Haywood v. Novartis Pharm. Corp.

• Decision Date: 16 January 2018
• Docket Number: No. 2:15–CV–373,2:15–CV–373
• Citation: 298 F.Supp.3d 1180
• Parties: Michelle HAYWOOD, Plaintiff, v. NOVARTIS PHARMACEUTICALS CORP., Defendant.
• Court: U.S. District Court — Northern District of Indiana

298 F.Supp.3d 1180

Michelle HAYWOOD, Plaintiff,

v.NOVARTIS PHARMACEUTICALS CORP., Defendant.

No. 2:15–CV–373

United States District Court, N.D. Indiana, Hammond Division.

Signed January 16, 2018

Tony Walker, The Walker Law Group PC, Gary, IN, for Plaintiff.

Ellen E. Boshkoff, Angela N. Johnson, Faegre Baker Daniels LLP, Indianapolis, IN, for Defendant.

OPINION AND ORDER

RUDY LOZANO, Judge

This matter is before the Court on the Defendant’s Motion to Dismiss Plaintiff’s First Amended Complaint, filed by the defendant, Novartis Pharmaceuticals Corporation, on December 27, 2016. (DE # 35.) For the reasons set forth below, the motion to dismiss is GRANTED . The clerk is DIRECTED to close this case.

BACKGROUND

Plaintiff, Michelle Haywood ("Haywood"), filed her complaint in state court on August 13, 2015. (DE # 4.) The complaint brought claims for negligence, negligent training and supervision, and public disclosure of private facts; it also listed "punitive damages" as a separate count. (Id. ) The defendant, Novartis Pharmaceuticals Corporation ("Novartis"), removed the matter to this Court on the basis of diversity jurisdiction on September 28, 2015. (DE # 1.) On November 2, 2015, Novartis filed a motion to dismiss the complaint. (DE # 14.) On September 27, 2016, the Court granted the motion, dismissed the complaint without prejudice, and granted Haywood thirty days to file an amended complaint. (DE # 28.) The first amended complaint was filed by Haywood on October 25, 2016. (DE # 30.) In Count one of her complaint, Haywood alleges that Novartis acted negligently when it disclosed personal information to her co-workers and supervisors via facsimile transmission which violated duties it owed to her under its privacy policy, under Indiana Code 25–26–13–15(b), and under the Health Insurance Portability and Accountability Act ("HIPPA"). In Count Two, Haywood alleges that Novartis was negligent in its training and supervision of its employees regarding the protection of customer privacy and confidentiality. Finally, in Count Three, Haywood alleges that she is entitled to punitive damages because Novartis acted with reckless indifference when it disclosed her protected information despite being told, in writing, not to do so. Novartis filed the instant motion to dismiss on December 27, 2016. (DE # 35.) Haywood filed her response on January 9, 2017. (DE # 37.) Novartis filed its reply on January 17, 2017. (DE # 38.) The motion is ripe for adjudication.

DISCUSSION

Facts

Novartis Patient Assistance NOW Oncology, a division of Novartis, administers the GLEEVEC Co-Pay Assistance Program (the "Program") in which eligible patients are given a GLEEVEC Co-Pay Card by Novartis to help offset the costs of their prescription medication. (DE # 30, p. 1.) Haywood applied for the Program, and on May 19, 2015, she sent Novartis a written statement requesting that no information regarding her application be sent to her place of employment. (Id. at 2.) On July 8, 2015, Novartis disclosed the following via facsimile transmission to Haywood’s co-workers and supervisors: her social security number, her date of birth, her income, her Medicare number, and information about her disease, treatment, and medical providers. (Id. )

According to the amended complaint, the website for the Program includes a privacy notice that states:

Novartis Pharmaceuticals Corporation and Novartis Group of Companies understand your personal and health information is private.

The personal information we collect from you, including your card or voucher usage, will be used to bring you information about products, programs, support, and services, to conduct market research, as required by federal regulations. Please be assured that although we share your personal information with our business partners who work with us on these activities, we do not permit them to use your personal information for their own marketing purposes. You may unsubscribe from our programs and services at any time by calling 1–888–669–6682. For more information about our privacy practices, please visit our website at www.usprivacy.novartis.com.

("Privacy Notice"). (Id. at 3.) Additionally, the amended complaint cites to the following privacy statement¹ that was found on the main Novartis website:

... This Privacy Statement tells you how we protect the privacy of personal information that you may provide to us.

As part of our commitment to privacy, Novartis has voluntarily certified to the U.S.–EU Safe Harbor Framework and the U.S.–Swiss Safe Harbor Framework as set forth by the U.S. Department of Commerce....

The purpose of this privacy statement is to explain what Novartis does with personally identifiable information that you provide to us, such as your name, address, age, and information relating to your medical conditions. We want you to know how your personally identifiable information will be protected, who we may share it with, and for what purposes.... The type of information collected from you will be based on the specific program that you register for, as indicated at the time of your registration. The information that we may ask you to provide may include your first and last name, your mailing address, your age, birth date, gender, e-mail address, and information about your medical conditions. Novartis limits the collection and processing of personal information to what is necessary to fulfill the purposes for which it is to be used.

... Many of our customers register for more than one Novartis program or service, through our websites, by calling Novartis, or through a third-party such as their healthcare provider. When you register with us more than once, we may combine your personally identifiable information as well as any anonymous computer information collected (see below) and store it collectively. This helps us keep track of all of your preferences in one organized place, and helps us provide information to you based on a more informed review of your requests and medical conditions of interest.

... We request your consent to collect your personally identifiable information when you seek to register for a Novartis program or service. In doing so, we also explain, for that program or service, what you are registering to receive and how we plan to use your personal information. We also offer you the option of discontinuing your consent (‘opting out’ or ‘unsubscribing’) if you later decide that you no longer want to participate in that program or receive additional information from us. If we wish to use this information for purposes incompatible from those for which the data was initially collected, we will offer an effective way to opt out of the secondary use.

... When you provide personally identifiable information to Novartis, it will be accessible to some of Novartis' business partners, such as companies we retain to fulfill requests for information, answer telephone calls from consumers, or provide assistance to us on specific programs or projects such as newsletters.... Novartis requires third-parties to whom it discloses personal data to protect personal information using substantially similar standards to those required by Novartis.

... Other departments within the Novartis group, and other Novartis companies that may receive your information will abide by substantially similar privacy requirements relating to your personally identifiable information.

... This Privacy Statement becomes effective on November 28, 2012. Novartis may update this Statement from time to time. We encourage you to review our Privacy Statement periodically.

("Privacy Statement"). (Id. at 3–4) (footnote omitted.) Haywood alleges that, when it disclosed her personal information to her co-workers and supervisors via facsimile, Novartis breached duties owed to her under the Privacy Notice and Privacy Statement, under Indiana Code 25–26–13–15(b), and under HIPPA. (Id. at 3–5.)

Analysis

In evaluating a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), a court must accept all facts alleged in the complaint as true and draw all reasonable inferences in the light most favorable to the plaintiff. Johnson v. Rivera , 272 F.3d 519, 520 (7th Cir. 2001). A complaint is not required to contain detailed factual allegations; however, the plaintiff must allege facts that state a claim to relief that is plausible on its face. Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). It is not enough that there might be some conceivable set of facts that entitle the plaintiff to relief.

Bell Atlantic Corp. v. Twombly , 550 U.S. 544, 553–56, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). The plaintiff’s obligation "requires more than labels and conclusions...." Id. at 555, 127 S.Ct. 1955. The Supreme Court has provided that "[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Iqbal , 556 U.S. at 678, 129 S.Ct. 1937.

Negligence and Negligent Training and Supervision

Novartis argues that Counts One and Two fail as a matter of law because Haywood has not properly alleged that Novartis owed her a legal duty or that any such duty, even if it existed, was breached. In response, Haywood asserts that Novartis owed her "multiple duties" based on its own policies, based on Indiana statutory law, and based on HIPPA.

In Indiana, "the tort of negligence is comprised of three elements: (1) a duty on the part of defendant in relation to the plaintiff; (2) the defendant’s breach of that duty; and (3) an injury to the plaintiff resulting from that failure." Kolozsvari v. Doe , 943 N.E.2d 823, 826–27 (Ind. Ct. App. 2011) (citing Miller v. Griesel , 261 Ind. 604, 308 N.E.2d 701, 706 (1974) ). "A duty to exercise care arises as a matter of law out of some relation existing between the parties, and it is the province of the court to determine whether such a relation gives rise to such duty." Id. at 827 (internal quotation marks and citation omitted). "Absent a...