale to third parties is consistent with the representations in the Code of Conduct and Notice of Privacy Practices. The Caremark Code of Conduct states that PHI is to be handled in a confidential manner. The Notice of Privacy Practice
The plaintiffs do not allege that the defendants disclose Protected Health Information to third parties. Rather, they disclose de-identified information, which (a) federal regulations do not prohibit; and (b) is consistent with the defendants' statements that they safeguard information that "may identify" consumers. The plaintiffs argue that the defendants "deliberately and intentionally sold confidential prescription information in direct contradiction to their representations," CAC ¶ 59, but the facts the plaintiffs have pled regarding the defendants' actions are consistent with the representations the plaintiffs claim to be deceptive. Therefore, as a matter of pleading sufficiency, the plaintiff's allegations do not raise a plausible claim for relief under the UTPCPL.
The UTPCPL claims are independently dismissible because the plaintiff lacks standing to bring them. The UTPCPL gives a private right of action to plaintiffs who "suffer[] any ascertainable loss of money or property ... as a result of the use or employment [of a deceptive practice]." 73 Pa. Stat. § 201-9.2. The United States Court of Appeals for the Third Circuit has held that this provision of the UTPCPL requires an individual to plead facts showing that the plaintiff (a) justifiably relied on the defendant's wrongful conduct or representation and (b) suffered harm as a result of that reliance. Hunt v. U.S. Tobacco Co., 538 F.3d 217, 221-23 (3d Cir.2008).
Steinberg's allegation that he "suffered an ascertainable loss as a direct and proximate result" of the defendants' conduct, CAC ¶ 67, is a legal conclusion the Court need not accept. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 564, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). No other facts are pled to suggest the nature of Steinberg's loss. Construing the allegations of the CAC liberally, the loss Steinberg claims to have suffered appears to be the loss of the value of his demographic information, or the loss of an opportunity to pay less for his prescriptions with the understanding that the defendants would be profiting from the sale of his information.
Other district courts examining the issue have found that the collection and sale of this kind of information does not carry a compensable value to consumers, and cannot sustain a finding of injury without a
As in those cases, the plaintiff's claim that he suffered a loss as a result of the sale of his information is without factual support in the complaint. Without specific factual allegations as to the injury Steinberg sustained by the defendant's collection and sale of his information, he lacks standing to bring a claim under the UTPCPL. The CAC contains no allegations that Steinberg would have sought to fill his prescriptions elsewhere had he known of the defendants' practices. Nor does Steinberg allege that the defendants' actions deprived him of the opportunity to sell his information to data aggregation firms directly. In short, Steinberg has not shown that he was harmed by the defendants' actions, which Pennsylvania law requires for a private plaintiff to bring a UTPCPL action. See Hunt, 538 F.3d at 225 (the UTPCPL's standing provision exists "to separate private plaintiffs (who may sue for harm they actually suffered as a result of the defendant's deception) from the Attorney General (who may sue to protect the public from conduct that is likely to mislead)").
Steinberg also lacks standing to bring a claim under the UTPCPL because of his failure to plead facts showing that he justifiably relied on the defendants' representations. The Hunt court noted that a 1996 amendment to the catch-all provision added the words "or deceptive" to its prohibition of "fraudulent" conduct. There, the appellant had argued that after the amendment, a plaintiff suing under that provision need not allege all the elements of common-law fraud. See id. at 225. Steinberg makes similar arguments here. See Pls.' Opp. III.C.1.
The Hunt court did not address that issue, but assumed it for the sake of argument and found that the plaintiff had still failed to plead his claim adequately because he had not alleged justifiable reliance. Hunt, 538 F.3d at 225. The court
Steinberg has failed to allege that he was aware of the defendants' representations in the Notice of Privacy Practices and Code of Conduct, nor has he alleged that he relied on those statements in electing to fill his prescriptions at CVS. Under the Third Circuit's interpretation of Pennsylvania law, such a failure requires dismissal of the plaintiff's UTPCPL claim for lack of standing.
The plaintiffs have not shown that the information disclosures by the defendants caused them to suffer an ascertainable loss. For related reasons, they cannot show that they conferred a benefit on the defendants or that retention of any benefit would be unjust under the circumstances.
Unjust enrichment is an equitable doctrine, but a prima facie showing of unjust enrichment in Pennsylvania includes facts demonstrating that (a) the plaintiff conferred a benefit on the defendant; (b) the defendant appreciated those benefits; and (c) acceptance and retention of those benefits would be inequitable under the circumstances without payment of value. See Lackner v. Glosser, 892 A.2d 21, 34 (Pa.Super.Ct.2006).
The "confidential prescription information" alleged to have been disclosed to third parties consists of de-identified patient information, and any disclosures of PHI were made to consumers' own physicians and for the purpose of recommending treatment alternatives. Regardless of the information disclosed, the plaintiffs have raised no facts or argument to suggest that Steinberg or the PFTHW disclosed information to the defendants for which they could reasonably have expected compensation.
The relationship between the plaintiffs and defendants was one wherein the plaintiffs provided certain information in exchange for the provision of pharmacy services. Under the circumstances the plaintiffs could have no reasonable expectation of being compensated for the information related to that transaction, because that information carries with it no
The plaintiffs allege that Caremark's "receipt of profits is unjust under the circumstances identified with particularity above." CAC ¶ 75. Such pleading is conclusory and inadequate, particularly because the "unjust" element of an unjust enrichment claim is the "most significant" one under Pennsylvania law. Northeast Fence & Iron Works, Inc. v. Murphy Quigley Co., 933 A.2d 664, 668-69 (Pa.Super.Ct.2007). The plaintiff paid the defendants to fill prescriptions, and the defendants did so. Retention of any benefit accruing to the defendants from the de-identification, aggregation, or sale of patient information could not be considered unjust under the circumstances. "[T]he doctrine does not apply simply because the defendant may have benefitted as a result of the actions of the plaintiff." Id. Because the plaintiffs have not pled facts showing that they have conferred a benefit on the defendants or that the retention of such benefits would be unjust under the circumstances, the plaintiffs' claims for unjust enrichment will be dismissed.
Unlike the UTPCPL and unjust enrichment claims discussed above, Steinberg's privacy claim does not depend on whether the information he provided to the defendants was something of value to him. Instead, Steinberg's claim fails because he voluntarily disclosed that information to the defendants. Under the circumstances, he cannot state a claim for intrusion upon seclusion in Pennsylvania.
"Under Pennsylvania law, invasion of privacy involves four separate torts: (1) unreasonable intrusion upon the seclusion of another; (2) appropriation of another's name or likeness for commercial purposes; (3) publicity given to another's private life; and (4) publicity that unreasonably places another in a false light before the public." Doe v. Wyoming Valley Health Care Sys., Inc., 987 A.2d 758, 765 (Pa.Super.Ct.2009). The plaintiffs allege that the defendants intruded upon their seclusion by making the third-party data sales. CAC ¶ 77.
Although the Pennsylvania Supreme Court has not expressly adopted the Restatement (Second) of Torts definition of intrusion upon seclusion, Pennsylvania courts rely upon its definition to parse such claims. See Tagouma v. Investigative Consultant Svcs., Inc., 4 A.3d 170, 174 (Pa.Super.Ct.2010). Intrusion upon seclusion is defined by the Restatement as follows: "One who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person." Restatement (Second) of Torts § 652B. "The defendant is subject to liability under this Section only when he has intruded into a private place, or has otherwise invaded a private seclusion that the plaintiff has thrown about his person or affairs." Id. cmt. c.
The plaintiffs acknowledge that they voluntarily disclosed the information later disseminated by the defendants, and argue that their claim is premised not on the receipt of that information but instead on its sale to third parties. Pls.' Opp. 16. This argument is unavailing. In Pennsylvania, liability for intrusion upon seclusion cannot exist where a defendant legitimately
The plaintiffs have raised a number of concerns about the ways in which the defendants used their information after providing them with pharmacy services. Indeed, commentators have called for a variety of statutory approaches to the collection and sale of consumer-information databases. See Jeff Sovern, Opting In, Opting Out, or No Options at All: The Fight for Control of Personal Information, 74 Wash. L.Rev. 1033, 1094-1116 (1999) (reviewing the merits of proposed voluntary and government-imposed systems by which consumers might actively permit or prohibit use of their information). The facts the plaintiffs are able to allege, however, fail to give rise to a cognizable claim under current law.
This case was filed in the Court of Common Pleas of Philadelphia County on March 7, 2011, and removed to this Court on April 7, 2011. The plaintiffs then amended their complaint on May 31, 2011. The plaintiffs filed their brief in opposition to the instant motion on August 19, 2011. Yet it was not until oral argument in October 2011 that the plaintiffs stated their new theory of "re-identification" as the basis for an amended pleading. Even at that time, the plaintiffs could not state what allegations an amended pleading would contain.
The Court must conclude under the circumstances that amendment would be futile. The defendants point out that they already have incurred the time and expense of responding to the instant complaint, and that the "re-identification" theory hinted at by the plaintiffs cannot salvage their claims. The defendants argue that the time to present alternative theories of recovery was before the motion to dismiss had been fully briefed, and that the manner in which to present those theories was in the form of a proposed amended pleading, which the plaintiffs have not provided. Tr. Hr'g 18, 32.
The Court agrees. This case was filed nearly one year ago, and despite multiple opportunities to clarify how Steinberg or PFTHW could plead their claims adequately, the plaintiffs have been unable to do so. As currently amended, the factual allegations of the complaint fail to state a claim, and the plaintiffs have proposed neither an alternative pleading nor even an alternative theory that would state a plausible claim for relief. Granting leave to amend the complaint would be futile. See Phillips v. County of Allegheny, 515 F.3d 224, 245 (3d Cir.2008) (leave to amend should be granted following 12(b)(6) dismissal unless the district court finds that amendment would be inequitable or futile).
An appropriate order follows.
AND NOW, this 15th day of February, 2012, upon consideration of the defendants'
The plaintiffs' additional argument that a fiduciary relationship existed as part of the defendants' role as a "pharmacy benefits manager," Pls.' Opp. 11-12, is inapplicable here because only Steinberg brings a UTPCPL claim and the CAC does not allege that either defendant acted as his pharmacy benefits manager.
