- 1 -

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF OHIO

EASTERN DIVISION

JOHN DOE, Individually and On Behalf of 

All Others Similarly Situated,

Plaintiff,

v.

CVS HEALTH CORPORATION, CVS 

PHARMACY, INC., CAREMARK PHC, 

L.L.C., and CAREMARK Rx, LLC,

Defendants.

Case No. 2:18-cv-00488

CLASS ACTION COMPLAINT

JURY TRIAL DEMANDED

Plaintiff John Doe (“Plaintiff”) brings this Class Action Complaint, on behalf of himself 

and the proposed classes defined herein, and alleges as follows:

I. INTRODUCTION

1. Medical privacy is among the most important tenets of American healthcare. 

Patients must be able to trust their physicians, insurers, and pharmacies to protect their medical 

information from the improper disclosure (including, but not limited to, their health conditions 

and courses of treatment). Indeed, numerous state and federal laws explicitly require this. And, 

these laws are especially important when protecting individuals with particular medical 

conditions such as HIV or AIDS that can and do subject them to regular discrimination.

2. Despite these legal and ethical requirements, in approximately July and August 

2017, CVS recklessly disclosed the protected health information of approximately 6,000 patients 

in Ohio taking HIV-related medications for treatment and prevention in a mass mailing (the 

“Notice”) that carelessly and clearly revealed the contents of the letter such that anyone who 

picked it up could see the name and address of who it was sent to, a clear identifier that the letter 

was ultimately from the Ohio Department of Health, and the designation “PM 6402 HIV”—

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 1 of 25 PAGEID #: 1
- 2 -

clearly disclosing the recipient’s HIV status. As a result of CVS’s conduct, the HIV status of 

recipients was unlawfully disclosed to entities entrusted to process the mailing and anyone who 

came in contact with the letter, including patients’ friends and families. 

3. The Ohio HIV Drug Assistance Program (“OhDAP”) has had a contract with 

CVS since March 2017 under which CVS provides OhDAP clients with HIV medications and is 

responsible for communications relating to those medications. In approximately late July or early 

August 2017, a letter containing membership cards, information about the CVS program and 

how to access their HIV medications was mailed to an estimated 6,000 participants in OhDAP. 

4. Plaintiff John Doe1 was a recipient of this mailing, revealing his HIV status to

third-parties despite the fact that Plaintiff Doe has taken great pains to keep his HIV status 

private for many years. Accordingly, he brings suit as a putative class action for damages, 

injunctive, and declaratory relief.

II. JURISDICTION AND VENUE

5. This Court has subject matter jurisdiction of Plaintiff’s Fair Credit Reporting Act 

and Declaratory Relief claims pursuant to 28 U.S.C. § 1331. This Court also has subject matter 

jurisdiction over Plaintiff’s state law claims pursuant to 28 U.S.C. § 1367. This Court has 

personal jurisdiction over CVS because at all relevant times it has conducted substantial business 

 1 Plaintiff is proceeding as “John Doe” so his medical information is not further compromised 

and to reduce the risk of housing, healthcare and employment discrimination traditionally 

experienced by those with or at high risk of contracting HIV and/or AIDS. See e.g. Doe v. 

Megless, 654 F.3d 404, 408-9 (3d Cir. 2011) (endorsing a noncomprehensive balancing test, 

which balances, “whether a litigant has a reasonable fear of severe harm that outweighs the 

public’s interest in open litigation,” and including AIDS as an example of an area where courts 

have permitted plaintiffs to proceed with pseudonyms); see also Smith v. Milton Hershey Sch., 

No. CIV.A. 11-7391 (E.D. Pa. 2011) (allowing mother of HIV-positive minor child to proceed 

under pseudonym); Doe v. Deer Mountain Day Camp, Inc., No. 07-cv- 5495 (S.D.N.Y. Jun. 22, 

2007) (permitting minor and his parent alleging HIV discrimination against camp to proceed 

under pseudonym); EW v. New York Blood Center, 213 F.R.D. 108, 110 (E.D.N.Y. 2003) 

(holding that the prejudice of embarrassment and fear of stigmatization because plaintiff had a 

“sexually and blood-transmitted disease” like AIDS “is real.”). If Plaintiff cannot proceed as 

“John Doe” then his identity will need to be sealed. 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 2 of 25 PAGEID #: 2
- 3 -

operations within this District and throughout the state of Ohio, and because the acts or 

omissions that gave rise to Plaintiff’s claims occurred in Ohio. 

6. Venue is proper in this District under 28 U.S.C. § 1391 because CVS does 

substantial business within this District and Plaintiff is a resident of this District. 

III. PARTIES

7. Plaintiff John Doe is a resident of Dayton, Ohio.

8. Defendant CVS Health Corporation is a Rhode Island corporation with its 

principal place of business and headquarters at One CVS Drive, Woonsocket, Rhode Island 

02895. 

9. Defendant CVS Pharmacy, Inc. is a Rhode Island corporation with its principal 

place of business and headquarters at One CVS Drive, Woonsocket, Rhode Island 02895. 

10. Defendant Caremark PHC, L.L.C. is a Delaware limited liability company with its 

principal place of business and headquarters at One CVS Drive, Woonsocket, Rhode Island 

02895. 

11. Defendant Caremark Rx, LLC is a Delaware limited liability company with its 

principal place of business and headquarters at One CVS Drive, Woonsocket, Rhode Island 

02895. On information and belief, Caremark Rx, LLC is a subsidiary of CVS Health 

Corporation.

12. Unless otherwise stated, all Defendants are collectively referred to herein as 

“CVS” or “Defendants.” Plaintiff is informed and alleges that at all relevant times CVS shared 

common management, officers, owners, and directors, and that they carried out a joint scheme, 

business plan, or policy, and that acts or omissions of each are attributable to the other. Plaintiff 

is informed and alleges that at all relevant times CVS did business in the state of Ohio. 

IV. FACTUAL BACKGROUND

A. CVS Collects Sensitive Personal And Medical Information

13. As a direct provider of medical and pharmacy services to customers all over the 

country, CVS collects and maintains possession, custody, and control of: (1) personally 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 3 of 25 PAGEID #: 3
- 4 -

identifiable information (“PII”), including, without limitation, patients’ names, dates of birth, 

Social Security numbers, and addresses; and (2) protected health information (“PHI”), which 

contains PII in addition to patients’ demographic information, medical histories, prescription, 

diagnostic, and treatment information, test and laboratory results, insurance information, and 

other data collected in the normal course of providing and obtaining payment for its services. 

14. CVS informs its consumers in “Notice of Privacy Practices” on its website2 that 

“[w]e are required by law to protect the privacy of your PHI and provide you this notice 

explaining our legal duties and privacy practices.” It also states that “some types of sensitive 

PHI, such as HIV information . . . may be subject to additional confidentiality protections under 

state or federal law.”

15. CVS expressly promises consumers that, among other things, it will notify 

customer if there has been a breach by CVS of a customer’s PHI.

B. CVS Is Required By Law To Prohibit Disclosure Of Medical Information

16. CVS is obligated by a number of state and federal laws to protect its patients’ PII 

and PHI. Under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 

and its accompanying regulations, health care providers like CVS are required to maintain 

reasonable and appropriate administrative, technical, and physical safeguards for protecting PHI. 

Among other things, CVS is required by HIPAA to:

 Ensure the confidentiality, integrity, and availability of all PHI it

creates, receives, maintains or transmits; 

 Identify and protect against reasonably anticipated threats to the 

security or integrity of the information; 

 Protect against reasonably anticipated, impermissible uses or 

disclosures; and 

 Ensure compliance by its workforce.3

 2 https://www.cvs.com/content/patient-privacy, last accessed May 8, 2018. 

3 See http://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/, last accessed May 8, 

2018.

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 4 of 25 PAGEID #: 4
- 5 -

17. HIPAA also requires health care providers like CVS to preserve the integrity of 

PII and PHI so that it is only available and accessible to authorized persons. One other key 

component of HIPAA is that it requires health care providers to implement administrative 

safeguards, including ongoing risk management analyses to evaluate potential or likely risks to 

patients’ PHI. In order to prevent the unauthorized disclosure of PHI, CVS is also required to 

implement physical and technical safeguards as part of a comprehensive protocol that is overseen 

by a chief privacy officer. 

18. CVS is also subject to federal laws protecting consumer data pursuant to the Fair 

Credit Reporting Act, 15 U.S.C. §§ 1681-1681x (“FCRA”), the Federal Trade Commission Act, 

15 U.S.C. § 45 (“FTCA”), and the Gramm-Leach Bliley Act, 15 U.S.C. §§ 6801, et seq. 

(“GLBA”). 

19. The FCRA requires any business that shares data for consumer credit reporting 

purposes to maintain reasonable procedures designed to limit the furnishing of data to the 

purposes listed in the statute. 15 U.S.C. § 1681e. Under the FCRA, a “person that receives 

medical information shall not disclose such information to any other person, except as necessary 

to carry out the purpose for which the information was initially disclosed, or as otherwise

permitted by statute, regulation, or order.” 15 U.S.C. §§ 1681b(g)(4), 1681b(g)(3)(A). As a 

provider of medical and pharmacy services, CVS collects and shares PII and PHI for purposes of 

collecting payment, subjecting it to the FCRA’s requirements to safeguard PII and PHI and limit 

unauthorized disclosures. 

20. Similarly, CVS is covered by the mandates of the FTCA, which prohibits it from 

unfair and deceptive conduct affecting commerce, a law that has been enforced and interpreted to 

include a company’s information privacy practices. CVS also maintains an obligation to 

“respect the privacy of its customers and to protect the security and confidentiality of those 

customers’ nonpublic personal information” under the GLBA. 

21. The state of Ohio, where Plaintiff resides and where CVS has substantial 

operations, provides a right of privacy that encompasses unconsented medical information 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 5 of 25 PAGEID #: 5
- 6 -

disclosures. “[I]t is for the patient—not some medical practitioner, lawyer, or court—to

determine what the patient’s interests are with regard to personal confidential medical 

information.” Biddle v. Warren Gen. Hosp., 86 Ohio St.3d 395, 408, 715 N.E.2d 518, 528 (Ohio 

1999); see also Hageman v. Southwest Gen. Health Ctr., 119 Ohio St.3d 185, 188-89, 893 

N.E.2d 153, 156 (Ohio 2008) (applying the rule of Biddle to disclosures made by parties other 

than physicians or hospitals). 

22. Ohio also has enacted protections specifically for HIV patients (and those at risk) 

in order to encourage testing and treatment. See Rev. Code 3701.243(A) (“no person or agency 

of state or local government that acquires the information while providing any health care service 

or while in the employ of a health care facility or health care provider shall disclose or compel 

another to disclose any of the following . . . (3) The identity of any individual diagnosed as 

having AIDS or an AIDS-related condition.”); see also Rev. Code 3701.244(B) (“ A person or an 

agency of state or local government that knowingly violates . . . division (A) of section 3701.243 

. . . may be found liable in a civil action; the action may be brought by any individual injured by 

the violation.”) 

C. CVS Disclosed Medical Information For Patients Taking HIV Medications

23. In July/August of 2017, CVS sent the Notice to 6,000 patients associated in its 

records as recipients of medications used for treatment and prevention of HIV. The Notice

recklessly disclosed through a transparent window on the front of the envelope CVS’s corporate 

logo along with the patient’s (1) name; (2) address; (3) a return address from the Ohio 

Department of Health, (4) a notice in red letters that “new prescription benefits” were available, 

and (5) a designation “PM 6402 HIV” above the name and address of the patient. 

24. Additionally, it does not appear CVS made any effort to ensure only the intended 

recipient would see the contents of the notice such as by certified mail or use of an opaque 

envelope. Instead, anyone who came in contact with the notice, including letter carriers, postal 

service employees, persons who sort and distribute mail at group homes or offices, co-workers, 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 6 of 25 PAGEID #: 6
- 7 -

roommates, significant others, and family members could view its contents sufficient to disclose 

protected PHI. CVS also wrongfully disclosed Plaintiff’s HIV status to other third-parties in 

connection with the preparation and dissemination of the Notice. 

D. CVS’s Disclosure Harmed A Population Subject To Pervasive Discrimination

25. CVS’s conduct is especially egregious in this instance because it was directed at a 

class of individuals historically subject to discrimination based upon their medical condition. 

Although many would like to believe a lot has changed since the U.S. Supreme Court held in 

1998 that HIV/AIDS was subject to protections of the Americans with Disabilities Act4, persons 

living with HIV and those at high risk of infection continue to battle for equal access to 

healthcare and rights. 

26. In a 2009 survey by Lambda Legal, “nearly 63 percent of the respondents who 

had HIV reported experiencing one or more of the following types of discrimination in health 

care: being refused needed care; being blamed for their healthcare status; and/or a healthcare 

professional refusing to touch them or using excessive precautions, using harsh or abusive 

language, or being physically rough and abusive.”5 Of those surveyed, 19% reported being 

denied care altogether. As CVS pointed out on its own website, if patients can’t trust their 

physicians and insurers to protect their health information, they will be less likely to seek 

important and potentially lifesaving medical treatment. 

27. Persons living with HIV (and their families) are also regularly subjected to 

employment and housing discrimination. In the 2000s, the U.S. Equal Employment Opportunity 

Commission received 2,175 complaints of discrimination based on HIV, with complaints 

peaking in the last year of the survey, demonstrating a disturbing upward trend. And, a 2009 

national survey conducted by the Kaiser Foundation also showed that only 21% of people were 

 4 Bragdon v. Abbott, 524 U.S. 624 (1988). 

5 https://www.lambdalegal.org/sites/default/files/publications/downloads/fs_hiv-stigma-anddiscrimination-in-the-us_1.pdf, last accessed May 8, 2018. All statistics cited herein are taken 

from Lambda’s report unless otherwise attributed. 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 7 of 25 PAGEID #: 7
- 8 -

comfortable living with someone with HIV. There are also numerous reported lawsuits over 

instances in which individuals with HIV (including children) have been denied housing and 

equal access because of their HIV status. 

28. It is also well known that HIV and AIDS disproportionately impacts minority

groups such as the LGBT community and African Americans. According to AmFAR, gay and 

bisexual men accounted for 82% of the United States’ 1.2 million people living with HIV, with 

African-Americans accounting for 45% of HIV diagnoses but only 12% of the general 

population.6 

29. The pervasive discrimination suffered by those with HIV or AIDS leads to a 

social stigma that results in significant harm, including a direct correlation to higher rates of 

depression, loneliness, and social isolation—and results in those suffering from (or at high risk 

of) the illness to avoid testing and treatment to avoid the negative consequences of a positive 

diagnoses. 

E. CVS Had A Duty To Prevent The Disclosure

30. CVS is and remains under a duty to Plaintiff and Class Members to maintain the 

security and integrity of their PII and PHI. CVS’s disclosure was a direct and proximate result of 

CVS’s failure to implement and maintain appropriate and reasonable patient privacy procedures 

and practices to safeguard and protect Plaintiff’s and Class Members’ (as defined below) PII and 

PHI from unauthorized access, use, and disclosure, as required by various state and federal 

regulations, industry practices, and its agreements with patients. 

31. At all times relevant herein, CVS also had a duty to disclose the true facts about 

its substandard patient privacy practices, as alleged herein. CVS has a duty to disclose because it 

is in a superior position to know the true character and quality of its privacy practices and these 

facts are not something that Plaintiff and putative Class Members could have discovered 

independently prior to purchasing or obtaining medical services from CVS. As a result of CVS’s 

 6 http://amfar.org/About-HIV-and-AIDS/Facts-and-Stats/Statistics--United-States/, last accessed 

May 9, 2018.

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 8 of 25 PAGEID #: 8
- 9 -

material omissions about its substandard patient privacy practices, it has been able to procure 

business from the state of Ohio and patients who may have otherwise selected a privacy 

compliant provider, or paid less for CVS’s services. CVS’s substandard privacy, data and 

cybersecurity practices were material facts actively concealed and/or not disclosed to Plaintiff 

and the Class Members that a reasonable person would have considered important.

32. CVS intentionally concealed and/or failed to disclose to consumers its 

substandard privacy practices as described in this Complaint for the purpose of inducing Plaintiff 

and putative Class Members to act thereon. Plaintiff and the putative Class Members justifiably 

acted upon, or relied upon to their detriment, the concealed and/or non-disclosed material facts as 

evidenced by their obtaining services and treatment from CVS. Had Plaintiff known of the true 

character and quality of CVS’s substandard privacy practices, Plaintiff and the putative Class 

Members would not have purchased (or would have paid less for) CVS’s services and treatment. 

33. CVS disregarded and violated Plaintiff’s and Class Members’ privacy rights, and 

materially harmed them in the process, by not obtaining Plaintiff’s and Class Members’ prior 

written consent to disclose their PII and PHI to any other person—as required by HIPAA and 

other pertinent laws, regulations, industry standards, and internal company policies.

34. CVS flagrantly disregarded and violated Plaintiff’s and Class Members’ privacy 

rights, and materially harmed them in the process, by failing to establish and implement 

appropriate administrative, technical, and physical safeguards to ensure the security and 

confidentiality of Plaintiff’s and Class Members’ PII and PHI, and to protect against reasonably 

foreseeable disclosures of such information through reckless mass mailings. CVS’s conduct has 

forever compromised Plaintiff’s and Class Member’s PII and PHI, including particularly 

sensitive information about treatment for stigmatized illnesses such as HIV. 

35. CVS’s wrongful actions and inaction directly and proximately caused the 

dissemination into the public domain of Plaintiff’s and Class Members’ PII and PHI without 

their knowledge, authorization, and consent. As a direct and proximate result of CVS’s wrongful 

actions and inactions and the resulting disclosure, Plaintiff and Class Members have suffered, 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 9 of 25 PAGEID #: 9
- 10 -

and will continue to suffer, economic damages and other actual harm including, without 

limitation: (i) improper disclosure of their PII and PHI, including their HIV status and/or their 

use of HIV-related medications for preventative measures; (ii) loss of privacy; (iii) out-of-pocket 

expenses reasonably incurred to remedy or mitigate the effects of the disclosure; (iv) the value of 

their time reasonably spent mitigating the effects of the disclosure; (v) mental, emotional, and 

physical distress and anguish; and/or (vi) rights they possess under medical privacy and 

consumer protection statutes—for which they are entitled to compensation.

36. As a direct and proximate cause of CVS’s misconduct, Plaintiff and the putative 

Class Members have suffered actual damages, CVS has been unjustly enriched, and Plaintiff and 

Class Members are entitled to appropriate relief. CVS’s conduct has been and is malicious, 

wanton and/or reckless and/or shows a reckless indifference to the interests and rights of others.

V. PLAINTIFF’S EXPERIENCE

37. As a direct and proximate result of CVS’s conduct, Plaintiff has suffered, and 

continues to suffer, ongoing harm, including the loss of his medical privacy, the disclosure of 

highly personal information, mental, emotional, and physical distress including panic, anxiety, 

loss of sleep, loss of productivity, and time spent dealing with the fallout of the disclosure. 

Moreover, Plaintiff remains in imminent threat of future harm from Defendants because they 

continue to maintain his PII and PHI but are not safeguarding it from unlawful disclosure in 

compliance with state and federal laws. 

VI. CLASS ACTION ALLEGATIONS

38. Plaintiff brings this suit as class action pursuant to Rule 23 of the Federal Rules of 

Civil Procedure on behalf of himself and all members of the following Class:

All persons who received from CVS a mailing on or about July or 

August of 2017 in which the person’s name and the letters “HIV”

were visible through the clear window of the envelope.

39. Excluded from the Class are: (1) any Judge or Magistrate Judge presiding over 

this action and members of their families; (2) CVS, CVS’s subsidiaries, parents, successors, 

predecessors, and any entity in which CVS has a controlling interest, and its current or former 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 10 of 25 PAGEID #: 10
- 11 -

employees, officers, and directors; (3) counsel for Plaintiff and CVS (and employees of their 

firms); and (4) legal representatives, successors, or assigns of any such excluded persons.

40. The Classes meet all of the criteria required by Federal Civil Rule 23(a). 

41. Numerosity: The Class Members are so numerous that joinder of all Members is 

impracticable. Though the exact number and identities of Class Members are unknown at this 

time, but are reported to be approximately 6,000. The identities of Class Members are 

ascertainable through Defendants’ records, Class Members’ records, publication notice, selfidentification, and other means. 

42. Commonality: Common questions of law and fact exist as to all Class Members. 

These common questions of law or fact predominate over any questions affecting only individual 

Members of the Classes. Common questions include, but are not limited to, the following:

a. Whether Defendants violated state and federal laws by disclosing 

Plaintiff’s and Class Members’ PII and PHI through the Notice;

b. Whether Defendants violated state and federal laws by failing to properly 

store, secure, and dispose of Plaintiff’s and Class Members’ PII and PHI;

c. Whether Defendants failed to employ reasonable and adequate medical 

privacy policies and practices in compliance with applicable state and federal regulations;

d. Whether Defendants acted willfully, recklessly, or negligently with regard 

to maintaining the privacy of Plaintiff’s and Class Members’ PII and PHI; 

e. Whether Plaintiff and Class Members are entitled to restitution, damages, 

statutory damages, compensation, or other monetary relief; and

f. Whether Plaintiff and Class Members are entitled to injunctive and 

declaratory relief necessary to secure their PII and PHI from further disclosure.

43. Common sources of evidence may also be used to demonstrate Defendants’

unlawful conduct on a class-wide basis, including, but not limited to documents and testimony 

about its medical privacy policies and practices (or lack thereof); documents and testimony about 

the source, cause, and purpose of the Notice; and documents and testimony about any remedial 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 11 of 25 PAGEID #: 11
- 12 -

efforts undertaken as a result of the unlawful disclosure of Plaintiff’s and Class Members’ PII 

and PHI. 

44. Typicality: Plaintiff’s claims are typical of the claims of the respective Class he 

seeks to represent, in that the named Plaintiff and all Members of the proposed Classes have 

suffered similar injuries as a result of the same practices alleged herein. Plaintiff has no interests 

adverse to the interests of the other Class Members.

45. Adequacy: Plaintiff will fairly and adequately protect the interests of the Classes, 

and has retained attorneys well experienced in class actions and complex litigation as their 

counsel, including cases alleging consumer protection and data privacy claims arising from 

medical data breaches, including unlawful HIV disclosures.

46. The Classes also satisfy the criteria for certification under Federal Civil Rules

23(b) and 23(c). Among other things, Plaintiff avers that the prosecution of separate actions by 

the individual Class Members would create a risk of inconsistent or varying adjudication which 

would establish incompatible standards of conduct for Defendants; that the prosecution of 

separate actions by individual Class Members would create a risk of adjudications with respect to 

them which would, as a practical matter, be dispositive of the interests of other Class Members 

not parties to the adjudications, or substantially impair or impede their ability to protect their 

interests; that Defendants have acted or refused to act on grounds that apply generally to the 

proposed classes, thereby making final injunctive relief or declaratory relief described herein 

appropriate with respect to the proposed classes as a whole; that questions of law or fact common 

to the Classes predominate over any questions affecting only individual members and that class 

action treatment is superior to other available methods for the fair and efficient adjudication of 

the controversy which is the subject of this action. Plaintiff also avers that certification of one or 

more subclasses or issues may be appropriate for certification under Federal Civil Rule 23(c). 

Plaintiff further states that the interests of judicial economy will be served by concentrating 

litigation concerning these claims in this Court, and that the management of the Classes will not 

be difficult.

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 12 of 25 PAGEID #: 12
- 13 -

47. Plaintiff and other Class Members have suffered injury, harm, and damages as a 

result of Defendants’ unlawful and wrongful conduct. Absent a class action, Defendants will 

continue to maintain Class Members’ PHI and PII that could be subject to future disclosures due 

to lax or non-existent privacy policies and practices, and such unlawful and improper conduct 

should not go remedied. Absent a class action, the Class Members will not be able to effectively 

litigate these claims and will suffer further harm and losses, as Defendants will be allowed to 

continue such conduct with impunity and benefit from its unlawful conduct.

VII. CAUSES OF ACTION

FIRST CAUSE OF ACTION

Willful Violation of the Fair Credit Reporting Act

15 U.S.C. §§ 1681-1681x

48. Plaintiff incorporates all preceding paragraphs as fully set forth herein. Plaintiff’s 

FCRA claim is on behalf of the Classes set forth above. 

49. One of the fundamental purposes of the FCRA is to protect consumers’ privacy. 

15 U.S.C. § 1681(a). Protecting consumers’ privacy involves adopting reasonable procedures to 

keep sensitive information confidential. 15 U.S.C. § 1681(b). 

50. The FCRA defines a “consumer reporting agency” as:

[A]ny person, which, for monetary fees, dues, or on a cooperative 

nonprofit basis, regularly engages in whole or in part in the 

practice of assembling or evaluating consumer credit information 

or other information or consumers for the purpose of furnishing 

consumer reports to third parties, and which uses any means or

facility of interstate commerce for the purpose of preparing or 

furnishing consumer reports.

15 U.S.C. § 1681a(f). 

51. The FCRA defines a “consumer report” as:

[A]ny written, oral, or other communication of any information by 

a consumer reporting agency bearing on a consumer’s credit 

worthiness, credit standing, credit capacity, character, general 

reputation, personal characteristics, or mode of living which is 

used or expected to be used or collected in whole or in part for the 

purpose of establishing the consumer’s eligibility for (A) credit or 

insurance to be used primarily for personal, family, or household 

purposes; (B) employment purposes; or (C) any other purpose 

authorized under 15 U.S.C. § 16881(b).

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 13 of 25 PAGEID #: 13
- 14 -

52. Defendants regularly assemble consumer information including, among other 

things, insurance policy information, such as names, dates of birth, type of loss, and amount paid 

for claims submitted by an insured; and a description of insured items. Defendants also regularly 

utilize interstate commerce to furnish such information on consumers to third parties. 

53. Plaintiff’s and Class Members’ PII and PHI constitute consumer reports under 

FCRA, because this information bears on, among other things, their credit worthiness, credit 

standing, credit capacity, character, general reputation, personal characteristics, physical and 

mental medical conditions, and mode of living, and is used or collected, in whole or in part, for 

the purpose of establishing Plaintiff’s and other Class Members’ eligibility for insurance to be 

used primarily for personal, family, or household purposes, and establishing rates for same. 

54. The FCRA requires the adoption of reasonable procedures with regard to, inter 

alia, the confidentiality and proper utilization of personal and insurance information. 15 U.S.C. 

§ 1681(b). FCRA also requires that consumer reporting agencies “maintain reasonable 

procedures designed to . . . limit the furnishing of consumer reports to the purposes listed under 

section 1681b of this title.” 15 U.S.C. § 1681e. 

55. The FCRA defines “medical information” as:

[I]nformation or data, whether oral or recorded, in any form or 

medium, created by or derived from a health care provider or the 

consumer, that relates to—(A) the past, present, or future physical, 

mental, or behavioral health or condition of an individual; (B) the 

provision of health care to an individual; or (C) the payment for the 

provision of health care to an individual.

15 U.S.C. § 1681(a)(i).

56. FRCA specifically protects medical information, restricting its dissemination to 

limited instances. See, e.g., 15 U.S.C. §§ 1681a(d)(3); 1681b(g); 1681c(a)(6). 

57. Plaintiff’s and Class Members’ PHI affected by the Notice constitutes medical 

information as defined by FCRA. Their PHI included diagnoses and treating information from 

medical professionals which relate to the provision of health care and past, present, or future 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 14 of 25 PAGEID #: 14
- 15 -

physical, mental, or behavioral health or condition of an individual under FCRA’s definition of 

medical information. 15 U.S.C. § 1681a(i). 

58. Under the FCRA, a “person that receives medication information shall not 

disclose such information to any other person, except as necessary to carry out the purpose for 

which the information was initially disclosed, or as otherwise permitted by statute, regulation, or 

order.” 15 U.S.C. §§1681(g)(4), 1681b(g)(3)(A). 

59. Defendants’ failure to adequately protect and safeguard Plaintiff’s and Class 

Members’ PII and PHI resulted in the disclosure of such information to one or more third-parties 

in violation of FCRA because such disclosure was not necessary to carry out the purposes for 

which Defendants received the information, nor was it permitted by statute, regulation or order. 

Defendants’ violations of the FCRA, as set forth above, were willful or, at the very least, 

reckless, constituting willfulness. 

60. As a direct and proximate result of Defendants’ willful or reckless failure to adopt 

and maintain reasonable procedures to limit the furnishing and disclosures of Plaintiff’s and 

Class Members’ PII and PHI to the purposes listed in the statute, Plaintiff’s and Class Members’

PII and PHI was disclosed and disseminated to unauthorized third-parties. Plaintiff and Class 

Members have suffered injury and harm, and will continue to suffer injury and harm because of 

Defendants’ conduct.

61. As a further direct or proximate result of CVS’s willful or reckless FCRA 

violations, as described above, Plaintiff and Class Members were (and continue to be) injured 

and have suffered (and will continue to suffer) the harms and damages described in this 

Complaint.

62. Accordingly, Plaintiff and Class Members are entitled to compensation for their 

actual damages in an amount to be determined at trial or statutory damages of not less than $100, 

and not more than $1,000, each, as well as attorneys’ fees, punitive damages, litigation expenses 

and costs, pursuant to 15 U.S.C. § 1681n(a). Plaintiff also seeks injunctive relief enjoining the 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 15 of 25 PAGEID #: 15
- 16 -

above described wrongful acts and practices of Defendants and requiring Defendants to employ 

and maintain industry accepted standards for medical privacy. 

SECOND CAUSE OF ACTION

Negligent Violation of the FCRA

63. Plaintiff realleges each and every allegation contained above, and incorporates by 

reference all other paragraphs of this Complaint as if fully set forth herein. Plaintiff brings this 

claim on behalf of the Classes set forth above.

64. Defendants negligently failed to adopt and maintain reasonable procedures 

designed to limit the furnishing of consumer reports to the purposes listed under 15 U.S.C. § 

1681b. 

65. Plaintiff’s and Class Members’ PII and PHI was wrongly disclosed and 

disseminated to unauthorized third-parties and the public as a direct and foreseeable result of 

Defendants’ failure to adopt and maintain such reasonable procedures. 

66. Defendants disclosed medical information of Plaintiff’s and Class Members to 

one or more third-parties in violation of the FCRA because such disclosure was not necessary to 

carry out the purpose for which Defendants received the information, nor was it permitted by 

statute, regulation, or order. 

67. As a direct and proximate result of Defendants’ negligent violations of the FCRA, 

as described above, Plaintiff’s and Class Members’ PII and PHI was made accessible to 

unauthorized third-parties in the public domain. Plaintiff has suffered harm and injury, including 

a loss of privacy, as a result of Defendants’ negligent FCRA violations. 

68. As a further direct or proximate result of CVS’s negligent violations of the FCRA, 

Plaintiff and Class Members were and continue to be injured and have suffered (and will suffer) 

the damages and harms as they deal with the disclosure for the foreseeable future. Accordingly, 

Plaintiff and Class Members are entitled to compensation for their actual damages, as well as 

attorneys’ fees, litigation expenses, and costs, pursuant to 15 U.S.C. § 1681o. Plaintiff also seeks 

injunctive relief enjoining the above described wrongful acts and practices of Defendants and 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 16 of 25 PAGEID #: 16
- 17 -

requiring Defendants to employ and maintain industry accepted standards for ensuring medical 

privacy. 

THIRD CAUSE OF ACTION

Ohio Rev. Code Ann. § 3701.243, et seq.

69. Plaintiff realleges each and every allegation contained above, and incorporates by 

reference all other paragraphs of this Complaint as if fully set forth herein. Plaintiff brings this 

claim on behalf of the Class set forth above.

70. This cause of action is brought pursuant to Ohio Rev. Code Ann. § 3701.243, et 

seq. At all times material herein Defendants have been subject to the requirements of § 

3701.243. The information contained in the Notice was protected information because it 

contained “the identity of any individual diagnosed as having AIDS or an AIDS-related 

condition.” Ohio Rev. Code Ann. § 3701.243(A)(3).

71. Ohio law prohibits disclosing any record mentioned above to another person

without written consent or without statutorily enumerated authorization. Ohio Rev. Code Ann. §

3701.243.

72. Defendants knowingly violated Ohio Rev. Code Ann. § 3701.243 by the unlawful 

disclosure of Plaintiff’s and Class Members’ HIV status information to third parties by providing 

it to third-parties who conducted the mailing and by sending such information in large-window 

envelopes where the information was exposed and readily viewable by others.

73. Ohio law provides a private right of action of violation of Ohio’s law regarding

HIV confidentiality. Ohio Rev. Code Ann. § 3701.244.

74. As a direct and proximate result of Defendants’ knowing and willful violations of 

the law, Plaintiff and Class Members suffered harm.

75. Plaintiff and Class Members seek relief, including, but not limited to,

compensatory damages, injunctive relief, and attorneys’ fees and costs.

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 17 of 25 PAGEID #: 17
- 18 -

FOURTH CAUSE OF ACTION

Violation of Ohio Insurance Information and Privacy Protection Act

Ohio Rev. Code § 3904.01, et seq.

76. Plaintiff realleges each and every allegation contained above, and incorporates by 

reference all other paragraphs of this Complaint as if fully set forth herein. Plaintiff brings this 

claim on behalf of the Class set forth above.

77. Plaintiff’s and Class Members’ HIV-medication information was “personal 

information” as defined under Ohio Rev. Code. § 3904.01(R) because it was “individually 

identifiable information gathered in connection with an insurance transaction from which 

judgments can be made about an individual’s character, habits, avocations, finances, occupation, 

general reputation, credit, health or any other personal characteristics.”

78. Defendants disclosed without authorization or legal basis personal information 

regarding Plaintiff and Class Members that was collected or received in connection with an 

insurance transaction, in violation of Ohio Rev. Code. § 3904.13. Plaintiff and Class Members

have been harmed by Defendants’ willful and unauthorized disclosures of their personal 

information. 

79. Plaintiff and Class Members seek relief under Ohio Rev. Code § 3904.21, 

including but not limited to, actual damages, injunctive relief, and attorney’s fees and costs. 

FIFTH CAUSE OF ACTION

Negligence

80. Plaintiff realleges each and every allegation contained above, and incorporates by 

reference all other paragraphs of this Complaint as if fully set forth herein. Plaintiff brings this 

claim on behalf of the Class.

81. CVS had a duty to exercise reasonable care and protect and secure Plaintiff’s and 

Class Members’ PII and PHI. 

82. Through its acts and omissions, Defendants violated their duty to use reasonable 

care to protect and secure Plaintiff’s and Class Members’ PII and PHI by employing substandard 

or non-existent medical privacy practices. 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 18 of 25 PAGEID #: 18
- 19 -

83. It was reasonably foreseeable, particularly given legal mandates governing health 

data protection and the growing number of data breaches of health information, that the failure to 

reasonably protect and secure Plaintiff’s and Class Members’ PII and PHI would result in the 

disclosure of Plaintiff’s and Class Members’ PII and PHI in the Notice.

84. Plaintiff’s and Class Members’ PII and PHI constitute personal property that was 

negligently disclosed due to Defendants’ negligence, resulting in harm, injury and damages to 

Plaintiff and Class Members.

85. Defendants’ reckless negligence directly and proximately caused the unauthorized 

access and disclosure of Plaintiff’s and Class Members’ PII and PHI and Plaintiff and Class 

Members have suffered and will continue to suffer damages as a result of CVS’s conduct. 

Plaintiff and Class Members seek damages and other relief as a result of CVS’s negligence.

SIXTH CAUSE OF ACTION

Negligence Per Se

86. Plaintiff realleges each and every allegation contained above, and incorporates by 

reference all other paragraphs of this Complaint as if fully set forth herein. Plaintiff brings this 

claim on behalf of the Class.

87. Pursuant to, inter alia, the FCRA, HIPAA (42 U.S.C. § 1302d et seq.), the FTCA, 

the GLBA, and Ohio Rev. Code. § 3904.01(R), Defendants were required by law to maintain 

adequate and reasonable data and measures to maintain the security and privacy of Plaintiff’s and 

Class Members’ PII and PHI. 

88. Defendants breached their duties by failing to employ industry standard medical 

privacy practices to gain compliance with those laws. 

89. It was reasonably foreseeable that the failure to reasonably protect and secure 

Plaintiff’s and Class Members’ PII and PHI in compliance with applicable laws would result in 

an unauthorized third-parties obtaining Plaintiff’s and Class Members’ PII and PHI via the 

Notice. 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 19 of 25 PAGEID #: 19
- 20 -

90. Plaintiff’s and Class Members’ PII and PHI constitute personal property that was 

stolen and disclosed due to Defendants’ negligence, resulting in harm, injury and damages to 

Plaintiff and Class Members.

91. Defendants’ conduct in violation of applicable laws directly and proximately 

caused the unauthorized access and disclosure of Plaintiff’s and Class Members’ PII and PHI and 

Plaintiff and Class Members have suffered and will continue to suffer damages as a result of 

Defendants’ conduct. Plaintiff and Class Members seek damages and other relief as a result of 

Defendants’ negligence. 

SEVENTH CAUSE OF ACTION

Breach of Contract

92. Plaintiff realleges each and every allegation contained above, and incorporates by 

reference all other paragraphs of this Complaint as if fully set forth herein. Plaintiff brings this 

claim on behalf of the Class.

93. Defendants provide services to Plaintiff and Class Members pursuant to the terms 

of its contracts, insurance agreements, and privacy policies, which all were a party to. As 

consideration, Plaintiff and Class Members paid money to CVS and/or their insurers for services. 

Accordingly, Plaintiff and Class Members paid Defendants to properly maintain and store their 

PII and PHI and not disclose it to unauthorized third-parties. Defendants violated their contracts

by failing to employ reasonable and adequate privacy practices and measures that led to the 

disclosure of Plaintiff’s and Class Members’ PII and PHI for purposes not required or permitted 

under the contracts. 

94. Plaintiff and Class Members have been damaged by Defendants’ conduct, 

including by paying for medical privacy services that they did not receive, as well as by 

incurring the harms and injuries arising from the Notice now and in the future. 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 20 of 25 PAGEID #: 20
- 21 -

EIGHTH CAUSE OF ACTION

Invasion of Privacy

95. Plaintiff realleges each and every allegation contained above, and incorporates by 

reference all other paragraphs of this Complaint as if fully set forth herein. Plaintiff brings this 

claim on behalf of the Class.

96. Plaintiff and Class Members maintain a privacy interest in their PII and PHI, 

which is private, confidential information that is also protected from disclosure by applicable 

laws as set forth above. 

97. Defendants’ disclosure of Plaintiff’s and Class Members’ PII and PHI to 

unauthorized third-parties as a result of its failure to adequately secure and safeguard their PII 

and PHI is offensive to a reasonable person. Defendants’ disclosure of Plaintiff’s and Class 

Members’ PII and PHI to unauthorized third-parties permitted the disclosure of Plaintiff’s and 

Class Members’ private quarters where their PII and PHI was stored, and disclosed private facts 

about their health into the public domain. 

98. Plaintiff and Class Members have been damaged by Defendants’ conduct, 

including by paying for medical privacy practices that they did not receive, as well as by 

incurring the harms and injuries arising from the Notice now and in the future.

NINTH CAUSE OF ACTION

Intentional Infliction of Emotional Distress

99. Plaintiff realleges each and every allegation contained above, and incorporates by 

reference all other paragraphs of this Complaint as if fully set forth herein. Plaintiff brings this 

claim on behalf of the Class.

100. Defendants’ knowing and intentional disclosure via the Notice of Plaintiff’s and 

Class Members’ treatment for HIV and HIV prevention was extreme and outrageous conduct 

made with the intention or causing, or with reckless disregard of the probability of causing 

emotional distress. As it is well known and set forth in this Complaint, those persons suffering 

from and at high-risk of contracting HIV are stigmatized and regularly discriminated against 

such that the disclosure of their HIV status or seeking of treatment of HIV is perhaps the most 

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 21 of 25 PAGEID #: 21
- 22 -

harmful disclosure CVS could make about it patients, and it did so in a reckless fashion. 

Moreover, numerous state and federal laws as set forth herein further demonstrate the necessity 

of confidential medical information being protected, and even more specifically so for 

information regarding HIV testing and treatment. 

101. As a direct and proximate cause of Defendants’ conduct alleged herein regarding 

the Notice, Plaintiff and Class Members have suffered severe or extreme emotional distress and 

other damages due to the release of their confidential medical information to third-parties. 

102. Accordingly, Defendants are liable to Plaintiff and Class Members for all actual 

compensatory damages, punitive damages, and all attorneys’ fees and costs of suit. 

TENTH CAUSE OF ACTION

Unjust Enrichment

103. Plaintiff realleges each and every allegation contained above, and incorporates by 

reference all other paragraphs of this Complaint as if fully set forth herein. Plaintiff brings this 

claim on behalf of the Class.

104. The State of Ohio, Plaintiff and Class Members conferred a benefit on Defendants

by paying for medical privacy practices they did not receive. 

105. Defendants have retained the benefits of its unlawful conduct including the 

amounts received for medical privacy practices that it did not provide. Due to Defendants’

conduct alleged herein, it would be unjust and inequitable under the circumstances for 

Defendants to be permitted to retain the benefit of the wrongful conduct. 

106. Plaintiff and the Class Members are entitled to full refunds, restitution and/or 

damages from Defendants and/or an order of this Court proportionally disgorging all profits, 

benefits, and other compensation obtained by Defendants from the alleged wrongful conduct. If 

necessary, the establishment of a constructive trust from which the Plaintiff and Class Members

may seek restitution or compensation may be created.

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 22 of 25 PAGEID #: 22
- 23 -

107. Additionally, Plaintiff and the Class Members may not have an adequate remedy 

at law against Defendants, and accordingly plead this claim for unjust enrichment in addition to 

or, in the alternative to, other claims pleaded herein.

ELEVENTH CAUSE OF ACTION

Declaratory Relief

28 U.S.C. § 2201

108. Plaintiff realleges each and every allegation contained above, and incorporates by 

reference all other paragraphs of this Complaint as if fully set forth herein. Plaintiff brings this 

claim on behalf of the Class.

109. An actual controversy has arisen and now exists between Plaintiff and the putative 

Class on the one hand, and Defendants on the other, concerning Defendants’ failure to protect 

Plaintiff’s and Class Members’ PII and PHI in accordance with applicable state and federal 

regulations and the agreements between the parties. Plaintiff and the Class Members contend 

that Defendants failed to maintain adequate and reasonable privacy practices to protect their PII 

and PHI while on the other hand, Defendants contend it has complied with applicable state and 

federal regulations and its agreements with Plaintiff and Class Members to protect their PII and 

PHI. 

110. Accordingly, Plaintiff and Class Members entitled to and seek a judicial 

determination of whether Defendants have performed, and are performing, the medical privacy 

practices and obligations necessary to protect and safeguard Plaintiff’s and Class Members’ PII 

and PHI from further unauthorized, access, use, and disclosure, or insecure disposal.

111. A judicial determination of the rights and responsibilities of the parties over 

Defendants’ medical privacy practices is necessary and appropriate at this time so that: (1) that 

the rights of the Plaintiff and the Classes may be determined with certainty for purposes of 

resolving this action; and (2) so that the Parties will have an understanding of Defendants’

obligations in the future given its continuing legal obligations and ongoing relationships with 

Plaintiff and Class Members.

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 23 of 25 PAGEID #: 23
- 24 -

VIII. PRAYER FOR RELIEF

WHEREFORE, Plaintiff on his own and behalf of all others similarly situated, prays for 

relief as follows:

A. For an Order certifying this case as a class action pursuant to Federal Civil 

Rule 23, appointing Plaintiff as Class Representative, and the undersigned as Class Counsel;

B. Awarding monetary, punitive and actual damages and/or restitution, as 

appropriate; 

C. Awarding declaratory and injunctive relief as permitted by law or equity to assure 

that the Class has an effective remedy, including enjoining Defendants from continuing the 

unlawful practices as set forth above;

D. Prejudgment interest to the extent allowed by the law;

E. Awarding all costs, experts’ fees and attorneys’ fees, expenses and costs of 

prosecuting this action; and

F. Such other and further relief as the Court may deem just and proper.

IX. JURY TRIAL DEMAND

Plaintiff requests a trial by jury on behalf of himself and all similarly-situated persons 

pursuant to Federal Rule of Civil Procedure 38.

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 24 of 25 PAGEID #: 24
- 25 -

DATED: May 16, 2018

Respectfully submitted,

By: /s David P. Meyer

 David P. Meyer

David P. Meyer (0065205)

MEYER WILSON CO., LPA

Email: dmeyer@meyerwilson.com

Matthew R. Wilson (0072925)

Email: mwilson@meyerwilson.com

Michael J. Boyle, Jr. (0091162)

Email: mboyle@meyerwilson.com

1320 Dublin Road, Ste. 100

Columbus, OH 43215

Telephone: (614) 224-6000

Facsimile: (614) 819-8230

Marnie C. Lambert (0073054)

LAMBERT LAW FIRM, LLC

4889 Sawmill Road, Suite 125

Columbus, OH 43235

Telephone: (888) 203-7833

Facsimile: (888) 386-3098

Laurence D. King (pro hac vice to be filed)

Matthew B. George (pro hac vice to be filed)

KAPLAN FOX & KILSHEIMER LLP

350 Sansome Street, Suite 400

San Francisco, CA 94104

Telephone: 415-772-4700

Facsimile: 415-772-4707

lking@kaplanfox.com

mgeorge@kaplanfox.com

mchoi@kaplanfox.com

Counsel for Plaintiff John Doe

Case: 2:18-cv-00488-ALM-KAJ Doc #: 1 Filed: 05/16/18 Page: 25 of 25 PAGEID #: 25