HIPAA Violation Results in $1.44M Jury Verdict Against Walgreens, Pharmacist


Although HIPAA does not create a private cause of action, a recent Indiana Superior Court jury verdict demonstrates that HIPAA still could play an important role in private causes of action in state court based on negligence and professional liability as it relates to confidentiality. On July 26, 2013, a jury in Marion County, Indiana, awarded $1.44 million to a Walgreens customer based on allegations that the customer's pharmacist accessed, reviewed and shared the customer's prescription history with others who then used the information to intimidate and harass the customer. At the heart of the case was a tangled love triangle in which the pharmacist's husband had fathered a child with a customer. Upon learning of the relationship, the pharmacist allegedly accessed the customer's prescription information and shared it with her husband, who used the information to intimidate the customer when she demanded child support payments.

The customer filed suit against both the pharmacist and Walgreens in Indiana Superior Court, claiming that both parties had breached their statutory and common law duties of confidentiality and privacy. The complaint also included claims of negligence, invasion of privacy and publication of private facts against the pharmacist and claims of negligent training, supervision and retention against Walgreens for continuing to employ the pharmacist after discovering the incident. The court granted Walgreens' motion for summary judgment on the negligent training claim.
At trial, plaintiff argued that even though HIPAA did not create a private cause of action, it still defined the standard of care for a pharmacist's duty of confidentiality and privacy to plaintiff's health information. Thus, according to plaintiff, because the pharmacist's actions violated HIPAA, the pharmacist had breached the standard of care and should therefore be held liable for the harm caused to plaintiff. Additionally, because the pharmacist had acted within the scope of her employment, plaintiff argued that Walgreens also was liable for the pharmacist's actions. After a four-day trial, the jury agreed on both points, awarding $1.44 million in damages to plaintiff. Walgreens intends to appeal the verdict.

This is not the first case in which HIPAA has been the centerpiece of a private cause of action, but it does appear to be the first case resulting in a substantial jury verdict against a provider using HIPAA as the basis for the standard of care. Whether and to what extent HIPAA can be used to establish the standard of care in a professional liability, negligence or other breach of professional duty case will be dependent on state tort law, and the outcome of this case on appeal is unpredictable. Nonetheless, as HIPAA continues to receive attention from trial lawyers seeking to establish the standard of care in negligence and professional liability cases involving the improper disclosure of health information, healthcare providers must be aware that, depending on the law of the state in which they are licensed, their potential liability for HIPAA violations could extend beyond civil monetary penalties.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© BakerHostetler | Attorney Advertising

Written by:


BakerHostetler on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.

Already signed up? Log in here

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.