J.R. v. Walgreens Boots Alliance, Inc. ( 2021 )

UNPUBLISHED
UNITED STATES COURT OF APPEALS
FOR THE FOURTH CIRCUIT
No. 20-1767
J.R., individually and on behalf of her minor children A.R. and H.K.; J.H., individually,
and on behalf of all others similarly situated; B.Y., individually, and on behalf of all others
similarly situated; J.S., individually, and on behalf of all others similarly situated,
Plaintiffs – Appellants,
v.
WALGREENS BOOTS ALLIANCE, INC.; WALGREEN CO.,
Defendants – Appellees.
Appeal from the United States District Court for the District of South Carolina, at
Charleston. David C. Norton, District Judge. (2:19-cv-00446-DCN)
Argued: September 22, 2021 Decided: October 19, 2021
Before MOTZ and AGEE, Circuit Judges, and KEENAN, Senior Circuit Judge.
Affirmed by unpublished per curiam opinion.
ARGUED: Michael J. Moore, POPE MCGLAMRY KILPATRICK MORRISON &
NORWOOD, P.C., Atlanta, Georgia, for Appellants. Robert N. Hochman, SIDLEY
AUSTIN LLP, Chicago, Illinois, for Appellees. ON BRIEF: Charles W. Byrd, Aimee J.
Hall, POPE MCGLAMRY KILPATRICK MORRISON & NORWOOD, P.C., Atlanta,
Georgia; William N. Nettles, BILL NETTLES LAW, Columbia, South Carolina, for
Appellants. David E. Dukes, Amanda S. Kitts, Adam J. Hegler, NELSON MULLINS
RILEY & SCARBOROUGH LLP, Columbia, South Carolina; Scott D. Stein, Matthew C.
Bergs, Ross O. Kloeber, SIDLEY AUSTIN LLP, Chicago, Illinois, for Appellees.
Unpublished opinions are not binding precedent in this circuit.
2
PER CURIAM:
Six pharmacy customers (“Plaintiffs”) appeal from the district court’s dismissal of
their twelve-count class action suit against Walgreens Boot Alliance, Inc. (“WBA”) and
Walgreen Company (collectively, “Walgreens”). At bottom, Plaintiffs allege that the
transfer of their personal identifying information (“PII”) from the Walgreens pharmacy
filling their prescription to separate, internal company databases violates their rights under
various federal and state statutes and state tort claims. For the following reasons, we affirm
the judgment of the district court.
I.
We accept as true all well-pleaded allegations in Plaintiffs’ Amended Complaint
and view it in the light most favorable to them. Ostrzenski v. Seigel, 177 F.3d 245, 251 (4th
Cir. 1999). Through that lens, the relevant facts are as follows.
Congress enacted the 340B Drug Pricing Program (the “Program”) in 1992, which
requires participating manufacturers to provide certain prescription drugs at significantly
discounted prices to eligible and enrolled health care providers (“covered entities”).
Covered entities typically serve low-income patients with limited access to health care.
Given the cost savings involved, federal law expressly prohibits covered entities from
“resell[ing] or otherwise transfer[ring]” a 340B drug “to a person who is not a patient of
the entity.” 42 U.S.C. § 256b(a)(5)(B). Covered entities are subject to audits by both the
Department of Health and Human Services and participating drug manufacturers.
Sometimes lacking the resources to operate in-house pharmacies, covered entities often
3
engage a retail pharmacy (“contract pharmacy”) to dispense 340B-eligible drugs purchased
by the covered entity to the low-income patient.
Relevant here, Walgreens is a 340B contract pharmacy for several covered entities
in South Carolina, some of which provided Plaintiffs with medical services and use
Walgreens pharmacies in South Carolina to fill their patients’ prescriptions. All South
Carolina pharmacies must comply with the South Carolina Pharmacy Practice Act (the
“PPA”), S.C. Code Ann. § 40-43-10 et seq.; the South Carolina Prescription Information
Privacy Act (the “PIPA”), S.C. Code Ann. § 44-117-10 et seq.; and the American
Pharmaceutical Association Code of Ethics.
In 2010, Walgreens created a separate division within its corporate organization,
“340B Complete,” to oversee administration of its contract pharmacy operations and
ensure compliance with the Program. This division is separate from other aspects of
Walgreens’ operations, including its pharmaceutical, photo, and retail divisions. None of
the 160 employees working in the 340B Complete division are licensed pharmacists.
When any patient seeks to fill a prescription at a Walgreens pharmacy, the
pharmacist first enters the patient’s PII into a “proprietary computer software system”
called IntercomPlus, which all Walgreens pharmacies nationwide can access. J.A. 36. That
PII includes: the patient’s name, address, date of birth, payment information, and third-
party reimbursement rate; the drug’s name, dosage, frequency, and refill information; and
the prescribing physician’s information. The PII in IntercomPlus is then transferred to a
“corporate central repository” called Enterprise Data Warehouse (“EDW”), J.A. 41, all of
which is part of the same Walgreens corporate entity.
4
Walgreens markets to covered entities a commercial software product registered and
trademarked as “340B Complete®,” which extracts the PII from EDW and compares it to
the PII that a given Walgreens pharmacy received from a covered entity. Assuming there
is a match, the 340B Complete® software transfers the PII on file in EDW into Walgreens’
340B Complete payment process.
This data transferring occurs for purposes of replenishing the pharmaceutical drugs
that a Walgreens pharmacy dispenses to a 340B patient. Under federal law, only a covered
entity may purchase 340B drugs. Walgreens cannot. Using 340B Complete®, Walgreens
performs a financial analysis to determine if it is less expensive to process payment through
the patient’s insurance company. If so, Walgreens will submit the claim to insurance, retain
the full insurance reimbursement amount as it would with any ordinary consumer, and
purchase the resupply itself. If, however, it is cheaper for Walgreens to process the
transaction as a 340B event, then 340B Complete® will designate it as such. This enables
Walgreens to replenish the drug inventory through the covered entity for a 340B patient
and not run afoul of the distinction between 340B and non-340B prescription drug
purchases.
Nonetheless, Plaintiffs claim the transfer of their PII from the pharmacy filling their
prescription to EDW, and the transfer from EDW to 340B Complete®, violates various
rights. Among other claims, they allege that they never gave Walgreens permission to use
or transfer their PII and that Walgreen’s Notice of Privacy Policy (“NPP”) did not inform
them that their PII would be used in 340B Complete®.
5
II.
Plaintiffs filed a twelve-count class action Amended Complaint, seeking
preliminary 1 and permanent injunctive relief, as well as “compensatory, exemplary, and
punitive damages in amounts to be determined.” J.A. 80. The claims are as follows: (1)
invasion of privacy: wrongful appropriation; (2) invasion of privacy: wrongful publicizing
of private affairs; (3) negligence per se based on violations of the PIPA; (4) breach of
contract; (5) negligence (based on violations of the PIPA, the PPA, and regulations issued
by the South Carolina Board of Pharmacy); (6) negligence (based on a duty to disclose to
Plaintiffs “the true facts about [Walgreens’] substandard patient privacy practices,” J.A.
67); (7) respondeat superior 2; (8) negligent training and supervision; (9) unjust enrichment;
(10) violation of the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. §§ 1681–1681x; (11)
negligence per se based on violations of the FCRA, 3 the Health Insurance Portability and
1
The district court denied Plaintiffs’ motion for a preliminary injunction. Plaintiffs’
appeal from that decision is currently being held in abeyance pending resolution of this
appeal. See J.R. v. Walgreens Boots Alliance, Inc., No. 19-2404.
2
The district court dismissed this claim because “[r]espondeat superior is not a
cause of action; it is a theory of liability.” J.R. Walgreens Boots Alliance, Inc., 470 F. Supp.
3d 534, 561 (D.S.C. 2020) (citing Austin v. Specialty Transp. Servs., Inc., 594 S.E.2d 867,
877 (S.C. Ct. App. 2004) (“Under the doctrine of respondeat superior, the employer is
liable for the acts of an employee acting within the scope of employment.”)). Plaintiffs
have waived any challenge to this aspect of the district court’s holding by failing to address
it in their Opening Brief. See Carter v. Lee, 283 F.3d 240, 252 n.11 (4th Cir. 2002) (“[T]his
Court normally views contentions not raised in an opening brief to be waived.”).
3
The district court found that Plaintiffs had “abandoned the FCRA claim” as well
as their “negligence per se claim based on an alleged violation of FCRA.” J.R., 470 F.
Supp. 3d at 550. Plaintiffs do not challenge this holding in their Opening Brief, and, as
such, have waived it. See Carter, 283 F.3d at 252 n.11.
6
Accountability Act (“HIPAA”), and the Federal Trade Commission Act (“FTCA”); and
(12) declaratory relief.
Walgreens filed a motion to dismiss for failure to state a claim under Federal Rule
of Civil Procedure 12(b)(6), which the district court granted. 4 We have jurisdiction over
Plaintiffs’ timely-filed appeal, see 28 U.S.C. § 1291, and review the district court’s
dismissal de novo, Garnett v. Remedi SeniorCare of Va., LLC, 892 F.3d 140, 142 (4th Cir.
2018). 5
4
The district court separately granted WBA’s motion to dismiss for lack of personal
jurisdiction. By way of background, WBA is a holding company that utilizes three
divisions to conduct its operations, one of which is “Retail Pharmacy USA.” Walgreen Co.
is a wholly owned WBA subsidiary, which operates the Retail Pharmacy USA division.
Stated differently, Walgreen Co. operates all Walgreens pharmacies in the United States.
Plaintiffs challenge the district court’s dismissal of WBA on two grounds, arguing
that: (1) WBA waived its jurisdictional challenge by asserting a merits-based defense to
their preliminary injunction motion; and, alternatively, (2) WBA is subject to the Court’s
jurisdiction because it is Walgreen Co.’s alter ego. Even if Plaintiffs are correct as to either
theory, we would still affirm the district court’s dismissal of WBA because Plaintiffs
alleged the same facts and deficient causes of action against both entities. And we must
conduct that analysis regardless of whether the district court’s personal jurisdiction
decision as to WBA was correct. Therefore, since the ultimate outcome would be the same
even if we agreed with Plaintiffs’ jurisdictional arguments, we need not reach this issue to
affirm. See East Coast Repair & Fabrication, LLC v. U.S. ex rel Dep’t of Navy, --- F.4th
---, 2021 WL 4780508, at *2 (4th Cir. 2021) (“[A] court may bypass a difficult
jurisdictional question and ‘choose among threshold grounds for denying audience to a
case on the merits . . . when considerations of convenience, fairness, and judicial economy
so warrant.’” (quoting Sinochem Int’l Co. v. Malaysia Int’l Shipping Corp., 549 U.S. 422,
431-32 (2007)); see also Gremillion v. Chivatero, 749 F.2d 276, 277 (5th Cir. 1985) (per
curiam) (affirming dismissal for failure to state a claim without addressing personal
jurisdiction).
5
We have subject matter jurisdiction under 28 U.S.C. § 1332(d)(2) because the
aggregated amount in controversy exceeds $5,000,000, and at least one of the proposed
class members is diverse from Walgreens.
7
A. The Invasion of Privacy Claims
“In South Carolina, there are three separate and distinct causes of action for invasion
of privacy: (1) wrongful appropriation of personality; (2) wrongful publicizing of private
affairs; and (3) wrongful intrusion into private affairs.” Sloan v. S.C. Dep’t of Pub. Safety,
586 S.E.2d 108, 110 (S.C. 2003) (per curiam). Plaintiffs brought claims under the first two
theories, both of which the district court dismissed because there were no allegations that
Walgreens publicized their PII.
The South Carolina Supreme Court has observed that “[e]ncompassed in these . . .
recognized torts is the infringement on the right of publicity.” Gignilliat v. Gignilliat, Savitz
& Bettis, L.L.P., 684 S.E.2d 756, 760 (S.C. 2009) (emphasis added). After all, “[t]he right
of privacy is defined as the right of an individual to be let alone and live a life free from
unwarranted publicity.” Glassmeyer v. City of Columbia, 777 S.E.2d 835, 839 (S.C. Ct.
App. 2015) (emphasis added).
As for wrongful appropriation of personality, the South Carolina Supreme Court has
explained that the “gist” of that claim “is the violation of the plaintiff’s exclusive right at
common law to publicize and profit from his name, likeness, and other aspects of personal
identity.” Sloan, 586 S.E.2d at 110 (emphasis added). Wrongful publicizing of private
affairs similarly “involves a public disclosure of private facts about the plaintiff . . . in
which there is no legitimate public interest.” Snakenberg v. Hartford Cas. Ins. Co.¸ 383
S.E.2d 2, 6 (S.C. Ct. App. 1989). “The gravamen of the tort is publicity as opposed to mere
publication.” Id.8
According to South Carolina courts, “publicity” “means that the matter is made
public, by communicating it to the public at large, or to so many persons that the matter
must be regarded as substantially certain to become one of public knowledge.” Swinton
Creek Nursery v. Edisto Farm Credit, ACA, 514 S.E.2d 126, 131 (S.C. 1999) (quoting
Restatement (Second) of Torts § 652D cmt. a (Am. L. Inst. 1977)). Here, though Plaintiffs
allege that their PII is accessible by the 160 non-pharmacist employees in Walgreen’s 340B
Complete division, there is no assertion that Walgreens has publicized that information to
the public at large. The alleged internal corporate disclosures are not “public” broadcasts,
as the PII is only accessed by those employees for private, business purposes. Therefore,
we agree with the district court that Plaintiffs failed to state a claim for invasion of privacy
under South Carolina law.
B. Negligence Per Se Based on Violation of the PIPA
South Carolina’s PIPA provides that “[n]o patient prescription drug information
may be transferred or received by a person without the written consent of the patient or a
person authorized by law to act on behalf of the patient.” S.C. Code Ann. § 44-117-30. The
statute provides thirteen exceptions to this broad prohibition. Id. § 44-117-30(1)–(13). It
further requires that pharmacies maintain “a mechanism to prevent the disclosure of” PII
and other patient information. Id. § 44-117-350.
The PIPA does not expressly authorize a private right of action, and instead subjects
violators to criminal penalties and a fine. Id. § 44-117-40. The district court, however,
concluded there is an implied private right of action under the statute. Regardless of
whether that decision was correct, we agree with the district court that Plaintiffs failed to
9
allege a substantive PIPA violation because Walgreens’ internal 340B Complete process
did not involve a “transfer” or “receipt” of their PII, nor did Walgreens fail to prevent its
“disclosure.”
The PIPA does not define what it means to “transfer,” “receive,” or “disclos[e]”
protected information, as set out in sections 44-117-30 and -350. Nor does South Carolina
have any case law interpreting the PIPA. Relying on general principles of statutory
interpretation, however, our goal is to “ascertain and effectuate the intent of the
legislature,” by “giv[ing] the words found in the statute their plain and ordinary meaning.”
CFRE, LLC v. Greenville Cnty. Assessor, 716 S.E.2d 877, 881 (S.C. 2011) (citations
omitted); see also Askew v. HRFC, LLC, 810 F.3d 263, 266 (4th Cir. 2016) (explaining that
federal courts sitting in diversity must, “if necessary, predict how the state’s highest court
would rule on an unsettled issue” (citation omitted)).
With that in mind, we conclude the district court did not err in limiting the PIPA’s
scope to external data transfers. Although the statute does not expressly modify the word
“transfer,” that term’s plain meaning supports this narrow construction. The Webster’s
Third New International Dictionary defines the verb “transfer” as “to carry or take from
one person or place to another”; “to move or send to a different location esp. for business,
vocational, or military purposes”; “to cause to pass from one person or thing to another”;
“to make over or negotiate the possession or control over.” Transfer, Webster’s Third New
Int’l Dictionary (2002) (emphases added). The Oxford English Dictionary similarly defines
it in a way implicating only exchanges between legally distinct entities: “To convey or take
from one place, person, etc. to another; . . . to give or hand over from one to another.”
10
Transfer, Oxford-English Dictionary Online, (Oxford Univ. Press, Sept. 2021) (emphases
added). Naturally read, then, the PIPA’s prohibition on “transfer[s]” is only implicated
when a patient’s PII leaves the custody of the corporate entity originally entitled to possess
it (a “person”) to a different legal entity or natural person.
The exceptions to section 44-117-30’s general prohibition support this
understanding of the text. They encompass—implicitly and explicitly—acceptable
transfers of information from the authorized possessor to a person outside of that legal
entity. In other words, they relate to external transfers of PII. For example, no violation of
the PIPA occurs: when specified professionals providing treatment services to a patient
communicate among themselves, § 44-117-30(2); when information must be transferred
“to effect the recall of a defective drug or device,” § 44-117-30(4); when information must
be transferred to “adjudicate or process payment claims for health care,” § 44-117-30(6),
so long as the recipient does not further disclose the information; when an entity transfers
information as part of a sale of a business to its successor in interest, § 44-117-30(10); or
when the patient has authorized another person to pick up his prescription from the
pharmacy, § 44-117-30(12). 6
6
Other PIPA provisions lend additional support. For example, section 44-117-50
states that PIPA’s prohibition does not invalidate the “authority of a court to issue a
subpoena for medical records” or “the authority of a license or disciplinary board of this
State” or “of the Department of Health and Environmental Control” to obtain patient
records as authorized elsewhere. Yet again, in all of the delineated caveats, the transfer or
receipt of PII involves a third party.
11
There is no textual basis for interpreting “transfer” and “receipt” 7 to apply to
movements of data between parts of a single legal entity. As the district court ably
expressed it, to adopt that construction would mean that a pharmacy would violate the
PIPA any time it moved data “outside of the four walls of the pharmacy, [including] basic
functions such as transmitting information for legal, administrative, or IT services that do
not occur within the four walls of the pharmacy.” J.R., 470 F. Supp. 3d at 557. 8 Therefore,
we affirm the district court’s dismissal of this claim.
C. Breach of Contract
Plaintiffs raised two breach of contract claims before the district court. First, they
argued that when they gave Walgreens their PII, it implicitly agreed to take reasonable
measures to secure that data, thereby creating an implied contract. Second, Plaintiffs
claimed that Walgreens’ NPP was a contract, which the 340B Complete process violated.
The district court rejected both theories. We agree.
First, there was no implied contract between Plaintiffs and Walgreens. An implied-
in-fact contract “arises when the assent of the parties is manifested by conduct, not words.”
7
To “receive” means “to take possession or delivery of,” suggesting that the
information was not previously possessed by that legal entity. Receive, Webster’s New
Int’l Dictionary (2002).
8
And while Plaintiffs now argue that the PIPA prohibits the initial exchange of
information from the pharmacy-entered database IntercomPlus to the corporate-controlled
database EDW, they did not make that assertion in the district court, instead limiting their
argument to the later transfer from EDW to 340B Complete for analysis. As such, that part
of the claim is waived. See Holland v. Big River Mins. Corp., 181 F.3d 597, 605 (4th Cir.
1999) (“Generally, issues that were not raised in the district court will not be addressed on
appeal.”).
12
Thomerson v. DeVito, 844 S.E.2d 378, 384 n.10 (S.C. 2020) (quoting Stanley Smith & Sons
v. Limestone College, 322 S.E.2d 474, 478 n.1 (S.C. Ct. App. 1984)). To be valid, “[t]he
parties must manifest their mutual assent to all essential terms,” so “[i]f one of the parties
has not agreed, then a prerequisite to formation of the contract is lacking.” Stanley Smith,
322 S.E.2d at 477. Plaintiffs alleged no facts indicating that at the time they agreed to
purchase prescription drugs from a Walgreens pharmacy, both they and Walgreens
implicitly agreed that Walgreens would not use their PII in the 340B Complete process.
See J.A. 44 (alleging that Plaintiffs were “unaware of” Walgreens’ use of Plaintiffs’ PII).
Thus, there is no basis to conclude that they entered into an implied contract with
Walgreens that included a term restricting its use. Indeed, Plaintiffs alleged that Walgreens’
NPP provided customers “the right to request additional restrictions on [Walgreens’] use
or disclosure” of PII, J.A. 35, but they did not allege that they ever asked for such additional
restrictions, further indicating a lack of agreement between the Parties. 9
Second, there was no actionable “breach” of the NPP. If a company’s privacy policy
“does not contain any exchange [of promises],” no enforceable contract exists. In re
Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 610–11 (9th Cir. 2020) (holding a
privacy policy was not a contract because it “merely provides information––not
commitments––regarding Facebook’s use of information and how users can control that
information”); Brush v. Miami Beach Healthcare Grp. Ltd., 238 F. Supp. 3d 1359, 1367
9
Plaintiffs cite data breach cases holding that there is an implied contract to keep a
person’s sensitive data reasonably secure. Those cases are inapposite because there is no
allegation that Walgreens was hacked or otherwise disclosed the PII to any outside party.
13
(S.D. Fla. 2017) (holding the defendant pharmacy’s privacy policy was not a contract
because it merely recounted patients’ rights under federal law, which defendant was
already required to comply with irrespective of the bargain with plaintiff). That same logic
applies here by Plaintiffs’ own allegations, which show that Walgreens’ NPP merely
informs patients of what it is “required by law” to do and “provide[s] notice of
[Walgreens’] ‘legal duties and privacy practices with respect to [PII].’” J.A. 34–35.
Therefore, we affirm the district court’s dismissal of Plaintiffs’ breach of contract claims.
D. Negligence Under the PPA
Next, Plaintiffs argue Walgreens’ purported breach of duties established by
professional standards amounts to negligence. The district court correctly rejected this
claim. The Supreme Court of South Carolina has squarely held that the PPA only
“regulate[s] the licensing and practice of pharmacists; . . . [its] provisions do not set forth,
explicitly or implicitly, a duty of confidentiality.” Evans v. Rite Aid Corp., 478 S.E.2d 846,
847 (S.C. 1996). Thus, Plaintiffs’ claim that the PPA imposes a duty of care to “maintain
the confidentiality of [Plaintiffs’] PII,” J.A. 72, is foreclosed.
Plaintiffs also assert that there is a general duty to “maintain a pharmacy patient
record system with adequate security and systems safeguards to prevent unauthorized
access of pharmacy patient records.” J.A. 72. That is one of the PPA’s requirements. See
S.C. Code Ann. § 40–43–86(O)(3). Assuming that this is sufficient evidence of a duty to
do so, Plaintiffs have nevertheless failed to allege a breach of that duty. There are no
allegations that unauthorized persons obtained access to Plaintiffs’ PII, and Plaintiffs have
cited no authority to plausibly establish that a non-pharmacist Walgreens employee’s
14
access to that data to determine if a transaction qualifies for the 340B program is
“unauthorized.”
E. General Negligence
Plaintiffs further allege that Walgreens “fail[ed] to conform to the privacy practices
universally recognized and accepted in the pharmaceutical profession.” J.A. 68. There are
no factual allegations from the American Pharmaceutical Code of Ethics or the South
Carolina Board of Pharmacy’s promulgated rules that show what constitutes those
“universally recognized and accepted” practices or how Walgreens purportedly violated
them. The same logic applies to the alleged duty to “exercise reasonable care to protect
[Plaintiffs] against the risk of foreseeable harm from their actions.” Opening Br. 45.
Without any facts plausibly demonstrating the precise duty Walgreens is alleged to have
breached, the district court properly determined that Plaintiffs failed to plausibly establish
that Walgreen’s 340B Complete process constitutes a breach. See Evans, 478 S.E.2d at 848
(holding there is no common law duty of confidentiality for pharmacists).
F. Negligent Training and Supervision Claims
South Carolina recognizes a cause of action for negligent supervision, Degenhart v.
Knights of Columbus, 420 S.E.2d 495, 496 (S.C. 1992), but negligent training is merely a
subset of a negligent supervision claim, e.g., Beneficial Financial I, Inc. v. Windham, 847
S.E.2d 793, 804–05 (S.C. Ct. App. 2020). Under South Carolina law,
[a]n employer may be liable for negligent supervision when (1) his employee
intentionally harms another when he is on the employer’s premises, is on
premises he is privileged to enter only as employee, or is using the
employer’s chattel; (2) the employer knows or has reason to know he has the
15
ability to control the employee; and (3) the employer knows or has reason to
know of the necessity and opportunity to exercise such control.
Doe v. Bishop of Charleston, 754 S.E.2d 494, 500 (S.C. 2014) (emphasis added) (citing
Degenhart, 420 S.E.2d at 496).
Here, as the district court observed, there is no allegation of any intentional conduct
on the part of any Walgreens employee. Further, because there has been no cognizable
“harm” to Plaintiffs arising from any Walgreens employee’s conduct, we find that
component of the negligent supervision claim also has not been adequately alleged.
Therefore, we affirm the dismissal of these claims.
G. Unjust Enrichment
To recover for unjust enrichment in South Carolina, a plaintiff must prove: “(1) [a]
benefit conferred by plaintiff upon the defendant; (2) realization of that benefit by the
defendant; and (3) retention of the benefit by the defendant under circumstances that make
it inequitable for him to retain it without paying its value.” Myrtle Beach Hosp., Inc. v. City
of Myrtle Beach, 532 S.E.2d 868, 872 (S.C. 2000). The district court dismissed Plaintiffs’
unjust enrichment claim because they failed to allege that they “reasonably expected
payment from the unconsented use of their PII.” J.R., 470 F. Supp. 3d at 563. Plaintiffs
argue there is no such requirement in bringing an unjust enrichment claim and that the
district court erroneously added this as an additional element.
We need not resolve this dispute, however, because Plaintiffs’ concession that they
voluntarily “provide[d] their PII to Walgreens’ pharmacy for the intended purposes of
obtaining, and allowing Walgreen’s pharmacy to seek third-party payment for, their
16
individual prescriptions,” J.A. 36 (emphasis added), defeats any allegation that its
acquisition and use of the PII was somehow “inequitable.” Stated differently, Walgreens
could not have acted unjustly by using Plaintiffs’ PII for the very purpose they intended
for it to be used. Therefore, we affirm the district court’s dismissal of Plaintiffs’ unjust
enrichment claim. See Scott v. United States, 328 F.3d 132, 137 (4th Cir. 2003) (“We are,
of course, entitled to affirm on any ground appearing in the record, including theories not
relied upon or rejected by the district court.”).
H. Negligence Per Se Based on HIPAA and FTCA Violations
We turn next to Plaintiffs’ negligence per se claims based on violations of HIPAA
and the FTCA. “Negligence per se is negligence arising from a defendant’s violation of a
statute.” Wogan v. Kunze, 623 S.E.2d 107, 117 (S.C. Ct. App. 2005). To make out such a
claim, Plaintiffs must demonstrate that the statute allegedly violated allows for a private
cause of action. See Doe v. Marion, 645 S.E.2d 245, 248 (S.C. 2007). That analysis turns
on whether the legislature intended to permit a private action, either explicitly or implicitly.
Id. But legislative intent can be implied “only if the legislation was enacted for the special
benefit of a private party.” Id.HIPAA addresses various aspects of confidentiality of health care information,
including requirements about how electronic health care information is stored. The district
court concluded that there was no implied private right of action under HIPAA, meaning
it could not support a negligence per se claim. We agree. Recently, we joined our sister
circuits in holding that HIPAA does not create a private right of action. See Payne v.
Taslimi, 998 F.3d 648, 660 (4th Cir. 2021) (“Every circuit court to consider whether
17
HIPAA created a private right to sue has found that it does not. This is because HIPAA
does not expressly allow for a private cause of action but delegates enforcement authority
to the Secretary of the Department of Health and Human Services, reflecting Congress’s
intent to forgo creating a private remedy. We see no reason to chart a different course from
our sister courts. [The plaintiff] has no private right of action under HIPAA.” (internal
citations omitted)). Therefore, the district court properly dismissed Plaintiffs’ negligence
per se claim based on an alleged HIPAA violation.
Plaintiffs’ FTCA-based negligence per se claim fares no better. The FTCA makes
it unlawful to engage in “[u]nfair methods of competition in or affecting commerce, and
unfair or deceptive acts or practices in or affecting commerce.” 15 U.S.C. § 45(a)(1). As
with HIPAA, the FTCA does not explicitly provide for a private right of action. And the
Act’s authorization of the Federal Trade Commission to enforce its provisions indicates
Congress’s intent against creating an implied right of action. See 15 U.S.C. § 45(m); cf.
Payne, 998 F.3d at 660 (observing, in the context of another federal statute, that Congress’s
grant of enforcement authority to the executive branch counsels against an implied right of
action). Though we have not yet addressed this issue, other Circuits have uniformly found
the FTCA does not contain an implied private right of action. See, e.g., Morrison v. Back
Yard Burgers, Inc., 91 F.3d 1184, 1187 (8th Cir. 1996); Am. Airlines v. Christensen, 967
F.2d 410, 414 (10th Cir. 1992); R.T. Vanderbilt Co. v. Occupational Safety & Health Rev.
Comm’n, 708 F.2d 570, 574 n.5 (11th Cir. 1983); Fulton v. Hecht, 580 F.2d 1243, 1248
n.2 (5th Cir. 1978); Holloway v. Bristol-Myers Corp., 485 F.2d 986, 1002 (D.C. Cir. 1973);
18
Carlson v. Coca-Cola Co., 483 F.2d 279, 280–81 (9th Cir. 1973). We think this conclusion
is correct and forecloses Plaintiffs’ claim.
But even assuming the FTCA does contain an implied private right of action, the
district court properly determined Plaintiffs failed to assert a violation. Their Amended
Complaint highlights supposed shortfalls in Walgreens’ information-privacy practices,
namely, its purported failure to “maintain the security and privacy of” patient’s PII, which
they contend resulted “in the unauthorized transfer, receipt, and/or use, disclosure, or
dissemination” of that PII. J.A. 61; see also Opening Br. 55 (discussing alleged
“unauthorized access”). But the only factual basis for this alleged violation is Walgreens’
internal transfer of information within various in-house electronic databases to be accessed
by Walgreens employees for purposes of processing a patient’s health care information for
a 340B billing determination. There are no allegations of any attempt—much less a
successful endeavor—by an unauthorized third-party to access Plaintiffs’ PII. Plaintiffs
have thus failed to state a claim under the FTCA, even assuming one exists. Therefore, we
affirm the district court’s dismissal of these claims.
I. Declaratory Relief
Finally, because all of Plaintiffs’ other claims fail as a matter of law, we affirm the
district court’s determination that they are not entitled to declaratory relief. See 28 U.S.C.
§ 2201(a) (requiring that there be an “actual controversy” before entering a declaratory
judgment).
19
III.
Accordingly, we affirm the district court’s judgment in full.
AFFIRMED
20