UNPUBLISHED

UNITED STATES COURT OF APPEALS

FOR THE FOURTH CIRCUIT

No. 20-1767

J.R., individually and on behalf of her minor children A.R. and H.K.; J.H., individually, 

and on behalf of all others similarly situated; B.Y., individually, and on behalf of all others 

similarly situated; J.S., individually, and on behalf of all others similarly situated,

Plaintiffs – Appellants,

v.

WALGREENS BOOTS ALLIANCE, INC.; WALGREEN CO.,

 Defendants – Appellees.

Appeal from the United States District Court for the District of South Carolina, at

Charleston. David C. Norton, District Judge. (2:19-cv-00446-DCN)

Argued: September 22, 2021 Decided: October 19, 2021

Before MOTZ and AGEE, Circuit Judges, and KEENAN, Senior Circuit Judge.

Affirmed by unpublished per curiam opinion.

ARGUED: Michael J. Moore, POPE MCGLAMRY KILPATRICK MORRISON & 

NORWOOD, P.C., Atlanta, Georgia, for Appellants. Robert N. Hochman, SIDLEY 

AUSTIN LLP, Chicago, Illinois, for Appellees. ON BRIEF: Charles W. Byrd, Aimee J. 

Hall, POPE MCGLAMRY KILPATRICK MORRISON & NORWOOD, P.C., Atlanta, 

Georgia; William N. Nettles, BILL NETTLES LAW, Columbia, South Carolina, for 

Appellants. David E. Dukes, Amanda S. Kitts, Adam J. Hegler, NELSON MULLINS 
2

RILEY & SCARBOROUGH LLP, Columbia, South Carolina; Scott D. Stein, Matthew C. 

Bergs, Ross O. Kloeber, SIDLEY AUSTIN LLP, Chicago, Illinois, for Appellees.

Unpublished opinions are not binding precedent in this circuit.
3

PER CURIAM:

Six pharmacy customers (“Plaintiffs”) appeal from the district court’s dismissal of 

their twelve-count class action suit against Walgreens Boot Alliance, Inc. (“WBA”) and 

Walgreen Company (collectively, “Walgreens”). At bottom, Plaintiffs allege that the 

transfer of their personal identifying information (“PII”) from the Walgreens pharmacy 

filling their prescription to separate, internal company databases violates their rights under 

various federal and state statutes and state tort claims. For the following reasons, we affirm

the judgment of the district court.

I.

We accept as true all well-pleaded allegations in Plaintiffs’ Amended Complaint 

and view it in the light most favorable to them. Ostrzenski v. Seigel, 177 F.3d 245, 251 (4th 

Cir. 1999). Through that lens, the relevant facts are as follows.

Congress enacted the 340B Drug Pricing Program (the “Program”) in 1992, which 

requires participating manufacturers to provide certain prescription drugs at significantly 

discounted prices to eligible and enrolled health care providers (“covered entities”). 

Covered entities typically serve low-income patients with limited access to health care. 

Given the cost savings involved, federal law expressly prohibits covered entities from 

“resell[ing] or otherwise transfer[ring]” a 340B drug “to a person who is not a patient of 

the entity.” 42 U.S.C. § 256b(a)(5)(B). Covered entities are subject to audits by both the 

Department of Health and Human Services and participating drug manufacturers. 

Sometimes lacking the resources to operate in-house pharmacies, covered entities often
4

engage a retail pharmacy (“contract pharmacy”) to dispense 340B-eligible drugs purchased 

by the covered entity to the low-income patient.

Relevant here, Walgreens is a 340B contract pharmacy for several covered entities 

in South Carolina, some of which provided Plaintiffs with medical services and use 

Walgreens pharmacies in South Carolina to fill their patients’ prescriptions. All South 

Carolina pharmacies must comply with the South Carolina Pharmacy Practice Act (the 

“PPA”), S.C. Code Ann. § 40-43-10 et seq.; the South Carolina Prescription Information 

Privacy Act (the “PIPA”), S.C. Code Ann. § 44-117-10 et seq.; and the American 

Pharmaceutical Association Code of Ethics.

In 2010, Walgreens created a separate division within its corporate organization, 

“340B Complete,” to oversee administration of its contract pharmacy operations and 

ensure compliance with the Program. This division is separate from other aspects of 

Walgreens’ operations, including its pharmaceutical, photo, and retail divisions. None of 

the 160 employees working in the 340B Complete division are licensed pharmacists. 

When any patient seeks to fill a prescription at a Walgreens pharmacy, the 

pharmacist first enters the patient’s PII into a “proprietary computer software system” 

called IntercomPlus, which all Walgreens pharmacies nationwide can access. J.A. 36. That 

PII includes: the patient’s name, address, date of birth, payment information, and thirdparty reimbursement rate; the drug’s name, dosage, frequency, and refill information; and 

the prescribing physician’s information. The PII in IntercomPlus is then transferred to a 

“corporate central repository” called Enterprise Data Warehouse (“EDW”), J.A. 41, all of 

which is part of the same Walgreens corporate entity.
5

Walgreens markets to covered entities a commercial software product registered and 

trademarked as “340B Complete®,” which extracts the PII from EDW and compares it to 

the PII that a given Walgreens pharmacy received from a covered entity. Assuming there 

is a match, the 340B Complete® software transfers the PII on file in EDW into Walgreens’ 

340B Complete payment process. 

This data transferring occurs for purposes of replenishing the pharmaceutical drugs 

that a Walgreens pharmacy dispenses to a 340B patient. Under federal law, only a covered 

entity may purchase 340B drugs. Walgreens cannot. Using 340B Complete®, Walgreens

performs a financial analysis to determine if it is less expensive to process payment through 

the patient’s insurance company. If so, Walgreens will submit the claim to insurance, retain 

the full insurance reimbursement amount as it would with any ordinary consumer, and 

purchase the resupply itself. If, however, it is cheaper for Walgreens to process the 

transaction as a 340B event, then 340B Complete® will designate it as such. This enables

Walgreens to replenish the drug inventory through the covered entity for a 340B patient 

and not run afoul of the distinction between 340B and non-340B prescription drug 

purchases.

Nonetheless, Plaintiffs claim the transfer of their PII from the pharmacy filling their 

prescription to EDW, and the transfer from EDW to 340B Complete®, violates various

rights. Among other claims, they allege that they never gave Walgreens permission to use 

or transfer their PII and that Walgreen’s Notice of Privacy Policy (“NPP”) did not inform

them that their PII would be used in 340B Complete®.
6

II.

Plaintiffs filed a twelve-count class action Amended Complaint, seeking 

preliminary1 and permanent injunctive relief, as well as “compensatory, exemplary, and 

punitive damages in amounts to be determined.” J.A. 80. The claims are as follows: (1) 

invasion of privacy: wrongful appropriation; (2) invasion of privacy: wrongful publicizing 

of private affairs; (3) negligence per se based on violations of the PIPA; (4) breach of 

contract; (5) negligence (based on violations of the PIPA, the PPA, and regulations issued 

by the South Carolina Board of Pharmacy); (6) negligence (based on a duty to disclose to 

Plaintiffs “the true facts about [Walgreens’] substandard patient privacy practices,” J.A. 

67); (7) respondeat superior2

; (8) negligent training and supervision; (9) unjust enrichment; 

(10) violation of the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. §§ 1681–1681x; (11) 

negligence per se based on violations of the FCRA,3 the Health Insurance Portability and 

1 The district court denied Plaintiffs’ motion for a preliminary injunction. Plaintiffs’ 

appeal from that decision is currently being held in abeyance pending resolution of this 

appeal. See J.R. v. Walgreens Boots Alliance, Inc., No. 19-2404.

2 The district court dismissed this claim because “[r]espondeat superior is not a 

cause of action; it is a theory of liability.” J.R. Walgreens Boots Alliance, Inc., 470 F. Supp. 

3d 534, 561 (D.S.C. 2020) (citing Austin v. Specialty Transp. Servs., Inc., 594 S.E.2d 867,

877 (S.C. Ct. App. 2004) (“Under the doctrine of respondeat superior, the employer is 

liable for the acts of an employee acting within the scope of employment.”)). Plaintiffs 

have waived any challenge to this aspect of the district court’s holding by failing to address 

it in their Opening Brief. See Carter v. Lee, 283 F.3d 240, 252 n.11 (4th Cir. 2002) (“[T]his 

Court normally views contentions not raised in an opening brief to be waived.”).

3 The district court found that Plaintiffs had “abandoned the FCRA claim” as well 

as their “negligence per se claim based on an alleged violation of FCRA.” J.R., 470 F. 

Supp. 3d at 550. Plaintiffs do not challenge this holding in their Opening Brief, and, as 

such, have waived it. See Carter, 283 F.3d at 252 n.11.
7

Accountability Act (“HIPAA”), and the Federal Trade Commission Act (“FTCA”); and 

(12) declaratory relief.

Walgreens filed a motion to dismiss for failure to state a claim under Federal Rule 

of Civil Procedure 12(b)(6), which the district court granted.4 We have jurisdiction over 

Plaintiffs’ timely-filed appeal, see 28 U.S.C. § 1291, and review the district court’s 

dismissal de novo, Garnett v. Remedi SeniorCare of Va., LLC, 892 F.3d 140, 142 (4th Cir. 

2018).5

4 The district court separately granted WBA’s motion to dismiss for lack of personal 

jurisdiction. By way of background, WBA is a holding company that utilizes three 

divisions to conduct its operations, one of which is “Retail Pharmacy USA.” Walgreen Co. 

is a wholly owned WBA subsidiary, which operates the Retail Pharmacy USA division. 

Stated differently, Walgreen Co. operates all Walgreens pharmacies in the United States.

Plaintiffs challenge the district court’s dismissal of WBA on two grounds, arguing 

that: (1) WBA waived its jurisdictional challenge by asserting a merits-based defense to 

their preliminary injunction motion; and, alternatively, (2) WBA is subject to the Court’s 

jurisdiction because it is Walgreen Co.’s alter ego. Even if Plaintiffs are correct as to either 

theory, we would still affirm the district court’s dismissal of WBA because Plaintiffs 

alleged the same facts and deficient causes of action against both entities. And we must 

conduct that analysis regardless of whether the district court’s personal jurisdiction 

decision as to WBA was correct. Therefore, since the ultimate outcome would be the same 

even if we agreed with Plaintiffs’ jurisdictional arguments, we need not reach this issue to 

affirm. See East Coast Repair & Fabrication, LLC v. U.S. ex rel Dep’t of Navy, --- F.4th 

---, 2021 WL 4780508, at *2 (4th Cir. 2021) (“[A] court may bypass a difficult 

jurisdictional question and ‘choose among threshold grounds for denying audience to a 

case on the merits . . . when considerations of convenience, fairness, and judicial economy 

so warrant.’” (quoting Sinochem Int’l Co. v. Malaysia Int’l Shipping Corp., 549 U.S. 422, 

431-32 (2007)); see also Gremillion v. Chivatero, 749 F.2d 276, 277 (5th Cir. 1985) (per 

curiam) (affirming dismissal for failure to state a claim without addressing personal 

jurisdiction).

5 We have subject matter jurisdiction under 28 U.S.C. § 1332(d)(2) because the 

aggregated amount in controversy exceeds $5,000,000, and at least one of the proposed 

class members is diverse from Walgreens.
8

A. The Invasion of Privacy Claims 

“In South Carolina, there are three separate and distinct causes of action for invasion 

of privacy: (1) wrongful appropriation of personality; (2) wrongful publicizing of private 

affairs; and (3) wrongful intrusion into private affairs.” Sloan v. S.C. Dep’t of Pub. Safety, 

586 S.E.2d 108, 110 (S.C. 2003) (per curiam). Plaintiffs brought claims under the first two

theories, both of which the district court dismissed because there were no allegations that

Walgreens publicized their PII. 

The South Carolina Supreme Court has observed that “[e]ncompassed in these . . .

recognized torts is the infringement on the right of publicity.” Gignilliat v. Gignilliat, Savitz 

& Bettis, L.L.P., 684 S.E.2d 756, 760 (S.C. 2009) (emphasis added). After all, “[t]he right 

of privacy is defined as the right of an individual to be let alone and live a life free from 

unwarranted publicity.” Glassmeyer v. City of Columbia, 777 S.E.2d 835, 839 (S.C. Ct. 

App. 2015) (emphasis added).

As for wrongful appropriation of personality, the South Carolina Supreme Court has 

explained that the “gist” of that claim “is the violation of the plaintiff’s exclusive right at 

common law to publicize and profit from his name, likeness, and other aspects of personal 

identity.” Sloan, 586 S.E.2d at 110 (emphasis added). Wrongful publicizing of private 

affairs similarly “involves a public disclosure of private facts about the plaintiff . . . in 

which there is no legitimate public interest.” Snakenberg v. Hartford Cas. Ins. Co. ̧ 383 

S.E.2d 2, 6 (S.C. Ct. App. 1989). “The gravamen of the tort is publicity as opposed to mere 

publication.” Id.
9

According to South Carolina courts, “publicity” “means that the matter is made 

public, by communicating it to the public at large, or to so many persons that the matter 

must be regarded as substantially certain to become one of public knowledge.” Swinton 

Creek Nursery v. Edisto Farm Credit, ACA, 514 S.E.2d 126, 131 (S.C. 1999) (quoting 

Restatement (Second) of Torts § 652D cmt. a (Am. L. Inst. 1977)). Here, though Plaintiffs 

allege that their PII is accessible by the 160 non-pharmacist employees in Walgreen’s 340B 

Complete division, there is no assertion that Walgreens has publicized that information to 

the public at large. The alleged internal corporate disclosures are not “public” broadcasts, 

as the PII is only accessed by those employees for private, business purposes. Therefore, 

we agree with the district court that Plaintiffs failed to state a claim for invasion of privacy

under South Carolina law.

B. Negligence Per Se Based on Violation of the PIPA

South Carolina’s PIPA provides that “[n]o patient prescription drug information 

may be transferred or received by a person without the written consent of the patient or a 

person authorized by law to act on behalf of the patient.” S.C. Code Ann. § 44-117-30. The 

statute provides thirteen exceptions to this broad prohibition. Id. § 44-117-30(1)–(13). It 

further requires that pharmacies maintain “a mechanism to prevent the disclosure of” PII 

and other patient information. Id. § 44-117-350.

The PIPA does not expressly authorize a private right of action, and instead subjects 

violators to criminal penalties and a fine. Id. § 44-117-40. The district court, however,

concluded there is an implied private right of action under the statute. Regardless of 

whether that decision was correct, we agree with the district court that Plaintiffs failed to 
10

allege a substantive PIPA violation because Walgreens’ internal 340B Complete process 

did not involve a “transfer” or “receipt” of their PII, nor did Walgreens fail to prevent its 

“disclosure.”

The PIPA does not define what it means to “transfer,” “receive,” or “disclos[e]” 

protected information, as set out in sections 44-117-30 and -350. Nor does South Carolina 

have any case law interpreting the PIPA. Relying on general principles of statutory 

interpretation, however, our goal is to “ascertain and effectuate the intent of the 

legislature,” by “giv[ing] the words found in the statute their plain and ordinary meaning.” 

CFRE, LLC v. Greenville Cnty. Assessor, 716 S.E.2d 877, 881 (S.C. 2011) (citations 

omitted); see also Askew v. HRFC, LLC, 810 F.3d 263, 266 (4th Cir. 2016) (explaining that 

federal courts sitting in diversity must, “if necessary, predict how the state’s highest court 

would rule on an unsettled issue” (citation omitted)).

With that in mind, we conclude the district court did not err in limiting the PIPA’s

scope to external data transfers. Although the statute does not expressly modify the word 

“transfer,” that term’s plain meaning supports this narrow construction. The Webster’s 

Third New International Dictionary defines the verb “transfer” as “to carry or take from 

one person or place to another”; “to move or send to a different location esp. for business, 

vocational, or military purposes”; “to cause to pass from one person or thing to another”; 

“to make over or negotiate the possession or control over.” Transfer, Webster’s Third New 

Int’l Dictionary (2002) (emphases added). The Oxford English Dictionary similarly defines 

it in a way implicating only exchanges between legally distinct entities: “To convey or take 

from one place, person, etc. to another; . . . to give or hand over from one to another.” 
11

Transfer, Oxford-English Dictionary Online, (Oxford Univ. Press, Sept. 2021) (emphases 

added). Naturally read, then, the PIPA’s prohibition on “transfer[s]” is only implicated 

when a patient’s PII leaves the custody of the corporate entity originally entitled to possess 

it (a “person”) to a different legal entity or natural person.

The exceptions to section 44-117-30’s general prohibition support this

understanding of the text. They encompass—implicitly and explicitly—acceptable 

transfers of information from the authorized possessor to a person outside of that legal 

entity. In other words, they relate to external transfers of PII. For example, no violation of

the PIPA occurs: when specified professionals providing treatment services to a patient 

communicate among themselves, § 44-117-30(2); when information must be transferred 

“to effect the recall of a defective drug or device,” § 44-117-30(4); when information must 

be transferred to “adjudicate or process payment claims for health care,” § 44-117-30(6), 

so long as the recipient does not further disclose the information; when an entity transfers 

information as part of a sale of a business to its successor in interest, § 44-117-30(10); or 

when the patient has authorized another person to pick up his prescription from the 

pharmacy, § 44-117-30(12).

6

6 Other PIPA provisions lend additional support. For example, section 44-117-50 

states that PIPA’s prohibition does not invalidate the “authority of a court to issue a 

subpoena for medical records” or “the authority of a license or disciplinary board of this 

State” or “of the Department of Health and Environmental Control” to obtain patient 

records as authorized elsewhere. Yet again, in all of the delineated caveats, the transfer or 

receipt of PII involves a third party.
12

There is no textual basis for interpreting “transfer” and “receipt”7 to apply to 

movements of data between parts of a single legal entity. As the district court ably 

expressed it, to adopt that construction would mean that a pharmacy would violate the 

PIPA any time it moved data “outside of the four walls of the pharmacy, [including] basic 

functions such as transmitting information for legal, administrative, or IT services that do 

not occur within the four walls of the pharmacy.” J.R., 470 F. Supp. 3d at 557.

8 Therefore, 

we affirm the district court’s dismissal of this claim.

C. Breach of Contract

Plaintiffs raised two breach of contract claims before the district court. First, they

argued that when they gave Walgreens their PII, it implicitly agreed to take reasonable 

measures to secure that data, thereby creating an implied contract. Second, Plaintiffs 

claimed that Walgreens’ NPP was a contract, which the 340B Complete process violated. 

The district court rejected both theories. We agree.

First, there was no implied contract between Plaintiffs and Walgreens. An impliedin-fact contract “arises when the assent of the parties is manifested by conduct, not words.” 

7 To “receive” means “to take possession or delivery of,” suggesting that the 

information was not previously possessed by that legal entity. Receive, Webster’s New 

Int’l Dictionary (2002).

8 And while Plaintiffs now argue that the PIPA prohibits the initial exchange of 

information from the pharmacy-entered database IntercomPlus to the corporate-controlled 

database EDW, they did not make that assertion in the district court, instead limiting their 

argument to the later transfer from EDW to 340B Complete for analysis. As such, that part 

of the claim is waived. See Holland v. Big River Mins. Corp., 181 F.3d 597, 605 (4th Cir. 

1999) (“Generally, issues that were not raised in the district court will not be addressed on 

appeal.”).
13

Thomerson v. DeVito, 844 S.E.2d 378, 384 n.10 (S.C. 2020) (quoting Stanley Smith & Sons 

v. Limestone College, 322 S.E.2d 474, 478 n.1 (S.C. Ct. App. 1984)). To be valid, “[t]he 

parties must manifest their mutual assent to all essential terms,” so “[i]f one of the parties 

has not agreed, then a prerequisite to formation of the contract is lacking.” Stanley Smith, 

322 S.E.2d at 477. Plaintiffs alleged no facts indicating that at the time they agreed to 

purchase prescription drugs from a Walgreens pharmacy, both they and Walgreens

implicitly agreed that Walgreens would not use their PII in the 340B Complete process. 

See J.A. 44 (alleging that Plaintiffs were “unaware of” Walgreens’ use of Plaintiffs’ PII). 

Thus, there is no basis to conclude that they entered into an implied contract with 

Walgreens that included a term restricting its use. Indeed, Plaintiffs alleged that Walgreens’ 

NPP provided customers “the right to request additional restrictions on [Walgreens’] use 

or disclosure” of PII, J.A. 35, but they did not allege that they ever asked for such additional 

restrictions, further indicating a lack of agreement between the Parties.9

Second, there was no actionable “breach” of the NPP. If a company’s privacy policy

“does not contain any exchange [of promises],” no enforceable contract exists. In re 

Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 610–11 (9th Cir. 2020) (holding a 

privacy policy was not a contract because it “merely provides information––not 

commitments––regarding Facebook’s use of information and how users can control that 

information”); Brush v. Miami Beach Healthcare Grp. Ltd., 238 F. Supp. 3d 1359, 1367 

9 Plaintiffs cite data breach cases holding that there is an implied contract to keep a 

person’s sensitive data reasonably secure. Those cases are inapposite because there is no 

allegation that Walgreens was hacked or otherwise disclosed the PII to any outside party.
14

(S.D. Fla. 2017) (holding the defendant pharmacy’s privacy policy was not a contract 

because it merely recounted patients’ rights under federal law, which defendant was 

already required to comply with irrespective of the bargain with plaintiff). That same logic 

applies here by Plaintiffs’ own allegations, which show that Walgreens’ NPP merely 

informs patients of what it is “required by law” to do and “provide[s] notice of 

[Walgreens’] ‘legal duties and privacy practices with respect to [PII].’” J.A. 34–35. 

Therefore, we affirm the district court’s dismissal of Plaintiffs’ breach of contract claims.

D. Negligence Under the PPA

Next, Plaintiffs argue Walgreens’ purported breach of duties established by 

professional standards amounts to negligence. The district court correctly rejected this 

claim. The Supreme Court of South Carolina has squarely held that the PPA only 

“regulate[s] the licensing and practice of pharmacists; . . . [its] provisions do not set forth, 

explicitly or implicitly, a duty of confidentiality.” Evans v. Rite Aid Corp., 478 S.E.2d 846, 

847 (S.C. 1996). Thus, Plaintiffs’ claim that the PPA imposes a duty of care to “maintain 

the confidentiality of [Plaintiffs’] PII,” J.A. 72, is foreclosed. 

Plaintiffs also assert that there is a general duty to “maintain a pharmacy patient 

record system with adequate security and systems safeguards to prevent unauthorized 

access of pharmacy patient records.” J.A. 72. That is one of the PPA’s requirements. See 

S.C. Code Ann. § 40–43–86(O)(3). Assuming that this is sufficient evidence of a duty to 

do so, Plaintiffs have nevertheless failed to allege a breach of that duty. There are no 

allegations that unauthorized persons obtained access to Plaintiffs’ PII, and Plaintiffs have 

cited no authority to plausibly establish that a non-pharmacist Walgreens employee’s 
15

access to that data to determine if a transaction qualifies for the 340B program is 

“unauthorized.”

E. General Negligence

Plaintiffs further allege that Walgreens “fail[ed] to conform to the privacy practices 

universally recognized and accepted in the pharmaceutical profession.” J.A. 68. There are 

no factual allegations from the American Pharmaceutical Code of Ethics or the South 

Carolina Board of Pharmacy’s promulgated rules that show what constitutes those 

“universally recognized and accepted” practices or how Walgreens purportedly violated 

them. The same logic applies to the alleged duty to “exercise reasonable care to protect 

[Plaintiffs] against the risk of foreseeable harm from their actions.” Opening Br. 45. 

Without any facts plausibly demonstrating the precise duty Walgreens is alleged to have 

breached, the district court properly determined that Plaintiffs failed to plausibly establish 

that Walgreen’s 340B Complete process constitutes a breach. See Evans, 478 S.E.2d at 848 

(holding there is no common law duty of confidentiality for pharmacists).

F. Negligent Training and Supervision Claims

South Carolina recognizes a cause of action for negligent supervision, Degenhart v. 

Knights of Columbus, 420 S.E.2d 495, 496 (S.C. 1992), but negligent training is merely a 

subset of a negligent supervision claim, e.g., Beneficial Financial I, Inc. v. Windham, 847 

S.E.2d 793, 804–05 (S.C. Ct. App. 2020). Under South Carolina law, 

[a]n employer may be liable for negligent supervision when (1) his employee 

intentionally harms another when he is on the employer’s premises, is on 

premises he is privileged to enter only as employee, or is using the 

employer’s chattel; (2) the employer knows or has reason to know he has the 
16

ability to control the employee; and (3) the employer knows or has reason to 

know of the necessity and opportunity to exercise such control.

Doe v. Bishop of Charleston, 754 S.E.2d 494, 500 (S.C. 2014) (emphasis added) (citing 

Degenhart, 420 S.E.2d at 496).

Here, as the district court observed, there is no allegation of any intentional conduct 

on the part of any Walgreens employee. Further, because there has been no cognizable 

“harm” to Plaintiffs arising from any Walgreens employee’s conduct, we find that 

component of the negligent supervision claim also has not been adequately alleged.

Therefore, we affirm the dismissal of these claims.

G. Unjust Enrichment

To recover for unjust enrichment in South Carolina, a plaintiff must prove: “(1) [a] 

benefit conferred by plaintiff upon the defendant; (2) realization of that benefit by the 

defendant; and (3) retention of the benefit by the defendant under circumstances that make 

it inequitable for him to retain it without paying its value.” Myrtle Beach Hosp., Inc. v. City 

of Myrtle Beach, 532 S.E.2d 868, 872 (S.C. 2000). The district court dismissed Plaintiffs’ 

unjust enrichment claim because they failed to allege that they “reasonably expected 

payment from the unconsented use of their PII.” J.R., 470 F. Supp. 3d at 563. Plaintiffs

argue there is no such requirement in bringing an unjust enrichment claim and that the 

district court erroneously added this as an additional element. 

We need not resolve this dispute, however, because Plaintiffs’ concession that they 

voluntarily “provide[d] their PII to Walgreens’ pharmacy for the intended purposes of 

obtaining, and allowing Walgreen’s pharmacy to seek third-party payment for, their 
17

individual prescriptions,” J.A. 36 (emphasis added), defeats any allegation that its 

acquisition and use of the PII was somehow “inequitable.” Stated differently, Walgreens 

could not have acted unjustly by using Plaintiffs’ PII for the very purpose they intended 

for it to be used. Therefore, we affirm the district court’s dismissal of Plaintiffs’ unjust 

enrichment claim. See Scott v. United States, 328 F.3d 132, 137 (4th Cir. 2003) (“We are, 

of course, entitled to affirm on any ground appearing in the record, including theories not 

relied upon or rejected by the district court.”).

H. Negligence Per Se Based on HIPAA and FTCA Violations

We turn next to Plaintiffs’ negligence per se claims based on violations of HIPAA 

and the FTCA. “Negligence per se is negligence arising from a defendant’s violation of a 

statute.” Wogan v. Kunze, 623 S.E.2d 107, 117 (S.C. Ct. App. 2005). To make out such a 

claim, Plaintiffs must demonstrate that the statute allegedly violated allows for a private 

cause of action. See Doe v. Marion, 645 S.E.2d 245, 248 (S.C. 2007). That analysis turns 

on whether the legislature intended to permit a private action, either explicitly or implicitly. 

Id. But legislative intent can be implied “only if the legislation was enacted for the special 

benefit of a private party.” Id.

HIPAA addresses various aspects of confidentiality of health care information, 

including requirements about how electronic health care information is stored. The district 

court concluded that there was no implied private right of action under HIPAA, meaning

it could not support a negligence per se claim. We agree. Recently, we joined our sister 

circuits in holding that HIPAA does not create a private right of action. See Payne v. 

Taslimi, 998 F.3d 648, 660 (4th Cir. 2021) (“Every circuit court to consider whether 
18

HIPAA created a private right to sue has found that it does not. This is because HIPAA 

does not expressly allow for a private cause of action but delegates enforcement authority 

to the Secretary of the Department of Health and Human Services, reflecting Congress’s 

intent to forgo creating a private remedy. We see no reason to chart a different course from 

our sister courts. [The plaintiff] has no private right of action under HIPAA.” (internal 

citations omitted)). Therefore, the district court properly dismissed Plaintiffs’ negligence 

per se claim based on an alleged HIPAA violation.

Plaintiffs’ FTCA-based negligence per se claim fares no better. The FTCA makes 

it unlawful to engage in “[u]nfair methods of competition in or affecting commerce, and 

unfair or deceptive acts or practices in or affecting commerce.” 15 U.S.C. § 45(a)(1). As 

with HIPAA, the FTCA does not explicitly provide for a private right of action. And the 

Act’s authorization of the Federal Trade Commission to enforce its provisions indicates 

Congress’s intent against creating an implied right of action. See 15 U.S.C. § 45(m); cf. 

Payne, 998 F.3d at 660 (observing, in the context of another federal statute, that Congress’s 

grant of enforcement authority to the executive branch counsels against an implied right of 

action). Though we have not yet addressed this issue, other Circuits have uniformly found 

the FTCA does not contain an implied private right of action. See, e.g., Morrison v. Back 

Yard Burgers, Inc., 91 F.3d 1184, 1187 (8th Cir. 1996); Am. Airlines v. Christensen, 967 

F.2d 410, 414 (10th Cir. 1992); R.T. Vanderbilt Co. v. Occupational Safety & Health Rev. 

Comm’n, 708 F.2d 570, 574 n.5 (11th Cir. 1983); Fulton v. Hecht, 580 F.2d 1243, 1248 

n.2 (5th Cir. 1978); Holloway v. Bristol-Myers Corp., 485 F.2d 986, 1002 (D.C. Cir. 1973); 
19

Carlson v. Coca-Cola Co., 483 F.2d 279, 280–81 (9th Cir. 1973). We think this conclusion 

is correct and forecloses Plaintiffs’ claim.

But even assuming the FTCA does contain an implied private right of action, the 

district court properly determined Plaintiffs failed to assert a violation. Their Amended 

Complaint highlights supposed shortfalls in Walgreens’ information-privacy practices, 

namely, its purported failure to “maintain the security and privacy of” patient’s PII, which

they contend resulted “in the unauthorized transfer, receipt, and/or use, disclosure, or 

dissemination” of that PII. J.A. 61; see also Opening Br. 55 (discussing alleged 

“unauthorized access”). But the only factual basis for this alleged violation is Walgreens’ 

internal transfer of information within various in-house electronic databases to be accessed 

by Walgreens employees for purposes of processing a patient’s health care information for 

a 340B billing determination. There are no allegations of any attempt—much less a 

successful endeavor—by an unauthorized third-party to access Plaintiffs’ PII. Plaintiffs 

have thus failed to state a claim under the FTCA, even assuming one exists. Therefore, we 

affirm the district court’s dismissal of these claims.

I. Declaratory Relief

Finally, because all of Plaintiffs’ other claims fail as a matter of law, we affirm the

district court’s determination that they are not entitled to declaratory relief. See 28 U.S.C. 

§ 2201(a) (requiring that there be an “actual controversy” before entering a declaratory 

judgment).
20

III.

Accordingly, we affirm the district court’s judgment in full.

AFFIRMED