IN THE UNITED STATES DISTRICT COURT 

FOR THE SOUTHERN DISTRICT OF OHIO 

EASTERN DIVISION 

JOHN DOE ONE; JOHN DOE TWO; and 

JOHN DOE THREE, on behalf of themselves 

and all similarly situated individuals, 

Plaintiffs, 

v. 

CAREMARK, L.L.C.; FISERV, INC.; 

FISERV SOLUTIONS, LLC; and 

DEFENDANTS DOES 1–10, 

Defendants. 

) 

) 

) 

) 

) 

) 

) 

) 

) 

) 

) 

) 

) 

)

CIVIL ACTION 

FILE NO. 2:18-cv-238 

CHIEF JUDGE EDMUND A. 

SARGUS, JR. 

Magistrate Judge Chelsey M. Vascura 

DEFENDANT CAREMARK, L.L.C.’S MOTION TO DISMISS 

THE AMENDED COMPLAINT 

Defendant Caremark L.L.C. (“Caremark”) moves to dismiss the Amended Class Action 

Complaint (ECF 38) of Plaintiffs John Does One, Two and Three. Caremark relies on the attached 

Memorandum of Law in support of this Motion. 

[SIGNATURE ON FOLLOWING PAGE] 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 1 of 19 PAGEID #: 196
- 2 - 

Respectfully submitted, this 26th day of June, 2018. 

/s Robert G. Cohen

Robert G. Cohen (0041707) 

KEGLER BROWN HILL + RITTER CO., LPA 

65 East State Street, Suite 1800 

Columbus, Ohio 43215 

Phone: 615-462-5492 

Fax: 614-462-2634 

rcohen@keglerbrown.com 

Kristine M. Brown (admitted pro hac vice) 

Donald M. Houser (admitted pro hac vice) 

Matthew L.J.D. Dowell (admitted pro hac vice) 

ALSTON & BIRD LLP 

1201 West Peachtree Street 

Atlanta, Georgia 30309 

Phone: 404-881-7434 

Fax: 404-881-7777 

kristy.brown@alston.com 

donald.houser@alston.com 

matt.dowell@alston.com 

Attorneys for Caremark L.L.C.

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 2 of 19 PAGEID #: 197
MEMORANDUM OF LAW IN SUPPORT OF CAREMARK L.L.C.’S 

MOTION TO DISMISS 

Plaintiffs’ Amended Class Action Complaint, ECF 38 (“Amended Complaint” or “Am. 

Compl.”) should be dismissed because Plaintiffs fail to state any plausible claim for relief. Each 

of Plaintiffs’ claims depends on the alleged disclosure of protected information to third parties. 

Caremark established in its initial Motion to Dismiss that Plaintiffs failed to plead this requisite 

element. The amendment changes nothing in that regard – Plaintiffs still do not plausibly allege 

that any protected information was actually disclosed to a third party. This shortcoming dooms 

Plaintiffs’ claims and requires dismissal of their claims against Caremark in their entirety. 

Plaintiffs’ claims also fail because the legal causes of action Plaintiffs have chosen to assert 

simply do not apply to Caremark. More specifically, Plaintiffs’ Biddle claim in Count I of the 

Amended Complaint only applies to physicians and hospitals. Plaintiffs cannot and do not allege 

Caremark is a physician or hospital. Count II fails for similar reasons – the statute does not apply 

because Caremark is not a government entity and because Caremark provides pharmacy benefits 

services, not healthcare services. Count II also fails because Plaintiffs fail to allege facts showing 

that Caremark knowingly violated Ohio’s AIDS disclosure statute. Finally, Plaintiffs’ remaining 

Counts should be dismissed because they do not assert independent causes of action; they are 

subsumed in – and are otherwise duplicative of – Plaintiffs’ Biddle claim and fail for the same 

reasons that claim fails. For these reasons, and as set forth more fully below, Plaintiffs’ claims 

against Caremark should be dismissed. 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 3 of 19 PAGEID #: 198
- 2 - 

I. SUMMARY OF AMENDED COMPLAINT ALLEGATIONS1

Plaintiffs allege they are members of the Ohio HIV Drug Assistance Program (“OHDAP”). 

See Am. Compl. ¶¶ 2-4. In 2017, Caremark, L.L.C. (“Caremark”) entered into an agreement with 

the State of Ohio whereby Caremark would serve as the pharmacy benefits manager for OHDAP. 

Id. ¶ 5. Plaintiffs allege that the “agreement resulted in [Caremark] being responsible” for sending 

letters containing membership cards and other information to “an estimated 6,000 participants in 

OHDAP.” Id. ¶ 18. The letters were mailed in envelopes with glassine windows, and above the 

addressee information, the program identification number “PM 6402 HIV” was allegedly visible. 

Id. ¶ 19. Plaintiffs allege that they each received the letter in August 2017. Id. ¶¶ 2-4. 

Plaintiffs filed this lawsuit more than six months later, asserting common law and statutory 

claims based on an alleged “disclosure” of protected information. See ECF 1. Plaintiffs amended 

their original complaint after Defendants moved to dismiss on the grounds that, inter alia, 

Plaintiffs failed to allege that their HIV status was disclosed to a third party. In the Amended 

Complaint, Plaintiffs tack on the conclusory allegation that their protected health information has 

been disclosed to Fiserv and the United State Postal Service (“USPS”), presumably because those 

entities were involved in the delivery of the letters. See id. ¶¶ 45-46. But even with this 

amendment, Plaintiffs still fail to allege any facts making it plausible that anyone other than 

themselves saw their respective letters and read the program identification number, much less that 

anyone – including any employee of Fiserv or the USPS – learned their HIV status as a result of 

1

 Caremark summarizes the allegations in the Amended Complaint because they must be taken as 

true for purposes of this Motion. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Caremark does 

not, however, concede the veracity of the Amended Complaint’s allegations and reserves the right 

to challenge them. 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 4 of 19 PAGEID #: 199
- 3 - 

that information. Plaintiffs do not allege, for instance that their letters were sent to the wrong 

address or received by a third party. 

Instead, Plaintiffs base their claims on speculation and possibility – that a third party could 

have seen the program identification number, read it, and then concluded that they were HIV 

positive. More specifically, Plaintiff John Doe One alleges that he is “concerned that members of 

his local community have or will learn of his HIV status” (id. at ¶ 31(a)), but does not identify 

anyone who has actually learned of his HIV status as a result of the letter at issue. Plaintiff John 

Doe Two “fears the stigma that would result from the disclosure of his HIV status” (id. at ¶ 31(b)), 

but does not identify any actual disclosure or stigma. Plaintiff John Doe Three is concerned that 

friends and relatives “would have seen this mailing” (id. at ¶ 31(c)), but does not identify anyone 

who actually saw the “PM 6402 HIV” code, much less that someone learned his HIV status after 

seeing that information. 

II. STANDARD OF REVIEW 

Caremark moves to dismiss under Rule 12(b)(6) for failure to state a claim. This Court 

should dismiss Plaintiffs’ claims if Plaintiffs fail to plead sufficient allegations “to raise . . . [their] 

right to relief above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). 

This requires “more than labels and conclusions” (id.), and “an unadorned, the-defendantunlawfully-harmed-me accusation” will not do. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A 

complaint “must contain sufficient factual matter, accepted as true, to state a claim to relief that is 

plausible on its face.” Id. at 679 (internal quotation marks and citation omitted). In short, Plaintiffs 

must allege facts that suggest more than the “mere possibility of misconduct.” Id.

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 5 of 19 PAGEID #: 200
- 4 - 

III. ARGUMENT AND CITATION TO AUTHORITIES 

A. Plaintiffs Do Not Plausibly Allege That Caremark Disclosed Protected 

Information. 

Plaintiffs’ claims in Counts I and II require them to prove that Caremark disclosed 

information protected by Ohio law to third parties:2

 In Count I, Plaintiffs seek to recover for the alleged “unauthorized, unprivileged 

disclosure” of their HIV status. Am. Compl. ¶¶ 42-49. This claim is based on the tort for 

breach of confidence announced in Biddle v. Warren General Hospital, 715 N.E.2d 518 

(Ohio 1999), which creates liability (in relevant part) for the “unauthorized, unprivileged 

disclosure to a third party of nonpublic medical information.” Id. at 523 (emphasis 

added). 

 In Count II, Plaintiffs seek to recover for the alleged violation of Ohio’s AIDS disclosure 

statute (Am. Compl. ¶¶ 50-57), which (in relevant part) prohibits certain persons from 

“disclos[ing]” the identity of individuals diagnosed with AIDS or an “AIDS-related 

condition.” R.C. § 3701.243(A)(3) (emphasis added). 

2

 Plaintiffs cite and implicitly refer to the Health Insurance Portability and Accountability Act 

(HIPAA) Privacy Rule and its protection of Personal Health Information (or PHI). See Am. 

Compl. ¶¶ 14, 18–20, 23–26, 28, 31. Plaintiffs also appear to request relief under HIPAA when 

they ask for an injunction requiring Caremark to notify the U.S. Department of Health and Human 

Services Office for Civil Rights (the agency that enforces HIPAA’s Privacy Rule) about the 

alleged disclosures. Id. at page 25. But it is “beyond dispute that HIPAA itself does not create an 

express or implied private right of action for violations of its provisions.” Sheldon v. Kettering 

Health Network, 40 N.E.3d 661, 670 (Ohio Ct. App. 2015); see also OhioHealth Corp. v. Ryan, 

No. 10AP-937, 2012 WL 68733, at *4 (Ohio Ct. App. 2012) (“HIPAA does not allow a private 

cause of action, according to Ohio law.”). Plaintiffs therefore cannot seek relief for alleged 

breaches of HIPAA’s Privacy Rule. The only issue in this case is whether Plaintiffs are entitled 

to relief under their state-law causes of action. 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 6 of 19 PAGEID #: 201
- 5 - 

Each claim fail because Plaintiffs do not plausibly allege that protected information was disclosed 

to third parties.3

1. Plaintiffs Do Not Allege That Any Actual Disclosure Occurred. 

Under Ohio law, a disclosure requires that the information at issue be viewed and 

understood by a third party. For instance, in Ohio v. Gonzalez, the Ohio Court of Appeals held 

that “[a] person of common intelligence would know that to ‘disclose’ is to reveal or make known.” 

796 N.E.2d 12, 21 (Ohio Ct. App. 2003) (interpreting statute which requires disclosure of HIV 

status to a sexual partner before engaging in sexual conduct). The Court continued to explain that 

a disclosure occurs when a person being told “hears and comprehends the information.” Id. at 22. 

Courts have resisted attempts to interpret “disclosure” under Ohio law to include potential

disclosures. Id. at 21. In Ackerman v. Medical College of Ohio Hosp., 680 N.E.2d 1309 (Ohio Ct. 

App. 1996), the Ohio Court of Appeals similarly held that a plaintiff could only recover under R.C. 

§ 3701.243 if the covered information was, in fact, disclosed (or revealed) to a third person. See 

id. at 1311. And interpreting an invasion of privacy claim that (like the claims here) required 

disclosure of protected information, the Northern District of Ohio held that no disclosure occurred 

if someone had the opportunity to—but did not actually—view the information. See Yoder v. 

Ingersoll-Rand Co., 31 F. Supp. 2d 565, 570 (N.D. Ohio 1997). 

Courts addressing disclosure in analogous contexts have reached the same conclusion. As 

the Federal Circuit noted when interpreting a federal confidentiality statute, disclosure requires 

“not just transmission, but actual viewing or imminent viewing by another.” Wrocklage v. Dep’t 

of Homeland Security, 769 F.3d 1363, 1369 (Fed. Cir. 2014). In Scott v. Ohio Department of 

3

 Plaintiffs assert three common law claims in Counts III through V. Each claim is pled in the 

alternative, and each claim fails for the reasons set forth in Section III.D, infra. 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 7 of 19 PAGEID #: 202
- 6 - 

Rehabilitation & Correction, 999 N.E.2d 231, 240 (Ohio Ct. App. 2013), the Court found that no 

disclosure occurred when a prison simply disposed of unshredded medical documents in a trash 

room that inmates could access. Likewise, in a highly analogous case, the Tenth Circuit held that 

sending confidential information to an unsecured fax machine where “unauthorized persons might

have viewed” the information did not constitute a “disclosure.” Luster v. Vilsack, 667 F.3d 1089, 

1098 (10th Cir. 2011) (emphasis added). 

In short, a key element of a claim under Biddle or R.C. § 3701.243 is disclosure to a third 

party. In their original complaint, Plaintiffs alleged that Caremark’s actions “resulted in the 

potential or actual disclosure” of their HIV status to a laundry list of individuals, including family 

members, “friends, roommates, landlords, neighbors, mail carriers, and complete strangers.” ECF 

1, ¶ 14 (emphasis added). After Caremark demonstrated in its original motion to dismiss that 

merely the “potential” disclosure of protected information was not actionable, Plaintiffs amended 

their complaint to conclude that some recipients’ HIV status was disclosed at least to mail carriers 

and possibly Fiserv. See Am. Compl. ¶ 20. But simply using the words “disclosure” and 

“disclosed” does not change the result – Plaintiffs have not stated any facts to support that there 

has been an actual disclosure. Plaintiffs do not allege that any mail carrier or Fiserv employee 

actually saw their respective letter, viewed the small font, alphanumeric program identification 

code, and learned their HIV status. As a result, Plaintiffs cannot identify any individual who 

learned of their HIV status as a result of the alleged disclosure despite the fact that the alleged 

disclosure occurred ten months ago. The disclosure of their HIV status remains purely 

hypothetical. That is fatal. As in Scott, the fact that private medical information could be accessed 

by others does not create a disclosure. 999 N.E.2d at 240. 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 8 of 19 PAGEID #: 203
- 7 - 

The lack of any factual allegations is made apparent by looking at the few allegations that 

discuss Plaintiffs’ actual experience (as opposed to the generalized alleged experience of the 

putative class). For example, Plaintiff John Doe One equivocates that he “feels that [Caremark] 

has essentially handed a weapon” to unidentified persons and is “concerned that” unidentified 

“members of his local community have or will learn of his HIV status.” Am. Compl. ¶ 31(a). 

Plaintiff John Doe Two “fears the stigma that would result from the disclosure of his HIV status.” 

Id. ¶ 31(b) (emphasis added). And Plaintiff John Doe Three is concerned that unidentified friends 

and relatives “would have seen this mailing.” Id. ¶ 31(c) (emphasis added). Even after being given 

an opportunity to amend their complaint, none of the John Doe Plaintiffs can identify any actual 

disclosure. The Court should reject Plaintiffs’ request to credit their conclusory allegation and 

make the unsupported and unfounded inference that simply because Fiserv and the USPS were 

involved in the delivery of the letters, their HIV status was necessarily disclosed to a third party. 

In sum, Plaintiffs can only allege that protected information might have been disclosed to 

third parties and that they might suffer consequences in the future. But the alleged disclosure in 

this case occurred more than ten months ago, and Plaintiffs allege no facts suggesting that their 

hypothetical fears have materialized into actual disclosures. That is fatal to their claims because 

those claims do not impose liability for potential disclosures – liability only attaches when 

protected information is actually disclosed. Plaintiffs’ mere “belief” that their HIV status was 

disclosed are “‘naked assertions devoid of further factual enhancement’ [that] contribute nothing 

to the sufficiency of the complaint.” 16630 Southfield Ltd. P’ship v. Flagstar Bank, F.S.B., 727 

F.3d 502, 506 (6th Cir. 2013) (quoting Iqbal, 556 U.S. at 678); see also In re Darvocet, Darvon, 

& Propoxyphene Prod. Liab. Litig., 756 F.3d 917, 931 (6th Cir. 2014) (“The mere fact that 

someone believes something to be true does not create a plausible inference that it is true.”). 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 9 of 19 PAGEID #: 204
- 8 - 

Similarly, the “possibility” that protected information might have been disclosed “fails to satisfy 

the pleading standards set forth in Twombly and Iqbal.” Patterson v. Novartis Pharm. Corp., 451 

F. App’x 495, 497 (6th Cir. 2011). 

2. Even if Some Information Were Disclosed, Plaintiffs Do Not Adequately 

Allege That it Was Protected Under Biddle or R.C. § 3701.243. 

Plaintiffs’ claims also fail for the related (but independent) reason that Plaintiffs do not 

plausibly allege that the program identification number visible in the glassine window gives rise 

to a claim under either Count. 

Plaintiffs allege that Caremark violated three subsections of R.C. § 3701.243 which protect 

against the disclosure of three types of information: (1) the “identity of any individual on whom 

an HIV test is performed”; (2) the “results of an HIV test in a form that identifies the individual 

tested”; and (3) the “identity of any individual diagnosed as having AIDS or an AIDS-related 

condition.” R.C. § 3701.243(A)(1)–(3). This statute is specifically limited to protecting the 

information transmitted in an HIV test, and it does not generally protect information regarding an 

individual’s HIV status. See id. The first two subsections – prohibiting the disclosure of the 

identity of an individual tested for HIV and the results of an HIV test that identifies the individual 

tested – are inapplicable. There is no reference to testing anywhere visible on the mailing, and 

certainly the alphanumeric program identification code, which is the entire basis for Plaintiffs’ 

lawsuit, does not disclose any testing information. Caremark anticipates that Plaintiffs will argue 

that testing can be inferred or assumed because a positive HIV test is a prerequisite to participation 

in OHDAP. Am. Compl. ¶ 14. But that argument turns the statute on its head because to reach a 

conclusion regarding testing, the viewer of the mailing would be required to know that the mailing 

was being sent in connection with Ohio’s Ryan White Program (there is no such indication on the 

mailing), know a criteria for participation in the program is a positive HIV test, and then understand 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 10 of 19 PAGEID #: 205
- 9 - 

that the addressee is, in fact, a participant. This hypothetical chain of conjectures that Plaintiffs 

appear to posit does not change the character of the information visible on the mailing, which on 

its face does not reveal any protected testing information. See Ackerman, 680 N.E.2d at 1312 (“In 

ascertaining the legislative intent of a statute, it is the duty of the court to give effect to the words 

used in a statute, not to delete words used or to insert words not used.”). Similarly, Plaintiffs do 

not allege that Caremark disclosed any information regarding AIDS or an “AIDS-related 

condition,” which is narrowly defined by statute to only include “symptoms of illness related to 

HIV infection, including AIDS-related complex, that are confirmed by a positive HIV test.” R.C. 

§ 3701.24(3). The Amended Complaint does not mention Plaintiffs’ “symptoms” or allege that 

their HIV status was “confirmed by a positive HIV test.” The third subsection is also inapplicable 

because the program identification number does not actually reveal the “identity” of anyone. In 

short, Plaintiffs have not alleged that the mailings disclosed the information protected by any 

subsection of R.C. § 3701.243(A). 

Biddle protects “nonpublic medical information” from disclosure. Biddle, 715 N.E.2d at 

523. As a gating matter, there is no support for the proposition that the program identification 

number constitutes medical information. But even assuming it does, Plaintiffs fail to establish that 

the information was “nonpublic” because they do not identify to whom the information was 

“disclosed.” For example, John Doe Two admits that his HIV status was previously disclosed in 

another “similar incident.” Am. Compl. ¶ 31(b). And none of the Plaintiffs allege that their HIV 

status is completely secret. If the people who saw the letter already knew of the Plaintiffs’ HIV 

status, no “nonpublic” information would have been disclosed. Plaintiffs are making a jump when 

they ask the Court to believe that someone like a mailman would have read the code, while 

delivering a letter, and learned the Plaintiffs’ HIV status from the code. This is particularly so 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 11 of 19 PAGEID #: 206
- 10 - 

when Plaintiffs do not even attempt to allege that anyone has actually learned their HIV status, just 

a hypothetical risk that their HIV status could have been disclosed. 

In sum, Plaintiffs have not alleged the disclosure of protected information under either 

Biddle or R.C. § 3701.243. 

B. Plaintiffs Do Not Adequately Allege A Biddle Claim (Count I) Because They 

Do Not Plead Facts Showing That Caremark Is A Physician Or Hospital. 

Even if Plaintiffs had adequately alleged that protected information was disclosed to third 

parties (they have not), Biddle still would not apply because Plaintiffs do not allege that Caremark 

is a physician or hospital. In Biddle, the Supreme Court of Ohio created a tort for the disclosure 

of information “that a physician or hospital has learned within a physician-patient relationship.” 

715 N.E.2d at 523. “[T]he cause of action only applies to physicians or hospitals who disclose 

nonpublic medical information to a third party.” Raiser v. Corp. of the President of the Church of 

Jesus Christ of Latter-Day Saints, 494 F. App’x 506, 507 (6th Cir. 2012). That is because “Biddle

is narrowly framed, providing liability can be established against only two parties: a physician or 

hospital that commits an unauthorized and unprivileged disclosure and a third-party that induces 

the disclosure to be made.” Templeton v. Fred W. Albrecht Grocery Co., 72 N.E.3d 699, 702 

(Ohio Ct. App. 2017). 

Plaintiffs cannot and do not allege that Caremark is a hospital or physician. In fact, 

Plaintiffs expressly allege that Caremark contracted with OHDAP to serve as a pharmacy benefits 

manager, and it was that contract that Plaintiffs allege “resulted in . . . [Caremark] being 

responsible for the mailings and illegal disclosures at issue herein.” Am. Compl. ¶ 5. Plaintiffs 

allege that their HIV status was originally learned within a physician-patient relationship, and that 

to participate in OHDAP, an applicant must submit medical documents. Am. Compl. ¶¶ 43-44. 

But these allegations do not bring Caremark within the reach of a Biddle claim – Caremark is not 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 12 of 19 PAGEID #: 207
- 11 - 

in a physician-patient relationship with Plaintiffs, and Plaintiffs do not allege that Caremark 

learned of their HIV status from their physician. The fact that Caremark allegedly obtained this 

information through unnamed third parties does not transform Caremark, a pharmacy benefits 

manager, into a doctor. Caremark therefore cannot be liable under Biddle, and Count I should be 

dismissed.4

C. Plaintiffs Do Not Allege Facts To State A Claim Under R.C. § 3701.243. 

In addition to Plaintiffs’ failure to plausibly allege that protected information was 

disclosed, Plaintiffs’ claim for alleged violation of R.C. § 3701.243 fails for three additional 

reasons. 

First, liability only extends to defendants who “knowingly violate” the prohibitions on 

disclosure in R.C. § 3701.243. See R.C. § 3701.244(B). To establish liability, therefore, Plaintiffs 

“must demonstrate that [Caremark] had actual awareness that [the statute] had been violated, or, 

at the very least, [Plaintiffs] must establish facts from which knowledge could be inferred.” Doe 

v. Ohio State Univ. Hosp. and Clinics, 663 N.E.2d 1369, 1373 (Ohio Ct. App. 1995). Mere 

knowledge of the statute or the prohibition on disclosure is insufficient. Id.; see also Ackerman, 

680 N.E.2d at 1312 (“That statute provides that a state agency, such as appellee, is liable only for 

a knowing violation of R.C. 3701.243(A) . . . .”). 

Here, Plaintiffs attempt to plead a knowing violation by making numerous references in 

the Amended Complaint to the fact that Caremark agrees to comply with all federal and state laws, 

in addition to being committed to protecting “PHI under HIPAA.” See, e.g., Am. Compl. ¶ 23. 

4

 If the Court finds that the Plaintiffs have stated a claim under R.C. § 3701.243 (they have not), 

Count I should be dismissed for the additional reason that § 3701.244 provides the “exclusive civil 

remedies for an individual injured by noncompliance” with § 3701.243. R.C. § 3701.244(F). 

Because R.C. § 3701.244 provides the exclusive remedy for disclosure of HIV status, Plaintiffs 

could not recover under Biddle for the same alleged misconduct. 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 13 of 19 PAGEID #: 208
- 12 - 

But Caremark’s commitment to compliance and protecting PHI does not make it plausible that 

Caremark disseminated the mailing knowing it violated R.C. § 3701.243(A). Plaintiffs’ additional 

allegations undercut this claim. Plaintiffs allege, for instance, a single mailing – Plaintiffs do not 

allege that Caremark has continued to send communications to OHDAP participants with the 

program identification code visible. Plaintiffs also allege that the Chief Privacy Officer for 

Caremark explained that the mailing was not “intentional” and “that it would modify its procedures 

in place to ensure that such an incident would not happen again.” Id. In fact, despite sprinkling 

the word “knowing” throughout the Amended Complaint, Plaintiffs’ assertion of a knowing 

violation of the Ohio’s AIDS disclosure statute is directly undercut by Plaintiffs’ multiple 

allegations of unintentional, negligent conduct. For instance, Plaintiffs allege “[Caremark] also 

made no effort to either test or quality control its mailings to ensure no PHI was publicly visible, 

or to prevent its vendors, including Fiserv, from using windowed envelopes that would disclose 

such information” Am. Compl. ¶ 24; see id. ¶ 26 (“Defendants either knew or reasonably should 

have known that this mailing was disseminated in violation of both federal and state laws.”).

Plaintiffs’ claim that Caremark knowingly violated R.C. § 3701.243(A) is not plausible and should 

be rejected. 

Second, the statute only applies to a “person or agency of state or local government.” R.C. 

§ 3701.243(A); see also R.C. § 3701.244(B) (imposing liability on a “person or agency of state or 

local government”). Interpreting this statute, the court in Milhouse v. Care Staff, Inc., No. 05 MA 

234, 2007 WL 1589465 (Ohio Ct. App. May 29, 2007), found that it “only governs persons or 

agencies of state or local government” and does not apply when “there is no allegation or evidence 

that state or local government entities were involved.” Id. *5. Because Plaintiffs do not allege 

that Caremark is a government entity, R.C. § 3701.243 is inapplicable, and this claim fails. 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 14 of 19 PAGEID #: 209
- 13 - 

Third, the statute only applies if the defendant learned the protected information “while 

providing any health care service or while in the employ of a health care facility.” R.C. 

§ 3701.243(A). “Health care service” is not defined in the statute. But “health care provider” is 

defined to only include an “individual who provides diagnostic, evaluative, or treatment services.” 

R.C. § 3701.24(11). Accordingly, the Northern District of Ohio held that the statute does not apply 

to companies providing “tangential items such as disability benefits.” Yoder, 31 F. Supp. 2d at 

571. In this case, Plaintiffs do not allege that Caremark disclosed their HIV status while providing 

“diagnostic, evaluative, or treatment services.” Instead, Plaintiffs allege that Defendant Caremark, 

L.L.C.’s agreement with OHDAP “resulted in [Caremark] being responsible for the mailings and 

illegal disclosures at issue herein.” Amended Compl. ¶ 5. Under that agreement, Caremark, L.L.C. 

operated as a pharmacy benefits manager. Id. A pharmacy benefits manager merely “provide[s] 

pharmacy health benefit services or administration” and “contracts with pharmacies” on behalf of 

“third-party payer[s].” R.C. § 3959.01(N). Pharmacy benefits managers do not provide health 

care services. In fact, they are regulated by the Ohio Department of Insurance (see R.C. 

§ 3959.04)—not the Ohio Department of Health, the Ohio Medical Board, or the Ohio Board of 

Pharmacy. In short, Caremark helps provide health care “benefits,” not health care “services” and 

therefore falls outside the scope of R.C. § 3701.243. 

D. Plaintiffs’ Duplicative Common Law Claims Must Be Dismissed. 

Plaintiffs assert in the Amended Complaint three additional common law claims in the 

alternative. See Am. Compl. ¶¶ 58-78. Each one fails and should be dismissed. These causes of 

action are predicated upon the same alleged disclosure of Plaintiffs’ HIV status that gives rise to 

Plaintiffs’ Biddle claim (Count I) and claim for an alleged violation of Ohio’s AIDS disclosure 

statute (Count II). See Am. Compl. ¶¶ 62, 70, 76. Even if Plaintiffs’ alternative common law 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 15 of 19 PAGEID #: 210
- 14 - 

claims were viable independent causes of action (which they are not for the reasons set forth 

below), they must be dismissed because Plaintiffs fail to allege an actual disclosure of their 

protected medical information for the reasons set forth in Section III.A, supra. For this reason 

alone Counts III through V should be dismissed. 

Plaintiffs’ alternative claims fail for yet another reason. Each of those claims is based on 

an alleged breach of a duty not to disclose medical information. See Am. Compl. ¶¶ 61, 68, 75. 

But the only duty to prevent the disclosure of medical information recognized by Ohio’s common 

law as giving rise to a cause of action is the duty created in Biddle, where the Ohio Supreme Court 

“created a new cause of action.” Pica v. OhioHealth Corp., 2011 WL 9527579 (Ohio Com. Pl. 

Apr. 12, 2011). The Ohio Supreme Court recognized this new common law duty because “the 

various methods that courts have used to address such claims (including theories like invasion of 

privacy, defamation, breach of contract, and others),” as well as negligence, were “unsatisfactory.” 

Hageman v. Sw. Gen. Health Ctr., 119 Ohio St. 3d 185, 188, 893 N.E.2d 153, 156 (Ohio 2008). 

In recognizing a new, independent duty, the Biddle Court “explicitly rejected” attempts to fit a 

claim premised on the unauthorized disclosure of medical information into “a number of traditional 

or accepted legal theories.” Norris v. Smart Document Sols., LLC, 483 F. App’x 247, 249-50 (6th 

Cir. 2012) (internal quotation marks and citations omitted). The Ohio Court of Appeals has 

explained that the “consolidation of other theories of recovery” based on an alleged unauthorized 

disclosure of medical information into a Biddle claim “is certain.” Sheldon, 40 N.E.3d at 673 

As a result, Courts have consistently dismissed duplicative claims based on an alleged 

unauthorized disclosure of medical information when brought under any theory other than as a 

Biddle claim. For instance, in Sheldon the Ohio Court of Appeals held that plaintiffs failed to state 

an independent claim for breach of fiduciary duty because that cause of action is “subsumed along 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 16 of 19 PAGEID #: 211
- 15 - 

with the other theories, particularly when appellant contends that . . . [the defendant] breach[ed] 

its fiduciary duty of confidentiality as set forth in Biddle by disclosing information to authorized 

employees.” Id. at 673-74.5 Biddle itself expressly identified a negligence claim as one of the 

legal theories that courts have been forced to “stretch[ ] . . . beyond their reasonable bounds” by 

courts addressing claims for unauthorized disclosure of medical information. Scott v. Ohio Dep’t 

of Rehab. & Corr., 2013-Ohio-4383, ¶ 29, 999 N.E.2d 231, 240 (referring to Biddle claim as a 

claim for “breach of patient confidentiality”); Pica, 2011 WL 9527579 (holding that the only 

recognized tort for unauthorized disclosure of medical information under Ohio law is a Biddle

claim and, as a result, “plaintiff’s claims [based on an unauthorized disclosure of medical 

information] for breach of fiduciary duty, invasion of privacy, and negligent/intentional infliction 

of emotional distress are without merit as a matter of law”) (emphasis added); see Biddle, 715 

N.E.2d at 523 (identifying negligence, among numerous others, as an “unsatisfactory” theory that 

courts have been forced to “stretch . . . beyond their reasonable bounds” in addressing claims for 

unauthorized disclosure of medical information). Accordingly, because the only recognized claim 

under Ohio common law for an alleged unauthorized disclosure of medical information is a Biddle 

claim, Plaintiffs have failed to state viable independent causes of action as a matter of law in 

Counts III through V. Those Counts should be dismissed. 

5

 Plaintiffs’ breach of fiduciary duty claim fails for the additional reason that Plaintiffs do not 

plausibly allege a fiduciary relationship, which under Ohio law “arises when a party places trust 

in the integrity and fidelity of another and there is a resulting position of superiority or influence 

acquired by virtue of this special trust.” Linder v. Am. Natl. Ins. Co., 2003-Ohio-5394, ¶ 36, 155 

Ohio App. 3d 30, 39, 798 N.E.2d 1190, 1198. Here, Plaintiffs fail to allege that they had any 

relationship with Caremark when they received the letters. Indeed, Plaintiffs allege that the letters 

were sent “regardless of whether . . . [the recipients] were active pharmacy customers of CVS . . 

.”. Compl. ¶ 18. 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 17 of 19 PAGEID #: 212
- 16 - 

IV. CONCLUSION 

For these reasons, Caremark respectfully requests that the Court dismiss Plaintiffs’ 

Amended Complaint. Caremark requests that it be dismissed with prejudice. See Riverview 

Health Inst. LLC v. Med. Mut. of Ohio, 601 F.3d 505, 520 (6th Cir. 2010) (finding denial of leave 

to amend appropriate when further amendment would be futile). 

Respectfully submitted, 

/s Robert G. Cohen

Robert G. Cohen (0041707) 

KEGLER BROWN HILL + RITTER CO., LPA 

65 East State Street, Suite 1800 

Columbus, Ohio 43215 

Phone: 615-462-5492 

Fax: 614-462-2634 

rcohen@keglerbrown.com 

Kristine M. Brown (admitted pro hac vice) 

Donald M. Houser (admitted pro hac vice) 

Matthew L.J.D. Dowell (admitted pro hac vice) 

ALSTON & BIRD LLP 

1201 West Peachtree Street 

Atlanta, Georgia 30309 

Phone: 404-881-7434 

Fax: 404-881-7777 

kristy.brown@alston.com 

donald.houser@alston.com 

matt.dowell@alston.com 

Attorneys for Caremark, L.L.C.

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 18 of 19 PAGEID #: 213
CERTIFICATE OF SERVICE 

The undersigned hereby certifies that true and accurate copies of the foregoing were served 

upon all counsel by the Court’s Electronic Filing System this 26th day of June, 2018.

 /s/ Robert G. Cohen 

 Robert G. Cohen 

Case: 2:18-cv-00238-EAS-CMV Doc #: 43 Filed: 06/26/18 Page: 19 of 19 PAGEID #: 214