Shepherd v. Costco , 246 Ariz. 470 ( 2019 )


Menu:
  •                                IN THE
    ARIZONA COURT OF APPEALS
    DIVISION ONE
    GREG SHEPHERD, Plaintiff/Appellant,
    v.
    COSTCO WHOLESALE CORPORATION, Defendant/Appellee.
    No. 1 CA-CV 18-0072
    FILED 4-30-2019
    Appeal from the Superior Court in Maricopa County
    No. CV2017-052615
    The Honorable Aimee L. Anderson, Judge Retired
    AFFIRMED IN PART, REVERSED AND REMANDED IN PART
    COUNSEL
    Joshua Carden Law Firm PC, Scottsdale
    By Joshua W. Carden
    Counsel for Plaintiff/Appellant
    Cavanagh Law Firm, Phoenix
    By Karen C. Stafford, Cassandra V. Meyer
    Counsel for Defendant/Appellee
    SHEPHERD v. COSTCO
    Opinion of the Court
    OPINION
    Presiding Judge Jennifer M. Perkins delivered the opinion of the Court, in
    which Judge Lawrence F. Winthrop joined. Judge Jon W. Thompson
    dissented in part and concurred in part.
    P E R K I N S, Judge:
    ¶1            Greg Shepherd challenges the dismissal of his complaint
    against Costco Wholesale Corporation (“Costco”) alleging numerous tort
    claims stemming from Costco’s alleged failure to cancel an unwanted
    prescription and disclosure of the prescription information to his ex-wife.
    We reverse and remand for further proceedings on Shepherd’s negligence
    and punitive damages claims but affirm the dismissal of his other claims.
    Further, we hold that HIPAA’s requirements may inform the standard of
    care in a negligence action for wrongful disclosure of healthcare
    information.
    FACTUAL AND PROCEDURAL BACKGROUND
    ¶2           Because Shepherd appeals from the grant of a motion to
    dismiss, we state the facts alleged in his operative complaint and must
    assume they are true for purposes of this appeal. Southwest Non-Profit
    Housing Corp. v. Nowak, 
    234 Ariz. 387
    , 389, ¶ 4 (App. 2014).
    ¶3              Shepherd saw his physician in January 2016 for a check-up
    and a refill of his usual prescription. During that visit, his physician offered
    him an erectile dysfunction (“E.D.”) medication sample, which he accepted.
    Shortly thereafter, Costco told Shepherd that his regular prescription and a
    full prescription of the E.D. medication were ready for pickup. Shepherd
    told Costco he did not want the E.D. prescription, and Costco
    acknowledged his cancellation request.
    ¶4            Approximately one month later, Shepherd called Costco to
    check on another refill of his regular prescription and was told it and a full
    prescription of the E.D. medication were ready for pickup. Shepherd again
    told Costco he did not want the E.D. medication.
    ¶5           Shepherd called Costco again the next day to authorize his ex-
    wife, with whom he was exploring possible reconciliation, to pick up his
    regular prescription. Costco gave her the regular prescription and the E.D.
    2
    SHEPHERD v. COSTCO
    Opinion of the Court
    medication. She did not accept or pay for the E.D. medication but joked
    with a Costco employee about Shepherd “not picking it up yet” and told
    Shepherd’s children and some friends about the medication. She also
    stopped reconciliation efforts with Shepherd.
    ¶6             Shepherd complained to Costco headquarters and received a
    written response that allegedly acknowledged the disclosure of medical
    information to his ex-wife violated both the Health Insurance Portability
    and Accountability Act of 1996 (“HIPAA”) and Costco’s privacy policy.
    Shepherd then sued Costco alleging negligence, breach of fiduciary duty,
    fraud, negligent misrepresentation, intentional infliction of emotional
    distress, intrusion upon seclusion, and public disclosure of private facts
    based on Costco’s “public disclosure of an embarrassing medication that
    [he] twice rejected.”
    ¶7            Costco moved to dismiss the complaint. The trial court
    granted the motion, finding (1) Costco was entitled to immunity from suit
    under Arizona Revised Statutes (“A.R.S.”) section 12-2296, (2) HIPAA
    preempted the claims, and (3) Shepherd failed to allege sufficient facts to
    support his claims. Shepherd now appeals.
    DISCUSSION
    ¶8             We review the dismissal of a complaint pursuant to Arizona
    Rule of Civil Procedure 12(b)(6) de novo. Coleman v. City of Mesa, 
    230 Ariz. 352
    , 355, ¶ 7 (2012). We are required to accept as true all well-pled facts and
    give Shepherd the benefit of all reasonable inferences arising therefrom.
    Botma v. Huser, 
    202 Ariz. 14
    , 15, ¶ 2 (App. 2002). We will affirm the dismissal
    only if Shepherd would not have been entitled to relief under any facts
    susceptible of proof in his complaint. 
    Coleman, 230 Ariz. at 356
    , ¶ 8.
    I.     Negligence
    ¶9             A plaintiff must prove four elements to establish a negligence
    claim: (1) a duty requiring the defendant to conform to a certain standard
    of care, (2) the defendant’s breach of that standard, (3) a causal connection
    between the defendant’s conduct and the resulting injury, and (4) actual
    damages. Quiroz v. ALCOA Inc., 
    243 Ariz. 560
    , 563–64, ¶ 7 (2018).
    ¶10         In his complaint, Shepherd alleged Costco’s duty of care arose
    from “the regulations governing pharmacy conduct, HIPAA laws, and
    Costco’s own privacy policy.” On appeal, he again contends Costco
    violated HIPAA and A.R.S. §§ 12-2291 to -2297.
    3
    SHEPHERD v. COSTCO
    Opinion of the Court
    A.     Statutory Authorization
    ¶11            Under Arizona law, “all medical records and payment
    records, and the information contained in medical records and payment
    records, are privileged and confidential.” A.R.S. § 12-2292(A). But this
    information may be disclosed “without the written authorization of the
    patient or the patient’s health care decision maker as otherwise authorized
    by state or federal law, including [HIPAA] privacy standards.” A.R.S. § 12-
    2294(C). HIPAA, in relevant part, allows covered entities such as Costco to
    “disclose to . . . any . . . person identified by the individual, the protected
    health information directly relevant to such person’s involvement with the
    individual’s health care.” 45 C.F.R. § 164.510(b)(1)(i).
    ¶12            Here, Costco disclosed the E.D. prescription to Shepherd’s ex-
    wife, whom he had expressly authorized to receive prescription
    information. Shepherd contends HIPAA only authorizes the disclosure of
    “filled prescriptions,” but even assuming Shepherd’s contention is correct,
    the E.D. prescription was filled, albeit erroneously.
    ¶13           Shepherd also contends he objected to such disclosure when
    he requested that the E.D. prescription be cancelled but he bases this
    contention on a HIPAA provision that applies only to disclosures that take
    place in the presence of the patient. 45 C.F.R. § 164.510(b)(2)(ii). The portion
    of the relevant regulation addressing disclosures made when the individual
    is not present grants covered entities such as Costco the ability to use
    professional judgment to reasonably infer the individual’s best interest in
    allowing another to act on his behalf to pick up filled prescriptions. 45
    C.F.R. § 164.510(b)(3). Costco did not need to exercise such judgment here
    because Shepherd authorized his ex-wife to receive prescription
    information. Shepherd thus did not allege a violation of either HIPAA or
    related Arizona statutes.
    B.     Duty
    ¶14           Although it did not arise under HIPAA, the parties
    nonetheless agree that Costco owed Shepherd a duty of care. That duty
    includes, at a minimum, the obligation to act as a reasonably prudent
    pharmacy would under the circumstances. See Lasley v. Shrake’s Country
    Club Pharmacy, Inc., 
    179 Ariz. 583
    , 586 (App. 1994). Shepherd alleged that
    Costco “represented . . . that his instructions to cancel his prescription had
    been acknowledged and would be acted upon,” that it “fail[ed] to cancel
    the [E.D.] prescription” despite multiple requests and opportunities to do
    so, and that one of its employees “joked” with his ex-wife about the E.D.
    prescription. These allegations are sufficient to withstand dismissal on the
    4
    SHEPHERD v. COSTCO
    Opinion of the Court
    pleadings under Rule 12(b)(6). See, e.g., Verduzco v. American Valet, 
    240 Ariz. 221
    , 225, ¶ 9 (App. 2016) (quoting Ariz. R. Civ. P. 8(a)(2)) (under Arizona’s
    notice pleading rules, “[a] short and plain statement of the claim showing
    that the pleader is entitled to relief” is sufficient to overcome a Rule 12(b)(6)
    motion to dismiss). The trial court thus erred in dismissing Shepherd’s
    negligence claim.
    II.    Breach of Fiduciary Duty
    ¶15           Shepherd alleged a fiduciary duty arose between himself and
    Costco because of “the confidential, professional, and private nature of the
    relationship between pharmacist/pharmacy and medical customer.”
    Establishing a fiduciary duty requires either peculiar intimacy or an express
    agreement to serve as a fiduciary. Cook v. Orkin Exterminating Co., Inc., 
    227 Ariz. 331
    , 334, ¶ 15 (App. 2011). Neither circumstance is alleged in this case,
    and mere unilateral trust in another party’s competence or integrity does
    not alone establish a fiduciary duty. Standard Chartered PLC v. Price
    Waterhouse, 
    190 Ariz. 6
    , 24 (App. 1996). Nor does the fact that a profession
    is regulated, despite Shepherd’s contention to the contrary. Thus, the
    superior court did not err in ruling Shepherd failed to state a claim for
    breach of fiduciary duty.
    III.   Fraud
    ¶16           Shepherd based his common law fraud claim on Costco’s
    alleged representations that “his instructions to cancel his [E.D.]
    prescription had been acknowledged and would be acted upon.” But
    unfulfilled promises cannot support an actual fraud claim absent the
    presence of an intent not to perform at the time of the promise. Hall v.
    Romero, 
    141 Ariz. 120
    , 123–24 (App. 1984). Shepherd alleged no facts to
    suggest Costco intended to not cancel the E.D. prescription when it
    acknowledged his first cancellation request. He contends on appeal that
    there was a “triple confirmation that the offending prescription had been
    cancelled,” but his complaint only alleged acknowledgment of his first
    cancellation request.
    ¶17            Shepherd further contends Costco acted fraudulently by
    failing to disclose to him the E.D. prescription was “a) still not cancelled
    and b) also waiting for pickup.” He did not raise this argument in the trial
    court and cannot raise it for the first time on appeal. County of La Paz v.
    Yakima Compost Co., Inc., 
    224 Ariz. 590
    , 606, ¶ 49 (App. 2010). The trial court
    correctly dismissed Shepherd’s fraud claim.
    5
    SHEPHERD v. COSTCO
    Opinion of the Court
    IV.    Negligent Misrepresentation
    ¶18           Shepherd’s negligent misrepresentation claim also relies on
    Costco’s alleged acknowledgment of his request to cancel the E.D.
    prescription. Negligent misrepresentation, like fraud, cannot be premised
    on a promise of future conduct. McAlister v. Citibank (Arizona), 
    171 Ariz. 207
    ,
    215 (App. 1992). Thus, this claim was properly dismissed.
    V.     Intentional Infliction of Emotional Distress
    ¶19            A plaintiff alleging intentional infliction of emotional distress
    must show the defendant caused severe emotional distress by committing
    extreme and outrageous conduct with the intent to cause emotional distress
    or with reckless disregard of the near-certainty that such distress would
    result. Watkins v. Arpaio, 
    239 Ariz. 168
    , 170–71, ¶ 8 (App. 2016). The conduct
    must be “so outrageous in character and so extreme in degree, as to go
    beyond all possible bounds of decency, and to be regarded as atrocious and
    utterly intolerable in a civilized community.” Mintz v. Bell Atl. Sys. Leasing
    Int'l, Inc., 
    183 Ariz. 550
    , 554 (App. 1995) (quoting Cluff v. Farmers Ins.
    Exchange, 
    10 Ariz. App. 560
    , 562 (1969)).
    ¶20             Shepherd contends a jury could conclude the “mocking
    disclosure” of the E.D. medication was outrageous. The trial court, not the
    jury, determines whether the acts are sufficiently extreme and outrageous
    to state a claim for relief. Id.; see also Nelson v. Phoenix Resort Corp., 
    181 Ariz. 188
    , 199 (App. 1994) (trial court must make “preliminary determination
    whether the conduct may be considered so outrageous and extreme as to
    permit recovery”). Shepherd only alleged that his ex-wife and a Costco
    employee “joked” at the counter about him “not picking it up yet.” While
    these jokes may have been in poor taste, they do not approach the level of
    outrageousness needed to prove intentional infliction of emotional distress.
    See, e.g., Restatement (Second) of Torts § 46, cmt. d (“The liability clearly
    does not extend to mere insults, indignities, threats, annoyances, petty
    oppressions, or other trivialities. . . . There is no occasion for the law to
    intervene in every case where some one’s feelings are hurt.”); Ford v. Revlon,
    Inc., 
    153 Ariz. 38
    , 43 (1987) (stating that Arizona follows the standard for
    liability set forth in Restatement (Second) of Torts § 46). The trial court did
    not err in dismissing this claim.
    VI.    Intrusion Upon Seclusion
    ¶21           Shepherd contends the trial court erroneously found “actual
    trespass” was a necessary element of an intrusion upon seclusion claim. The
    court instead found he had not alleged any “intrusion.” We agree.
    6
    SHEPHERD v. COSTCO
    Opinion of the Court
    ¶22           This court has previously followed the four-part classification
    of invasion of privacy claims set forth in Restatement (Second) of Torts §§
    652A-E. Hart v. Seven Resorts Inc., 
    190 Ariz. 272
    , 279 (App. 1997). An
    intrusion upon seclusion occurs when one “intentionally intrudes,
    physically or otherwise, upon the solitude or seclusion of another or his
    private affairs or concerns” and the intrusion is “highly offensive to a
    reasonable person.” Restatement (Second) of Torts § 652B. It typically
    involves
    (1) “physical intrusion into a place in which the plaintiff has
    secluded himself;”
    (2) “the use of the defendant’s senses, with or without
    mechanical aids, to oversee or overhear the plaintiff’s private
    affairs, as by looking into his upstairs windows with
    binoculars or tapping his telephone wires;” or
    (3) “some other form of investigation or examination into his
    private concerns, as by opening his private and personal mail,
    searching his safe or his wallet, examining his private bank
    account, or compelling him by a forged court order to permit
    an inspection of his personal documents.”
    
    Id., cmt. b.
    Shepherd alleged none of these circumstances; he instead alleged
    in conclusory fashion that Costco “intentionally intruded upon the solitude
    and seclusion of [Shepherd’s] private affairs and concerns”without alleging
    additional facts that would support this claim. On appeal, he contends
    Costco “published” the information to his ex-wife but does not contend that
    Costco knew Shepherd had purposefully secluded or shielded his ex-wife
    from receiving prescription information; in fact, Shepherd expressly
    authorized Costco to share prescription information with her. Accordingly,
    Shepherd’s claim for intrusion upon seclusion fails as a matter of law. See
    
    Hart, 190 Ariz. at 279
    (“The defendant is subject to liability . . . only when
    he has intruded into a private place, or has otherwise invaded a private
    seclusion that the plaintiff has thrown about his person or affairs”) (quoting
    Restatement (Second) of Torts § 652B, cmt. c).
    VII.   Public Disclosure of Private Facts and False Light
    ¶23            Shepherd contends the disclosure to his ex-wife constituted a
    false light invasion of privacy. A false light tort occurs when:
    7
    SHEPHERD v. COSTCO
    Opinion of the Court
    One who gives publicity to a matter concerning another that
    places the other before the public in a false light is subject to
    liability to the other for invasion of his privacy, if
    (a) the false light in which the other was placed would
    be highly offensive to a reasonable person, and
    (b) the actor had knowledge of or acted in reckless
    disregard as to the falsity of the publicized matter and
    the false light in which the other would be placed.
    
    Hart, 190 Ariz. at 280
    (quoting Restatement (Second) of Torts § 652E).
    Generally, however, “it is not an invasion of the right of privacy . . . to
    communicate a fact concerning the plaintiff’s private life to a single person
    or even to a small group of persons.” 
    Id. (quoting Restatement
    (Second) of
    Torts § 652D, cmt. a).
    ¶24            In Hart, the appellants asserted a false light claim based on
    “rumors in the community” that they had been terminated from
    employment because they were drug users. 
    Id. The court
    rejected the claim,
    finding there was no evidence to suggest the employer had “publicly
    revealed the reasons for appellants’ termination.” 
    Id. at 208–81.
    Similarly,
    Shepherd did not allege that Costco publicly revealed the E.D. prescription.
    He only alleged that Costco disclosed it to one person—his ex-wife, who
    was authorized to receive such information. What she chose to do with that
    information is irrelevant to whether he stated a claim against Costco. See 
    id. at 281
    (“The mere fact that some interested parties may have heard rumors
    from sources other than [the plaintiff] . . . is, without more, insufficient to
    meet the level of publicity required for a false light claim.”) (quoting Moore
    v. Big Picture Co., 
    828 F.2d 270
    , 274 (5th Cir. 1987)). Accordingly, the trial
    court properly dismissed Shepherd’s false light claim.
    VIII. Immunity from Suit for Good Faith Disclosures
    ¶25          Because Shepherd’s negligence claim was improperly
    dismissed, we next consider the trial court’s determination that Costco was
    immune from suit under A.R.S. § 12-2296. That statute provides as follows:
    A health care provider, contractor or clinical laboratory that
    acts in good faith under this article is not liable for damages
    in any civil action for the disclosure of medical records,
    payment records or clinical laboratory results or information
    contained in medical records, payment records or clinical
    laboratory results that is made pursuant to this article or as
    8
    SHEPHERD v. COSTCO
    Opinion of the Court
    otherwise provided by law. The health care provider,
    contractor or clinical laboratory is presumed to have acted in
    good faith. The presumption may be rebutted by clear and
    convincing evidence.
    A.R.S. § 12-2296. When interpreting a statute, we look first to the statute’s
    plain language. White Mountain Health Ctr., Inc. v. Maricopa Cty., 
    241 Ariz. 230
    , 249, ¶ 68 (App. 2016). If the language is clear and unambiguous, we
    must give effect to it without using other rules of statutory construction.
    Parsons v. Ariz. Dep’t of Health Serv., 
    242 Ariz. 320
    , 323, ¶ 11 (App. 2017). We
    strictly construe statutes that limit common law liability. Ramirez v. Health
    Partners of S. Ariz., 
    193 Ariz. 325
    , 329, ¶ 11 (App. 1998).
    A.     Section 12-2296 Applies to the Alleged Disclosure.
    ¶26           The parties do not dispute that Costco is a “health care
    provider” for purposes of § 12-2296. A.R.S. § 12-2291(5)(a). Shepherd
    contends, however, that § 12-2296 does not apply because Costco did not
    disclose the E.D. prescription to his ex-wife “under this article.”
    ¶27           Section 12-2294(C) authorizes the disclosure of medical
    records or the information contained in those records without written
    authorization “as otherwise authorized by state or federal law, including
    [HIPAA] privacy standards,” and HIPAA allows disclosure to “any . . .
    person identified by the individual” so long as the information is relevant
    to that person’s involvement with the individual’s health care. 45 C.F.R.
    § 164.510(b)(1)(i). HIPAA also authorizes covered entities to “use
    professional judgment and . . . experience with common practice to make
    reasonable inferences of the individual’s best interest in allowing a person
    to act on behalf of the individual to pick up filled prescriptions, medical
    supplies, X-rays, or other similar forms of protected health information”
    when the individual is not present. 45 C.F.R. § 164.510(b)(3).
    ¶28          Shepherd admits that he authorized his ex-wife to pick up his
    regular medication and that he was not present at the time of the disclosure.
    Accordingly, Costco’s disclosure was within the scope of § 12-2296.
    B.     Shepherd Alleged Sufficient Facts to Avoid Dismissal
    Based on § 12-2296 Immunity.
    ¶29            Shepherd argues Costco is not entitled to immunity because
    it did not act in good faith. While the statute presumes good faith, it does
    not define it; we therefore give the term its ordinary meaning and may
    9
    SHEPHERD v. COSTCO
    Opinion of the Court
    consult dictionary definitions in doing so. DBT Yuma, L.L.C. v. Yuma Cty.
    Airport Auth., 
    238 Ariz. 394
    , 396, ¶ 9 (2015).
    ¶30            Webster’s Second Unabridged Dictionary defines good faith,
    in the general sense, as “accordance with standards of honesty, trust,
    sincerity, etc..” Random House Webster’s Second Unabridged Dictionary
    822 (2001); see Sierra Tucson, Inc. v. Pima Cty., 
    178 Ariz. 215
    , 220 (App. 1994)
    (citing same dictionary). Similarly, in the context of commercial
    transactions, the Uniform Commercial Code defines “[g]ood faith” as
    “honesty in fact in the conduct or transaction concerned”; see also Stewart v.
    Thornton, 
    116 Ariz. 107
    , 110 (1977) (relying on the UCC’s definition of good
    faith). Our supreme court has further noted that good faith, in the context
    of commercial transactions, entails the absence of bad faith including
    actions that amount to “guilty knowledge or willful ignorance.” 
    Stewart, 116 Ariz. at 110
    .
    ¶31            Shepherd has alleged that: (1) he told Costco to cancel the E.D.
    prescription twice; (2) Costco acknowledged one of his requests but did not
    cancel the prescription; and (3) a Costco employee crudely joked about the
    prescription with Shepherd’s ex-wife. Given these allegations, Shepherd
    may be able to prove some set of facts showing Costco did not act in good
    faith. See Luchanski v. Congrove, 
    193 Ariz. 176
    , 180, ¶ 20 (App. 1998) (stating
    that a motion to dismiss should be denied unless it is “beyond doubt” that
    the plaintiff could prove no set of facts which would entitle him to relief)
    (quoting Newman v. Maricopa Cty., 
    167 Ariz. 501
    , 505–06 (App. 1991)). Thus,
    Costco was not entitled to dismissal based on § 12-2296 immunity. Instead,
    Costco’s potential § 12-2296 immunity remains an open question on
    remand, subject to further discovery, but without prejudice to summary
    judgment in the event the developed record does not support a genuine
    issue of fact on this issue.
    IX.    HIPAA Preemption
    ¶32         We next consider the trial court’s conclusion that HIPAA
    preempted Shepherd’s claims.
    ¶33           Relying on federal authorities, Costco contends Shepherd
    “cannot use a HIPAA violation as the basis of a lawsuit” because HIPAA
    does not create a private cause of action. See, e.g., Webb v. Smart Document
    Solutions, LLC, 
    499 F.3d 1078
    , 1082 (9th Cir. 2007); Lee-Thomas v. LabCorp, 
    316 F. Supp. 3d 471
    , 474 (D.D.C. 2018). Other state courts have allowed state law
    claims based on alleged HIPAA violations to survive a motion to dismiss.
    See R.K. v. St. Mary’s Med. Ctr., Inc., 
    735 S.E.2d 715
    , 724 (W. Va. 2012)
    (“[S]tate common-law claims for the wrongful disclosure of medical or
    10
    SHEPHERD v. COSTCO
    Opinion of the Court
    personal health information are not inconsistent with HIPAA . . . [and]
    compliment HIPAA by enhancing the penalties for its violation and thereby
    encouraging HIPAA compliance”); Acosta v. Byrum, 
    638 S.E.2d 246
    , 251
    (N.C. Ct. App. 2006) (“Here, defendant has been placed on notice that
    plaintiff will use . . . HIPAA to establish the standard of care. Therefore,
    plaintiff has sufficiently pled the standard of care in her complaint”); but see
    Sheldon v. Kettering Health Network, 
    40 N.E.3d 661
    , 672, ¶ 24 (Ohio 2015)
    (“[I]n our view utilization of HIPAA as an ordinary negligence ‘standard of
    care’ is tantamount to authorizing a prohibited private right of action for
    violation of HIPAA itself”).
    ¶34             HIPAA does not prohibit a private right of action for tortious
    disclosure of healthcare information, it merely declines to create an
    independent federal statutory private right of action. See 
    Webb, 499 F.3d at 1082
    ; see also 65 Fed.Reg. 82462-01, 82566, 82641 (Dec. 28, 2000) (noting that
    the penalty provisions of HIPAA do not include a private right of action).
    A state-law negligence claim for wrongful disclosure of protected
    information, even when based on failure to abide by standard practices
    mandated by HIPAA, does not interfere with government enforcement
    actions authorized by HIPAA. Instead, additional state remedies encourage
    compliance with HIPAA by providing further means for patients to recover
    for harm suffered due to non-compliance. Accord 
    Sheldon, 40 N.E.3d at 672
    ,
    ¶¶ 24–25 (holding that HIPAA does not preempt state-law claims for
    unauthorized disclosure of medical information so long as the disclosure is
    not specifically allowed by HIPAA, but deferring to an Ohio statute setting
    forth a standard of care). Moreover, A.R.S. § 12-2296 limits, but does not
    eliminate, private causes of action based on improper disclosure of medical
    information. If all private causes of action were foreclosed, § 12-2296’s grant
    of qualified immunity would be superfluous. Thus, HIPAA does not
    preempt state-law negligence claims for wrongful disclosure of medical
    information. Accordingly, we hold HIPAA’s requirements may inform the
    standard of care in state-law negligence actions just as common industry
    practice may establish an alleged tortfeasor’s duty of care and to the extent
    such claims are permitted under A.R.S. § 12-2296.
    ¶35          Finally, relying on Skinner v. Tel-Drug, Inc., Costco argues that
    federal courts in Arizona have previously dismissed negligence per se
    claims made by a patient on HIPAA grounds. No. CV-16-00236-TUC-JGZ
    (BGM), 
    2017 WL 1076376
    (D. Ariz. Jan. 27, 2017), adopted by the district court
    at 
    2017 WL 1075029
    (D. Ariz. March 22, 2017). In Skinner, the plaintiff raised
    a negligence per se claim alleging the defendant breached HIPAA
    regulations by sending numerous faxes containing protected health
    information to an unintended recipient. 
    Id. at *1,
    *3. The magistrate judge
    11
    SHEPHERD v. COSTCO
    Opinion of the Court
    recommended dismissing the plaintiff’s claim because it relied solely on
    HIPAA violations to establish per se negligence. 
    Id. *3–*4, *5.
    Skinner is
    distinguishable because Shepherd’s negligence claim does not rely solely
    on HIPAA and because Shepherd did not state a per se violation of HIPAA
    in his complaint, as 
    discussed supra
    . Moreover, we are not bound by the
    federal district court’s interpretation of Arizona law. Arpaio v. Figueroa, 
    229 Ariz. 444
    , 447, ¶ 11 (App. 2012).
    X.     Punitive Damages
    ¶36           Finally, we address the trial court’s dismissal of Shepherd’s
    punitive damages claim. To recover punitive damages, a plaintiff must
    prove something more than the underlying tort. Saucedo ex rel. Sinaloa v.
    Salvation Army, 
    200 Ariz. 179
    , 182, ¶ 11 (App. 2001). There are no special
    pleading requirements for punitive damages claims; a general prayer for
    punitive damages is sufficient to put a defendant on notice that punitive
    damages are requested in the prayer for relief. Ezell v. Quon, 
    224 Ariz. 532
    ,
    538, ¶ 23 (App. 2010) (quoting Kline v. Kline, 
    221 Ariz. 564
    , 572, ¶ 29 (App.
    2009)). Most of the tort claims alleged in Shepherd’s complaint that might
    legitimately give rise to a punitive damage claim have been properly
    dismissed by the trial court. What is left is a general negligence claim. But
    punitive damages are not available for mere negligence. Smith v. Chapman,
    
    115 Ariz. 211
    , 214 (1977) (“Punitive damages are not permitted in Arizona
    for mere negligence: there also must be shown a reckless or wanton
    disregard of the rights of others.”) (citation omitted).
    ¶37            In his complaint, Shepherd alleged Costco’s actions were
    “malicious, oppressive or in reckless disregard of Plaintiff’s rights” and
    sought punitive damages. This conclusory allegation, standing alone, is
    insufficient to support punitive damages. Shepherd has, however,
    specifically alleged that Costco “rewards its pharmacy employees through
    a system of incentives for pharmacy sales, which system contributed to the
    failure of [Costco] to cancel the prescription as requested twice by Plaintiff.”
    This is a serious allegation leveled against Costco. We reiterate that, in a
    Rule 12(b)(6) setting, we are not examining whether the allegation is true,
    or whether there is sufficient admissible evidence in the record to satisfy
    the heightened burden of proof and allow the jury to consider the claim.
    Instead, we presume counsel can meet the obligations imposed by Rule of
    Civil Procedure 11 and thus are required to accept that these allegations are
    true. See Ariz. R. Civ. P. 11(b)(3) (by signing a pleading, an attorney certifies
    that factual contentions have evidentiary support or likely will after
    discovery). In that circumstance, and on that basis alone, we cannot say as
    a matter of law that Shepherd will be unable to adduce facts supporting his
    allegation of an overt financial incentive to disregard a customer’s
    12
    SHEPHERD v. COSTCO
    Opinion of the Court
    prescription cancellation request. See 
    Verduzco, 240 Ariz. at 225
    , ¶ 9 (“Under
    Arizona’s notice pleading rules, it is not necessary to allege the evidentiary
    details of plaintiff’s claim for relief.”) (internal quotation marks omitted).
    Again, this holding is based on the Rule 12(b)(6) standard and will not
    prejudice any motion practice following discovery.
    CONCLUSION
    ¶38           We affirm the dismissal of Shepherd’s complaint except for
    his negligence and punitive damages claims. We reverse and remand for
    further proceedings on those claims. Shepherd may recover his taxable
    costs incurred on appeal upon compliance with Arizona Rule of Civil
    Appellate Procedure 21. See, e.g., Douglas v. Governing Bd. of Window Rock
    Consol. Sch. Dist. No. 8, 
    206 Ariz. 344
    , 346, 349, ¶¶ 3, 18–19 (App. 2003)
    (awarding costs to party who successfully appealed trial court’s dismissal
    of their claims).
    T H O M P S O N, J., concurring in part, dissenting in part:
    ¶39         I concur with the majority opinion, except as to punitive
    damages against Costco, and the award of costs.
    ¶40           “To obtain punitive damages, plaintiff must prove that
    defendant’s evil hand was guided by an evil mind.” Rawlings v. Apodaca,
    
    151 Ariz. 149
    , 162 (1986). It would serve no evil purpose on Costco’s part to
    reward employees’ inefficiencies in filling prescriptions which customers
    do not want. Thus, the complaint fails to sufficiently allege conduct by
    Costco, with evil intent, which could have caused harm to Shepherd.
    ¶41           Costs are generally awarded when a party has prevailed on
    the merits. Plaintiff has not yet prevailed on the merits. Costs may also be
    awarded under the so-called “Wagenseller” exception. Wagenseller v.
    Scottsdale Mem. Hosp., 
    147 Ariz. 370
    , 393–94 (1985) (stating fees may be
    awarded where appellant has obtained reversal of an order central to the
    case or final determination of a significant issue of law, which
    determination on appeal forms a separate unit within the overall litigation);
    Henry v. Cook, 
    189 Ariz. 42
    , 44 (App. 1996) (stating interpretation of
    “successful party” should be uniform for fees and costs). The punitive
    damages issue is merely ancillary, and not central to Shepherd’s claims.
    13
    SHEPHERD v. COSTCO
    T H O M P S O N, J., concurring in part, dissenting in part
    Indeed his counsel, at oral argument, characterized the punitives claim as
    “a stretch.”
    ¶42          I would therefore affirm as to punitive damages, and would
    not award costs at this point in the ongoing litigation.
    AMY M. WOOD • Clerk of the Court
    FILED: AA
    14