HIPAA Violation Results In $1.44m Jury Verdict Against Walgreens, Pharmacist

Although HIPAA does not create a private cause of action, a recent Indiana Superior Court jury verdict demonstrates that HIPAA still could play an important role in private causes of action in state court based on negligence and professional liability as it relates to confidentiality. On July 26, 2013, a jury in Marion County, Indiana, awarded $1.44 million to a Walgreens customer based on allegations that the customer's pharmacist accessed, reviewed and shared the customer's prescription history with others who then used the information to intimidate and harass the customer. At the heart of the case was a tangled love triangle in which the pharmacist's husband had fathered a child with a customer. Upon learning of the relationship, the pharmacist allegedly accessed the customer's prescription information and shared it with her husband, who used the information to intimidate the customer when she demanded child support payments.
The customer filed suit against both the pharmacist and Walgreens in Indiana Superior Court, claiming that both parties had breached their statutory and common law duties of confidentiality and privacy. The complaint also included claims of negligence, invasion of privacy and publication of private facts against the pharmacist and claims of negligent training, supervision and retention against Walgreens for continuing to employ the pharmacist after discovering the incident. The court granted Walgreens' motion for summary judgment on the negligent training claim.