DAVID C. NORTON, UNITED STATES DISTRICT JUDGE

Adair Ford Boroughs, Frances C. Trapp, William Norman Nettles, Bill Nettles Law, Columbia, SC, Aimee J. Hall, Pro Hac Vice, C. Neal Pope, Pro Hac Vice, Charles W. Byrd, Pro Hac Vice, Michael J. Moore, Pro Hac Vice, Pope McGlamry PC, Atlanta, GA, Arthur R. Miller, Pro Hac Vice, New York University School of Law, New York, NY, Edward L. Hardin, Jr., Pro Hac Vice, Edward L. Hardin Jr. Law Office, Birmingham, AL, Sally Corbette Newman, Charleston, SC, Wade H. Tomlinson, III, Pro Hac Vice, Pope McGlamry, Columbus, GA, for Plaintiffs.

Adam Jesse Hegler, Amanda S. Kitts, David Eidson Dukes, Nelson Mullins Riley and Scarborough LLP, Columbia, SC, Kate Elizabeth Heinzelman, Pro Hac Vice, Sidley and Austin LLP, Washington, DC, Matt C. Bergs, Pro Hac Vice, Ross O. Kloeber, Pro Hac Vice, Scott David Stein, Pro Hac Vice, Sidley Austin LLP, Chicago, IL, for Defendants.

ORDER

DAVID C. NORTON, UNITED STATES DISTRICT JUDGE

The following matter is before the court on defendants Walgreens Boots Alliance, Inc. ("WBA") and Walgreen Co.’s (collectively, "Walgreens") motion to dismiss the amended complaint and to dismiss WBA for lack of personal jurisdiction, ECF No. 135. For the reasons set forth below, the court grants the motion.

I. BACKGROUND

This case arises from Walgreens's alleged violation of plaintiffs J.R., J.H., B.Y., and J.S.’s (collectively, "plaintiffs") privacy rights by unlawfully using, disclosing, and disseminating plaintiffs’ personally identifiable information ("PII") through Walgreens's 340B Complete® services ("340B Complete"). Plaintiffs are all residents of Charleston, South Carolina and customers of Walgreens pharmacies. Plaintiffs allege that WBA uses three divisions to conduct its operations: Retail Pharmacy USA, Retail Pharmacy International, and Pharmaceutical Wholesale. Walgreen Co. is the wholly-owned subsidiary of WBA that operates the Retail Pharmacy USA division of WBA, meaning Walgreen Co. operates all of the Walgreens pharmacy locations in South Carolina.

A. Walgreens Pharmacy Operations in South Carolina

Plaintiffs begin by explaining that each Walgreens pharmacy is required to comply with South Carolina's Prescription Information Privacy Act ("PIPA"), the South Carolina Pharmacy Practice Act ("PPA"), and the American Pharmaceutical Association Code of Ethics. In addition, South Carolina law requires each Walgreens pharmacy to operate with a pharmacist-in-charge, who is responsible for compliance with the law and management of the pharmacy and its personnel. Walgreens uses a Notice of Privacy Practices ("NPP") in its pharmacies, and plaintiffs allege that the NPP contains no mention of 340B Complete.

Plaintiffs allege that Walgreens pharmacy customers provide their PII to Walgreens's pharmacies for the purpose of obtaining their individual prescriptions and to allow Walgreens's pharmacy to seek third-party payment for those prescriptions. In doing so, Walgreens inputs pharmacy customers’ PII into a "proprietary computer software system" called IntercomPlus, which is accessible by all nationwide retail, mail service, and specialty Walgreens pharmacies. Am. Compl. ¶ 42. The PII that is collected and inputted into IntercomPlus includes the pharmacy customer's name, address, date of birth, payment information, allergies, health conditions, drug information, and physician information.

B. 340B Complete

In 1992, Congress enacted the 340B Drug Discount Program ("340B Program"), which requires drug manufacturers to provide certain medications at discounted prices to eligible healthcare entities that primarily serve low-income patients ("Covered Entities"). Because not all Covered Entities have in-house pharmacy services, Covered Entities contract with third-party pharmacies ("contract pharmacies") to dispense 340B drugs on their behalf. When doing so, Covered Entities are still responsible for ensuring compliance with the 340B Program. Walgreens has entered into multiple contracts with Covered Entities in South Carolina to serve as contract pharmacies.

Around 2010, Walgreens created an allegedly separate department, division, or unit within its corporate structure known as 340B Complete and began marketing its 340B Complete services to help Covered Entities administer the 340B Program and to ensure compliance. Plaintiffs allege that Walgreens operates 340B Complete "as an independent line of business, separate from its retail, photo, health clinic, or pharmacy lines of business, and functions on its own" and promotes 340B Complete "as a ‘prescription eligibility verification solution’ with ‘comprehensive’ and ‘advanced online reporting and data-capture tools,’ providing a single vendor ‘end-to-end contract pharmacy solution.’ " Am. Compl. ¶ 56. Plaintiffs allege that Walgreens markets access to its entire database of pharmacy customers’ PII to potentially capture all patients who received care from a Covered Entity and would therefore be eligible for 340B discounted drugs.

Walgreens's alleged 340B Complete process is as follows. Walgreens allegedly transfers on a daily basis all of its pharmacy customers’ PII from IntercomPlus to a "corporate central repository" called Enterprise Data Warehouse ("EDW"). Am. Compl. ¶ 68. Plaintiffs allege that EDW is not a secure platform and that "unauthorized persons and other Walgreens’ departments, divisions, and/or units can and do unlawfully access pharmacy customers’ PII contained therein." Id. ¶ 69. Plaintiffs allege that 340B Complete receives and scans EDW, compares it to the patient database received by Covered Entities, and then transfers PII of those patients of the Covered Entities into 340B Complete.

According to plaintiffs, one of the business purposes behind 340B Complete is to acquire 340B drugs for resale at Walgreens's pharmacies at prices significantly below the price that Walgreens pays in the wholesale market. Walgreens allegedly performs a financial analysis to determine whether a profit margin on a 340B drug exceeds the Covered Entity's fees paid to Walgreens, and if it does, 340B Complete will generate a purchase order for the drug. If the profit margin does not exceed the fee, 340B Complete will not generate a purchase order for the 340B drug, will not charge fees to the Covered Entity, and will retain its usual non-340B profit margin. Plaintiffs allege that 340B Complete is outside of the scope of Walgreens's pharmacies’ normal operations, and that these administration services are not provided to its pharmacy customers. Covered Entities compensate Walgreens for its provision of services through 340B Complete, and Walgreens allegedly realizes substantial profits from 340B Complete.

There are 160 employees in Walgreens's 340B Complete department, and plaintiffs allege that those employees all have unauthorized and unconsented access to pharmacy customers’ PII. Those employees are allegedly not registered with South Carolina's State Board of Pharmacy, do not maintain pharmacy licensure in South Carolina, and do not provide pharmacy care services.

Plaintiffs filed their complaint and a motion for a preliminary injunction on February 14, 2019. After briefing and limited discovery, the court held a two-day evidentiary hearing on the motion for a preliminary injunction and issued an order denying the motion. This order is currently on appeal.

After appealing the court's order, plaintiffs filed an amended complaint. ECF No. 128. The amended 56-page, 280-paragraph complaint brings claims for: (1) invasion of privacy: wrongful appropriation; (2) invasion of privacy: wrongful publicizing of private affairs; (3) violation of the Fair Credit Reporting Act ("FCRA"); (4) negligence per se based on violations of FCRA, the Health Insurance Portability and Accountability Act ("HIPAA"), and the Federal Trade Commission Act ("FTCA"); (5) negligence per se based on violations of PIPA; (6) breach of contract; (7) declaratory relief pursuant to 28 U.S.C. § 2201 ; (8) negligence based on professional standards; (9) negligence based on PPA; (10) respondeat superior; (11) negligent training and supervision; and (12) unjust enrichment. Walgreens filed a motion to dismiss the amended complaint and to dismiss Walgreens Boots Alliance, Inc. ("WBA") for lack of personal jurisdiction on January 9, 2020. ECF No. 135. Plaintiffs responded on February 24, 2020, ECF No. 143, and Walgreens replied on April 8, 2020, ECF No. 147. On May 18, 2020, plaintiffs filed additional exhibits to their response brief that were not discussed in the brief, ECF No. 154, and on May 19, 2020, plaintiffs filed a "request that the court take judicial notice of facts contained in plaintiffs’ additional exhibits in support of" their response brief, ECF No. 155. The court held a hearing on the motion on May 19, 2020.

II. STANDARD

A. Motion to Dismiss for Lack of Personal Jurisdiction

When the defendant challenges personal jurisdiction, the plaintiff has the burden of showing that jurisdiction exists. See In re Celotex Corp., 124 F.3d 619, 628 (4th Cir. 1997). When the court decides a personal jurisdiction challenge without an evidentiary hearing, the plaintiff must prove a prima facie case of personal jurisdiction. See Mylan Labs., Inc. v. Akzo, N.V., 2 F.3d 56, 60 (4th Cir. 1993). "In considering the challenge on such a record, the court must construe all relevant pleading allegations in the light most favorable to the plaintiff, assume credibility, and draw the most favorable inferences for the existence of jurisdiction." In re Celotex Corp., 124 F.3d at 628 (quoting Combs v. Bakker, 886 F.2d 673, 676 (4th Cir. 1989) ). However, the court need not "credit conclusory allegations or draw farfetched inferences." Masselli & Lane, PC v. Miller & Schuh, PA, 2000 WL 691100, at *1 (4th Cir. May 30, 2000) (quoting Ticketmaster-New York, Inc. v. Alioto, 26 F.3d 201, 203 (1st Cir. 1994) ).

B. Motion to Dismiss for Failure to State a Claim

A Rule 12(b)(6) motion for failure to state a claim upon which relief can be granted "challenges the legal sufficiency of a complaint." Francis v. Giacomelli, 588 F.3d 186, 192 (4th Cir. 2009) (citations omitted); see also Republican Party of N.C. v. Martin, 980 F.2d 943, 952 (4th Cir. 1992) ("A motion to dismiss under Rule 12(b)(6) ... does not resolve contests surrounding the facts, the merits of a claim, or the applicability of defenses."). To be legally sufficient, a pleading must contain a "short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). A Rule 12(b)(6) motion should not be granted unless it appears certain that the plaintiff can prove no set of facts that would support his claim and would entitle him to relief. Mylan Labs., Inc. v. Matkari, 7 F.3d 1130, 1134 (4th Cir. 1993). When considering a Rule 12(b)(6) motion, the court should accept all well-pleaded allegations as true and should view the complaint in a light most favorable to the plaintiff. Ostrzenski v. Seigel, 177 F.3d 245, 251 (4th Cir. 1999) ; Mylan Labs., Inc., 7 F.3d at 1134. "To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ " Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id.

III. DISCUSSION

Walgreens argues that each cause of action in the amended complaint should be dismissed, and it also argues that WBA should be dismissed for lack of personal jurisdiction. The court first addresses the personal jurisdiction issue and then turns to Walgreens's motion to dismiss.

A. Motion to Dismiss for Lack of Personal Jurisdiction

Walgreens argues that this court lacks personal jurisdiction over WBA. In response, plaintiffs first argue that WBA has waived any personal jurisdiction defense and then contends that even if WBA has not waived the defense, the court has personal jurisdiction over WBA through the alter ego theory of jurisdiction. The court addresses each in turn.

a. Waiver

Plaintiffs argue that WBA has waived its jurisdictional defense because it has participated in this litigation for over a year, including conducting limited discovery, participating in the two-day preliminary injunction hearing, and agreeing to the confidentiality order, and only now asserts its jurisdictional defense. Plaintiffs note that both WBA and Walgreen Co. have included in their filings a footnote reserving any and all defenses, but that Rule 12(h) requires WBA to raise its jurisdictional defense, not merely to reserve it. According to plaintiffs, WBA should have already raised its defense but failed to do so, meaning that the defense has been waived.

The problem with this argument is that it is contrary to the plain language of Rule 12 of the Federal Rules of Civil Procedure. Pursuant to Rule 12(h)(1), a party must raise its lack of personal jurisdiction defense in its answer to the complaint or in a motion under the rule, such as the instant motion. While litigation has been ongoing for the past year, the procedural posture of the case is such that the court is just now considering Walgreens's motion to dismiss. Indeed, the court entered an order on March 11, 2019 giving Walgreens 14 days following the court's ruling on the motion for a preliminary injunction to respond to the complaint. The court's ruling took place on October 4, 2019, and Walgreens filed its motion to dismiss on October 18, 2019, in which WBA raised its jurisdictional defense. As such, WBA has complied with Rule 12(h) and has not waived its defense.

Plaintiffs argue that WBA should have raised its jurisdictional defense at the preliminary injunction hearing, but doing so would contradict Rule 12(h)(1). Rule 12(h)(1) requires a party to raise its jurisdictional defense in its answer or its motion to dismiss. Plaintiffs’ argument about WBA's participation in the preliminary injunction adjudication sticks WBA between Scylla and Charybdis. Either WBA doesn't participate in limited discovery and the hearing on the preliminary injunction in order to preserve its jurisdictional defense but sacrifices its opportunity to defend itself from a preliminary injunction or WBA defends itself but waives its chance to assert its jurisdictional defense. That is an untenable position. Finally, the cases cited by plaintiffs are inapposite. In Ashley II of Charleston, LLC v. PCS Nitrogen, Inc., the court found that a party waived several defenses because the party failed to substantively argue them until after judgment was entered, which is clearly not the case here. 791 F. Supp. 2d 431, 510 (D.S.C. 2011), aff'd, 714 F.3d 161 (4th Cir. 2013). Similarly, in Alger v. Hayes, the Eighth Circuit found that the party was playing "fast and loose" with the court's power by indicating that it would only consent to jurisdiction if the verdict was favorable to the party, which again is not what happened here. 452 F.2d 841, 845 (8th Cir. 1972). In sum, the court finds that WBA has not waived its ability to assert its jurisdictional defense.

b. Alter Ego Theory

Walgreens argues that the court does not have general or specific personal jurisdiction over WBA. Walgreens contends that general personal jurisdiction does not exist because WBA is incorporated under the laws of Delaware and its headquarters/principal place of business are in Illinois, and there is no specific personal jurisdiction because WBA does not operate Walgreens pharmacies in South Carolina. Instead, it is Walgreen Co., a subsidiary of WBA, that operates the pharmacies, contracts with Covered Entities, and administers 340B Complete in South Carolina. In response, plaintiffs do not dispute these arguments but instead contend that the court has personal jurisdiction over WBA through the alter ego theory, in that WBA is the alter ego of Walgreen Co.

Before diving into the substance of the parties’ arguments, the court first addresses plaintiffs’ late filing of additional exhibits related to this issue and their request that the court take judicial notice of the facts contained within the exhibits. On the day before the hearing, plaintiffs filed additional exhibits to their response brief that they did not address in the brief, and on the morning of the hearing, plaintiffs submitted another filing requesting that the court take judicial notice of the facts within those exhibits. The exhibits consist of press releases, pages from WBA's website, and a settlement order, all of which well pre-date plaintiffs’ response brief and thus could have been timely filed with the response brief. Instead, and presumably based on some strategy, plaintiffs filed these additional exhibits at the eleventh hour. At the hearing, Walgreens objected to the court's consideration of these untimely exhibits, argued that the exhibits do not support a finding of personal jurisdiction based on the alter ego theory, and requested the opportunity to provide supplemental briefing on the issue.

While the court certainly does not condone the questionable tactic of failing to file all available exhibits with a party's brief, the court will consider plaintiffs’ additional exhibits. The issue of personal jurisdiction is one of the utmost importance, and the court feels obligated to consider all of the evidence before it when making its ruling. Walgreens was able to respond to these eleventh hour exhibits at the hearing, and the court is able to resolve the issue of personal jurisdiction without the need for supplemental briefing. However, the court stresses that it does not view this gambit favorably, and should plaintiffs try something like this again, the court will not be as generous.

In determining whether to exercise jurisdiction based on the alter ego theory, the court considers the following factors: (1) common ownership; (2) financial independence; (3) degree of selection of executive personnel and failure to observe corporate formalities; and (4) the degree of control over marketing and operational policies. Builder Mart of America, Inc. v. First Union Corp., 349 S.C. 500, 563 S.E.2d 352, 358 (S.C. Ct. App. 2002), overruled on other grounds by Farmer v. Monsanto Corp., 353 S.C. 553, 579 S.E.2d 325 (2003). "For the courts to have personal jurisdiction" under this theory, the plaintiff "must show that the subsidiary functions as the agent or mere department of the parent—that is, that the subsidiary does all the business which the parent corporation could do if here on its own." Id. "It is essential that all four factors be present with sufficient factual specificity to confer jurisdiction on [ ] courts." Id.

Plaintiffs argue in their response brief that WBA is the alter ego of Walgreen Co. because WBA identifies its Retail Pharmacy USA operations as a "division" of WBA, and Walgreen Co. is the WBA subsidiary that conducts the Retail Pharmacy USA operations. Plaintiffs explain that in WBA's most recent 10-K filing, WBA touts itself as "a market leader in the United States" that operates 9,560 retail stores within its Retail Pharmacy USA division and holds pharmacy licenses. ECF No. 143-1 at 8, 13, 34. Plaintiffs also argue that WBA and Walgreen Co. share the same principal place of business and that WBA guarantees Walgreen Co.’s debt and matches employee contributions to Walgreen Co.’s profit-sharing retirement plan, all of which indicate WBA's alter ego status. Am. Compl. ¶¶ 11, 14; ECF No. 143-1 at 92 n.4, 107.

The additional exhibits submitted by plaintiffs include press releases, personnel biographies from WBA's website, and a settlement stipulation order. There is a December 31, 2014 press release announcing that Walgreen Co. and Alliance Boots GmbH completed Step 2 of their merger to form WBA; a December 10, 2014 press release announcing that the Walgreen Co. president and chief executive officer would retire once the merger between Walgreen Co. and Alliance Boots was complete and that the Walgreen Co. Chariman would become WBA's executive chairman; a June 9, 2016 press release announcing various changes in senior management following the Walgreen Co. and Alliance Boots merger; and a February 3, 2020 press release announcing changes to WBA's IT system. ECF Nos. 154-1, 154-3, 154-4, 154-9. Plaintiffs also include biographies of various WBA executives who currently hold or have held positions at both WBA and Walgreen Co. ECF No. 154-2, 154-5, 154-6, 154-7. Finally, plaintiffs include a December 20, 2018 settlement stipulation and order from the Southern District of New York to which WBA is a party to show that WBA admitted to conduct related to IntercomPlus and that Walgreen Co.’s general counsel signed the agreement. ECF No. 154-8.

This evidence is insufficient to show that WBA exercises the degree of control over Walgreen Co. such that WBA is its alter ego. The facts cited by plaintiffs simply show that Walgreen Co. is a subsidiary of WBA that operates a division of WBA. This court has previously held that a parent company referring to "its subsidiary companies by the informal title of ‘division’ rather than emphasizing these are distinct corporate entities does not give rise to jurisdiction." Wright v. Waste Pro USA Inc., 2019 WL 3344040, at *7 (D.S.C. July 25, 2019). With regard to financial independence, WBA guaranteeing Walgreen Co.’s debt is not significant because "little, if any control, is exemplified by [a parent company]’s serving as a guarantor to its subsidiary." ScanSource, Inc. v. Mitel Networks Corp., 2011 WL 2550719, at *6 (D.S.C. June 24, 2011). Similarly, the court fails to see how WBA's contribution to Walgreen Co.’s profit-sharing retirement plan shows Walgreen Co.’s lack of financial independence.

Plaintiffs provide no evidence to suggest that WBA and Walgreen Co. fail to observe corporate formalities. This alone is fatal to their argument. Builder Mart of Am., Inc., 563 S.E.2d at 358 ("It is essential that all four factors be present with sufficient factual specificity to confer jurisdiction."). As to the degree of common executive personnel, the fact that WBA executives previously worked for Walgreen Co. is of no import to the alter ego analysis, especially since Walgreen Co. and Alliance Boots merged to form a new company, WBA. All of the press releases cited by plaintiffs show as much. Along similar lines, the fact that WBA admitted to conduct related to IntercomPlus and the fact that Walgreen Co.’s general counsel signed the settlement stipulation do not convince the court that WBA operates as an alter ego to Walgreen Co. but instead merely suggests that WBA took legal responsibility for conduct of its subsidiary.

Finally, plaintiffs argue that WBA and Walgreen Co. share a principal place of business and "WBA and Walgreen Co. jointly conduct business through South Carolina under the ‘Walgreens’ trade name," ECF No. 143 at 38, but "unified marketing and advertising and holding out to the public as a single entity, without more, insufficient to confer jurisdiction," Builder Mart of Am., Inc., 563 S.E.2d at 358–59. As such, plaintiffs have failed to show that WBA is the alter ego of Walgreen Co., meaning the court does not have personal jurisdiction over WBA.

Plaintiffs requested for the first time at the hearing that the court permit jurisdictional discovery. The court declines to entertain this belated request. Therefore, the court dismisses WBA from this case, leaving Walgreen Co. as the only remaining defendant. As such, the court will only refer to Walgreen Co. moving forward.

B. Motion to Dismiss for Failure to State a Claim

Next, Walgreen Co. presents various arguments as to why each of plaintiffs’ claims should be dismissed. As an initial matter, Walgreen Co. argues that plaintiffs’ FCRA claim should be dismissed for a variety of reasons, including the fact that Walgreen Co. is not a consumer reporting agency, Walgreen Co. does not receive plaintiffs’ PII from a consumer reporting agency, plaintiffs’ PII is not a "consumer report," and the FCRA explicitly excludes plaintiffs’ PII from the definition of a "consumer report." Plaintiffs appeared to care so little about this claim that they failed to mention it in their response brief. When asked at the hearing if they had abandoned their claim, plaintiffs’ counsel said that they did not and that they failed to address the claim in their response brief because of the page limit but planned to do so at the hearing. Local Rule 7.05 requires memoranda to include "[t]he argument ... relating to the matter before the court for ruling with appropriate citations," Local Civ. Rule 7.05(a)(3) (D.S.C.), and failure to address a claim in an opposition memorandum constitutes waiver of that claim. Jones v. Family Health Ctr., Inc., 323 F. Supp. 2d 681, 690 (D.S.C. 2003), aff'd 98 F. App'x 959 (4th Cir. 2004). Moreover, the court notes that Walgreens was able to present arguments on all of plaintiffs’ claims within the same page limit provided to plaintiffs and that plaintiffs had the option to ask for leave to file excess pages if they ran out of room in their brief. In light of these considerations, the court finds that plaintiffs abandoned the FCRA claim and dismisses it. The same is true for plaintiffs’ negligence per se claim based on an alleged violation of FCRA. The court now turns to plaintiffs’ other causes of action.

a. Invasion of Privacy: Wrongful Appropriation

Walgreen Co. argues that plaintiffs’ wrongful appropriation claim must be dismissed because plaintiffs fail to allege: (1) that Walgreen Co. publicized their names or identities; (2) any appropriation of the commercial value of their names, identities, appearances, or personalities; and (3) a factual basis that Walgreen Co. processed plaintiffs’ PII without their consent. Plaintiffs take issue with each of these points, arguing that publicity is not required for wrongful appropriation, that wrongful appropriation is not limited to commercial value, and that they did not consent to Walgreen Co.’s use of their PII. The court dismisses this claim based on plaintiffs’ failure to allege publicity and therefore declines to address the other two arguments.

"In South Carolina, there are three separate and distinct causes of action for invasion of privacy: 1) wrongful appropriation of personality; 2) wrongful publicizing of private affairs; and 3) wrongful intrusion into private affairs." Sloan v. S.C. Dep't of Pub. Safety, 355 S.C. 321, 586 S.E.2d 108, 110 (2003). "Encompassed in these three recognized torts is the infringement on the right of publicity; it is denominated wrongful appropriation of personality." Gignilliat v. Gignilliat, Savitz & Bettis, L.L.P., 385 S.C. 452, 684 S.E.2d 756, 760 (2009). Plaintiffs argue that Gignilliat identifies the elements of wrongful appropriation of personality as: (1) the unconsented use of the plaintiff's name, likeness, or identity; (2) by the defendant; and (3) for the defendant's own benefit; and that publicity is not a required element. The Gignilliat court does discuss those elements in defining the cause of action, stating that "[w]rongful appropriation of personality involves the intentional, unconsented use of the plaintiff's name, likeness, or identity by the defendant for his own benefit." 684 S.E.2d at 759 (quoting Sloan v. South Carolina Dep't of Pub. Safety, 355 S.C. 321, 586 S.E.2d 108, 110 (2003) ). However, in the very next sentence, the court states that "[t]he gist of the action is the violation of the plaintiff's exclusive right at common law to publicize and profit from his name, likeness, and other aspects of personal identity." Id. (emphasis added) (quoting Sloan, 586 S.E.2d at 110 ).

This and other discussions by South Carolina courts make clear that while publicity is not explicitly stated as an element per se, it is still a fundamental requirement of the cause of action of wrongful appropriation of personality. As South Carolina courts have recognized, "[t]he terms ‘infringement on the right of publicity’ and ‘wrongful appropriation of personality’ are interchangeable." In re Wiser, 2010 WL 5437241, at *6 (Bankr. D.S.C. June 21, 2010) ; see also Uhlig LLC v. Shirley, 2011 WL 1119548, at *7 (D.S.C. Mar. 25, 2011) ("The South Carolina Supreme Court has stated that ‘wrongful appropriation of personality’ and ‘infringement on the right of publicity’ are the same claim under the rubric of ‘invasion of privacy.’ "). Indeed, Gignilliat explained that "[e]ncompassed in [wrongful appropriation of personality, wrongful publicizing of private affairs, and wrongful intrusion of private affairs] is the infringement on the right of publicity." 684 S.E.2d at 760. Moreover, in Holloman v. Life Ins. Co. of Va., the plaintiff argued that the defendant violated her right to privacy when the defendant issued a life insurance policy to her son without the plaintiff's consent, and the Supreme Court of South Carolina held that the plaintiff's claim failed because the issuance of a life insurance policy did not publicize her name. 192 S.C. 454, 7 S.E.2d 169, 171 (1940) (Mem.). As such, infringement on the right of publicity and wrongful appropriation of personality are one in the same, meaning publicity is required in a wrongful appropriation of personality claim.

Plaintiffs argue that Holloman is inapplicable because it was decided prior to Gignilliat’s expression of the current state of the law and that the Supreme Court of South Carolina's statement in Sloan that "[t]he gist of [wrongful appropriation of personality] is the violation of the plaintiff's exclusive right at common law to publicize and profit from his name, likeness, and other aspects of personal identity," 586 S.E.2d at 110, is a "colloquial description" that "cannot alter the South Carolina Supreme Court's express wrongful appropriation formulation." ECF No. 143 at 8. However, plaintiffs fail to cite to any South Carolina case discussing wrongful appropriation of personality that does not involve publicity. Instead, the cases that rely on Gignilliat involve some form of publicity. See Ins. Prod. Mktg., Inc. v. Conseco Life Ins. Co., 2012 WL 3308368, at *5 (D.S.C. Aug. 13, 2012) (genuine issue of material fact as to whether the defendant's use of plaintiffs’ name on its correspondence was wrongful appropriation); In re Wiser, 2010 WL 5437241, at *7 (granting summary judgment on debtors’ wrongful appropriation claim because there was no publicizing of debtors’ names). Plaintiffs cite to a law review article by Professor William Prosser that states that appropriation does not depend upon publicity, but they do not cite to any authority to suggest that this view has been adopted by any South Carolina court, which is the relevant inquiry here.

Plaintiffs also argue, in a footnote, that if wrongful appropriation requires publicity, plaintiffs have alleged that Walgreen Co. publicized their information by transferring it from the pharmacy to the EDW database, which is "used as an information highway for other corporate-wide, non-pharmacy business units (including 340B Complete) to access." ECF No. 143 at 8 n.2. Even accepting as true the factual allegation that non-pharmacy Walgreen Co. employees can access EDW and plaintiffs’ PII, the court fails to see how this access constitutes publicity as a matter of law. As discussed in greater detail below, the Restatement (Second) of Torts, which has been adopted by the Supreme Court of South Carolina, has defined publicity as making the matter public "by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge." Swinton Creek Nursery v. Edisto Farm Credit, ACA, 334 S.C. 469, 514 S.E.2d 126, 132 (1999). The fact that Walgreen Co. employees can access plaintiffs’ PII does not mean that plaintiffs’ PII is being communicated to the public at large. Because plaintiffs have not sufficiently alleged that Walgreen Co. is publicizing plaintiffs’ PII to the public at large, their cause of action for wrongful appropriation must fail.

b. Invasion of Privacy: Wrongful Publicizing of Private Affairs

Next, Walgreen Co. argues that plaintiffs’ wrongful publicizing of private affairs claim fails because, like in their wrongful appropriation claim, plaintiffs fail to allege that Walgreen Co. publicized their PII. "Wrongful publicizing of private affairs involves a public disclosure of private facts about the plaintiff ... in which there is no legitimate public interest." Snakenberg v. Hartford Cas. Ins. Co., 299 S.C. 164, 383 S.E.2d 2, 6 (S.C. Ct. App. 1989). "The gravamen of the tort is publicity as opposed to mere publication." Id. The Supreme Court of South Carolina, relying on the Restatement (Second) of Torts, has distinguished these terms, explaining that "publication" is "any communication by the defendant to a third person" while " ‘[p]ublicity ... means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge." Swinton Creek Nursery, 514 S.E.2d at 132. However, the size of the audience alone is not determinative of whether a communication is publication or publicity, as publicity can include "any publication in a newspaper or a magazine, even of small circulation, or in a handbill distributed to a large number of persons, or any broadcast over the radio, or statement made in an address to a large audience." Id. Instead, the distinction "is one between private and public communication." Id.

Plaintiffs allege that their PII is transferred from IntercomPlus to EDW, which "is not a secure platform for pharmacy customers’ PII because unauthorized persons and other Walgreens’ departments, divisions, and/or units can and do unlawfully access pharmacy customers’ PII contained therein." Am. Compl. ¶¶ 68–69 (emphasis added). Plaintiffs further allege that the 160 non-pharmacy employees in the 340B Complete division of Walgreen Co. have unauthorized access to plaintiffs’ PII in EDW. Id. ¶¶ 76–78. Plaintiffs argue that this constitutes publicity, equating this alleged unauthorized access by 160 employees to "small [newspaper] circulation," "a large number of persons," or a "large audience." ECF No. 143 at 11. However, plaintiffs’ focus on the number of people is misplaced. As the Supreme Court of South Carolina has made clear, the relevant distinction between publication and publicity has to do with private versus public communication, not the size of the audience. A "small [newspaper] circulation," "a handbill distributed to a large number of persons," and a "statement made in an address to a large audience" are all instances of communication that is dispersed to the general public. Here, plaintiffs do not allege that plaintiffs’ PII is communicated publicly or made public in any manner. Accepting plaintiffs’ allegations as true, just because plaintiffs’ PII may be accessed within Walgreen Co. by Walgreen Co. employees does not mean it is distributed or made available to the public, which is a requirement of wrongful publicizing of private affairs claim. Therefore, the court dismisses this claim.

c. Negligence Per Se Based on HIPAA, FCRA, and FTCA

Walgreen Co. contends that plaintiffs’ negligence per se claim based on violations of HIPAA, FCRA, and FTCA must fail. As discussed above, the court has found that plaintiffs abandoned any arguments about the FCRA, meaning the court will only focus on negligence per se for violations of HIPAA and FTCA. Walgreen Co. argues that this claim should be dismissed because plaintiffs cannot maintain a negligence per se claim based on a statutory violation unless the statute permits a private cause of action, and neither HIPAA nor FTCA do. Walgreen Co. then argues that even if HIPAA and FTCA were to permit a private cause of action, plaintiffs have failed to allege a violation of either statute.

i. Private Cause of Action

First, Walgreen Co. argues that plaintiffs’ negligence per se claim must fail because neither HIPAA nor the FTCA permit a private cause of action. In response, plaintiffs argue that while HIPAA and the FTCA do not explicitly contain a private cause of action, the statutes imply a cause of action, meaning they have properly alleged their claim.

"A statute must permit a private cause of action in order for plaintiffs to maintain a civil suit" for negligence per se. Salley v. Heartland-Charleston of Hanahan, SC, LLC, 2011 WL 2728051, at *3 (D.S.C. July 12, 2011). However, that private cause of action need not be explicit. "When a statute does not specifically create a private cause of action, one can be implied only if the legislation was enacted for the special benefit of a private party." Doe v. Marion, 373 S.C. 390, 645 S.E.2d 245, 248 (2007) ; see also Companion Prop. & Cas. Ins. Co. v. U.S. Bank Nat'l Ass'n, 2016 WL 3027552, at *8 (D.S.C. May 27, 2016) ("In the context of negligence per se, the primary factor to determine whether a statute creates such a primary right is legislative intent, which ‘is determined primarily from the language of the statute." (internal quotations omitted)). As such, "for a statute to support a claim for negligence per se, a plaintiff must show that the statute was enacted for the special benefit of a private party." Winley v. Int'l Paper Co., 2012 WL 13047989, at *10 (D.S.C. Oct. 23, 2012) (internal quotations omitted). In contrast, "[i]f a statute is concerned with the protection of the public and not with the protection of an individual's private right, it cannot support a private cause of action for negligence per se." Id. Stated differently, a statute may form the basis of a negligence per se claim when "(1) the essential purpose of the statute is to protect from the kind of harm the plaintiff has suffered; and (2) the plaintiff is a member of the class of persons the statute is intended to protect." Whitlaw v. Kroger Co., 306 S.C. 51, 410 S.E.2d 251, 252 (1991).

Therefore, the question becomes whether plaintiffs have adequately pleaded that the essential purpose of HIPAA and the FTCA is to protect from the kind of harm plaintiffs have allegedly suffered and whether plaintiffs are members of the class meant to be protected by the statutes. However, the problem is that plaintiffs have not pleaded this at all. They argued in their response brief and at the hearing that these two prongs exist, but "[i]t is well-established that parties cannot amend their complaints through briefing or oral advocacy." S. Walk at Broadlands Homeowner's Ass'n, Inc. v. OpenBand at Broadlands, LLC, 713 F.3d 175, 184 (4th Cir. 2013). Nowhere in their complaint do plaintiffs allege that they are members of the class that HIPAA and the FTCA are meant to protect or that HIPAA and the FTCA are meant to protect from the harm plaintiffs have allegedly suffered.

Moreover, even if plaintiffs had included these allegations in their amended complaint, the court is not convinced that HIPAA implies a private cause of action such that it can form the basis of a negligence per se claim as a matter of law. Plaintiffs argue that "[c]ourts have held that HIPAA, while not providing a private cause of action, may be a legitimate element of a state law claim and have allowed negligence per se claims to stand," citing to various cases. ECF No. 143 at 19 n.4. However, several of those cases permit the use of HIPAA to inform the standard of care in an ordinary negligence claim, not the use of a HIPAA violation as the basis of a negligence per se claim, and the rest are clearly inapplicable. See Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C., 314 Conn. 433, 102 A.3d 32, 47 (2014) (noting that "several [courts] have determined that HIPAA may inform the relevant standard of care"); Acosta v. Byrum, 180 N.C.App. 562, 638 S.E.2d 246, 251 (2006) (finding that the plaintiff sufficiently pleaded the standard of care in her negligence claim because she alleged that HIPAA establishes the standard of care); Fung-Schwartz v. Cerner Corp., 2018 WL 4386087, at *8 (S.D.N.Y. Sept. 13, 2018) (finding that HIPAA can be used to establish standard of care in a negligence claim).

There is a difference between using a statute to establish the standard of care in an ordinary negligence claim and using the violation of a statute to establish the duty and breach of duty in a negligence per se claim. Negligence per se uses a statutory violation to establish duty and breach of duty. Rayfield v. S.C. Dep't of Corr., 297 S.C. 95, 374 S.E.2d 910, 914–15 (S.C. Ct. App. 1988). In contrast, if a statute is used to established a standard of care, there must be some independent duty because "[o]nly when there is a duty would a standard of care need to be established." Doe ex rel. Doe v. Wal-Mart Stores, Inc., 393 S.C. 240, 711 S.E.2d 908, 912 (2011). In other words, there must be some duty, i.e., a common law duty of confidentiality, that exists before looking to HIPAA to inform the standard of care. Indeed, plaintiffs cite to no case in which a court permitted a negligence per se claim based on a violation of HIPAA, and the court's own research has revealed none. Therefore, there appears to be no basis in the law that a violation of HIPAA can be used to plead a negligence per se claim.

With regard to the FTCA, Plaintiffs cite to various cases in which courts have found an implied cause of action in the FTCA, meaning a violation of the FTCA could serve as the basis for a negligence per se claim. See In re Equifax, Inc., Customer Data Sec. Breach Litig., 362 F. Supp. 3d 1295, 1327 (N.D. Ga. 2019) (denying motion to dismiss the plaintiffs’ negligence per se claim based on a violation of the FTCA because the complaint adequately pleaded a violation of the FTCA, that the plaintiffs were within the class of persons that the statute intended to protect, and that the harm suffered is the kind that the statute meant to protect); Bans Pasta, LLC v. Mirko Franchising, LLC, 2014 WL 637762, at *13 (W.D. Va. Feb. 12, 2014) (same). Assuming arguendo that plaintiffs properly alleged this cause of action and that a violation of the FTCA could serve as the basis of a negligence per se claim, the court finds that plaintiffs have failed to sufficiently allege a FTCA violation.

The FTCA prohibits "unfair or deceptive acts or practices in or affecting commerce," 15 U.S.C. § 45(a), and plaintiffs allege that Walgreen Co.’s failure to maintain reasonable and appropriate data security for plaintiffs’ PII constitutes an unfair method of competition in commerce, Am. Compl. ¶ 173. Plaintiffs rely on case law that has interpreted the FTCA to apply to instances in which an entity has insufficient cybersecurity. For example, in a case cited by plaintiffs, the Third Circuit considered whether the defendant's failure to use certain cybersecurity measures to prevent hackers from accessing consumers’ information violated the FTCA. F.T.C. v. Wyndham Worldwide Corp., 799 F.3d 236, 242 (3d Cir. 2015). Similarly, in the other case cited by plaintiffs, there were factual allegations of hackers accessing consumers’ personal information due to Equifax's weak cybersecurity practices. In re Equifax, Inc., Customer Data Sec. Breach Litig., 362 F. Supp. 3d 1295, 1310 (N.D. Ga. 2019). Notably, these cases both involve third-party hackers gaining access to a company's information due to inadequate cybersecurity protections.

Here, plaintiffs allege that "Walgreens’ EDW is not a secure platform for pharmacy customers’ PII because unauthorized persons and other Walgreens’ departments, divisions, and/or units can and do unlawfully access pharmacy customers’ PII contained therein." Am. Compl. ¶ 69. Plaintiffs do not allege that Walgreen Co.’s cybersecurity practices are inadequate nor do they allege any attempt by a third-party hacker to access plaintiffs’ PII. In other words, plaintiffs do not factually allege the type of FTCA violation upon which they purport to base their claim. As such, plaintiffs’ negligence per se claim based on violations of federal law must be dismissed.

d. Negligence Per Se Based on PIPA

Next, Walgreen Co. argues that plaintiff's negligence per se claim based on a violation of PIPA must be dismissed because PIPA does not create a private cause of action, PIPA only limits external transfers of information, PIPA's exceptions cover the actions that plaintiffs challenge, and PIPA's prohibition of disclosing PII does not apply because Walgreens does not disclose such information. Plaintiffs disagree with all of these arguments.

i. Private Cause of Action

First, Walgreen Co. argues that PIPA does not create a private cause of action and can only be enforced through criminal prosecution or agency action. In response, plaintiffs argue that PIPA implies a private cause of action. Unlike their negligence per se claim based on violations of federal law, plaintiffs did allege that the purpose of PIPA was to protect from unauthorized use of PII and that plaintiffs fall within the class of person that PIPA is meant to protect, Am. Compl. ¶¶ 183–84, and they argue as much in their response brief.

As Walgreen Co. points out, neither party cites to any case that recognizes a private cause of action in PIPA. The court has also been unable to locate any instance in which a court has held that a violation of PIPA could be used to imply a cause of action such that a negligence per se claim could be sustained. Nevertheless, plaintiffs have alleged that the two requirements of negligence per se exist here, and Walgreen Co. provides no argument in opposition to those allegations. As such, the lack of an explicit private cause of action does not convince the court that this claim should be dismissed.

ii. External Transfers

Next, Walgreen Co. argues that plaintiffs failed to allege a violation of PIPA because PIPA only applies to external transfers, and any use of plaintiffs’ PII is internal to Walgreens. In response, plaintiffs argue that PIPA simply prohibits any transfer of PII outside of the database in which it was entered with patients’ consent, and that defendants alter the plain language of PIPA by inserting the modifier "external" before the word "transfers."

PIPA states that "[n]o patient prescription drug information may be transferred or received by a person without the written consent of the patient or a person authorized by law to act on behalf of the patient." S.C. Code Ann. § 44-117-30. "Patient prescription drug information" is defined in relevant part as "any data concerning the dispensing of a drug or device that identifies a patient as having been the recipient of a prescription drug or device, whether this data is held by a practitioner, pharmacy, or another entity." Id. § 44-117-20. The statute then lists various exceptions to this prohibition.

Walgreen Co. argues that this prohibition only applies to external data transfers, and because any transfer of data here occurs within the Walgreen Co. entity, plaintiffs have failed to allege a violation of PIPA. In response, plaintiffs argue that PIPA prohibits any transfer of PII outside of the pharmacy setting without written consent of the patient. Plaintiffs argue that this distinction between external and internal transfers is without merit. They contend that plain language of the statute states that "[n]o patient prescription drug information may be transferred or received by a person without the written consent of the patient," S.C. Code Ann. § 44-117-30, and that the plain meaning of "transfer" is "to convey from one person, place, or situation to another." As such, plaintiffs contend that any transfer outside of the pharmacy itself, whether within Walgreen Co. or not, without consent is prohibited by PIPA, and that any reading of PIPA that would permit a corporation that owns pharmacies to control pharmacy data is absurd. However, the statute prohibits the "transfer[ ] or recei[pt] by a person." Based on plaintiffs’ own allegations, that is not what occurs here. Instead, plaintiffs allege that PIPA prohibits Walgreen Co.’s "transfer" of plaintiffs’ PII "from its pharmacy's IntercomPlus system to its corporate EDW repository" and Walgreen Co.’s "receipt" of plaintiffs’ PII "by its 340B Complete software and/or process from its corporate EDW repository." Am. Compl. ¶¶ 187–88. These are not instances of transfers or receipts by a person. Instead, they are instances of transfer and receipts by databases within the same entity, Walgreen Co. Moreover, as Walgreen Co. points out, if "transfer" was to be interpreted as narrowly as plaintiffs claim, i.e., any conveyance of information outside of the four walls of the pharmacy, then PIPA would prohibit basic functions such as transmitting information for legal, administrative, or IT services that do not occur within the four walls of the pharmacy.

The court previously interpreted the statute to prohibit external transfers of information to another entity relying in part on PIPA's exceptions. Most of PIPA's exceptions to the prohibition of transfers that are enumerated in § 44-117-30 relate to external transfers of patient prescription drug information. Those include transmittals of a prescription drug order, id. § 44-117-30(1); communications with other health care professionals who treat the patient, id. § 44-117-30(2); information necessary to effect the recall of a defective drug, id. § 44-117-30(4); information necessary to adjudicate or process payment claims, id. § 44-117-30(6); and information for use in clinical research and medical studies, id. § 44-117-30(8)–(9). It stands to reason that if the prohibition applied to external transfers, then the exceptions to the prohibition would include external transfers. Moreover, PIPA clarifies that it does not invalidate other certain laws and authority, including the authority of a court to subpoena patient prescription drug information, the authority of a licensing or disciplinary board of the State to obtain prescription records, and the authority of the Department of Health and Environmental Control to access the records. Id. § 44-117-50. These are all authorities to which information would be transferred externally outside of the entity that holds the patient's PII. Based on this context, the court is still convinced that PIPA does not prohibit what plaintiffs allege here—transfer of data within the same entity.

Plaintiffs cite to several portions of PIPA that they argue requires patient information to stay within the pharmacy context. They first cite to a portion of the statute that requires that "[a]ll electronic equipment for receipt of prescription drug orders communicated by way of electronic transmission must have adequate security and system safeguards and must be maintained so as to ensure patient confidentiality and to ensure against unauthorized access or an intervening person or entity having access to view, read, manipulate, alter, store, or delete the electronic prescription prior to its receipt by the pharmacy of the patient's choice." S.C. Code Ann. § 44-117-330 (emphasis added). However, the court understands this to stand for the proposition that a pharmacy needs security measures to make sure no one can intercept patient information prior to the pharmacist receiving it.

Next, plaintiffs cite to S.C. Code Ann. § 44-117-340(F), which requires that "[t]he facsimile machine receiving prescription drug orders must be in the prescription department of the pharmacy to protect confidentiality and security." This provision does suggest that patient information must be kept within the pharmacy setting, as it presumably prevents a fax machine set up in, for example, the photo department from receiving prescription information. However, the court is unconvinced that this provision alone prohibits transfer of PII within the same entity. S.C. Code Ann. § 44-117-350(b) requires pharmacies "provide a mechanism to prevent the disclosure of any information, confidential or otherwise, about patients that was obtained or collected by a pharmacist or pharmacy incidental to the delivery of pharmaceutical care other than as authorized in regulation." The court fails to see how this requirement factors into the internal/external debate. Finally, plaintiffs point to S.C. Code Ann. § 44-117-350(c), which requires the pharmacist-in-charge to "establish and maintain written policies and procedures for maintaining the integrity and confidentiality of prescription information and patient health care information" and requires "[a]ll employees of the pharmacy with access to this information ... to comply with the established policies and procedures." Again, the court is not sure how this citation plays into the internal/external distinction.

In light of these arguments, the court is unconvinced that plaintiffs have sufficiently alleged a violation of PIPA. Plaintiffs allege that data is transferred between databases that are all within Walgreen Co., and the court finds no support in the language of PIPA for plaintiffs’ narrow interpretation that PIPA prohibits data transfer outside of the pharmacy setting. As such, the court dismisses the claim.

e. Breach of Contract

Plaintiffs bring a claim for breach of contract in their amended complaint for Walgreen Co.’s alleged breach of the "terms of an implied contract, insurance agreements, and privacy policies" to "properly maintain and store their PII and to not transfer, receive, and/or use, disclose, or disseminate it in furtherance of its 340B Complete process(es)." Am. Compl. ¶¶ 195–96. Walgreen Co. argues that the claim should be dismissed because plaintiffs fail to identify the terms of any implied contract between Walgreen Co. and plaintiffs.

"A contract is an obligation which arises from actual agreement of the parties manifested by words, oral or written, or by conduct." Stanley Smith & Sons v. Limestone Coll., 283 S.C. 430, 322 S.E.2d 474, 477 (S.C. Ct. App. 1984). If an agreement is manifested by conduct, then the contract is implied. Id. "An implied contract, like an express contract, rests on an actual agreement of the parties to be bound to a particular undertaking. The parties must manifest their mutual assent to all essential terms of the contract in order for an enforceable obligation to exist." Id. Plaintiffs allege that Walgreen Co. implicitly agreed to maintain and store plaintiffs’ PII confidentially and to not transfer and/or use that information for 340B Complete without plaintiffs’ consent, and in exchange, plaintiffs purchased medication from the pharmacies. However, plaintiffs have failed to allege that they even knew of, much less agreed to, one of the essential terms of the purported implied contract—that Walgreen Co. would not use their PII for the purposes of 340B Complete. In fact, plaintiffs allege just the opposite by claiming that "Walgreens pharmacy customers do not consent to, are unaware of, and have no reason to expect Walgreens’ surreptitious transfer, receipt, and/or use, disclosure, or dissemination of their PII following the completion of their retail pharmacy transaction." Am. Compl. ¶ 86. If plaintiffs were unaware of the alleged use of their PII during 340B Complete, then the court fails to see how they could have entered into an implied contract with Walgreen Co. that included a term that Walgreen Co. would not use their PII in such a manner.

In addition, plaintiffs allege that Walgreen Co.’s use of plaintiffs’ PII violates Walgreen Co.’s insurance agreements and Walgreen Co.’s Notice of Privacy Practices ("NPP"). Beginning with the "insurance agreements," plaintiffs argue that Walgreen Co. pharmacies "agree to provide pharmaceutical care and services to Plaintiffs in return for claim reimbursement by Plaintiffs’ insurers." ECF No. 143 at 23. Counsel expanded on this at the hearing, arguing that insurers pay Walgreen Co. on the premise that the patient's information is kept confidential and as a benefit to the patient, creating an agreement between the parties. However, plaintiffs fail to allege any terms of these insurance agreements nor do they provide any argument as to how they have standing to raise a claim for breaching these supposed agreements when the agreements allegedly exist between insurance companies and Walgreen Co., not between Walgreen Co. and plaintiffs.

With regard to the NPPs, as another court has explained, NPPs "are not contractual in nature" but instead "inform patients of their rights under federal law—specifically [HIPAA]—and the duties imposed ... by these statutory provisions." Brush v. Miami Beach Healthcare Grp. Ltd., 238 F. Supp. 3d 1359, 1367 (S.D. Fla. 2017). As such, NPPs cannot create contractual obligations because entities like Walgreen Co. are required by law to comply with HIPAA without receiving consideration from plaintiffs. Therefore, plaintiffs have failed to allege all three contracts upon which they base their breach of contract claim, and the court dismisses the claim.

f. Negligence Based on Professional Standards

Next, Walgreen Co. contends that plaintiffs’ negligence claim based on breach of duties established by professional standards must be dismissed. First, Walgreen Co. argues that plaintiffs fail to identify any duty of care that Walgreen Co. has breached. Plaintiffs allege that "Walgreens breached its duty to Plaintiffs and Class Members by failing to conform to the privacy practices universally recognized and accepted in the pharmaceutical profession." Am. Compl. ¶ 211. Plaintiffs allege that those privacy practices are prescribed by the South Carolina Board of Pharmacy, the American Pharmaceutical Association Code of Ethics, and PIPA. Id. ¶ 209. PIPA is discussed in plaintiffs’ negligence per se claim, but plaintiffs fail to cite to any portion of the American Pharmaceutical Association Code of Ethics or standard prescribed by the South Carolina Board of Pharmacy that establishes a duty. In response, plaintiffs argue that Walgreen Co. has a duty to exercise reasonable care when its actions create a risk to others and cites to several cases that plaintiffs argue recognize such a duty in this context, none of which is a South Carolina case. Plaintiffs also argue that they have sufficiently alleged the duties prescribed by the South Carolina Board of Pharmacy that require Walgreen Co. to protect pharmacy customers’ PII, which are promulgated in the PPA. Am. Compl. ¶ 221.

Plaintiffs fail to cite to any source of Walgreen Co.’s purported duty to "conform to the privacy practices universally recognized and accepted in the pharmaceutical profession." While plaintiffs contend that the duty prescribed by the South Carolina Board of Pharmacy is promulgated in the PPA, plaintiffs bring a separate negligence cause of action based on the PPA, and the paragraph that they cite to, ¶ 221, is within that cause of action, not the negligence cause of action that is the focus of this discussion. Moreover, plaintiffs do not even mention the American Pharmaceutical Association Code of Ethics in their response brief, and they cite to no South Carolina case law to suggest that Walgreen Co. has any duty in this context. Finally, plaintiffs fail to cite to any South Carolina law that applies the general proposition that anyone has a duty to exercise reasonable care when his or her action creates a risk to others to this context. The court is unconvinced that such a general application of basic negligence law would apply here. Finally, to the extent plaintiffs are attempting to argue that Walgreen Co. has a common law duty to maintain the privacy of plaintiffs’ PII, that argument directly contradicts the Supreme Court of South Carolina's holding that there is no common law duty of confidentiality for pharmacists. Evans v. Rite Aid Corp., 324 S.C. 269, 478 S.E.2d 846, 848 (1996).

To be sure, something like the American Pharmaceutical Association Code of Ethics "may be a potential source of guidance on a pharmacist's duty of care generally," Evans v. Rite Aid Corp., 324 S.C. 269, 273, 478 S.E.2d 846 (1996) ; see also Madison ex rel. Bryant v. Babcock Ctr., Inc., 371 S.C. 123, 638 S.E.2d 650, 659 (2006) ("The standard of care in a given case may be established and defined by the common law, statutes, administrative regulations, industry standards, or a defendant's own policies and guidelines."). However, as previously explained, "if no duty has been established, evidence as to the standard of care is irrelevant. Only when there is a duty would a standard of care need to be established." Doe ex rel. Doe, 711 S.E.2d at 912. Plaintiffs fail to sufficiently allege any duty that Walgreen Co. owed to plaintiffs for which the standard of care would be informed by professional standards. As such, this claim must be dismissed.

g. Negligence Based on PPA

Walgreen Co. argues that PPA does not establish a relevant duty of care, that PPA does not give rise to a private cause of action, and that plaintiffs fail to plausibly allege that Walgreen Co. violated PPA, meaning this claim should be dismissed. In their response brief, plaintiffs clarify that this cause of action is based on a breach of a standard of care set by PPA, not a violation of PPA. In other words, this cause of action is not a negligence per se claim. However, as discussed above, plaintiffs’ theory of a "breach of a standard of care" is not how negligence claims work. Something like PPA may inform the standard of care, but there has to first be a duty. Once a duty is established, the court looks to the standard of care, which could be informed by PPA, to determine whether that duty was breached. In other words, a negligence claim is based on a breach of a duty, which is informed by a standard of care, not based on a breach of a standard of care. The sole case on which plaintiffs rely, Bibeau v. Shortt, clearly considers violations of PPA in the context of a negligence per se claim. 2006 WL 8443485, at *9 (D.S.C. June 29, 2006) ("These acts violate clear safety standards established in the Pharmacy Practices Act and each supports a separate finding of negligence per se."). Plaintiffs argue that there are "PPA-established duties" but cite to no authority suggesting that to be true. ECF No. 143 at 31. In fact, the Supreme Court of South Carolina has held just the opposite. Evans v. Rite Aid Corp., 324 S.C. 269, 478 S.E.2d 846, 847 (1996) (holding that PPA "do[es] not set forth, explicitly or implicitly, a duty of confidentiality"). As such, even if PPA does inform the standard of care, plaintiffs point to no duty that Walgreen Co. owed to plaintiffs, and this claim must be a negligence per se claim for a violation of PPA if it has any hope of surviving. The problem with treating this cause of action as one for negligence per se is PPA does not provide an explicit private cause of action, and plaintiffs make no allegations or arguments that a cause of action is implied based on the two-prong test: that "(1) the essential purpose of the statute is to protect from the kind of harm the plaintiff has suffered; and (2) the plaintiff is a member of the class of persons the statute is intended to protect." Whitlaw, 410 S.E.2d at 252. Without any such allegations or argument, this claim fails. See Skinner v. Horace Mann Ins. Co., 369 F. Supp. 3d 649, 655 (D.S.C. 2019) (dismissing a negligence per se claim because the statute upon which the claim was based did not create a private cause of action and the plaintiff made no argument that a private cause of action was implied).

h. Respondeat Superior and Negligent Training and Supervision

Walgreen Co. argues that these claims should be dismissed because the causes of action underlying these claims fail. In response, plaintiffs argue that they have sufficiently alleged these causes of action because they have alleged that Walgreen Co.’s pharmacists-in-charge have allowed plaintiffs’ PII to be transferred out of the pharmacy for unauthorized purposes, failed to establish policies and procedures to maintain the confidentiality of plaintiffs’ PII, failed to maintain adequate security and systems safeguards, and failed to implement and abide by the PIPA, PPA, American Pharmaceutical Code of Ethics, and requirements set forth by the South Carolina Board of Pharmacy, all of which occurred within their scope of employment. Am. Compl. ¶¶ 255–56. Plaintiffs also allege that Walgreen Co. negligently failed to properly train and supervise its pharmacists and pharmacists-in-charge with regard to how 340B Complete operates. Id. ¶ 266.

Respondeat superior is not a cause of action; it is a theory of liability. See Austin v. Specialty Transp. Servs., Inc., 358 S.C. 298, 594 S.E.2d 867, 877 (S.C. Ct. App. 2004) ("Under the doctrine of respondeat superior, the employer is liable for the acts of an employee acting within the scope of employment."). Therefore, the court dismisses this cause of action. With regard to the negligent training and supervision cause of action, "[a]n employer can be liable for negligent supervision of an employee when an employee intentionally harms another on the employer's premises and the employer (i) knows or has reason to know that he has the ability to control his employee, and (ii) knows or should know of the necessity and opportunity for exercising such control.’ " Thomas v. City of Mauldin, 2017 WL 4776972, at *6 (D.S.C. Sept. 26, 2017), report and recommendation adopted, 2017 WL 4764814 (D.S.C. Oct. 20, 2017) (cleaned up). "[N]egligent training is merely a specific negligent supervision theory by another name." Holcombe v. Helena Chem. Co., 238 F. Supp. 3d 767, 772 (D.S.C. 2017). Plaintiffs do not allege that pharmacists intentionally harmed plaintiffs, as is required for this cause of action. Degenhart v. Knights of Columbus, 309 S.C. 114, 420 S.E.2d 495, 496 (1992) ("An employer may be liable for negligent supervision if the employee intentionally harms another...." (emphasis added)). Instead, plaintiffs allege that Walgreen Co. was negligent because of its pharmacists’ alleged negligence, which is not the point of a negligent supervision and training claim. Plaintiffs allege that Walgreen Co. intentionally does not disclose its 340B processes to pharmacists, Am. Compl. ¶ 262–65, but they do not allege that the pharmacists are intentionally harming plaintiffs. As such, the court dismisses this claim.

i. Unjust Enrichment

Walgreen Co. argues that plaintiffs’ unjust enrichment claim should be dismissed because plaintiffs have failed to show that Walgreen Co. has realized any benefit from plaintiffs’ PII, to allege any harm, and to show that it would be unjust for Walgreen Co. to retain that benefit. In response, plaintiffs argue that they have sufficiently alleged that Walgreen Co.’s transfer of plaintiffs’ PII in furtherance of 340B Complete conferred a benefit on Walgreen Co. in the form of additional profits, and that it is unjust for Walgreen Co. to retain those profits because the transfer and use of plaintiffs’ PII was without plaintiffs’ knowledge or consent.

"Unjust enrichment is an equitable doctrine which permits the recovery of that amount the defendant has been unjustly enriched at the expense of the plaintiff." Dema v. Tenet Physician Servs.-Hilton Head, Inc., 383 S.C. 115, 678 S.E.2d 430, 434 (2009). To succeed on an unjust enrichment claim, a plaintiff must prove: "(1) [a] benefit conferred by plaintiff upon the defendant; (2) realization of that benefit by the defendant; and (3) retention of the benefit by the defendant under circumstances that make it inequitable for him to retain it without paying its value." Myrtle Beach Hosp., Inc. v. City of Myrtle Beach, 341 S.C. 1, 532 S.E.2d 868, 872 (2000). "The South Carolina Supreme Court defines benefits as ‘goods or services.’ " Quintech Sec. Consultants, Inc. v. Intralot USA, Inc., 2011 WL 5105446, at *4 (D.S.C. Oct. 27, 2011) (citing Gignilliat, 684 S.E.2d at 764 ).

Plaintiffs allege that Walgreen Co. "induced Plaintiffs and class Members to provide their PII to its pharmacy in order to receive their prescription drugs" and that Walgreen Co. "realized value from the transfer, receipt, and/or use, disclosure, or dissemination of Plaintiffs’ and Class Members’ PII" because Walgreen Co. is compensated for its 340B administration services through 340B Complete. Am. Compl. ¶¶ 275–77. The compensation allegedly occurs when the profit margin of a 340B drug exceeds the fee that the Covered Entity paid to Walgreen Co. and Walgreen Co. subsequently purchases the drug at the discounted 340B price. Id. ¶¶ 72–74.

The court begins with Walgreen Co.’s last argument because it is the one that warrants dismissal of this claim. Walgreen Co. argues that plaintiffs have failed to allege that a benefit was conferred in a circumstance in which it would be unjust for Walgreen Co. to retain the benefit. Walgreen Co. relies on a Fourth Circuit case which states that "three elements encompass the equitable remedy of unjust enrichment and quasi-contract: the plaintiff must show that (1) he had a reasonable expectation of payment, (2) the defendant should reasonably have expected to pay, or (3) society's reasonable expectations of person and property would be defeated by nonpayment." Provident Life & Acc. Ins. Co. v. Waller, 906 F.2d 985, 993–94 (4th Cir. 1990). As plaintiffs note, this case applied federal common law unjust enrichment, not South Carolina law on unjust enrichment. However, South Carolina law also clearly contemplates an expectation of payment in unjust enrichment claims. See Quintech Sec. Consultants, Inc. v. Intralot USA, Inc., 2011 WL 5105446, at *4 (D.S.C. Oct. 27, 2011) (dismissing unjust enrichment claim in part because the plaintiff had no expectation of compensation); Webb v. First Fed. Sav. & Loan Ass'n of Anderson, 300 S.C. 507, 388 S.E.2d 823, 827 (S.C. Ct. App. 1989), overruled on other grounds by Myrtle Beach Hosp., Inc. v. City of Myrtle Beach, 341 S.C. 1, 532 S.E.2d 868 (2000) ("The case of Gantt v. Morgan, 199 S.C. 138, 18 S.E.2d 672 (1942), clearly implies that an expectation of payment is an element of a quantum meruit action in South Carolina."). Plaintiffs claim that they could not have reasonably expected payment from the unconsented use of their PII because Walgreen Co. intentionally concealed its conduct, but that argument simply goes to show that their unjust enrichment claim is untenable. If they could not have reasonably expected payment, then they cannot state a claim for unjust enrichment. Despite claiming that "[t]he facts of this case ‘fit the archetypal unjust enrichment scenario," ECF No. 143 at 35, plaintiffs fail to cite to any unjust enrichment case with similar facts. Therefore, the court dismisses this claim.

j. Declaratory Relief

Walgreen Co. argues this claim should be dismissed because seeking declaratory relief under 28 U.S.C. § 2201 is not an independent cause of action and because it is premised on plaintiffs’ other failed claims. Walgreen Co. also argues that it should be dismissed as inappropriate at this stage of litigation because the merits of plaintiffs’ claims have not been adjudicated yet. Plaintiffs "seek a judicial determination of whether Walgreens has performed, and is performing, the privacy practices and obligations necessary to protect and safeguard Plaintiffs’ and Class Members’ PII from further unauthorized transfer, receipt, and/or use, disclosure, or dissemination." Am. Compl. ¶ 202.

The Declaratory Judgment Act states that

In a case of actual controversy within its jurisdiction ... any court of the United States, upon the filing of an appropriate pleading, may declare the rights and other legal relations of any interested party seeking such declaration, whether or not further relief is or could be sought.

28 U.S.C. § 2201. To determine whether a claim for declaratory judgment is properly alleged, the court must ask "whether the facts alleged, under all the circumstances, show that there is a substantial controversy, between parties having adverse legal interests, of sufficient immediacy and reality to warrant the issuance of a declaratory judgment." MedImmune, Inc. v. Genentech, Inc., 549 U.S. 118, 127, 127 S.Ct. 764, 166 L.Ed.2d 604 (2007). "A case meets the actual controversy requirement only if it presents a controversy that qualifies as an actual controversy under Article III of the Constitution." Volvo Const. Equip. N. Am., Inc. v. CLM Equip. Co., Inc., 386 F.3d 581, 592 (4th Cir. 2004). "A ‘controversy’ in this sense must be one that is appropriate for judicial determination." Aetna Life Ins. Co. of Hartford, Conn. v. Haworth, 300 U.S. 227, 240, 57 S.Ct. 461, 81 L.Ed. 617 (1937). "A justiciable controversy is thus distinguished from a difference or dispute of a hypothetical or abstract character; from one that is academic or moot." Id.

Because the court dismisses all of plaintiffs’ other claims, plaintiffs have failed to allege an "actual controversy" upon which the court could issue a declaratory judgment. Plaintiffs allege that an actual controversy exists relating to "Walgreens’ failure to protect Plaintiffs’ and Class Members’ PII in accordance with applicable state and federal laws and agreements between the parties." Am. Compl. ¶ 200. However, the court has found that plaintiffs have failed to allege any violation of state or federal law or any breach of an agreement between the parties. The "actual controversy" in plaintiffs’ declaratory judgment claim is premised on their other claims, all of which are dismissed. Absent sufficient allegations of wrongdoing, any declaration as to whether Walgreens was sufficiently protecting plaintiffs’ PII would be abstract and hypothetical. As such, plaintiffs have failed to allege an actual controversy, meaning their declaratory judgment claim must be dismissed.

IV. CONCLUSION

For the reasons set forth above, the court GRANTS the motion.

AND IT IS SO ORDERED.