CVS Pharmacy, Inc. v. Press Am., Inc.

• Citation: 377 F.Supp.3d 359
• Decision Date: 27 March 2019
• Docket Number: 1:17-cv-190-GHW
• Parties: CVS PHARMACY, INC., and Caremark Rx, LLC, Plaintiffs, v. PRESS AMERICA, INC., Defendant.
• Court: U.S. District Court — Southern District of New York

377 F.Supp.3d 359

CVS PHARMACY, INC., and Caremark Rx, LLC, Plaintiffs,

v.PRESS AMERICA, INC., Defendant.

1:17-cv-190-GHW

United States District Court, S.D. New York.

Signed March 27, 2019

Frank E. Pasquesi, Ungaretti & Harris LLP, Chicago, IL, Adam Gregory Pence, Foley & Lardner, LLP, New York, NY, for Plaintiffs.

David E. Heiss, Pro Hac Vice, Iga Wiktoria Cyganczuk, John Rooks, Jr., Peter E. Kanaris, Fisher Kanaris P.C., Chicago, IL, for Defendant.

MEMORANDUM OPINION AND ORDER

GREGORY H. WOODS, District Judge:

Press America, Inc. ("Press America") contracted to print and mail letters for Plaintiffs CVS Pharmacy, Inc. and Caremark Rx, LLC. The letters were related to Plaintiffs' pharmaceutical benefits program, so the parties were aware that the contract involved some risk that letters containing individuals' private health care information would be misdirected. Press America indemnified Plaintiffs for any claims or liabilities arising from its negligence. What Press America did not know was that Plaintiffs had entered into a contract with International Business Machines Corporation ("IBM"), requiring that Plaintiffs pay IBM $ 45,000 for each piece of misdirected mail—a payment obligation that IBM and CVS transparently referred to as a "penalty." Press America learned that information the hard way. After Press America errantly mailed 41 letters to the wrong people, IBM sought $ 1.845 million ($ 45,000*41) from CVS. CVS paid without much fuss, then demanded that Press America reimburse it for that amount pursuant to its indemnity. Press America refused, leading to this lawsuit. Because Press America has established that CVS's payment was an unenforceable penalty, and therefore was not founded upon any legal liability to CVS, Press America need not reimburse CVS pursuant to its contractual indemnity. For that and the other reasons described below, the parties' cross motions for summary judgment are GRANTED IN PART and DENIED IN PART.

I. BACKGROUND AND FACTS¹

A. The Parties: Press America and CVS

CVS Pharmacy Inc. ("CVS Pharmacy") and Caremark Rx, L.L.C. ("Caremark", and collectively with CVS Pharmacy, "CVS"), are in the pharmacy business. Among other things, CVS administers prescription drug plans for clients as part of what are referred to as "pharmacy benefits management programs" ("PBMs"). Joint Statement ¶ 1. As part of its administrative obligations to its clients, CVS contacts its clients' employees, retirees, and dependents about their prescription medications, in particular, when it is time for them to renew their prescriptions. Id. ¶ 2-3. CVS mails notices to PBM members about such matters.

Aptly named, Press America, Inc. ("Press America") prints and distributes mass mailings for its customers. Press America had served as a vendor for CVS since approximately 1990. Id. ¶ 4. In 2010, CVS began talks with Press America for Press America to provide printing and mailing services to CVS in connection with CVS's PBM business. Those discussions ultimately yielded fruit in February 2012, when CVS and Press America entered into the series of agreements that are the subject of this litigation. Id. ¶ 7.

B. CVS's Relationship with IBM

One of CVS's PBM clients was International Business Machines Corporation ("IBM"). In early 2011, IBM issued a request for proposals, seeking bids from companies to administer a PBM plan for IBM's PBM members. Id. ¶ 96. One of the requirements of the request for proposals was that any potential bidder agree to provide a "performance guarantee" to protect members' personally identifiable information ("PII") and protected health information ("PHI"). Id. ¶ 98. In particular, IBM made clear that bidders would have to compensate IBM for each security incident, including inadvertent disclosures of members' PII or PHI. Id. ¶¶ 98-99. CVS submitted a bid in response to the request for proposals, and won. Id. ¶¶ 97, 100.

IBM and CVS set about negotiating a contract to govern their relationship. For purposes of this litigation, the most significant feature of their negotiations involved the "performance guarantee" that IBM had required as part of its request for proposals. IBM viewed their requested provision "as different, it was new...." Declaration of Adam Pence ("Pence Decl."), Dkt. No. 89, Ex. 29, Transcript of Deposition of IBM 30(b)(6) witness, Tobe Mizels ("Mizel Tr.") 129:3-4. CVS also believed that the performance guarantee request was "unique" in the industry. Joint Statement ¶ 34. (When Press America learned of the provision following the claim that led to this litigation, they too believed it to be a novel requirement for a contract of this sort; it was, in their view "way out of left field.") Id. ¶ 30. Not only did IBM want CVS to pay a penalty if it failed to meet its performance guarantee, it wanted the amount of its vendor's potential liability to be uncapped. Mizel Tr. at 129:3-4. The provision was a focus of the negotiations between CVS and IBM.

IBM and CVS entered into a Letter of Understanding (the "LOU") on December 29, 2011, to be effective January 1, 2012. Pence Decl. Ex. 30. The LOU was a binding contract, but it was understood by the parties as an interim step, bridging the way to a final agreement. In the LOU itself, the parties agreed to "further negotiate in good faith to execute the Pharmacy Benefits Management Services Agreement and [to] use best efforts to complete this work as soon as possible." LOU at 2. The LOU was structured so that it would automatically terminate when the final agreement was consummated. Id.

In the LOU, CVS agreed to "comply with the performance standards described in Exhibit C of this Letter of Understanding." Id. Exhibit C to the LOU, in turn, required CVS to meet an "Ongoing Performance Standard." The relevant performance standard at issue here is Number 26:, Security Incidents, described as the following:

Security incidents, including inadvertent disclosures, involving Confidential Participant Information or Protected Health Information: a) must be reported to IBM as quickly as possible and no later than 24 hours after knowledge of security incident (including magnitude of data exposure); b) root cause analysis must be performed and communicated to IBM no later than 72 hours after knowledge of security incident; c) a full corrective plan of action must be provided to IBM no later than five business days after knowledge of security incident.

LOU at 25.

Failure by CVS to meet this performance standard had real consequences under the LOU—it triggered a "penalty." For each breach, the LOU provided that CVS would be on the hook for the "Fees at Risk per Period" (with, again, each "Period" defined as a single breach). Id. The amount at risk was defined as follows: "Penalty of 3% of total annual administrative fees at risk shall apply for each security incident, inadvertent disclosure or breach, as well as $ 25,000 for each failure to meet any of the standards for follow-up." Id. (emphasis added). While the penalties associated with breaches of other "performance guarantees" under the LOU were capped at $ 1,500,000 per year, breaches of the "Security Incidents" standards could result in an unlimited amount of penalty obligations. See LOU at 18 ("the maximum penalty that CVS Caremark shall have at risk for any Agreement Year is $ 1,500,000 for the performance guarantees listed in Table B, excluding PG # 26 Security Incidents."). Of course, it was this uncapped, "different," and "new" performance guarantee that led to this lawsuit.

In general, CVS treated all of its client contracts as confidential. Joint Statement ¶ 110. But the LOU did not contain a contractual provision requiring that it be maintained in confidence.

After CVS and IBM entered into the LOU, they continued to negotiate a final contract. Id. ¶ 112. Among the provisions that they negotiated was the nature of what would constitute a "Security Incident" under the performance guarantee. Id. ¶ 113. Eventually, IBM and CVS executed a final contract on March 28, 2013 (the "Final IBM Agreement"). Id. ¶ 118; Pence Decl. Ex. 31. That final contract states that it is "effective January 1, 2012," however, IBM and CVS agree that the LOU governed the parties' relationship prior to the date of its execution. Joint Statement ¶¶ 118-119. And, in particular, IBM's representative agreed that the "performance guarantee penalties" established in the LOU were the ones that applied until the final contract was signed. Id. ¶¶ 115-116.

Given that the LOU governed at the time of the incident that provoked this litigation, the terms of the Final IBM Agreement are not significant for purposes of the Court's resolution of this motion—it was not the governing agreement at the time.² But CVS argues that the Final IBM Agreement "best represents the understanding of the parties, even during the time between the execution of the LOU and the final agreement." Plaintiff's Memorandum of Law in Support ("P's Aff. Mem."), Dkt. No. 86, at 8. Perhaps not coincidentally, in the Final IBM Agreement, concluded following the incident that instigated this suit, references to the consequences of a violation of a performance guarantee as "penalties" were scrubbed. Instead, they are described as "fee adjustments."

In particular, in Section 3.13 of the Final IBM Agreement, CVS agrees that if it

fails to satisfy the performance standards in Exhibit D, CVS Caremark's fees shall be adjusted as described in Exhibit D. Measurements related to the performance standards described in Exhibit D shall be reported to CVS Caremark quarterly within 60 calendar days after the end of each quarter. Performance for the purpose of fee adjustment shall be measured on a quarterly basis and CVS Caremark shall credit the Plan for any payments due within thirty (30) days after the issuance of the quarterly performance standard report.

Final IBM Agreement § 3.13 (emphasis added). The performance guarantee is triggered by a "Protection of Information Failure" as defined...