Judge Mary McLaughlin of the Eastern District of Pennsylvania recently dismissed a class action complaint brought against CVS Pharmacy and CVS Caremark for selling information provided by prescription drug purchasers.  Notably, in its decision in Steinberg v. CVS Caremark Corp., the court found that information on a customer’s prescription drug and medical history “carries with it no compensable value at the individual level.”  

The plaintiffs, on behalf of a class of Pennsylvania prescription drug purchasers, brought claims under the Pennsylvania Unfair Trade Practices and Consumer Protection Law and for unjust enrichment and invasion of privacy.  The UTPCPL claim was based on defendants’ representations that they did not share customer information in violation of federal or state law.  Plaintiffs alleged that the defendants’ sale of information violated HIPAA, even though they conceded that the information the defendants sold was “de-identified.”  The information consisted of medical history, prescription drugs dispensed, dates of prescriptions, diagnoses, and physician names, but not of patient names, birth dates, or Social Security numbers. 

Plaintiffs argued, however, that the information shared could be “re-identified,” or associated with a specific person in violation of HIPAA.  The court found plaintiffs’ generalized warning of re-identification insufficient to show a HIPAA violation without demonstrating how the threat applied in the circumstances of the case: “The Court was referred to the name of an article in an academic journal discussing risks associated with re-identification of data, but counsel did not explain how or whether the theory applied to this case.” 

In the end, the court dismissed all three claims, determining that “the defendants neither sold information entitled to legal protection nor made any misrepresentations on which the plaintiffs justifiably relied . . . .”  Moreover, “the information the defendants sold to third parties does not carry a compensable value to the plaintiffs or constitute an invasion of privacy.”  The court also dismissed the claims with prejudice, finding that the plaintiffs had not presented a viable alternate theory of recovery.