1 

IN THE UNITED STATES DISTRICT COURT 

FOR THE NORTHERN DISTRICT OF INDIANA 

HAMMOND DIVISION 

MICHELLE HAYWOOD, ) 

 ) 

 Plaintiff, ) 

 ) 

 vs. ) No. 2:15-CV-373 

 ) 

NOVARTIS PHARMACEUTICALS ) 

CORP., ) 

 ) 

 Defendant. ) 

OPINION AND ORDER 

This matter is before the Court on the Defendant’s Motion to 

Dismiss Plaintiff’s First Amended Complaint, filed by the 

defendant, Novartis Pharmaceuticals Corporation, on December 27, 

2016. (DE #35.) For the reasons set forth below, the motion to 

dismiss is GRANTED. The clerk is DIRECTED to close this case. 

 

BACKGROUND 

Plaintiff, Michelle Haywood (“Haywood”), filed her complaint 

in state court on August 13, 2015. (DE #4.) The complaint brought 

claims for negligence, negligent training and supervision, and 

public disclosure of private facts; it also listed “punitive 

damages” as a separate count. (Id.) The defendant, Novartis 

Pharmaceuticals Corporation (“Novartis”), removed the matter to 
2 

this Court on the basis of diversity jurisdiction on September 28, 

2015. (DE #1.) On November 2, 2015, Novartis filed a motion to 

dismiss the complaint. (DE #14.) On September 27, 2016, the Court 

granted the motion, dismissed the complaint without prejudice, and 

granted Haywood thirty days to file an amended complaint. (DE 

#28.) The first amended complaint was filed by Haywood on October 

25, 2016. (DE #30.) In Count one of her complaint, Haywood 

alleges that Novartis acted negligently when it disclosed personal 

information to her co-workers and supervisors via facsimile 

transmission which violated duties it owed to her under its privacy 

policy, under Indiana Code 25-26-13-15(b), and under the Health 

Insurance Portability and Accountability Act (“HIPPA”). In Count 

Two, Haywood alleges that Novartis was negligent in its training 

and supervision of its employees regarding the protection of 

customer privacy and confidentiality. Finally, in Count Three, 

Haywood alleges that she is entitled to punitive damages because 

Novartis acted with reckless indifference when it disclosed her 

protected information despite being told, in writing, not to do 

so. Novartis filed the instant motion to dismiss on December 27, 

2016. (DE #35.) Haywood filed her response on January 9, 2017. 

(DE #37.) Novartis filed its reply on January 17, 2017. (DE #38.) 

The motion is ripe for adjudication. 
3 

DISCUSSION 

Facts

 Novartis Patient Assistance NOW Oncology, a division of 

Novartis, administers the GLEEVEC Co-Pay Assistance Program (the 

“Program”) in which eligible patients are given a GLEEVEC Co-Pay 

Card by Novartis to help offset the costs of their prescription 

medication. (DE #30, p. 1.) Haywood applied for the Program, and 

on May 19, 2015, she sent Novartis a written statement requesting 

that no information regarding her application be sent to her place 

of employment. (Id. at 2.) On July 8, 2015, Novartis disclosed 

the following via facsimile transmission to Haywood’s co-workers 

and supervisors: her social security number, her date of birth, 

her income, her Medicare number, and information about her disease, 

treatment, and medical providers. (Id.) 

According to the amended complaint, the website for the 

Program includes a privacy notice that states: 

Novartis Pharmaceuticals Corporation and Novartis Group 

of Companies understand your personal and health 

information is private. 

The personal information we collect from you, including 

your card or voucher usage, will be used to bring you 

information about products, programs, support, and 

services, to conduct market research, as required by 

federal regulations. Please be assured that although we 

share your personal information with our business 

partners who work with us on these activities, we do not 

permit them to use your personal information for their 

own marketing purposes. You may unsubscribe from our 

programs and services at any time by calling 1-888-669-
4 

6682. For more information about our privacy practices, 

please visit our website at www.usprivacy.novartis.com. 

(“Privacy Notice”). (Id. at 3.) Additionally, the amended 

complaint cites to the following privacy statement1 that was found 

on the main Novartis website: 

. . . This Privacy Statement tells you how we protect 

the privacy of personal information that you may provide 

to us. 

As part of our commitment to privacy, Novartis has 

voluntarily certified to the U.S.-EU Safe Harbor 

Framework and the U.S.-Swiss Safe Harbor Framework as 

set forth by the U.S. Department of Commerce . . . . 

The purpose of this privacy statement is to explain what 

Novartis does with personally identifiable information 

that you provide to us, such as your name, address, age, 

and information relating to your medical conditions. We 

want you to know how your personally identifiable 

information will be protected, who we may share it with, 

and for what purposes. 

. . . The type of information collected from you will be 

based on the specific program that you register for, as 

indicated at the time of your registration. The 

information that we may ask you to provide may include 

your first and last name, your mailing address, your 

age, birth date, gender, e-mail address, and information 

about your medical conditions. Novartis limits the 

collection and processing of personal information to 

what is necessary to fulfill the purposes for which it 

is to be used. 

. . . Many of our customers register for more than one 

Novartis program or service, through our websites, by 

calling Novartis, or through a third-party such as their 

healthcare provider. When you register with us more 

than once, we may combine your personally identifiable 

information as well as any anonymous computer 

information collected (see below) and store it 

                                                            

1 The amended complaint cites to the version of the privacy statement that 

was revised as of November 28, 2012. 
5 

collectively. This helps us keep track of all of your 

preferences in one organized place, and helps us provide 

information to you based on a more informed review of 

your requests and medical conditions of interest. 

. . . We request your consent to collect your personally 

identifiable information when you seek to register for 

a Novartis program or service. In doing so, we also 

explain, for that program or service, what you are 

registering to receive and how we plan to use your 

personal information. We also offer you the option of 

discontinuing your consent (‘opting out’ or 

‘unsubscribing’) if you later decide that you no longer 

want to participate in that program or receive 

additional information from us. If we wish to use this 

information for purposes incompatible from those for 

which the data was initially collected, we will offer an 

effective way to opt out of the secondary use. 

. . . When you provide personally identifiable 

information to Novartis, it will be accessible to some 

of Novartis’ business partners, such as companies we 

retain to fulfill requests for information, answer 

telephone calls from consumers, or provide assistance to 

us on specific programs or projects such as newsletters 

. . . . Novartis requires third-parties to whom it 

discloses personal data to protect personal information 

using substantially similar standards to those required 

by Novartis. 

. . . Other departments within the Novartis group, and 

other Novartis companies that may receive your 

information will abide by substantially similar privacy 

requirements relating to your personally identifiable 

information. 

. . . This Privacy Statement becomes effective on 

November 28, 2012. Novartis may update this Statement 

from time to time. We encourage you to review our 

Privacy Statement periodically. 

(“Privacy Statement”). (Id. at 3-4) (footnote omitted.) Haywood 

alleges that, when it disclosed her personal information to her 

co-workers and supervisors via facsimile, Novartis breached duties 
6 

owed to her under the Privacy Notice and Privacy Statement, under 

Indiana Code 25-26-13-15(b), and under HIIPA. (Id. at 3-5.) 

 

Analysis 

In evaluating a motion to dismiss under Federal Rule of Civil 

Procedure 12(b)(6), a court must accept all facts alleged in the 

complaint as true and draw all reasonable inferences in the light 

most favorable to the plaintiff. Johnson v. Rivera, 272 F.3d 519, 

520 (7th Cir. 2001). A complaint is not required to contain 

detailed factual allegations; however, the plaintiff must allege 

facts that state a claim to relief that is plausible on its face. 

Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). It is not enough 

that there might be some conceivable set of facts that entitle the 

plaintiff to relief. Bell Atlantic Corp. v. Twombly, 550 U.S. 

544, 553-56 (2007). The plaintiff’s obligation “requires more 

than labels and conclusions. . . .” Id. at 555. The Supreme Court 

has provided that “[t]hreadbare recitals of the elements of a cause 

of action, supported by mere conclusory statements, do not 

suffice.” Iqbal, 556 U.S. at 678. 

Negligence and Negligent Training and Supervision 

Novartis argues that Counts One and Two fail as a matter of 

law because Haywood has not properly alleged that Novartis owed 
7 

her a legal duty or that any such duty, even if it existed, was 

breached. In response, Haywood asserts that Novartis owed her 

“multiple duties” based on its own policies, based on Indiana 

statutory law, and based on HIPPA. 

In Indiana, “the tort of negligence is comprised of three 

elements: (1) a duty on the part of defendant in relation to the 

plaintiff; (2) the defendant’s breach of that duty; and (3) an 

injury to the plaintiff resulting from that failure.” Kolozsvari 

v. Doe, 943 N.E.2d 823, 826-27 (Ind. Ct. App. 2011) (citing Miller 

v. Griesel, 308 N.E.2d 701, 706 (Ind. 1974)). “A duty to exercise 

care arises as a matter of law out of some relation existing 

between the parties, and it is the province of the court to 

determine whether such a relation gives rise to such duty.” Id. at 

827 (internal quotation marks and citation omitted). “Absent a 

duty, there can be no breach of duty and thus no negligence or 

liability based upon the breach.” Peters v. Forster, 804 N.E.2d 

736, 738 (Ind. 2004). In general, Indiana courts consider three 

factors when determining whether a duty exists: “(1) the 

relationship between the plaintiff and defendant; (2) the 

reasonable foreseeability of harm to the person injured by the 

defendant’s conduct; and (3) public policy concerns.” Houser v. 

Kaufman, 972 N.E.2d 927, 938 (Ind. Ct. App. 2012). This inquiry 

is case specific. Id. Furthermore, a claim for negligent 
8 

supervision and training must be analyzed pursuant to the doctrine 

of respondeat superior, and the court has “observe[d] that for 

respondeat liability to attach, there must also be underlying 

liability of the acting party.” Walgreen Co. v. Hinchy, 21 N.E.3d 

99, 109 (Ind. Ct. App. 2014). 

Here, Haywood’s amended complaint alleges that Novartis 

breached explicit duties of privacy that it owed to her as a 

customer pursuant to the representations on its websites. In her 

response brief, Haywood argues that she relied on those 

representations to ensure that her information would remain 

private when applying for the program. However, as Novartis points 

out, the assurances in the Privacy Notice relate to the 

dissemination of information to its business partners who are 

prohibited from using customers’ personal data for marketing 

purposes.2 The complaint does not allege, nor is it reasonable to 

infer, that the facsimile transmission sent to Haywood’s place of 

employment was in any way connected with third-party marketing. 

Similarly, according to its own terms, the purpose of the Privacy 

Statement is to explain what Novartis does with its customers’ 

personally identifiable information and how it will be protected. 

In relevant part, the Privacy Statement confirms that Novartis 

                                                            

2 “Please be assured that although we share your personal information with 

our business partners who work with us on these activities, we do not permit 

them to use your personal information for their own marketing purposes.” (DE 

#30, p. 3.) 
9 

will “limit[] the collection and processing of personal 

information to what is necessary to fulfill the purposes for which 

it is to be used” and will require third-parties and other 

departments within the Novartis group to conform with those same 

policies. (DE #30, pp. 3-4.) The portion of Privacy Statement 

included in Haywood’s amended complaint does not set forth detailed 

standards or describe Novartis’ specific obligations with regard 

to general non-disclosure.3 However, of note, the Privacy 

Statement does indicate that a customer’s consent related to the 

collection of personal information is required when he or she 

registers for a Novartis program or service, and it states that 

Novartis will explain how the information will be used for that 

particular program upon registration. (Id. at 4.) The Privacy 

Statement goes on to indicate that, if information is to be used 

“for purposes incompatible from those for which the data was 

initially collected, we will offer an effective way to opt out of 

the secondary use.” (Id.) Reading the Privacy Statement cited in 

the amended complaint in conjunction with the Privacy Notice 

associated with the Program, it is clear that the relevant privacy 

                                                            

3 The amended complaint includes a footnote that cites to the following 

provision of the Privacy Statement: “Novartis takes reasonable precautions to 

protect EU and Swiss personal information in its possession from loss, 

misuse, unauthorized access, disclosure, alteration and destruction.” (DE 

#30, p. 3, n. 3) (emphasis by Haywood in original). However, the relevance 

of this provision is not clear, as Haywood has not alleged that she or the 

personal information disclosed by Novartis was in any way related to the EU 

or Switzerland. 
10 

considerations focus primarily on dissemination to Novartis’ 

partners and the subsequent intended secondary usage of that 

information rather than a duty to ensure against all possible 

disclosures in all circumstances. Again, the allegations in the 

complaint do not suggest, nor is it reasonable to infer, that the 

facsimile transmitted to Haywood’s place of employment was related 

to improper secondary usage or was anything other than routine 

collection and processing by Novartis. Rather, the complaint 

simply alleges that “in processing” the Program application, 

Haywood’s information was disclosed by facsimile to her place of 

employment, and the fact that Haywood allegedly told Novartis not 

to send any information regarding her application to her place of 

employment, without more, does not create a legal duty where none 

previously existed. 

Haywood also argues that Novartis owed her a statutory duty 

to protect her personal information pursuant to Indiana Code 25-

26-13-15(b). It is true that, under Indiana law, violating 

statutory duties constitutes negligence per se. See Kho v. 

Pennington, 875 N.E.2d 208, 212 (Ind. 2007) (citing cases); Thiele 

v. Norfolk & W. Ry. Co., 68 F.3d 179, 184–85 (7th Cir. 1995) 

(citing French v. Bristol Myers Co., 574 N.E.2d 940, 943 (Ind. Ct. 

App. 1991)). The question here is whether the section of the code 

relied upon by Haywood applies to Novartis. Haywood argues that 
11 

it does because the statute clearly and unambiguously pertains to 

“any ‘person’ with patient information.” This is true, according 

to Haywood, because the preceding and subsequent subsections of 

the statute refer specifically to a pharmacist or pharmacy, while 

the subsection in question refers more generally to a person. 

Novartis argues that such an interpretation fails to consider the 

statute as a whole which applies to pharmacists, pharmacies, and 

drug stores rather than drug manufacturers or the public at large. 

If a statute is clear and unambiguous, courts are directed to 

take words and phrases in “their plain, ordinary, and usual sense” 

when analyzing their applicability. City of N. Vernon v. Jennings 

N.W. Regl. Utilities, 829 N.E.2d 1, 4 (Ind. 2005) (citing Poehlman 

v. Feferman, 717 N.E.2d 578, 581 (Ind. 1999)). However, when there 

is more than one interpretation of a statute, it is considered 

ambiguous and is subject to judicial construction. Id. (citing 

Amoco Production Co. v. Laird, 622 N.E.2d 912, 915 (Ind. 1993)). 

Courts are directed to examine the statute as a whole and read its 

sections in harmony to best effectuate legislative intent. Id. at 

4-5. “And we do not presume that the Legislature intended language 

used in a statute to be applied illogically or to bring about an 

unjust or absurd result.” Id. at 5 (citing State ex rel. Hatcher 

v. Lake Super. Ct., Rm. Three, 500 N.E.2d 737, 739 (Ind. 1986). 
12 

Title 25 of the Indiana Code is entitled “Professions and 

Occupations,” and Article 26 within that title deals specifically 

with the regulation of “Pharmacists, Pharmacies, and Drug Stores.” 

Chapter 13, entitled “Regulation of Pharmacists and Pharmacies — 

Creation of Board,” declares that the “practice of pharmacy” is a 

matter of public interest and concern that must be subjected to 

certain regulations and controls. I.C. 25-26-13-1. Section 2 

provides the definitions that apply to Chapter 13, and the 

“practice of pharmacy” is defined as: 

a patient oriented health care profession in which 

pharmacists interact with and counsel patients and with 

other health care professionals concerning drugs and 

devices used to enhance patients’ wellness, prevent 

illness, and optimize the outcome of a drug or device, 

by accepting responsibility for performing or 

supervising a pharmacist intern or an unlicensed person 

under section 18.5 of this chapter to do the following 

acts, services, and operations: 

(1) The offering of or performing of those acts, 

service operations, or transactions incidental to the 

interpretation, evaluation, and implementation of 

prescriptions or drug orders. 

(2) The compounding, labeling, administering, 

dispensing, or selling of drugs and devices, including 

radioactive substances, whether dispensed under a 

practitioner's prescription or drug order or sold or 

given directly to the ultimate consumer. 

(3) The proper and safe storage and distribution of 

drugs and devices. 

(4) The maintenance of proper records of the 

receipt, storage, sale, and dispensing of drugs and 

devices. 

(5) Counseling, advising, and educating patients, 

patients’ caregivers, and health care providers and 

professionals, as necessary, as to the contents, 

therapeutic values, uses, significant problems, risks, 

and appropriate manner of use of drugs and devices. 
13 

(6) Assessing, recording, and reporting events 

related to the use of drugs or devices. 

(7) Provision of the professional acts, 

professional decisions, and professional services 

necessary to maintain all areas of a patient’s pharmacy 

related care as specifically authorized to a pharmacist 

under this article. 

(8) Provision of medication therapy management. 

I.C. 25-26-13-2. A “pharmacist” is defined as “a person licensed 

under this chapter,” and a “person” is “any individual, 

partnership, copartnership, firm, company, corporation, 

association, joint stock company, trust, estate, or municipality, 

or a legal representative or agent, unless this chapter expressly 

provides otherwise.” Id. A “pharmacy” is defined as: 

any facility, department, or other place where 

prescriptions are filled or compounded and are sold, 

dispensed, offered, or displayed for sale and which has 

as its principal purpose the dispensing of drug and 

health supplies intended for the general health, 

welfare, and safety of the public, without placing any 

other activity on a more important level than the 

practice of pharmacy. 

Id. Section 15, upon which Haywood relies, mandates the 

following: 

(a) A pharmacist shall hold in strictest confidence all 

prescriptions, drug orders, records, and patient 

information. He may divulge such information only when 

it is in the best interest of the patient or when 

requested by the board or its representatives or by a 

law enforcement officer charged with the enforcement of 

laws pertaining to drugs or devices or the practice of 

pharmacy. 

(b) A person who has knowledge by virtue of his office 

of any prescription drug order, record, or patient 

information may not divulge such information except in 
14 

connection with a criminal prosecution or proceeding or 

a proceeding before the board, to which the person to 

whom the information relates is a party. 

(c) A pharmacist or pharmacy is immune from civil 

liability for any action based on its good faith release 

of information under this section. 

I.C. 25-26-13-15. 

 While Haywood argues that subsection (b) clearly and 

unambiguously pertains to “any person with patient information,” 

the Court agrees with Novartis that such a reading would produce 

an unjust result. See City of N. Vernon v. Jennings N.W. Regl. 

Utilities, 829 N.E.2d 1, 5 (Ind. 2005) (court proceeded to construe 

a statute that appeared unambiguous at “first blush” because “a 

strict interpretation” in light of the facts presented would have 

produced “an absurd result”). First, subsection (b) itself 

expressly limits the definition of a “person” to one whose 

knowledge is obtained “by virtue of his office.” That particular 

phrase is not defined in the statute, which results in some degree 

of ambiguity; however, reading the statute as a whole makes it 

clear that the regulations are intended to apply to those 

associated with the “practice of pharmacy” which the legislature 

has determined to be a matter of public concern. The practice of 

pharmacy is “a patient oriented health care profession” that 

focuses on a pharmacist’s interactions with and counseling of 

patients regarding their prescription drug needs. The statute 
15 

describes several acts, services, and/or operations that a 

pharmacist (or those interns or unlicensed persons the pharmacist 

supervises) is responsible for during the practice of pharmacy, 

none of which pertain to manufacturing pharmaceutical drugs or 

administering a co-payment assistance program. Moreover, the 

title of Chapter 13 itself applies directly to pharmacists and 

pharmacies. A pharmacy is a place where “prescriptions are filled 

or compounded,” and its principal purpose is dispensing drug and 

health supplies to the public; the definition also refers directly 

back to the practice of pharmacy as being of the upmost importance. 

Reading the statute to limit the applicability of its regulations 

to a person acting within the realm of the practice of pharmacy is 

also consistent with long-standing Indiana law recognizing the 

distinction of an individual who acts by virtue of his or her 

office as opposed to one who is employed more generally. See e.g. 

Wells v. State ex rel. Peden, 94 N.E. 321, 322 (Ind. 1911) (“An 

office is a position or station in which a person is employed to 

perform certain duties, or by virtue of which he becomes charged 

with the performance of certain duties, public or private; a place 

of trust.”). Based on the foregoing, the Court finds that the 

legislature intended subsection (b) to apply to a person involved 

in the practice of pharmacy, rather than to “any person with 

patient information” as is argued by Haywood. 
16 

The amended complaint describes Novartis as a “Pharmaceutical 

Corporation,” with a division that administers the Program, and 

also as a “provider of pharmaceuticals.” Haywood does not properly 

allege, nor is it reasonable to infer, that Novartis falls within 

the definition of a pharmacy, that Novartis filled or dispensed 

any prescriptions to Haywood, that the person who sent Haywood’s 

information to her place of employment was a pharmacist, intern, 

or other unlicensed person working within a pharmacy, or that 

Novartis or the Program performs acts consistent with the practice 

of pharmacy as described above.4 The allegation that Novartis is 

a “provider of pharmaceuticals” is not enough to bring it within 

the purview of Indiana Code 25-26-13-15; thus, Novartis did not 

owe Haywood a duty under that statute. 

Haywood also claims that Novartis owed her a duty, under a 

negligence theory, for violating HIPPA standards. Novartis 

responds by pointing out that HIPPA provides no private cause of 

action and insists that Haywood’s alleged HIPPA claims may not be 

                                                            

4 Indeed, as is pointed out by Novartis, it simply “researches, manufactures, 

markets, and sells pharmaceuticals,” and “[u]nder federal regulations, it is 

prohibited from selling its prescription drugs directly to patients.” In re 

Novartis Wage and Hour Litig., 611 F.3d 141, 144 (2d Cir. 2010), abrogated by 

Christopher v. SmithKline Beecham Corp., 567 U.S. 142 (2012). Rather, 

“Novartis typically sells its products to wholesalers, which sell them to 

individual pharmacies.” Id. See Ennenga v. Starns, 677 F.3d 766, 773-74 

(7th Cir. 2012) (“A court may take judicial notice of facts that are (1) not 

subject to reasonable dispute and (2) either generally known within the 

territorial jurisdiction or capable of accurate and ready determination 

through sources whose accuracy cannot be questioned.”); see also Henson v. 

CSC Credit Servs., 29 F.3d 280, 284 (7th Cir. 1994) (finding public court 

documents judicially noticeable). 
17 

shoehorned into a negligence action. As this Court has noted 

previously: 

‘When a civil tort action is premised upon violation of 

a duty imposed by statute, the initial question to be 

determined by the court is whether the statute in 

question confers a private right of action.’ Right 

Reason Publ’ns v. Silva, 691 N.E.2d 1347, 1352 (Ind. Ct. 

App. 1998) (quotation omitted); see also Dawson by 

Dawson v. Long, 546 N.E.2d 1265, 1268 (Ind. Ct. App. 

1989) (holding in order for the violation of a statute 

or ordinance to be negligence per se, the trier of fact 

must first determine whether the statute is applicable). 

Chappey v. Ineos USA LLC, No. 2:08-CV-271, 2009 WL 790194, at *2 

(N.D. Ind. Mar. 23, 2009). Haywood acknowledges that there is no 

private right of action under HIPPA, but she argues that courts in 

Indiana and elsewhere have “permitted the use of HIPPA to establish 

a breach of the standard of care owed to a patient in a negligence 

action.” She cites to Hinchy to support her position; however, 

the Hinchy court discussed the tort of professional malpractice 

that arose from Indiana law based on the unique “relationship 

between a pharmacist and her customer that gives rise to a duty on 

the pharmacist’s part” and Indiana Code 25-26-13-15(a) rather than 

based on a violation of HIPPA. See Hinchy, 21 N.E.3d at 109. 

Haywood also cites to Grable & Sons Metal Products, Inc. v. Darue 

Engr. & Mfg., 545 U.S. 308, 318–19 (2005), but Grable simply 

recognizes the general possibility that the breach of federal 

statues may support negligence per se claims in state tort 

proceedings. It does not stand for the proposition that HIPPA 
18 

itself is one of those statutes. Id.5 HIPPA does not provide a 

private right of action. See e.g. Carpenter v. Phillips, 419 Fed. 

Appx. 658, 659 (7th Cir. May 4, 2011) (collecting cases); Doe v. 

Board of Tr. of the Univ. of Ill., 429 F.Supp.2d 930, 944 (N.D.Ill. 

2006) (“Every court to have considered the issue . . . has 

concluded that HIPAA does not authorize a private right of 

action”); see also Acara v. Banks, 470 F.3d 569, 570–72 (5th Cir. 

2006); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Seaton v. 

Mayberg, 610 F.3d 530, 533 (9th Cir. 2010); Wilkerson v. Shinseki, 

606 F.3d 1256, 1267 n. 4 (10th Cir. 2010). As noted by the court 

in Doe, “HIPAA provides civil and criminal penalties for improper 

disclosures of medical information, but it does not create a 

private cause of action, leaving enforcement to the Department of 

Health and Human Services alone.” Doe, 429 F.Supp.2d at 944. 

Indiana state law claims that rely on HIPPA as the basis for 

establishing negligence are not cognizable because utilizing them 

                                                            

5 Haywood also cites to several out-of-state opinions to support her 

position. In one such case, the North Carolina court of appeals found that 

the plaintiff had not stated a cause of action under HIPPA, but it recognized 

that HIPPA was applicable to the extent that it “provid[ed] evidence of the 

duty of care owed by [the defendant] with regards to the privacy of 

plaintiff's medical records.” Acosta v. Byrum, 638 S.E.2d 246, 253 (N.C. 

App. 2006). In another, a district court acknowledged that HIPPA does not 

confer a private right of action but found that HIPPA could be used to 

establish a negligence per se claim under Missouri law. I.S. v. Wash. Univ., 

No. 4:11CV235SNLJ, 2011 WL 2433585, at *2 (E.D. Mo. June 14, 2011). However, 

these cases are not binding on this Court, and the Court finds their 

reasoning unpersuasive in light of the weight of authority to the contrary 

and the lack of any Indiana decision allowing HIPPA to be used as the basis 

for a negligence claim such as this. 
19 

in such a way would circumvent HIPPA’s enforcement mechanisms. 

See e.g. Sheldon v. Kettering Health Network, 40 N.E.3d 661, 672 

(Ohio App. 2d Dist. 2015) (stating that “in our view utilization 

of HIPAA as an ordinary negligence ‘standard of care’ is tantamount 

to authorizing a prohibited private right of action for violation 

of HIPAA itself”). Thus, HIPPA does not create a duty or provide 

a statutory basis for Haywood’s negligence claim in this case. 

 Finally, Haywood cites to no Indiana case, nor can the Court 

find any, that would suggest that a pharmaceutical corporation has 

a general duty to safeguard an individual’s personal information 

from disclosure to her employer. In cases where a duty has not 

been established, Indiana courts look to the relationship between 

the parties, the reasonable foreseeability of harm, and public 

policy concerns to determine whether a duty should be imposed at 

common law. See Neal v. IAB Fin. Bank, 68 N.E.3d 1114, 1117-18 

(Ind. Ct. App. 2017) (citations omitted); Williams v. Cingular 

Wireless, 809 N.E.2d. 473, 476 (Ind. Ct. App. 2004).6 Here, the 

relationship between Haywood and Novartis is described in the 

amended complaint in terms of a potential customer and a co-pay 

                                                            

6 Because jurisdiction in this case is premised on diversity, the Court must 

apply the substantive law of Indiana and attempt to predict how the Indiana 

Supreme Court would decide a novel question of state law. “Where the state 

supreme court has not ruled on an issue, decisions of the state appellate 

courts control, unless there are persuasive indications that the state 

supreme court would decide the issue differently.” See Lexington Ins. Co. v. 

Rugg & Knopp, Inc., 165 F.3d 1087, 1090 (7th Cir. 1999). 
20 

assistance company. Haywood alleges that she was in the process 

of applying for the Program when her information was disclosed to 

her employer. She does not allege that she was in a contractual 

relationship with Novartis or that she had even begun receiving or 

relying on the benefits provided by the Program. Although she 

describes Novartis as a “provider of pharmaceuticals,” she does 

not allege, nor is it reasonable to infer, that Novartis was a 

pharmacist or pharmacy that directly provided her with 

pharmaceutical drugs, medical care, treatment, counseling, or the 

like. While it is well-settled that the law recognizes a dutybound relationship between a pharmacist and a customer, see e.g. 

Forbes v. Walgreen Co., 566 N.E.2d 90, 91 (Ind. Ct. App. 1991), 

that duty is premised upon a unique patient oriented health care 

connection. As noted by the Supreme Court of Indiana, “pharmacists 

possess expertise regarding the dispensing of prescription drugs,” 

and consumers rely upon that expertise during direct interactions 

with pharmacists regarding their prescription drug needs. Hooks 

Superx, Inc. v. McLaughlin, 642 N.E.2d 514, 517 (Ind. 1994). That 

special relationship has been codified by the Indiana legislature, 

as described in detail above, to include the practice of pharmacy 

more broadly. See I.C. 25-26-13-1 through 25-26-13-33. However, 

the relationship between a pharmaceutical corporation and a person 

seeking assistance with their co-payments is not similarly close 
21 

to justify imposing a duty, mainly because the direct contact, 

expertise, reliance, and counseling aspects of the relationship 

are wholly lacking. 

 As to foreseeability, courts must look to the broad type of 

plaintiff and broad type of harm at issue and focus on “the general 

class of persons of which the plaintiff was a member and whether 

the harm suffered was of a kind normally to be expected—without 

addressing the specific facts of the occurrence.” Neal, 68 N.E.3d 

at 1121 (citation omitted). However: 

because almost any outcome is possible and can be 

foreseen, the mere fact that a particular outcome is 

sufficiently likely is not enough to give rise to a duty. 

Instead, for purposes of determining whether an act is 

foreseeable in the context of duty we assess whether 

there is some probability or likelihood of harm that is 

serious enough to induce a reasonable person to take 

precautions to avoid it. 

Goodwin v. Yeakle’s Sports B. and Grill, Inc., 62 N.E.3d 384, 392 

(Ind. 2016) (internal quotation marks and citations omitted). 

Here, the broad type of plaintiff is a consumer seeking to enroll 

in a program administered by a company, and the broad type of harm 

is the damage suffered from the disclosure of the prospective 

enrollee’s personal and protected health information to that 

person’s place of employment. Considering the fact that much of 

an employee’s personal information is likely already available to 

his or her employer, and the fact that a reasonable employer and/or 

co-worker would be unlikely to take negative action against an 
22 

employee based on the receipt of protected health information, the 

likelihood of harm that is serious enough to be legally actionable 

is slight. See Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 636-

40 (7th Cir. 2007) (finding that exposure of personal data is not 

a compensable injury in a negligence action under Indiana law).7

 Turing to public policy concerns, the Indiana Court of Appeals 

has noted that, “[s]imply because an action may have some degree 

of foreseeability does not make it sound public policy to impose 

a duty.” Williams v. Cingular Wireless, 809 N.E.2d 473, 478 (Ind. 

Ct. App. 2004). “Various factors play into this policy 

consideration, including convenience of administration, capacity 

of the parties to bear the loss, a policy of preventing future 

injuries, and the moral blame attached to the wrongdoer.” Id. 

(citing Ousley v. Bd. of Comm’rs of Fulton Cnty., 734 N.E.2d 290, 

294 (Ind. Ct. App. 2000). While it seems likely that a 

pharmaceutical company could adequately bear the loss in an action 

such as this and that personal and protected health information 

should ideally be protected, other elements weigh against imposing 

a duty. Assigning significant moral blame to a pharmaceutical 

corporation in this situation is disproportionate to the actual 

                                                            

7 Moreover, while not relevant to the analysis of foreseeability, the Court 

notes that Haywood’s amended complaint fails to adequately allege an injury 

beyond the disclosure itself. While she states generally that she “suffered 

damages to her employment, emotional distress, and physical health,” she has 

not provided any details regarding such injuries and has not responded to 

Novartis’ lack of damages argument in any meaningful way. 
23 

acts performed (i.e. negligently disclosing information to an 

employer during a routine application process). The reality is 

that, for most people, the amount of sensitive personal information 

readily available to third parties with whom no close relationship 

exists is significant due to the nature of today’s digital society. 

Imposing a duty to safeguard information from all possible 

disclosures upon any party or entity who happens to be in 

possession of the personal information of another would expand 

liability in a way that has the potential to stifle the collection 

of data and the routine processing of information. As noted by 

Novartis, courts have construed Indiana laws applicable to the 

disclosure of private information narrowly. For example, the 

Seventh Circuit Court of Appeals analyzed the Indiana data 

disclosure statute and found that there is no private right of 

action against a database owner for negligently disclosing 

information; rather, the database owner is simply obligated to 

advise potentially affected customers of a breach, and enforcement 

is handled by the Indiana Attorney General. Pisciotta, 499 F.3d 

at 636-37. And, as discussed in detail above, while duties of 

non-disclosure have been imposed on those with specialized 

expertise (i.e. pharmacists and physicians), the nature of the 

specialized relationship is the driving force behind the 

imposition of that duty rather than the act of disclosure itself. 
24 

After balancing the relevant factors, the Court concludes 

that the general, non-specialized nature of the relationship 

between the parties and the fact that actionable harm is not 

reasonably foreseeable from the type of disclosure at issue 

outweighs the public policy considerations suggesting that 

potential customers may be entitled to protection of their personal 

data during an application process. Ultimately, “[w]hen given a 

choice between an interpretation of [state] law which reasonably 

restricts liability, and one which greatly expands liability, we 

should choose the narrower and more reasonable path (at least until 

the [state] Supreme Court tells us differently).” Pisciotta, 499 

F.3d at 636 (7th Cir. 2007) (quoting Todd v. Societe Bic, S.A., 21 

F.3d 1402, 1412 (7th Cir. 1994); see also Insolia v. Philip Morris 

Inc., 216 F.3d 596, 607 (7th Cir. 2000) (“Federal courts are loathe 

to fiddle around with state law. Though district courts may try 

to determine how the state courts would rule on an unclear area of 

state law, district courts are encouraged to dismiss actions based 

on novel state law claims.”). Therefore, the Court concludes that 

Novartis did not owe Haywood a duty of care in this case. 

Because Haywood has failed to allege a viable negligence 

claim, her claims for negligent training and supervision and 

punitive damages must also fail. See Hinchy, 21 N.E.3d at 109 

(must be underlying liability of acting party for negligent 
25 

training and supervision claim to succeed); Wohlwend v. Edwards, 

796 N.E.2d 781, 784 (Ind. Ct. App. 2003) (punitive damages proper 

only when defendant acted with malice, fraud, gross negligence, or 

oppressiveness which was not the result of a mistake of fact or 

law, mere negligence, or other human failing). 

CONCLUSION 

 For the aforementioned reasons, the motion to dismiss filed 

by Novartis (DE #35) is GRANTED. The clerk is DIRECTED to close 

this case. 

DATED: January 16, 2018 /s/ RUDY LOZANO, Judge 

 United States District Court