Costco Sued for Disclosing Erectile Dysfunction Prescription to Patient’s Ex-Wife

The Arizona Supreme Court has ruled that a lawsuit may proceed against Costco based on a pharmacy error.

The patient visited his physician for a check-up and refill of his usual medication. The doctor also gave him a sample of an erectile dysfunction (ED) medication.

When the patient went to Costco to pick up his regular prescription, he was notified that a full prescription of the ED medication was also ready. The patient told the pharmacy he did not want the ED medication and asked that it be cancelled, which was acknowledged by the pharmacy employee.

A month later, the patient called to check on his regular prescription refill and was told that it and the ED prescription were ready. Again, the patient told the pharmacy he did not want the ED medication and the pharmacy acknowledged this.

The next day, he called the pharmacy asking if his ex-wife, with whom he was exploring possible reconciliation, could pick up his regular prescription. The employee said yes, and that the prescription was ready for pickup.

When the patient’s ex-wife went to the pharmacy, she was given both the regular and the ED prescription, which she joked with the pharmacy employee about and refused to accept. When she returned to the patient, she told him that she knew about the ED medication and did not want to reconcile with him. She later told his children and friends about the medication.

The patient complained to Costco headquarters about the disclosure of the ED meds and received a written response acknowledging a violation of Costo’s privacy policy and HIPAA. The patient then sued Costco.

Costco moved to dismiss the suit, and the trial court granted its request, holding that the claims were preempted by HIPAA. The state Supreme Court disagreed, however, and has reinstated the case, holding that the patient “permissibly referenced HIPAA in his complaint to inform the standard of care in his negligence claim.”

It’s important to note that while there is no private right of action for HIPAA violations, it does not preclude state law tort claims, which this case has now been characterized.