UNPUBLISHED
UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT
No. 20-1767
J.R., individually and on behalf of her minor children A.R. and H.K.; J.H., individually, and on behalf of all others similarly situated; B.Y., individually, and on behalf of all others similarly situated; J.S., individually, and on behalf of all others similarly situated,
Plaintiffs – Appellants,
v. WALGREENS BOOTS ALLIANCE, INC.; WALGREEN CO., Defendants – Appellees.
Appeal from the United States District Court for the District of South Carolina, at Charleston. David C. Norton, District Judge. (2:19-cv-00446-DCN)
Argued: September 22, 2021 Decided: October 19, 2021
Before MOTZ and AGEE, Circuit Judges, and KEENAN, Senior Circuit Judge.
Affirmed by unpublished per curiam opinion.
ARGUED: Michael J. Moore, POPE MCGLAMRY KILPATRICK MORRISON & NORWOOD, P.C., Atlanta, Georgia, for Appellants. Robert N. Hochman, SIDLEY AUSTIN LLP, Chicago, Illinois, for Appellees. ON BRIEF: Charles W. Byrd, Aimee J. Hall, POPE MCGLAMRY KILPATRICK MORRISON & NORWOOD, P.C., Atlanta, Georgia; William N. Nettles, BILL NETTLES LAW, Columbia, South Carolina, for Appellants. David E. Dukes, Amanda S. Kitts, Adam J. Hegler, NELSON MULLINS
RILEY & SCARBOROUGH LLP, Columbia, South Carolina; Scott D. Stein, Matthew C. Bergs, Ross O. Kloeber, SIDLEY AUSTIN LLP, Chicago, Illinois, for Appellees.
Unpublished opinions are not binding precedent in this circuit.
3
PER CURIAM:
Six pharmacy customers (“Plaintiffs”) appeal from the district court’s dismissal of their twelve-count class action suit against Walgreens Boot Alliance, Inc. (“WBA”) and Walgreen Company (collectively, “Walgreens”). At bottom, Plaintiffs allege that the transfer of their personal identifying information (“PII”) from the Walgreens pharmacy filling their prescription to separate, internal company databases violates their rights under various federal and state statutes and state tort claims. For the following reasons, we affirm the judgment of the district court.
I.
We accept as true all well-pleaded allegations in Plaintiffs’ Amended Complaint and view it in the light most favorable to them. Ostrzenski v. Seigel, 177 F.3d 245, 251 (4th Cir. 1999). Through that lens, the relevant facts are as follows.
Congress enacted the 340B Drug Pricing Program (the “Program”) in 1992, which requires participating manufacturers to provide certain prescription drugs at significantly discounted prices to eligible and enrolled health care providers (“covered entities”). Covered entities typically serve low-income patients with limited access to health care. Given the cost savings involved, federal law expressly prohibits covered entities from “resell[ing] or otherwise transfer[ring]” a 340B drug “to a person who is not a patient of the entity.” 42 U.S.C. § 256b(a)(5)(B). Covered entities are subject to audits by both the Department of Health and Human Services and participating drug manufacturers. Sometimes lacking the resources to operate in-house pharmacies, covered entities often
4
engage a retail pharmacy (“contract pharmacy”) to dispense 340B-eligible drugs purchased by the covered entity to the low-income patient.
Relevant here, Walgreens is a 340B contract pharmacy for several covered entities in South Carolina, some of which provided Plaintiffs with medical services and use Walgreens pharmacies in South Carolina to fill their patients’ prescriptions. All South Carolina pharmacies must comply with the South Carolina Pharmacy Practice Act (the “PPA”), S.C. Code Ann. § 40-43-10 et seq.; the South Carolina Prescription Information Privacy Act (the “PIPA”), S.C. Code Ann. § 44-117-10 et seq.; and the American Pharmaceutical Association Code of Ethics.
In 2010, Walgreens created a separate division within its corporate organization, “340B Complete,” to oversee administration of its contract pharmacy operations and ensure compliance with the Program. This division is separate from other aspects of Walgreens’ operations, including its pharmaceutical, photo, and retail divisions. None of the 160 employees working in the 340B Complete division are licensed pharmacists.
When any patient seeks to fill a prescription at a Walgreens pharmacy, the pharmacist first enters the patient’s PII into a “proprietary computer software system” called IntercomPlus, which all Walgreens pharmacies nationwide can access. J.A. 36. That PII includes: the patient’s name, address, date of birth, payment information, and third- party reimbursement rate; the drug’s name, dosage, frequency, and refill information; and the prescribing physician’s information. The PII in IntercomPlus is then transferred to a “corporate central repository” called Enterprise Data Warehouse (“EDW”), J.A. 41, all of which is part of the same Walgreens corporate entity.
5
Walgreens markets to covered entities a commercial software product registered and trademarked as “340B Complete®,” which extracts the PII from EDW and compares it to the PII that a given Walgreens pharmacy received from a covered entity. Assuming there is a match, the 340B Complete® software transfers the PII on file in EDW into Walgreens’ 340B Complete payment process.
This data transferring occurs for purposes of replenishing the pharmaceutical drugs that a Walgreens pharmacy dispenses to a 340B patient. Under federal law, only a covered entity may purchase 340B drugs. Walgreens cannot. Using 340B Complete®, Walgreens performs a financial analysis to determine if it is less expensive to process payment through the patient’s insurance company. If so, Walgreens will submit the claim to insurance, retain the full insurance reimbursement amount as it would with any ordinary consumer, and purchase the resupply itself. If, however, it is cheaper for Walgreens to process the transaction as a 340B event, then 340B Complete® will designate it as such. This enables Walgreens to replenish the drug inventory through the covered entity for a 340B patient and not run afoul of the distinction between 340B and non-340B prescription drug purchases.
Nonetheless, Plaintiffs claim the transfer of their PII from the pharmacy filling their prescription to EDW, and the transfer from EDW to 340B Complete®, violates various rights. Among other claims, they allege that they never gave Walgreens permission to use or transfer their PII and that Walgreen’s Notice of Privacy Policy (“NPP”) did not inform them that their PII would be used in 340B Complete®.
6
II.
Plaintiffs filed a twelve-count class action Amended Complaint, seeking preliminary 1 and permanent injunctive relief, as well as “compensatory, exemplary, and punitive damages in amounts to be determined.” J.A. 80. The claims are as follows: (1) invasion of privacy: wrongful appropriation; (2) invasion of privacy: wrongful publicizing of private affairs; (3) negligence per se based on violations of the PIPA; (4) breach of contract; (5) negligence (based on violations of the PIPA, the PPA, and regulations issued by the South Carolina Board of Pharmacy); (6) negligence (based on a duty to disclose to Plaintiffs “the true facts about [Walgreens’] substandard patient privacy practices,” J.A. 67); (7) respondeat superior 2; (8) negligent training and supervision; (9) unjust enrichment; (10) violation of the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. §§ 1681–1681x; (11) negligence per se based on violations of the FCRA, 3 the Health Insurance Portability and
1 The district court denied Plaintiffs’ motion for a preliminary injunction. Plaintiffs’
appeal from that decision is currently being held in abeyance pending resolution of this appeal. See J.R. v. Walgreens Boots Alliance, Inc., No. 19-2404.
2 The district court dismissed this claim because “[r]espondeat superior is not a cause of action; it is a theory of liability.” J.R. Walgreens Boots Alliance, Inc., 470 F. Supp. 3d 534, 561 (D.S.C. 2020) (citing Austin v. Specialty Transp. Servs., Inc., 594 S.E.2d 867, 877 (S.C. Ct. App. 2004) (“Under the doctrine of respondeat superior, the employer is liable for the acts of an employee acting within the scope of employment.”)). Plaintiffs have waived any challenge to this aspect of the district court’s holding by failing to address it in their Opening Brief. See Carter v. Lee, 283 F.3d 240, 252 n.11 (4th Cir. 2002) (“[T]his Court normally views contentions not raised in an opening brief to be waived.”).
3 The district court found that Plaintiffs had “abandoned the FCRA claim” as well as their “negligence per se claim based on an alleged violation of FCRA.” J.R., 470 F. Supp. 3d at 550. Plaintiffs do not challenge this holding in their Opening Brief, and, as such, have waived it. See Carter, 283 F.3d at 252 n.11.
7
Accountability Act (“HIPAA”), and the Federal Trade Commission Act (“FTCA”); and (12) declaratory relief.
Walgreens filed a motion to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6), which the district court granted. 4 We have jurisdiction over Plaintiffs’ timely-filed appeal, see 28 U.S.C. § 1291, and review the district court’s dismissal de novo, Garnett v. Remedi SeniorCare of Va., LLC, 892 F.3d 140, 142 (4th Cir. 2018). 5
4 The district court separately granted WBA’s motion to dismiss for lack of personal jurisdiction. By way of background, WBA is a holding company that utilizes three divisions to conduct its operations, one of which is “Retail Pharmacy USA.” Walgreen Co. is a wholly owned WBA subsidiary, which operates the Retail Pharmacy USA division. Stated differently, Walgreen Co. operates all Walgreens pharmacies in the United States.
Plaintiffs challenge the district court’s dismissal of WBA on two grounds, arguing that: (1) WBA waived its jurisdictional challenge by asserting a merits-based defense to their preliminary injunction motion; and, alternatively, (2) WBA is subject to the Court’s jurisdiction because it is Walgreen Co.’s alter ego. Even if Plaintiffs are correct as to either theory, we would still affirm the district court’s dismissal of WBA because Plaintiffs alleged the same facts and deficient causes of action against both entities. And we must conduct that analysis regardless of whether the district court’s personal jurisdiction decision as to WBA was correct. Therefore, since the ultimate outcome would be the same even if we agreed with Plaintiffs’ jurisdictional arguments, we need not reach this issue to affirm. See East Coast Repair & Fabrication, LLC v. U.S. ex rel Dep’t of Navy, --- F.4th ---, 2021 WL 4780508, at *2 (4th Cir. 2021) (“[A] court may bypass a difficult jurisdictional question and ‘choose among threshold grounds for denying audience to a case on the merits . . . when considerations of convenience, fairness, and judicial economy so warrant.’” (quoting Sinochem Int’l Co. v. Malaysia Int’l Shipping Corp., 549 U.S. 422, 431-32 (2007)); see also Gremillion v. Chivatero, 749 F.2d 276, 277 (5th Cir. 1985) (per curiam) (affirming dismissal for failure to state a claim without addressing personal jurisdiction).
5 We have subject matter jurisdiction under 28 U.S.C. § 1332(d)(2) because the aggregated amount in controversy exceeds $5,000,000, and at least one of the proposed class members is diverse from Walgreens.
8
A. The Invasion of Privacy Claims “In South Carolina, there are three separate and distinct causes of action for invasion of privacy: (1) wrongful appropriation of personality; (2) wrongful publicizing of private affairs; and (3) wrongful intrusion into private affairs.” Sloan v. S.C. Dep’t of Pub. Safety, 586 S.E.2d 108, 110 (S.C. 2003) (per curiam). Plaintiffs brought claims under the first two theories, both of which the district court dismissed because there were no allegations that Walgreens publicized their PII.
The South Carolina Supreme Court has observed that “[e]ncompassed in these . . .
recognized torts is the infringement on the right of publicity.” Gignilliat v. Gignilliat, Savitz & Bettis, L.L.P., 684 S.E.2d 756, 760 (S.C. 2009) (emphasis added). After all, “[t]he right of privacy is defined as the right of an individual to be let alone and live a life free from unwarranted publicity.” Glassmeyer v. City of Columbia, 777 S.E.2d 835, 839 (S.C. Ct. App. 2015) (emphasis added).
As for wrongful appropriation of personality, the South Carolina Supreme Court has explained that the “gist” of that claim “is the violation of the plaintiff’s exclusive right at common law to publicize and profit from his name, likeness, and other aspects of personal identity.” Sloan, 586 S.E.2d at 110 (emphasis added). Wrongful publicizing of private affairs similarly “involves a public disclosure of private facts about the plaintiff . . . in which there is no legitimate public interest.” Snakenberg v. Hartford Cas. Ins. Co.¸ 383 S.E.2d 2, 6 (S.C. Ct. App. 1989). “The gravamen of the tort is publicity as opposed to mere publication.” Id.
9
According to South Carolina courts, “publicity” “means that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge.” Swinton Creek Nursery v. Edisto Farm Credit, ACA, 514 S.E.2d 126, 131 (S.C. 1999) (quoting Restatement (Second) of Torts § 652D cmt. a (Am. L. Inst. 1977)). Here, though Plaintiffs allege that their PII is accessible by the 160 non-pharmacist employees in Walgreen’s 340B Complete division, there is no assertion that Walgreens has publicized that information to the public at large. The alleged internal corporate disclosures are not “public” broadcasts, as the PII is only accessed by those employees for private, business purposes. Therefore, we agree with the district court that Plaintiffs failed to state a claim for invasion of privacy under South Carolina law.
B. Negligence Per Se Based on Violation of the PIPA South Carolina’s PIPA provides that “[n]o patient prescription drug information may be transferred or received by a person without the written consent of the patient or a person authorized by law to act on behalf of the patient.” S.C. Code Ann. § 44-117-30. The statute provides thirteen exceptions to this broad prohibition. Id. § 44-117-30(1)–(13). It further requires that pharmacies maintain “a mechanism to prevent the disclosure of” PII and other patient information. Id. § 44-117-350.
The PIPA does not expressly authorize a private right of action, and instead subjects violators to criminal penalties and a fine. Id. § 44-117-40. The district court, however, concluded there is an implied private right of action under the statute. Regardless of whether that decision was correct, we agree with the district court that Plaintiffs failed to
10
allege a substantive PIPA violation because Walgreens’ internal 340B Complete process did not involve a “transfer” or “receipt” of their PII, nor did Walgreens fail to prevent its “disclosure.”
The PIPA does not define what it means to “transfer,” “receive,” or “disclos[e]”
protected information, as set out in sections 44-117-30 and -350. Nor does South Carolina have any case law interpreting the PIPA. Relying on general principles of statutory interpretation, however, our goal is to “ascertain and effectuate the intent of the legislature,” by “giv[ing] the words found in the statute their plain and ordinary meaning.” CFRE, LLC v. Greenville Cnty. Assessor, 716 S.E.2d 877, 881 (S.C. 2011) (citations omitted); see also Askew v. HRFC, LLC, 810 F.3d 263, 266 (4th Cir. 2016) (explaining that federal courts sitting in diversity must, “if necessary, predict how the state’s highest court would rule on an unsettled issue” (citation omitted)).
With that in mind, we conclude the district court did not err in limiting the PIPA’s scope to external data transfers. Although the statute does not expressly modify the word “transfer,” that term’s plain meaning supports this narrow construction. The Webster’s Third New International Dictionary defines the verb “transfer” as “to carry or take from one person or place to another”; “to move or send to a different location esp. for business, vocational, or military purposes”; “to cause to pass from one person or thing to another”; “to make over or negotiate the possession or control over.” Transfer, Webster’s Third New Int’l Dictionary (2002) (emphases added). The Oxford English Dictionary similarly defines it in a way implicating only exchanges between legally distinct entities: “To convey or take from one place, person, etc. to another; . . . to give or hand over from one to another.”
11
Transfer, Oxford-English Dictionary Online, (Oxford Univ. Press, Sept. 2021) (emphases added). Naturally read, then, the PIPA’s prohibition on “transfer[s]” is only implicated when a patient’s PII leaves the custody of the corporate entity originally entitled to possess it (a “person”) to a different legal entity or natural person.
The exceptions to section 44-117-30’s general prohibition support this understanding of the text. They encompass—implicitly and explicitly—acceptable transfers of information from the authorized possessor to a person outside of that legal entity. In other words, they relate to external transfers of PII. For example, no violation of the PIPA occurs: when specified professionals providing treatment services to a patient communicate among themselves, § 44-117-30(2); when information must be transferred “to effect the recall of a defective drug or device,” § 44-117-30(4); when information must be transferred to “adjudicate or process payment claims for health care,” § 44-117-30(6), so long as the recipient does not further disclose the information; when an entity transfers information as part of a sale of a business to its successor in interest, § 44-117-30(10); or when the patient has authorized another person to pick up his prescription from the pharmacy, § 44-117-30(12). 6
6 Other PIPA provisions lend additional support. For example, section 44-117-50 states that PIPA’s prohibition does not invalidate the “authority of a court to issue a subpoena for medical records” or “the authority of a license or disciplinary board of this State” or “of the Department of Health and Environmental Control” to obtain patient records as authorized elsewhere. Yet again, in all of the delineated caveats, the transfer or receipt of PII involves a third party.
12
There is no textual basis for interpreting “transfer” and “receipt” 7 to apply to movements of data between parts of a single legal entity. As the district court ably expressed it, to adopt that construction would mean that a pharmacy would violate the PIPA any time it moved data “outside of the four walls of the pharmacy, [including] basic functions such as transmitting information for legal, administrative, or IT services that do not occur within the four walls of the pharmacy.” J.R., 470 F. Supp. 3d at 557. 8 Therefore, we affirm the district court’s dismissal of this claim.
C. Breach of Contract
Plaintiffs raised two breach of contract claims before the district court. First, they argued that when they gave Walgreens their PII, it implicitly agreed to take reasonable measures to secure that data, thereby creating an implied contract. Second, Plaintiffs claimed that Walgreens’ NPP was a contract, which the 340B Complete process violated. The district court rejected both theories. We agree.
First, there was no implied contract between Plaintiffs and Walgreens. An implied-
in-fact contract “arises when the assent of the parties is manifested by conduct, not words.”
7 To “receive” means “to take possession or delivery of,” suggesting that the information was not previously possessed by that legal entity. Receive, Webster’s New Int’l Dictionary (2002).
8 And while Plaintiffs now argue that the PIPA prohibits the initial exchange of information from the pharmacy-entered database IntercomPlus to the corporate-controlled database EDW, they did not make that assertion in the district court, instead limiting their argument to the later transfer from EDW to 340B Complete for analysis. As such, that part of the claim is waived. See Holland v. Big River Mins. Corp., 181 F.3d 597, 605 (4th Cir. 1999) (“Generally, issues that were not raised in the district court will not be addressed on appeal.”).
13
Thomerson v. DeVito, 844 S.E.2d 378, 384 n.10 (S.C. 2020) (quoting Stanley Smith & Sons v. Limestone College, 322 S.E.2d 474, 478 n.1 (S.C. Ct. App. 1984)). To be valid, “[t]he parties must manifest their mutual assent to all essential terms,” so “[i]f one of the parties has not agreed, then a prerequisite to formation of the contract is lacking.” Stanley Smith, 322 S.E.2d at 477. Plaintiffs alleged no facts indicating that at the time they agreed to purchase prescription drugs from a Walgreens pharmacy, both they and Walgreens implicitly agreed that Walgreens would not use their PII in the 340B Complete process. See J.A. 44 (alleging that Plaintiffs were “unaware of” Walgreens’ use of Plaintiffs’ PII). Thus, there is no basis to conclude that they entered into an implied contract with Walgreens that included a term restricting its use. Indeed, Plaintiffs alleged that Walgreens’ NPP provided customers “the right to request additional restrictions on [Walgreens’] use or disclosure” of PII, J.A. 35, but they did not allege that they ever asked for such additional restrictions, further indicating a lack of agreement between the Parties. 9 Second, there was no actionable “breach” of the NPP. If a company’s privacy policy “does not contain any exchange [of promises],” no enforceable contract exists. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 610–11 (9th Cir. 2020) (holding a privacy policy was not a contract because it “merely provides information––not commitments––regarding Facebook’s use of information and how users can control that information”); Brush v. Miami Beach Healthcare Grp. Ltd., 238 F. Supp. 3d 1359, 1367
9 Plaintiffs cite data breach cases holding that there is an implied contract to keep a person’s sensitive data reasonably secure. Those cases are inapposite because there is no allegation that Walgreens was hacked or otherwise disclosed the PII to any outside party.
14
(S.D. Fla. 2017) (holding the defendant pharmacy’s privacy policy was not a contract because it merely recounted patients’ rights under federal law, which defendant was already required to comply with irrespective of the bargain with plaintiff). That same logic applies here by Plaintiffs’ own allegations, which show that Walgreens’ NPP merely informs patients of what it is “required by law” to do and “provide[s] notice of [Walgreens’] ‘legal duties and privacy practices with respect to [PII].’” J.A. 34–35. Therefore, we affirm the district court’s dismissal of Plaintiffs’ breach of contract claims.
D. Negligence Under the PPA Next, Plaintiffs argue Walgreens’ purported breach of duties established by professional standards amounts to negligence. The district court correctly rejected this claim. The Supreme Court of South Carolina has squarely held that the PPA only “regulate[s] the licensing and practice of pharmacists; . . . [its] provisions do not set forth, explicitly or implicitly, a duty of confidentiality.” Evans v. Rite Aid Corp., 478 S.E.2d 846, 847 (S.C. 1996). Thus, Plaintiffs’ claim that the PPA imposes a duty of care to “maintain the confidentiality of [Plaintiffs’] PII,” J.A. 72, is foreclosed.
Plaintiffs also assert that there is a general duty to “maintain a pharmacy patient record system with adequate security and systems safeguards to prevent unauthorized access of pharmacy patient records.” J.A. 72. That is one of the PPA’s requirements. See S.C. Code Ann. § 40–43–86(O)(3). Assuming that this is sufficient evidence of a duty to do so, Plaintiffs have nevertheless failed to allege a breach of that duty. There are no allegations that unauthorized persons obtained access to Plaintiffs’ PII, and Plaintiffs have cited no authority to plausibly establish that a non-pharmacist Walgreens employee’s
15
access to that data to determine if a transaction qualifies for the 340B program is “unauthorized.”
E. General Negligence
Plaintiffs further allege that Walgreens “fail[ed] to conform to the privacy practices universally recognized and accepted in the pharmaceutical profession.” J.A. 68. There are no factual allegations from the American Pharmaceutical Code of Ethics or the South Carolina Board of Pharmacy’s promulgated rules that show what constitutes those “universally recognized and accepted” practices or how Walgreens purportedly violated them. The same logic applies to the alleged duty to “exercise reasonable care to protect [Plaintiffs] against the risk of foreseeable harm from their actions.” Opening Br. 45. Without any facts plausibly demonstrating the precise duty Walgreens is alleged to have breached, the district court properly determined that Plaintiffs failed to plausibly establish that Walgreen’s 340B Complete process constitutes a breach. See Evans, 478 S.E.2d at 848 (holding there is no common law duty of confidentiality for pharmacists).
F. Negligent Training and Supervision Claims South Carolina recognizes a cause of action for negligent supervision, Degenhart v.
Knights of Columbus, 420 S.E.2d 495, 496 (S.C. 1992), but negligent training is merely a subset of a negligent supervision claim, e.g., Beneficial Financial I, Inc. v. Windham, 847 S.E.2d 793, 804–05 (S.C. Ct. App. 2020). Under South Carolina law,
[a]n employer may be liable for negligent supervision when (1) his employee intentionally harms another when he is on the employer’s premises, is on premises he is privileged to enter only as employee, or is using the employer’s chattel; (2) the employer knows or has reason to know he has the
16
ability to control the employee; and (3) the employer knows or has reason to know of the necessity and opportunity to exercise such control.
Doe v. Bishop of Charleston, 754 S.E.2d 494, 500 (S.C. 2014) (emphasis added) (citing Degenhart, 420 S.E.2d at 496).
Here, as the district court observed, there is no allegation of any intentional conduct on the part of any Walgreens employee. Further, because there has been no cognizable “harm” to Plaintiffs arising from any Walgreens employee’s conduct, we find that component of the negligent supervision claim also has not been adequately alleged. Therefore, we affirm the dismissal of these claims.
G. Unjust Enrichment
To recover for unjust enrichment in South Carolina, a plaintiff must prove: “(1) [a]
benefit conferred by plaintiff upon the defendant; (2) realization of that benefit by the defendant; and (3) retention of the benefit by the defendant under circumstances that make it inequitable for him to retain it without paying its value.” Myrtle Beach Hosp., Inc. v. City of Myrtle Beach, 532 S.E.2d 868, 872 (S.C. 2000). The district court dismissed Plaintiffs’ unjust enrichment claim because they failed to allege that they “reasonably expected payment from the unconsented use of their PII.” J.R., 470 F. Supp. 3d at 563. Plaintiffs argue there is no such requirement in bringing an unjust enrichment claim and that the district court erroneously added this as an additional element.
We need not resolve this dispute, however, because Plaintiffs’ concession that they voluntarily “provide[d] their PII to Walgreens’ pharmacy for the intended purposes of obtaining, and allowing Walgreen’s pharmacy to seek third-party payment for, their
17
individual prescriptions,” J.A. 36 (emphasis added), defeats any allegation that its acquisition and use of the PII was somehow “inequitable.” Stated differently, Walgreens could not have acted unjustly by using Plaintiffs’ PII for the very purpose they intended for it to be used. Therefore, we affirm the district court’s dismissal of Plaintiffs’ unjust enrichment claim. See Scott v. United States, 328 F.3d 132, 137 (4th Cir. 2003) (“We are, of course, entitled to affirm on any ground appearing in the record, including theories not relied upon or rejected by the district court.”).
H. Negligence Per Se Based on HIPAA and FTCA Violations We turn next to Plaintiffs’ negligence per se claims based on violations of HIPAA and the FTCA. “Negligence per se is negligence arising from a defendant’s violation of a statute.” Wogan v. Kunze, 623 S.E.2d 107, 117 (S.C. Ct. App. 2005). To make out such a claim, Plaintiffs must demonstrate that the statute allegedly violated allows for a private cause of action. See Doe v. Marion, 645 S.E.2d 245, 248 (S.C. 2007). That analysis turns on whether the legislature intended to permit a private action, either explicitly or implicitly. Id. But legislative intent can be implied “only if the legislation was enacted for the special benefit of a private party.” Id.
HIPAA addresses various aspects of confidentiality of health care information, including requirements about how electronic health care information is stored. The district court concluded that there was no implied private right of action under HIPAA, meaning it could not support a negligence per se claim. We agree. Recently, we joined our sister circuits in holding that HIPAA does not create a private right of action. See Payne v. Taslimi, 998 F.3d 648, 660 (4th Cir. 2021) (“Every circuit court to consider whether
18
HIPAA created a private right to sue has found that it does not. This is because HIPAA does not expressly allow for a private cause of action but delegates enforcement authority to the Secretary of the Department of Health and Human Services, reflecting Congress’s intent to forgo creating a private remedy. We see no reason to chart a different course from our sister courts. [The plaintiff] has no private right of action under HIPAA.” (internal citations omitted)). Therefore, the district court properly dismissed Plaintiffs’ negligence per se claim based on an alleged HIPAA violation.
Plaintiffs’ FTCA-based negligence per se claim fares no better. The FTCA makes it unlawful to engage in “[u]nfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce.” 15 U.S.C. § 45(a)(1). As with HIPAA, the FTCA does not explicitly provide for a private right of action. And the Act’s authorization of the Federal Trade Commission to enforce its provisions indicates Congress’s intent against creating an implied right of action. See 15 U.S.C. § 45(m); cf. Payne, 998 F.3d at 660 (observing, in the context of another federal statute, that Congress’s grant of enforcement authority to the executive branch counsels against an implied right of action). Though we have not yet addressed this issue, other Circuits have uniformly found the FTCA does not contain an implied private right of action. See, e.g., Morrison v. Back Yard Burgers, Inc., 91 F.3d 1184, 1187 (8th Cir. 1996); Am. Airlines v. Christensen, 967 F.2d 410, 414 (10th Cir. 1992); R.T. Vanderbilt Co. v. Occupational Safety & Health Rev. Comm’n, 708 F.2d 570, 574 n.5 (11th Cir. 1983); Fulton v. Hecht, 580 F.2d 1243, 1248 n.2 (5th Cir. 1978); Holloway v. Bristol-Myers Corp., 485 F.2d 986, 1002 (D.C. Cir. 1973);
19
Carlson v. Coca-Cola Co., 483 F.2d 279, 280–81 (9th Cir. 1973). We think this conclusion is correct and forecloses Plaintiffs’ claim.
But even assuming the FTCA does contain an implied private right of action, the district court properly determined Plaintiffs failed to assert a violation. Their Amended Complaint highlights supposed shortfalls in Walgreens’ information-privacy practices, namely, its purported failure to “maintain the security and privacy of” patient’s PII, which they contend resulted “in the unauthorized transfer, receipt, and/or use, disclosure, or dissemination” of that PII. J.A. 61; see also Opening Br. 55 (discussing alleged “unauthorized access”). But the only factual basis for this alleged violation is Walgreens’ internal transfer of information within various in-house electronic databases to be accessed by Walgreens employees for purposes of processing a patient’s health care information for a 340B billing determination. There are no allegations of any attempt—much less a successful endeavor—by an unauthorized third-party to access Plaintiffs’ PII. Plaintiffs have thus failed to state a claim under the FTCA, even assuming one exists. Therefore, we affirm the district court’s dismissal of these claims.
I. Declaratory Relief
Finally, because all of Plaintiffs’ other claims fail as a matter of law, we affirm the district court’s determination that they are not entitled to declaratory relief. See 28 U.S.C. § 2201(a) (requiring that there be an “actual controversy” before entering a declaratory judgment).
20
III.
Accordingly, we affirm the district court’s judgment in full.
AFFIRMED