The opinion of the court was delivered by: McLaughlin, J.
The plaintiffs, Arthur Steinberg and the Philadelphia Federation of Teachers Health and Welfare Fund ("PFTHW"), bring this action on behalf of themselves and other Pennsylvania prescription drug purchasers against CVS Caremark Corporation ("Caremark") and CVS Pharmacy, Inc., in connection with the defendants' sale of information they provided when having their prescriptions filled. The operative complaint was filed on May 31, 2011 and brings claims under the Pennsylvania Unfair Trade Practices and Consumer Protection Law ("UTPCPL") as well as theories of unjust enrichment and invasion of privacy. The defendants have moved to dismiss the complaint for failure to state a claim. The Court will grant the defendants' motion.
This case was initially brought in the Philadelphia
Court of Common Pleas on March 7, 2011, and removed to this Court on April 7 under the Class Action Fairness Act of 2005. The plaintiffs filed their Amended Consumer Class Action Complaint ("CAC") on May 31, which the defendants moved to dismiss on July 25, arguing under Rule 12(b)(6) of the Federal Rules of Civil Procedure that the plaintiffs had failed to state a claim.
The CAC alleges that the defendants misused "confidential prescription information" provided by the plaintiffs when filling prescriptions. The plaintiffs bring several claims under state law for the defendants' (a) use of this data to send letters to consumers' physicians suggesting that they prescribe alternate drugs; (b) packaging and sale of certain consumer data to third parties; and (c) failure to disclose that consumers' data would be used in this manner. Steinberg brings UTPCPL and privacy claims against both defendants (Counts I & IV); both plaintiffs assert an unjust enrichment claim against Caremark (Counts II & III).
A. Allegations of the Complaint
Steinberg is an individual who purchased prescription medication at a CVS pharmacy located in Richboro, Pennsylvania. PFTHW is a trust providing benefits for members, retirees, spouses, and dependents of the Philadelphia Federation of Teachers Local 3 Union, including administration of prescription drug benefit plans. Through those plans, PFTHW reimbursed its members for prescriptions filled at CVS pharmacies. CAC ¶¶ 5-6, 9. The plaintiffs assert claims on behalf of a putative class of all Pennsylvania consumers and third-party payors who filled prescriptions at CVS pharmacies and were not notified that the defendants would use and sell their information in the ways described above. CAC ¶¶ 47-49. The defendants operate retail pharmacies, and Caremark operates as a pharmacy benefits manager, providing pharmacy services to numerous entities. CAC ¶ 8.
The CAC identifies several public representations that Caremark made in connection with its handling of consumer information. First, Caremark has a "Code of Conduct" for employees that it makes available on its website. The Code of Conduct states:
Our role in the health care industry requires us to collect and maintain the personal health information of those we serve. This data, also called "Protected Health Information" or PHI, is protected under federal and state privacy and security laws. These laws require that PHI, such as names, addresses, dates of birth, phone numbers, social security numbers, medical diagnoses, prescription histories and physician notations, be handled in a confidential manner. "Personally Identifiable Information" must also be protected. PII is any piece of information which can potentially be used to uniquely identify, contact, or locate a single person. It includes the demographic information associated with PHI, as well as other unique identifiers such as credit card data, email addresses, driver's licenses, fingerprints, or handwriting.
It is critical that those we serve . . . are able to count on us to protect their personal and health information. Remember, the people we serve trust CVS Caremark to use their PHI and PII only for purposes of providing our services to them.
CVS Caremark Code of Conduct at 8-9, CAC Ex. A.
Caremark's website also makes available guidelines from the American Pharmacists Association's Advisory Committee. These "Principles of Practice" describe the contours of the pharmacist-patient relationship, including how pharmacists should treat patient information. Specifically, the Principles state that "[p]atient-specific medical information must be collected, organized, recorded, and maintained," and that "[p]atient information must be maintained in a confidential manner." Principles of Practice for Pharmaceutical Care, CAC Ex. B.
Caremark issues a "Notice of Privacy Practices" to customers when they fill prescriptions in Pennsylvania. This document states:
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED . . . .
CVS/pharmacy wants you to know that nothing is more central to our operations than maintaining the privacy of your health information ("Protected Health Information" or "PHI"). PHI is information about you, including basic information that may identify you and relates to your past, present, or future health and the dispensing of pharmaceutical products to you. . . .
Our Pledge Regarding Your Health Information We are required by federal and applicable state law, regulations, and other authorities to protect the privacy of your health information and to provide you with this Notice. Our pharmacy staff is required to protect the confidentiality of your PHI and will disclose your PHI to a person other than you or your personal representative only when permitted under federal or state law. . . . In some circumstances, as described in this Notice, the law permits us to use and disclose your PHI without your express permission. . . . .
How We May Use and Disclose Your PHI Without Your Permission.
Treatment, Payment or Health Care Operations.
Below are examples of how Federal law permits use or disclosure of your PHI for these purposes without your permission:
1. Treatment: . . . Patient Contacts. We may contact you to provide treatment-related services, such as refill reminders, treatment alternatives (e.g., available generic products), and other health related benefits and services that may be of interest to you. . . .
Other Special Circumstances.
We are permitted under federal and applicable state law to use or disclose your PHI without your permission only when certain circumstances may arise, as described below.
We are likely to use or disclose your PHI for the following purposes:
Business associates: We provide some services through other companies termed "business associates". Federal law requires us to enter into business associate contracts to safeguard your PHI as required by CVS and by law. . . . .
You have the right to request a restriction or limitation on our use or disclosure of your PHI by submitting a written request to the CVS/pharmacy Privacy Office. You must identify in this request: (I) what particular information you would like to limit,
(ii) whether you want to limit use, disclosure, or both, and (iii) to whom you want the limits to apply. All requests will be carefully considered, but we are not required to agree to those restrictions. We will provide you with a written response to your request within 30 days.
Notice of Privacy Practices, CAC Ex. E (emphasis in original).
The CAC alleges that the defendants entered agreements with pharmaceutical manufacturers such as Eli Lilly and Company, Merck, AstraZeneca, and Bayer, whereby those companies funded mailings by Caremark to the physicians of the defendants' customers, urging them to consider prescribing alternative medications. The letters identified consumers by name, birth date, and the medications they had been prescribed, stating that such information had been obtained from consumers filling prescriptions at CVS pharmacies. The defendants also sold "confidential prescription information" obtained from consumers to third parties, including pharmaceutical manufacturers and data companies. CAC ¶¶ 17, 19-26.
The defendants did not state in the Code of Conduct or Notice of Privacy Practices that "confidential prescription information" would be sold to these entities, but Caremark executives admitted to the sale of this information in public pronouncements to investors and in other judicial proceedings. CAC ¶¶ 37-43; Change to Win Coalition, CVS Caremark: An Alarming Prescription (Nov. 2008) at 15-16, CAC Ex. F (noting that Caremark's Chief Executive Officer told investors that the company has "more information on the consumer and their behavior than anybody else, and we share it with our ...