Washburn v. Rite Aid Corp.

695 A.2d 495 (1997)

Christine WASHBURN
v.
RITE AID CORP., d.b.a. Rite Aid Pharmacies.

No. 95-681-Appeal.

Supreme Court of Rhode Island.

June 13, 1997.

Paul Giacobbe, Warwick, for Plaintiff.

Kevin S. Cotter, Providence, for Defendant.

Before WEISBERGER, C.J., and LEDERBERG, BOURCIER and FLANDERS, JJ.

OPINION

FLANDERS, Justice.

This lawsuit challenges a pharmacy's disclosure of a woman's prescription-drug records to her estranged husband's attorney without first notifying her or obtaining her consent. In 1992 the plaintiff, Christine Washburn, was pregnant and in the throes of a bitterly contested divorce. Her husband, Robert Washburn (the husband), through his attorney, Terrence Higgins (Higgins), subpoenaed the defendant, Rite Aid Corp., d.b.a. Rite Aid Pharmacies (Rite Aid), to bring her prescription-drug records for the last five years to a Family Court hearing scheduled for May 5, 1992. Although he caused Rite Aid to be duly served with the subpoena, Higgins neither notified the plaintiff or her attorney that he was subpoenaing these records from Rite Aid nor served either of them with a copy of the subpoena. After receiving the subpoena, Rite Aid also did not notify the plaintiff, and it neither sought nor obtained her consent to disclose any of the confidential information requested.

Moreover, rather than bring plaintiff's prescription-drug records to court as the subpoena commanded, Rite Aid decided to follow its usual custom when it received subpoenas of this sort: it simply mailed the responsive records directly to Higgins, figuring that this action would probably obviate any need for it to have one of its employees actually attend the Family Court hearing and testify about the records. The plaintiff claims she first learned that Rite Aid had disclosed her prescription-drug records in this fashion when, before the scheduled court hearing, her husband allegedly threatened her with further disclosure of what the records revealed about her drug-taking habits in an attempt to gain an improper advantage over her in their pending divorce case.

The plaintiff eventually sued Rite Aid, claiming, inter alia, that by disclosing her prescription-drug records to her husband's attorney without complying with the subpoena, Rite Aid violated the Confidentiality of Health Care Information Act (Confidentiality Act), G.L.1956 chapter 37.3 of title 5, and her statutory privacy rights, see G.L.1956 § 9-1-28.1 (the Privacy Act).^[1] In due course both sides moved for summary judgment. Relying in part on Bartlett v. Danti, 503 A.2d 515 (R.I.1986), and State v. Almonte, 644 A.2d 295 (R.I.1994), a Superior Court justice granted summary judgment in favor of Rite Aid on all of plaintiff's claims. The plaintiff's appeal followed.

Because Rite Aid failed to comply with its legal obligations in responding to the subpoena and instead improperly disclosed plaintiff's confidential health-care information^[2] to an unauthorized third party (the attorney for plaintiff's estranged husband), we believe that Rite Aid thereby violated her confidentiality and privacy rights with respect to the information in these medical prescription records. Accordingly, we reverse the Superior Court's award of summary judgment to Rite Aid on plaintiff's statutory invasion-of-confidentiality (count 2) and privacy claims (count 4), reverse the denial of plaintiff's motion for summary judgment on these same claims, and remand for a trial to determine damages.

Facts

In the middle of their rancorous divorce proceedings, plaintiff's husband filed a motion in Family Court, seeking to restrain her from ingesting prescription drugs during her pregnancy without first obtaining the court's consent. He also sought a court order to prevent her from moving their two children out of Rhode Island. To accomplish this objective, Higgins scheduled a May 5, 1992 hearing before the Family Court, prepared a subpoena duces tecum, and caused it to be duly served on the Rite Aid pharmacy where plaintiff had her prescriptions filled. The subpoena requested Rite Aid's keeper of records to bring to court all prescription-drug records for both plaintiff and her husband for a five-year period (from June 1987 through June 1992). As previously stated, plaintiff did not receive a copy of this subpoena from her husband or Rite Aid nor did she otherwise obtain notice that her husband had subpoenaed this information.

Following Rite Aid's usual practice and custom, the local pharmacy referred this subpoena, together with whatever responsive records it had, to Rite Aid's corporate office. A corporate officer/attorney supervised the gathering and review of the responsive records. However, instead of responding to the subpoena as the legal process directed and as required by statute,^[3] Rite Aid simply mailed plaintiff's prescription-drug records directly to Higgins together with an authenticating affidavit. (It had no such records for her husband.)

Analysis

A. The Confidentiality Act Claims

The plaintiff contends that by failing to comply with the terms of the subpoena (that is, by not having the keeper of the subpoenaed records bring the documents to court as directed by the subpoena and as required by G.L. § 9-17-5), Rite Aid violated the Confidentiality Act when it simply mailed her confidential health-care information directly to Higgins. We agree.

It is true that in Bartlett we ruled that a particular section of the Confidentiality Act (§ 5-37.3-6) was unconstitutional because it purported to preclude the production and use of confidential medical records in connection with judicial proceedings. Bartlett, 503 A.2d at 517; see also Almonte, 644 A.2d at 298-99 (finding a similar provision enacted in response to Bartlett to be unconstitutional). However, neither Bartlett nor Almonte eradicated the underlying privilege created by such statutes. This privilege generally protects a person's confidential health-care records from being disclosed to unauthorized third parties unless the disclosure falls within one of the statutory exceptions. Although these records must be subject to compulsory legal process to avoid the separation-of-powers problem discussed in Bartlett and Almonte, the privilege does not evaporate merely because confidential health-care records can be or have been duly subpoenaed in connection with a court proceeding. On the contrary, the privilege continues to exist, and the documents that are privileged still cannot be disclosed (without the privilege holder's consent) except by strictly complying with the requirements of any compulsory legal process that may be issued with respect to such documents — and then only according to the procedures applicable to that process.

Here, despite receiving a lawful subpoena, Rite Aid did not disclose the records pursuant to such compulsory legal process — that is, it did not bring the records to court as the subpoena commanded.^[4] Had it done so, it could only then disclose them when and in what manner the court may direct, and even then it would have been subject to whatever limitations concerning disclosure the court may decide to impose. Instead, without legal warrant or other authorization, Rite Aid unilaterally disclosed plaintiff's confidential health-care records to an unauthorized third party (the attorney for the husband who had subpoenaed them) without first obtaining the court's permission or plaintiff's consent. Certainly nothing on the face of the subpoena allowed it to respond in this fashion, and no other law or rule of court countenanced such a disclosure of privileged documents. And because the subpoena did not indicate that it had been issued with any notice to plaintiff or with any court knowledge or authorization for Rite Aid to disclose the subpoenaed records to the attorney requesting them, the privilege created by the Confidentiality Act prevented Rite Aid from disclosing the records in this manner.

In sum, while confidential health-care information about a person can be subject to compulsory legal process without first obtaining that person's consent, entities like Rite Aid that are subpoenaed to bring these records to a judicial proceeding are not thereby authorized to disclose them (or the confidential information contained therein) to any party or person other than the court (except as the court may thereafter order or the person holding the privilege may thereafter allow). Indeed, only after the privilege holder has been notified of the subpoena and has had the opportunity to review the information in the subpoenaed records, to object to the requested disclosure, and, if needed, to request possible protective limitations from the court on the nature and the extent of the requested disclosure and use of these records should such privileged information be turned over to the subpoenaing party.^[5]

However, we agree with the motion justice that Rite Aid is not a "health care provider" under § 5-37.3-3(4). As a pharmacy Rite Aid is not licensed to perform "health care services" as defined by the Confidentiality Act, that is, "acts of diagnosis, treatment, medical evaluation or counselling or other such acts as may be permissible under the health care licensing statutes of this state." Section 5-37.3-3(5). The dispensing of medicines pursuant to prescriptions ordered by licensed health-care providers does not fall within this definition. Nonetheless, Rite Aid is a "third party" within the meaning of the Confidentiality Act because it is "a person other than the patient to whom the confidential health care information relates and other than a health care provider." Section 5-37.3-3(14). Indeed, under § 5-37.3-4(c), third parties like Rite Aid that receive and retain a person's confidential health-care information must establish security procedures to prevent unauthorized disclosure, including limiting authorized access to this information.

Pursuant to § 5-37.3-9, "[a]ny one who violates the provisions of [the Confidentiality Act] may be held liable for actual and exemplary damages." Because Rite Aid violated the Confidentiality Act by disclosing plaintiff's confidential health-care information to an unauthorized person in a manner not allowed by law, it is liable to her for any actual damages she sustained as a result of this disclosure and, if the requisite malice-amounting-to-criminality circumstances were present, see, e.g., Palmisano v. Toth, 624 A.2d 314, 318 (R.I.1993), for any exemplary damages that the factfinder deems appropriate.^[6] In addition, it is also liable, at the discretion of the court, to pay for plaintiff's attorney's fees in connection with her Confidentiality Act claim, because she is a successful party in this action. See § 5-37.3-9(d).

Finally, because Rite Aid is not a qualified "health care facility," it was not entitled to take advantage of the provisions of G.L.1956 § 9-19-39,^[7] which allow a qualified health-care facility to respond to a subpoena for health-care records by certified mail.^[8] A health-care facility is "any institutional health service provider, facility or institution, place, building, agency, or portion thereof * * * used, operated, or engaged in providing health care services." General Laws 1956 § 23-17-2(5). A pharmacy does not fall within this definition. Thus, having received a subpoena to bring confidential health-care records to Family Court, Rite Aid was "obliged to attend accordingly," § 9-17-5, until excused by the court or until and unless the subpoena was withdrawn. In any event it should not have disclosed plaintiff's confidential health-care information without plaintiff's consent or the court's direction to do so. See G.L.1956 § 5-37.3-2 (the purpose of the Confidentiality Act "is to establish safeguards for maintaining the integrity of confidential health care information that relates to an individual").

B. The Privacy Act Claim

We also believe that plaintiff stated a right-to-privacy claim under G.L.1956 § 9-1-28.1(a).^[9] By disclosing plaintiff's confidential health-care records to an unauthorized person representing an adverse party in pending litigation, Rite Aid violated her "right to be secure from unreasonable intrusion," § 9-1-28.1(a)(1), and her "right to be secure from unreasonable publicity given to one's private life," § 9-1-28.1(a)(3). By unilaterally disclosing this information to the attorney who subpoenaed the records, Rite Aid committed "an invasion of something that is entitled to be private or would be expected to be private," § 9-1-28.1(a)(1)(A)(i), to wit: plaintiff's prescription-drug records, which she rightly expected would be kept confidential by Rite Aid pursuant to the Confidentiality Act. "Such invasion was or is offensive or objectionable to a reasonable [person]." See § 9-1-28.1(a)(1)(A)(ii). Further, when Rite Aid made its out-of-court disclosure of this information to the attorney for her estranged husband, there was "some publication of a private fact * * * which would be offensive or objectionable to a reasonable [person] of ordinary sensibilities." Section 9-1-28.1(a)(3)(A)(i) and (ii).

Although plaintiff's prescription-drug history may well have been subject to discovery in her divorce litigation and ultimate disclosure pursuant to compulsory legal process, Rite Aid's mere receipt of a subpoena did not give it carte blanche to publish the information willy-nilly to third parties like Higgins who have subpoenaed the records to court. Rather, to take advantage of the compulsory-legal-process exception to the privileged, confidential status of these records, Rite Aid was obliged to follow the directions on the subpoena and the law for complying with that legal process to the letter. The reason this is so is that as their confidential status indicates, plaintiff's prescription-drug records contain information that is presumptively private and confidential. They may also contain much information that is extraneous or irrelevant to whatever may be legitimately at issue in the divorce case. These records could also contain information that might be extremely embarrassing or damaging to plaintiff if it were to be disclosed to someone like her estranged husband or his attorney. They would then be in a position to use this information against her (for example, by further disclosure to other unauthorized parties or just by using it for improper leverage in any court case or settlement negotiations). Indeed, the Confidentiality Act presumes that each and every one of these records is confidential and should not be disclosed except pursuant to valid legal process.

Moreover, mere receipt of a valid subpoena does not negate this privilege; much less does it justify publication of the records to the person subpoenaing them or to anyone else. This is where Rite Aid violated the plaintiff's statutory rights to privacy. To obtain the benefits of the protection afforded by compulsory legal process, it was required to bring such records to court, § 9-17-5, to request protective relief from the court, or to obtain the consent of the plaintiff or her attorney to the disclosure it proposed to make to the husband's attorney. But it failed to do so.

Conclusion

We sustain the plaintiff's appeal with respect to the summary judgment that was granted against her statutory invasion-of-privacy claims under the Confidentiality Act and under the Privacy Act, but we affirm the trial justice's grant of summary judgment with respect to those claims that purport to state a violation of § 9-19-39 and with respect to all other counts contained in her complaint.^[10] The papers in this case shall be remanded to the Superior Court for further proceedings consistent with this opinion.

GOLDBERG, J., did not participate.

APPENDIX

General Laws 1956 § 5-37.3-6.1 provides:

"Court proceedings — Confidential health care information. — (a) Except as otherwise provided in § 5-37.3-6, a health care provider or custodian of health care information may disclose confidential health care information in a judicial proceeding if the disclosure is pursuant to a subpoena and the provider or custodian is provided written certification by the party issuing the subpoena that:

(1) A copy of the subpoena has been served by the party on the individual whose records are being sought on or before the date the subpoena was served, together with a notice of the individual's right to challenge the subpoena; or, if the individual cannot be located within this jurisdiction, that an affidavit of that fact be provided; and

(2) Twenty (20) days have passed from the date of service on the individual and within that time period the individual has not initiated a challenge; or

(3) Disclosure is ordered by a court after challenge.

"(b) Within twenty (20) days after the date of service of a subpoena, an individual or his/her authorized representative may file a motion to quash the subpoena in the court in which the case is pending or, if no case is pending, in superior court. A copy of the motion to quash shall be served by the movant upon the party issuing the subpoena in accordance with the rules of civil procedure.

"(c) The party issuing the subpoena may file with the court such papers, including affidavits and other sworn documents, as sustain the validity of the subpoena. The movant may file with the court reply papers in response to the issuing party's filing. The court, upon receipt of these papers may proceed in camera. The court may conduct such proceedings as it deems appropriate to rule on the motion, but shall endeavor to expedite its determination.

"(d) The court shall grant a motion to quash unless the requesting party can demonstrate that there is reasonable ground to believe the information being sought is relevant to the proceedings, and the need for the information clearly outweighs the privacy interest of the individual.

"(e) In determining whether the need for information clearly outweighs the privacy of the individual, the court shall consider:

(1) The particular purpose for which the information was collected;

(2) The individual's reasonable expectation of privacy in the information;

(3) The degree to which disclosure of the information would embarrass, injure, or invade the privacy of the individual;

(4) The effect of the disclosure on the individual's future health care;

(5) The importance of the information to the lawsuit or proceeding; and

(6) Whether the information is available from another source, including rule 35 of the rules of civil procedure.

"(f) If the court determines that a subpoena should issue, the information shall not be disclosed for any other purpose except as otherwise authorized by this chapter.

"(g) Nothing contained herein shall be construed to bar a health care provider or custodian of health care information from filing a motion to quash a subpoena for such information in accordance with the rules of civil procedure."

NOTES

[1] The plaintiff alleged eight counts, which distilled to their essence are as follows: Rite Aid, as a "health care provider," G.L.1956 § 5-37.3-3(4), violated the Confidentiality Act by releasing plaintiff's confidential health-care information to a third party without her authorization (count 1); Rite Aid, as a "[t]hird part[y] receiving and retaining a patient's confidential health care information," G.L.1956 § 5-37.3-4(c), failed to limit authorized access to it and "negligently and in violation of" the Confidentiality Act released it (count 2); Rite Aid's negligent release of plaintiff's confidential medical information violated her right to be free from unreasonable intrusion (count 3); Rite Aid violated plaintiff's statutory right to privacy, G.L.1956 § 9-1-28.1 (count 4); Rite Aid's failure to comply with G.L.1956 § 9-19-39 in responding to the subpoena "breach[ed] their legal duty of due care to the plaintiff" (count 5); Rite Aid breached an implied contract with plaintiff to safeguard her private medical information (count 6); Rite Aid, as a "health care provider," "negligently failed to use due care to limit disclosure of the plaintiff's confidential health care information as required" by the Confidentiality Act (count 7); and, Rite Aid, as a "health care provider," "negligently failed to use due care to limit authorized access to the plaintiff's confidential health care information" (count 8).

[2] On appeal, the parties do not dispute whether the prescription-drug records at issue contain confidential health-care information, § 5-37.3-3(3)(b), protected by the Confidentiality Act.

[3] General Laws 1956 § 9-17-5 states that

"[e]very witness who shall be duly served with a subpoena in behalf of any party to a suit or proceeding, civil or criminal, and shall have his lawful fees tendered to him for his travel from his place of abode to the place at which he shall be summoned to attend, and for one (1) day's attendance, shall be obliged to attend accordingly."

[4] According to its Latin provenance, the word "subpoena" literally means "under penalty." See Cassell's Latin Dictionary 422, 545 (1909).

[5] Although not applicable to this case, the Confidentiality Act was recently amended by P.L.1996, ch. 248, § 3, and P.L.1996, ch. 266, § 3, to establish a procedure for the disclosure of confidential health-care information in connection with judicial proceedings. G.L.1956 § 5-37.3-6.1 (attached as an appendix to this opinion).

[6] We note that there do not appear to be any factual circumstances present that would make this case an appropriate one for exemplary damages.

[7] General Laws 1956 § 9-19-39(2)(a) provides that

"[w]hen a subpoena duces tecum is served upon any employee of any health care facility licensed under the laws of this state, requiring the production of any such medical charts or records at any action or proceeding consistent with the requirements of § 5-37.3-6, it shall be deemed a sufficient response to such subpoena if the employee of the health care facility charged with the responsibility of being custodian of the original thereof promptly notifies the attorney for the party causing service of the subpoena, of the health care facility's election to proceed under the provisions of this section and of the estimated actual and reasonable expenses of reproducing such charts or records. Upon such notification, the attorney causing the service of the subpoena shall notify all other attorneys of record or other parties if they are not represented by attorneys of the health care facility's election. Following such election, the employee of the health care facility charged with the responsibility of being custodian of the original charts or records specified in the subpoena shall hold the originals available at the health care facility, and upon payment of their reasonable reproduction expense not to exceed the sum of twenty-five dollars ($25.00) by the party causing service of the subpoena, or by any other party, shall promptly deliver, by certified mail or with thirty (30) minutes advance notice by personal delivery, legible and durable copies, certified by said health care facility employee, of all medical charts or records specified in such subpoena to the person specified in the subpoena."

[8] Even if Rite Aid had been a qualified health-care facility, it failed to satisfy the requirements of § 9-19-39 in the way it responded to this subpoena because inter alia it did not separately enclose the records it mailed to Higgins in a sealed envelope. See § 9-19-39(2)(b).

[9] General Laws 1956 § 9-1-28.1(a) declares in part that

"[i]t is the policy of this state that every person in this state shall have a right to privacy which shall be defined to include any of the following rights individually:

(1) The right to be secure from unreasonable intrusion upon one's physical solitude or seclusion;

(A) In order to recover for violation of this right, it must be established that:

(i) It was an invasion of something that is entitled to be private or would be expected to be private;

(ii) Such invasion was or is offensive or objectionable to a reasonable man; although,

(B) The person who discloses such information need not benefit from such disclosure.

* * * * * *

(3) The right to be secure from unreasonable publicity given to one's private life;

(A) In order to recover for violation of this right, it must be established that:

(i) There has been some publication of a private fact;

(ii) The fact which has been made public must be one which would be offensive or objectionable to a reasonable man of ordinary sensibilities;

(B) The fact which has been disclosed need not be of any benefit to the discloser of such fact."

[10] Contrary to the plaintiff's position, there is no implied contractual obligation on Rite Aid's part to hold the prescription-drug information confidential. Its obligation to do so is statutory; it arises neither from the common law nor from contract. And there is no common-law right of privacy in Rhode Island. See Clift v. Narragansett Television L.P., 688 A.2d 805, 814 (R.I.1996).