Opinion
No. 2:15–CV–373
01-16-2018
Michelle HAYWOOD, Plaintiff, v. NOVARTIS PHARMACEUTICALS CORP., Defendant.
Tony Walker, The Walker Law Group PC, Gary, IN, for Plaintiff. Ellen E. Boshkoff, Angela N. Johnson, Faegre Baker Daniels LLP, Indianapolis, IN, for Defendant.
Tony Walker, The Walker Law Group PC, Gary, IN, for Plaintiff.
Ellen E. Boshkoff, Angela N. Johnson, Faegre Baker Daniels LLP, Indianapolis, IN, for Defendant.
OPINION AND ORDER
RUDY LOZANO, Judge
This matter is before the Court on the Defendant’s Motion to Dismiss Plaintiff’s First Amended Complaint, filed by the defendant, Novartis Pharmaceuticals Corporation, on December 27, 2016. (DE # 35.) For the reasons set forth below, the motion to dismiss is GRANTED . The clerk is DIRECTED to close this case.
BACKGROUND
Plaintiff, Michelle Haywood ("Haywood"), filed her complaint in state court on August 13, 2015. (DE # 4.) The complaint brought claims for negligence, negligent training and supervision, and public disclosure of private facts; it also listed "punitive damages" as a separate count. (Id. ) The defendant, Novartis Pharmaceuticals Corporation ("Novartis"), removed the matter to this Court on the basis of diversity jurisdiction on September 28, 2015. (DE # 1.) On November 2, 2015, Novartis filed a motion to dismiss the complaint. (DE # 14.) On September 27, 2016, the Court granted the motion, dismissed the complaint without prejudice, and granted Haywood thirty days to file an amended complaint. (DE # 28.) The first amended complaint was filed by Haywood on October 25, 2016. (DE # 30.) In Count one of her complaint, Haywood alleges that Novartis acted negligently when it disclosed personal information to her co-workers and supervisors via facsimile transmission which violated duties it owed to her under its privacy policy, under Indiana Code 25–26–13–15(b), and under the Health Insurance Portability and Accountability Act ("HIPPA"). In Count Two, Haywood alleges that Novartis was negligent in its training and supervision of its employees regarding the protection of customer privacy and confidentiality. Finally, in Count Three, Haywood alleges that she is entitled to punitive damages because Novartis acted with reckless indifference when it disclosed her protected information despite being told, in writing, not to do so. Novartis filed the instant motion to dismiss on December 27, 2016. (DE # 35.) Haywood filed her response on January 9, 2017. (DE # 37.) Novartis filed its reply on January 17, 2017. (DE # 38.) The motion is ripe for adjudication.
DISCUSSION
Facts
Novartis Patient Assistance NOW Oncology, a division of Novartis, administers the GLEEVEC Co-Pay Assistance Program (the "Program") in which eligible patients are given a GLEEVEC Co-Pay Card by Novartis to help offset the costs of their prescription medication. (DE # 30, p. 1.) Haywood applied for the Program, and on May 19, 2015, she sent Novartis a written statement requesting that no information regarding her application be sent to her place of employment. (Id. at 2.) On July 8, 2015, Novartis disclosed the following via facsimile transmission to Haywood’s co-workers and supervisors: her social security number, her date of birth, her income, her Medicare number, and information about her disease, treatment, and medical providers. (Id. )
According to the amended complaint, the website for the Program includes a privacy notice that states:
Novartis Pharmaceuticals Corporation and Novartis Group of Companies understand your personal and health information is private.
The personal information we collect from you, including your card or voucher usage, will be used to bring you information about products, programs, support, and services, to conduct market research, as required by federal regulations. Please be assured that although we share your personal information with our business partners who work with us on these activities, we do not permit them to use your personal information for their own marketing purposes. You may unsubscribe from our programs and services at any time by calling 1–888–669–6682. For more information about our privacy practices, please visit our website at www.usprivacy.novartis.com.
("Privacy Notice"). (Id. at 3.) Additionally, the amended complaint cites to the following privacy statement that was found on the main Novartis website:
The amended complaint cites to the version of the privacy statement that was revised as of November 28, 2012.
... This Privacy Statement tells you how we protect the privacy of personal information that you may provide to us.
As part of our commitment to privacy, Novartis has voluntarily certified to the U.S.–EU Safe Harbor Framework and the U.S.–Swiss Safe Harbor Framework as set forth by the U.S. Department of Commerce....
The purpose of this privacy statement is to explain what Novartis does with personally identifiable information that you provide to us, such as your name, address, age, and information relating to your medical conditions. We want you to know how your personally identifiable information will be protected, who we may share it with, and for what purposes.
... The type of information collected from you will be based on the specific program that you register for, as indicated at the time of your registration. The information that we may ask you to provide may include your first and last name, your mailing address, your age, birth date, gender, e-mail address, and information about your medical conditions. Novartis limits the collection and processing of personal information to what is necessary to fulfill the purposes for which it is to be used.
... Many of our customers register for more than one Novartis program or service, through our websites, by calling Novartis, or through a third-party such as their healthcare provider. When you register with us more than once, we may combine your personally identifiable information as well as any anonymous computer information collected (see below) and store it collectively. This helps us keep track of all of your preferences in one organized place, and helps us provide information to you based on a more informed review of your requests and medical conditions of interest.
... We request your consent to collect your personally identifiable information when you seek to register for a Novartis program or service. In doing so, we also explain, for that program or service, what you are registering to receive and how we plan to use your personal information. We also offer you the option of discontinuing your consent (‘opting out’ or ‘unsubscribing’) if you later decide that you no longer want to participate in that program or receive additional information from us. If we wish to use this information for purposes incompatible from those for which the data was initially collected, we will offer an effective way to opt out of the secondary use.
... When you provide personally identifiable information to Novartis, it will be accessible to some of Novartis' business partners, such as companies we retain to fulfill requests for information, answer telephone calls from consumers, or provide assistance to us on specific programs or projects such as newsletters.... Novartis requires third-parties to whom it discloses personal data to protect personal information using substantially similar standards to those required by Novartis.
... Other departments within the Novartis group, and other Novartis companies that may receive your information will abide by substantially similar privacy requirements relating to your personally identifiable information.
... This Privacy Statement becomes effective on November 28, 2012. Novartis may update this Statement from time to time. We encourage you to review our Privacy Statement periodically.
("Privacy Statement"). (Id. at 3–4) (footnote omitted.) Haywood alleges that, when it disclosed her personal information to her co-workers and supervisors via facsimile, Novartis breached duties owed to her under the Privacy Notice and Privacy Statement, under Indiana Code 25–26–13–15(b), and under HIPPA. (Id. at 3–5.)
Analysis
In evaluating a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), a court must accept all facts alleged in the complaint as true and draw all reasonable inferences in the light most favorable to the plaintiff. Johnson v. Rivera , 272 F.3d 519, 520 (7th Cir. 2001). A complaint is not required to contain detailed factual allegations; however, the plaintiff must allege facts that state a claim to relief that is plausible on its face. Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). It is not enough that there might be some conceivable set of facts that entitle the plaintiff to relief. Bell Atlantic Corp. v. Twombly , 550 U.S. 544, 553–56, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). The plaintiff’s obligation "requires more than labels and conclusions...." Id. at 555, 127 S.Ct. 1955. The Supreme Court has provided that "[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Iqbal , 556 U.S. at 678, 129 S.Ct. 1937.
Negligence and Negligent Training and Supervision
Novartis argues that Counts One and Two fail as a matter of law because Haywood has not properly alleged that Novartis owed her a legal duty or that any such duty, even if it existed, was breached. In response, Haywood asserts that Novartis owed her "multiple duties" based on its own policies, based on Indiana statutory law, and based on HIPPA.
In Indiana, "the tort of negligence is comprised of three elements: (1) a duty on the part of defendant in relation to the plaintiff; (2) the defendant’s breach of that duty; and (3) an injury to the plaintiff resulting from that failure." Kolozsvari v. Doe , 943 N.E.2d 823, 826–27 (Ind. Ct. App. 2011) (citing Miller v. Griesel , 261 Ind. 604, 308 N.E.2d 701, 706 (1974) ). "A duty to exercise care arises as a matter of law out of some relation existing between the parties, and it is the province of the court to determine whether such a relation gives rise to such duty." Id. at 827 (internal quotation marks and citation omitted). "Absent a duty, there can be no breach of duty and thus no negligence or liability based upon the breach." Peters v. Forster , 804 N.E.2d 736, 738 (Ind. 2004). In general, Indiana courts consider three factors when determining whether a duty exists: "(1) the relationship between the plaintiff and defendant; (2) the reasonable foreseeability of harm to the person injured by the defendant’s conduct; and (3) public policy concerns." Houser v. Kaufman , 972 N.E.2d 927, 938 (Ind. Ct. App. 2012). This inquiry is case specific. Id. Furthermore, a claim for negligent supervision and training must be analyzed pursuant to the doctrine of respondeat superior, and the court has "observe[d] that for respondeat liability to attach, there must also be underlying liability of the acting party." Walgreen Co. v. Hinchy , 21 N.E.3d 99, 109 (Ind. Ct. App. 2014).
Here, Haywood’s amended complaint alleges that Novartis breached explicit duties of privacy that it owed to her as a customer pursuant to the representations on its websites. In her response brief, Haywood argues that she relied on those representations to ensure that her information would remain private when applying for the program. However, as Novartis points out, the assurances in the Privacy Notice relate to the dissemination of information to its business partners who are prohibited from using customers' personal data for marketing purposes. The complaint does not allege, nor is it reasonable to infer, that the facsimile transmission sent to Haywood’s place of employment was in any way connected with third-party marketing. Similarly, according to its own terms, the purpose of the Privacy Statement is to explain what Novartis does with its customers' personally identifiable information and how it will be protected. In relevant part, the Privacy Statement confirms that Novartis will "limit[ ] the collection and processing of personal information to what is necessary to fulfill the purposes for which it is to be used" and will require third-parties and other departments within the Novartis group to conform with those same policies. (DE # 30, pp. 3–4.) The portion of Privacy Statement included in Haywood’s amended complaint does not set forth detailed standards or describe Novartis' specific obligations with regard to general non-disclosure. However, of note, the Privacy Statement does indicate that a customer’s consent related to the collection of personal information is required when he or she registers for a Novartis program or service, and it states that Novartis will explain how the information will be used for that particular program upon registration. (Id. at 4.) The Privacy Statement goes on to indicate that, if information is to be used "for purposes incompatible from those for which the data was initially collected, we will offer an effective way to opt out of the secondary use." (Id. ) Reading the Privacy Statement cited in the amended complaint in conjunction with the Privacy Notice associated with the Program, it is clear that the relevant privacy considerations focus primarily on dissemination to Novartis' partners and the subsequent intended secondary usage of that information rather than a duty to ensure against all possible disclosures in all circumstances. Again, the allegations in the complaint do not suggest, nor is it reasonable to infer, that the facsimile transmitted to Haywood’s place of employment was related to improper secondary usage or was anything other than routine collection and processing by Novartis. Rather, the complaint simply alleges that "in processing" the Program application, Haywood’s information was disclosed by facsimile to her place of employment, and the fact that Haywood allegedly told Novartis not to send any information regarding her application to her place of employment, without more, does not create a legal duty where none previously existed.
"Please be assured that although we share your personal information with our business partners who work with us on these activities, we do not permit them to use your personal information for their own marketing purposes." (DE # 30, p. 3.)
The amended complaint includes a footnote that cites to the following provision of the Privacy Statement: "Novartis takes reasonable precautions to protect EU and Swiss personal information in its possession from loss, misuse, unauthorized access, disclosure, alteration and destruction." (DE # 30, p. 3, n. 3) (emphasis by Haywood in original). However, the relevance of this provision is not clear, as Haywood has not alleged that she or the personal information disclosed by Novartis was in any way related to the EU or Switzerland.
Haywood also argues that Novartis owed her a statutory duty to protect her personal information pursuant to Indiana Code 25–26–13–15(b). It is true that, under Indiana law, violating statutory duties constitutes negligence per se. See Kho v. Pennington , 875 N.E.2d 208, 212 (Ind. 2007) (citing cases); Thiele v. Norfolk & W. Ry. Co. , 68 F.3d 179, 184–85 (7th Cir. 1995) (citing French v. Bristol Myers Co. , 574 N.E.2d 940, 943 (Ind. Ct. App. 1991) ). The question here is whether the section of the code relied upon by Haywood applies to Novartis. Haywood argues that it does because the statute clearly and unambiguously pertains to "any ‘person’ with patient information." This is true, according to Haywood, because the preceding and subsequent subsections of the statute refer specifically to a pharmacist or pharmacy, while the subsection in question refers more generally to a person. Novartis argues that such an interpretation fails to consider the statute as a whole which applies to pharmacists, pharmacies, and drug stores rather than drug manufacturers or the public at large.
If a statute is clear and unambiguous, courts are directed to take words and phrases in "their plain, ordinary, and usual sense" when analyzing their applicability. City of N. Vernon v. JenningsN.W. Regl. Utilities , 829 N.E.2d 1, 4 (Ind. 2005) (citing Poehlman v. Feferman , 717 N.E.2d 578, 581 (Ind. 1999) ). However, when there is more than one interpretation of a statute, it is considered ambiguous and is subject to judicial construction. Id. (citing Amoco Production Co. v. Laird , 622 N.E.2d 912, 915 (Ind. 1993) ). Courts are directed to examine the statute as a whole and read its sections in harmony to best effectuate legislative intent. Id. at 4–5. "And we do not presume that the Legislature intended language used in a statute to be applied illogically or to bring about an unjust or absurd result." Id. at 5 (citing State ex rel. Hatcher v. Lake Super. Ct., Rm. Three , 500 N.E.2d 737, 739 (Ind. 1986) ).
Title 25 of the Indiana Code is entitled "Professions and Occupations," and Article 26 within that title deals specifically with the regulation of "Pharmacists, Pharmacies, and Drug Stores." Chapter 13, entitled "Regulation of Pharmacists and Pharmacies—Creation of Board," declares that the "practice of pharmacy" is a matter of public interest and concern that must be subjected to certain regulations and controls. I.C. 25–26–13–1. Section 2 provides the definitions that apply to Chapter 13, and the "practice of pharmacy" is defined as:
a patient oriented health care profession in which pharmacists interact with and counsel patients and with other health care professionals concerning drugs and devices used to enhance patients' wellness, prevent illness, and optimize the outcome of a drug or device, by accepting responsibility for performing or supervising a pharmacist intern or an unlicensed person under section 18.5 of this chapter to do the following acts, services, and operations:
(1) The offering of or performing of those acts, service operations, or transactions incidental to the interpretation, evaluation, and implementation of prescriptions or drug orders.
(2) The compounding, labeling, administering, dispensing, or selling of drugs and devices, including radioactive substances, whether dispensed under a practitioner's prescription or drug order or sold or given directly to the ultimate consumer.
(3) The proper and safe storage and distribution of drugs and devices.
(4) The maintenance of proper records of the receipt, storage, sale, and dispensing of drugs and devices.
(5) Counseling, advising, and educating patients, patients' caregivers, and health care providers and professionals, as necessary, as to the contents, therapeutic values, uses, significant problems, risks, and appropriate manner of use of drugs and devices.
(6) Assessing, recording, and reporting events related to the use of drugs or devices.
(7) Provision of the professional acts, professional decisions, and professional services necessary to maintain all areas of a patient’s pharmacy related care as specifically authorized to a pharmacist under this article.
(8) Provision of medication therapy management.
I.C. 25–26–13–2. A "pharmacist" is defined as "a person licensed under this chapter," and a "person" is "any individual, partnership, copartnership, firm, company, corporation, association, joint stock company, trust, estate, or municipality, or a legal representative or agent, unless this chapter expressly provides otherwise." Id. A "pharmacy" is defined as:
any facility, department, or other place where prescriptions are filled or compounded and are sold, dispensed, offered, or displayed for sale and which has as its principal purpose the dispensing of drug and health supplies intended for the general health, welfare, and safety of the public, without placing any other activity on a more important level than the practice of pharmacy.
Id. Section 15, upon which Haywood relies, mandates the following:
(a) A pharmacist shall hold in strictest confidence all prescriptions, drug orders, records, and patient information. He may divulge such information only when it is in the best interest of the patient or when requested by the board or its representatives or by a law enforcement officer charged with the enforcement of laws pertaining to drugs or devices or the practice of pharmacy.
(b) A person who has knowledge by virtue of his office of any prescription drug order, record, or patient information may not divulge such information except in connection with a criminal prosecution or proceeding or a proceeding before the board, to which the person to whom the information relates is a party.
(c) A pharmacist or pharmacy is immune from civil liability for any action based on its good faith release of information under this section.
I.C. 25–26–13–15.
While Haywood argues that subsection (b) clearly and unambiguously pertains to "any person with patient information," the Court agrees with Novartis that such a reading would produce an unjust result. See City of N. Vernon v. Jennings N.W. Regl. Utilities , 829 N.E.2d 1, 5 (Ind. 2005) (court proceeded to construe a statute that appeared unambiguous at "first blush" because "a strict interpretation" in light of the facts presented would have produced "an absurd result"). First, subsection (b) itself expressly limits the definition of a "person" to one whose knowledge is obtained "by virtue of his office." That particular phrase is not defined in the statute, which results in some degree of ambiguity; however, reading the statute as a whole makes it clear that the regulations are intended to apply to those associated with the "practice of pharmacy" which the legislature has determined to be a matter of public concern. The practice of pharmacy is "a patient oriented health care profession" that focuses on a pharmacist’s interactions with and counseling of patients regarding their prescription drug needs. The statute describes several acts, services, and/or operations that a pharmacist (or those interns or unlicensed persons the pharmacist supervises) is responsible for during the practice of pharmacy, none of which pertain to manufacturing pharmaceutical drugs or administering a co-payment assistance program. Moreover, the title of Chapter 13 itself applies directly to pharmacists and pharmacies. A pharmacy is a place where "prescriptions are filled or compounded," and its principal purpose is dispensing drug and health supplies to the public; the definition also refers directly back to the practice of pharmacy as being of the upmost importance. Reading the statute to limit the applicability of its regulations to a person acting within the realm of the practice of pharmacy is also consistent with long-standing Indiana law recognizing the distinction of an individual who acts by virtue of his or her office as opposed to one who is employed more generally. See e.g. Wells v. State ex rel. Peden , 175 Ind. 380, 94 N.E. 321, 322 (1911) ("An office is a position or station in which a person is employed to perform certain duties, or by virtue of which he becomes charged with the performance of certain duties, public or private; a place of trust."). Based on the foregoing, the Court finds that the legislature intended subsection (b) to apply to a person involved in the practice of pharmacy, rather than to "any person with patient information" as is argued by Haywood.
The amended complaint describes Novartis as a "Pharmaceutical Corporation," with a division that administers the Program, and also as a "provider of pharmaceuticals." Haywood does not properly allege, nor is it reasonable to infer, that Novartis falls within the definition of a pharmacy, that Novartis filled or dispensed any prescriptions to Haywood, that the person who sent Haywood’s information to her place of employment was a pharmacist, intern, or other unlicensed person working within a pharmacy, or that Novartis or the Program performs acts consistent with the practice of pharmacy as described above. The allegation that Novartis is a "provider of pharmaceuticals" is not enough to bring it within the purview of Indiana Code 25–26–13–15 ; thus, Novartis did not owe Haywood a duty under that statute.
Indeed, as is pointed out by Novartis, it simply "researches, manufactures, markets, and sells pharmaceuticals," and "[u]nder federal regulations, it is prohibited from selling its prescription drugs directly to patients." In re Novartis Wage and Hour Litig. , 611 F.3d 141, 144 (2d Cir. 2010), abrogated by Christopher v. SmithKline Beecham Corp. , 567 U.S. 142, 132 S.Ct. 2156, 183 L.Ed.2d 153 (2012). Rather, "Novartis typically sells its products to wholesalers, which sell them to individual pharmacies." Id. See Ennenga v. Starns , 677 F.3d 766, 773–74 (7th Cir. 2012) ("A court may take judicial notice of facts that are (1) not subject to reasonable dispute and (2) either generally known within the territorial jurisdiction or capable of accurate and ready determination through sources whose accuracy cannot be questioned."); see also Henson v. CSC Credit Servs. , 29 F.3d 280, 284 (7th Cir. 1994) (finding public court documents judicially noticeable).
Haywood also claims that Novartis owed her a duty, under a negligence theory, for violating HIPPA standards. Novartis responds by pointing out that HIPPA provides no private cause of action and insists that Haywood’s alleged HIPPA claims may not be shoehorned into a negligence action. As this Court has noted previously:
‘When a civil tort action is premised upon violation of a duty imposed by statute, the initial question to be determined by the court is whether the statute in question confers a private right of action.’ Right Reason Publ'ns v. Silva , 691 N.E.2d 1347, 1352 (Ind. Ct. App. 1998) (quotation omitted); see also Dawson by Dawson v. Long , 546 N.E.2d 1265, 1268 (Ind. Ct. App. 1989) (holding in order for the violation of a statute or ordinance to be negligence per se , the trier of fact must first determine whether the statute is applicable).
Chappey v. Ineos USA LLC , No. 2:08-CV-271, 2009 WL 790194, at *2 (N.D. Ind. Mar. 23, 2009). Haywood acknowledges that there is no private right of action under HIPPA, but she argues that courts in Indiana and elsewhere have "permitted the use of HIPPA to establish a breach of the standard of care owed to a patient in a negligence action." She cites to Hinchy to support her position; however, the Hinchy court discussed the tort of professional malpractice that arose from Indiana law based on the unique "relationship between a pharmacist and her customer that gives rise to a duty on the pharmacist’s part" and Indiana Code 25–26–13–15(a) rather than based on a violation of HIPPA. See Hinchy , 21 N.E.3d at 109. Haywood also cites to Grable & Sons Metal Products, Inc. v. Darue Engr. & Mfg. , 545 U.S. 308, 318–19, 125 S.Ct. 2363, 162 L.Ed.2d 257 (2005), but Grable simply recognizes the general possibility that the breach of federal statutes may support negligence per se claims in state tort proceedings. It does not stand for the proposition that HIPPA itself is one of those statutes. Id. HIPPA does not provide a private right of action. See e.g. Carpenter v. Phillips , 419 Fed. Appx. 658, 659 (7th Cir. May 4, 2011) (collecting cases); Doe v. Board of Tr. of the Univ. of Ill. , 429 F.Supp.2d 930, 944 (N.D. Ill. 2006) ("Every court to have considered the issue ... has concluded that HIPAA does not authorize a private right of action"); see also Acara v. Banks , 470 F.3d 569, 570–72 (5th Cir. 2006) ; Dodd v. Jones , 623 F.3d 563, 569 (8th Cir. 2010) ; Seaton v. Mayberg , 610 F.3d 530, 533 (9th Cir. 2010) ; Wilkerson v. Shinseki , 606 F.3d 1256, 1267 n. 4 (10th Cir. 2010). As noted by the court in Doe , "HIPAA provides civil and criminal penalties for improper disclosures of medical information, but it does not create a private cause of action, leaving enforcement to the Department of Health and Human Services alone." Doe , 429 F.Supp.2d at 944. Indiana state law claims that rely on HIPPA as the basis for establishing negligence are not cognizable because utilizing them in such a way would circumvent HIPPA’s enforcement mechanisms. See e.g. Sheldon v. Kettering Health Network , 40 N.E.3d 661, 672 (Ohio App. 2d Dist. 2015) (stating that "in our view utilization of HIPAA as an ordinary negligence ‘standard of care’ is tantamount to authorizing a prohibited private right of action for violation of HIPAA itself"). Thus, HIPPA does not create a duty or provide a statutory basis for Haywood’s negligence claim in this case.
Haywood also cites to several out-of-state opinions to support her position. In one such case, the North Carolina court of appeals found that the plaintiff had not stated a cause of action under HIPPA, but it recognized that HIPPA was applicable to the extent that it "provid[ed] evidence of the duty of care owed by [the defendant] with regards to the privacy of plaintiff's medical records." Acosta v. Byrum , 180 N.C.App. 562, 638 S.E.2d 246, 253 (2006). In another, a district court acknowledged that HIPPA does not confer a private right of action but found that HIPPA could be used to establish a negligence per se claim under Missouri law. I.S. v. Wash. Univ. , No. 4:11CV235SNLJ, 2011 WL 2433585, at *2 (E.D. Mo. June 14, 2011). However, these cases are not binding on this Court, and the Court finds their reasoning unpersuasive in light of the weight of authority to the contrary and the lack of any Indiana decision allowing HIPPA to be used as the basis for a negligence claim such as this.
Finally, Haywood cites to no Indiana case, nor can the Court find any, that would suggest that a pharmaceutical corporation has a general duty to safeguard an individual’s personal information from disclosure to her employer. In cases where a duty has not been established, Indiana courts look to the relationship between the parties, the reasonable foreseeability of harm, and public policy concerns to determine whether a duty should be imposed at common law. See Neal v. IAB Fin. Bank , 68 N.E.3d 1114, 1117–18 (Ind. Ct. App. 2017) (citations omitted); Williams v. Cingular Wireless , 809 N.E.2d 473, 476 (Ind. Ct. App. 2004). Here, the relationship between Haywood and Novartis is described in the amended complaint in terms of a potential customer and a co-pay assistance company. Haywood alleges that she was in the process of applying for the Program when her information was disclosed to her employer. She does not allege that she was in a contractual relationship with Novartis or that she had even begun receiving or relying on the benefits provided by the Program. Although she describes Novartis as a "provider of pharmaceuticals," she does not allege, nor is it reasonable to infer, that Novartis was a pharmacist or pharmacy that directly provided her with pharmaceutical drugs, medical care, treatment, counseling, or the like. While it is well-settled that the law recognizes a duty-bound relationship between a pharmacist and a customer, see e.g. Forbes v. Walgreen Co. , 566 N.E.2d 90, 91 (Ind. Ct. App. 1991), that duty is premised upon a unique patient oriented health care connection. As noted by the Supreme Court of Indiana, "pharmacists possess expertise regarding the dispensing of prescription drugs," and consumers rely upon that expertise during direct interactions with pharmacists regarding their prescription drug needs. Hooks SuperX, Inc. v. McLaughlin , 642 N.E.2d 514, 517 (Ind. 1994). That special relationship has been codified by the Indiana legislature, as described in detail above, to include the practice of pharmacy more broadly. See I.C. 25–26–13–1 through 25–26–13–33. However, the relationship between a pharmaceutical corporation and a person seeking assistance with their co-payments is not similarly close to justify imposing a duty, mainly because the direct contact, expertise, reliance, and counseling aspects of the relationship are wholly lacking.
Because jurisdiction in this case is premised on diversity, the Court must apply the substantive law of Indiana and attempt to predict how the Indiana Supreme Court would decide a novel question of state law. "Where the state supreme court has not ruled on an issue, decisions of the state appellate courts control, unless there are persuasive indications that the state supreme court would decide the issue differently." See Lexington Ins. Co. v. Rugg & Knopp, Inc. , 165 F.3d 1087, 1090 (7th Cir. 1999).
As to foreseeability, courts must look to the broad type of plaintiff and broad type of harm at issue and focus on "the general class of persons of which the plaintiff was a member and whether the harm suffered was of a kind normally to be expected—without addressing the specific facts of the occurrence." Neal , 68 N.E.3d at 1121 (citation omitted). However:
because almost any outcome is possible and can be foreseen, the mere fact that a particular outcome is sufficiently likely is not enough to give rise to a duty. Instead, for purposes of determining whether an act is foreseeable in the context of duty we assess whether there is some probability or likelihood of harm that is serious enough to induce a reasonable person to take precautions to avoid it.
Goodwin v. Yeakle’s Sports B. and Grill, Inc. , 62 N.E.3d 384, 392 (Ind. 2016) (internal quotation marks and citations omitted). Here, the broad type of plaintiff is a consumer seeking to enroll in a program administered by a company, and the broad type of harm is the damage suffered from the disclosure of the prospective enrollee’s personal and protected health information to that person’s place of employment. Considering the fact that much of an employee’s personal information is likely already available to his or her employer, and the fact that a reasonable employer and/or co-worker would be unlikely to take negative action against an employee based on the receipt of protected health information, the likelihood of harm that is serious enough to be legally actionable is slight. See Pisciotta v. Old Nat. Bancorp , 499 F.3d 629, 636–40 (7th Cir. 2007) (finding that exposure of personal data is not a compensable injury in a negligence action under Indiana law).
Moreover, while not relevant to the analysis of foreseeability, the Court notes that Haywood’s amended complaint fails to adequately allege an injury beyond the disclosure itself. While she states generally that she "suffered damages to her employment, emotional distress, and physical health," she has not provided any details regarding such injuries and has not responded to Novartis' lack of damages argument in any meaningful way.
--------
Turing to public policy concerns, the Indiana Court of Appeals has noted that, "[s]imply because an action may have some degree of foreseeability does not make it sound public policy to impose a duty." Williams v. Cingular Wireless , 809 N.E.2d 473, 478 (Ind. Ct. App. 2004). "Various factors play into this policy consideration, including convenience of administration, capacity of the parties to bear the loss, a policy of preventing future injuries, and the moral blame attached to the wrongdoer." Id. (citing Ousley v. Bd. of Comm'rs of Fulton Cnty. , 734 N.E.2d 290, 294 (Ind. Ct. App. 2000) ). While it seems likely that a pharmaceutical company could adequately bear the loss in an action such as this and that personal and protected health information should ideally be protected, other elements weigh against imposing a duty. Assigning significant moral blame to a pharmaceutical corporation in this situation is disproportionate to the actual acts performed (i.e. negligently disclosing information to an employer during a routine application process). The reality is that, for most people, the amount of sensitive personal information readily available to third parties with whom no close relationship exists is significant due to the nature of today’s digital society. Imposing a duty to safeguard information from all possible disclosures upon any party or entity who happens to be in possession of the personal information of another would expand liability in a way that has the potential to stifle the collection of data and the routine processing of information. As noted by Novartis, courts have construed Indiana laws applicable to the disclosure of private information narrowly. For example, the Seventh Circuit Court of Appeals analyzed the Indiana data disclosure statute and found that there is no private right of action against a database owner for negligently disclosing information; rather, the database owner is simply obligated to advise potentially affected customers of a breach, and enforcement is handled by the Indiana Attorney General. Pisciotta , 499 F.3d at 636–37. And, as discussed in detail above, while duties of non-disclosure have been imposed on those with specialized expertise (i.e. pharmacists and physicians), the nature of the specialized relationship is the driving force behind the imposition of that duty rather than the act of disclosure itself.
After balancing the relevant factors, the Court concludes that the general, non-specialized nature of the relationship between the parties and the fact that actionable harm is not reasonably foreseeable from the type of disclosure at issue outweighs the public policy considerations suggesting that potential customers may be entitled to protection of their personal data during an application process. Ultimately, "[w]hen given a choice between an interpretation of [state] law which reasonably restricts liability, and one which greatly expands liability, we should choose the narrower and more reasonable path (at least until the [state] Supreme Court tells us differently)." Pisciotta , 499 F.3d at 636 (7th Cir. 2007) (quoting Todd v. Societe Bic, S.A. , 21 F.3d 1402, 1412 (7th Cir. 1994) ); see also Insolia v. Philip Morris Inc. , 216 F.3d 596, 607 (7th Cir. 2000) ("Federal courts are loathe to fiddle around with state law. Though district courts may try to determine how the state courts would rule on an unclear area of state law, district courts are encouraged to dismiss actions based on novel state law claims."). Therefore, the Court concludes that Novartis did not owe Haywood a duty of care in this case.
Because Haywood has failed to allege a viable negligence claim, her claims for negligent training and supervision and punitive damages must also fail. See Hinchy , 21 N.E.3d at 109 (must be underlying liability of acting party for negligent training and supervision claim to succeed); Wohlwend v. Edwards , 796 N.E.2d 781, 784 (Ind. Ct. App. 2003) (punitive damages proper only when defendant acted with malice, fraud, gross negligence, or oppressiveness which was not the result of a mistake of fact or law, mere negligence, or other human failing).
CONCLUSION
For the aforementioned reasons, the motion to dismiss filed by Novartis (DE # 35) is GRANTED . The clerk is DIRECTED to close this case.