United States: New York Ruling Creates New Cause of Action Based on Pharmacy’s Fiduciary Duty to Protect Patient Privacy

On December 10, 2003, the Supreme Court of the State of New York–New York County expanded privacy law duties and protections by creating a new fiduciary duty for pharmacies to protect the confidentiality of their customers’ prescription records and medical histories. In Anonymous v. CVS Corp. (604804/99), the trial court held that a pharmacy violated that duty when it sold its customers’ prescription information without prior notice to or consent from its customers.

The matter began in 1999, when the independent drugstore Trio Drugs ceased doing business and sold its customer records to CVS as part of CVS’ File Buy Program. It is estimated that in 1998, CVS purchased the files of 350 pharmacies in the United States under this program. As part of the sale agreement, Trio Drugs agreed not to inform its customers of the records transfer until it had closed. After the sale was complete, customers were notified that their records had been transferred to CVS.

Plaintiff, a customer of Trio Drugs diagnosed with AIDS, filed suit claiming that Trio Drugs had breached a fiduciary duty to protect the confidentiality of his records. He asserted that the transfer to CVS and its networked databases made his records accessible to CVS stores and thousands of CVS employees nationwide.

Plaintiff’s lawsuit was certified as a class action for all persons whose medical or prescription information was purchased or acquired without their knowledge or consent by CVS from Trio for the six-year period preceding the lawsuit.

The most significant aspect of the ruling is the court’s creation of a new fiduciary duty for pharmacies and pharmacists to protect patient privacy, even in the absence of a specific law creating such a duty or a written agreement between the parties. Instead, the court ruled that a fiduciary duty could be implied from the circumstances of the relationship between the pharmacy and its customer. In support of its finding, the court pointed to the fact that patients often must disclose sensitive information to pharmacists for purposes of receiving counseling prior to dispensing of drugs, and concluded that customers may reasonably expect that the information will remain confidential. The court also pointed to a regulation governing the conduct of health care professionals, including pharmacists, providing that it is unprofessional conduct to "reveal personally identifiable facts, data, or information obtained in a professional capacity without the prior consent of the patient or client, except as authorized or required by law." Even though the regulation does not mention a fiduciary duty or a right to private action, the court concluded that it gave rise to such a duty.

The court acknowledged that, prior to this decision, the scope of duty a pharmacy has to its customers with regard to "file buys" was undefined. The court further acknowledged that industry custom and practice was to transfer customer records from one pharmacy to another without prior notice or consent. Despite this, the court held that "a fiduciary duty established by statute will override the doctrine of custom and practice," referencing New York’s regulatory proscription against disclosing identifiable information without prior consent unless authorized or required by law.

The court also found, based on the same regulatory duty of confidentiality, that Trio breached an implied contract of confidentiality with its customers.

Finally, the court granted Plaintiff’s claim for injunctive relief based on general business law preventing deceptive business practices. Although Trio argued that Plaintiff’s claim was not actionable because no injury could be demonstrated, the court deter-mined that the "breach of trust [in the relationship between pharmacist and patient] is an actual harm." The court left the scope of the injunction to be decided in a subsequent ruling.

The court held that CVS did not have a fiduciary duty to inform Trio’s customers of the file-buy transaction. Therefore, the only viable claims against CVS were those that put at issue CVS’s inducement of Trio into withholding notice and failing to obtain customer consent prior to the transfer of confidential information. The Plaintiff’s claim for injunctive relief under general business law prohibiting deceptive business practices was continued to permit Plaintiff to investigate CVS’s actions and determine where they fall within the standards of deceptive trade.

The ruling is significant because it establishes a new cause of action with regard to medical privacy. This may pave the way for other states to impose on pharmacies (or other types of providers) a fiduciary duty to protect confidential information, even in the absence of explicit regulatory or statutory requirements to do so. While the circumstances of this case are unique, it is not difficult to envision the underlying fiduciary duty being applied under other circumstances. The ruling also highlights another dimension to issues of confidentiality of identifiable health care information. In addition to federal and state regulation, health care providers may face liability through the courts for failure to protect patient privacy, based on theories of fiduciary duty or deceptive trade practices, separate and apart from specific privacy laws or regulations. The potential breadth of the court’s expansion of fiduciary duty highlights the increased attention now paid to privacy concerns, even outside the regulatory field, and the need for consideration of privacy issues as part of business decisions. The true impact of this new cause of action that the court created is not yet apparent, because no dam-ages have been awarded. The Plaintiff abandoned claims for actual damages for procedural reasons, so the potential magnitude of damages awarded for such claims is unknown. Future decisions, and other suits, will have to develop the amount of damage awards available under this new cause of action.