UNPUBLISHED

UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT

No. 20-1767

J.R., individually and on behalf of her minor children A.R. and H.K.; J.H., individually, and on behalf of all others similarly situated; B.Y., individually, and on behalf of all others similarly situated; J.S., individually, and on behalf of all others similarly situated,

Plaintiffs – Appellants,

v.

WALGREENS BOOTS ALLIANCE, INC.; WALGREEN CO.,

Defendants – Appellees.

Appeal from the United States District Court for the District of South Carolina, at Charleston. David C. Norton, District Judge. (2:19-cv-00446-DCN)

Argued: September 22, 2021 Decided: October 19, 2021

Before MOTZ and AGEE, Circuit Judges, and KEENAN, Senior Circuit Judge.

Affirmed by unpublished per curiam opinion.

ARGUED: Michael J. Moore, POPE MCGLAMRY KILPATRICK MORRISON & NORWOOD, P.C., Atlanta, Georgia, for Appellants. Robert N. Hochman, SIDLEY AUSTIN LLP, Chicago, Illinois, for Appellees. ON BRIEF: Charles W. Byrd, Aimee J. Hall, POPE MCGLAMRY KILPATRICK MORRISON & NORWOOD, P.C., Atlanta, Georgia; William N. Nettles, BILL NETTLES LAW, Columbia, South Carolina, for Appellants. David E. Dukes, Amanda S. Kitts, Adam J. Hegler, NELSON MULLINS RILEY & SCARBOROUGH LLP, Columbia, South Carolina; Scott D. Stein, Matthew C. Bergs, Ross O. Kloeber, SIDLEY AUSTIN LLP, Chicago, Illinois, for Appellees.

Unpublished opinions are not binding precedent in this circuit.

2 PER CURIAM:

Six pharmacy customers (“Plaintiffs”) appeal from the district court’s dismissal of

their twelve-count class action suit against Walgreens Boot Alliance, Inc. (“WBA”) and

Walgreen Company (collectively, “Walgreens”). At bottom, Plaintiffs allege that the

transfer of their personal identifying information (“PII”) from the Walgreens pharmacy

filling their prescription to separate, internal company databases violates their rights under

various federal and state statutes and state tort claims. For the following reasons, we affirm

the judgment of the district court.

I.

We accept as true all well-pleaded allegations in Plaintiffs’ Amended Complaint

and view it in the light most favorable to them. Ostrzenski v. Seigel,

(4th

Cir. 1999). Through that lens, the relevant facts are as follows.

Congress enacted the 340B Drug Pricing Program (the “Program”) in 1992, which

requires participating manufacturers to provide certain prescription drugs at significantly

discounted prices to eligible and enrolled health care providers (“covered entities”).

Covered entities typically serve low-income patients with limited access to health care.

Given the cost savings involved, federal law expressly prohibits covered entities from

“resell[ing] or otherwise transfer[ring]” a 340B drug “to a person who is not a patient of

the entity.” 42 U.S.C. § 256b(a)(5)(B). Covered entities are subject to audits by both the

Department of Health and Human Services and participating drug manufacturers.

Sometimes lacking the resources to operate in-house pharmacies, covered entities often

3 engage a retail pharmacy (“contract pharmacy”) to dispense 340B-eligible drugs purchased

by the covered entity to the low-income patient.

Relevant here, Walgreens is a 340B contract pharmacy for several covered entities

in South Carolina, some of which provided Plaintiffs with medical services and use

Walgreens pharmacies in South Carolina to fill their patients’ prescriptions. All South

Carolina pharmacies must comply with the South Carolina Pharmacy Practice Act (the

“PPA”),

et seq.; the South Carolina Prescription Information

Privacy Act (the “PIPA”),

et seq.; and the American

Pharmaceutical Association Code of Ethics.

In 2010, Walgreens created a separate division within its corporate organization,

“340B Complete,” to oversee administration of its contract pharmacy operations and

ensure compliance with the Program. This division is separate from other aspects of

Walgreens’ operations, including its pharmaceutical, photo, and retail divisions. None of

the 160 employees working in the 340B Complete division are licensed pharmacists.

When any patient seeks to fill a prescription at a Walgreens pharmacy, the

pharmacist first enters the patient’s PII into a “proprietary computer software system”

called IntercomPlus, which all Walgreens pharmacies nationwide can access. J.A. 36. That

PII includes: the patient’s name, address, date of birth, payment information, and third-

party reimbursement rate; the drug’s name, dosage, frequency, and refill information; and

the prescribing physician’s information. The PII in IntercomPlus is then transferred to a

“corporate central repository” called Enterprise Data Warehouse (“EDW”), J.A. 41, all of

which is part of the same Walgreens corporate entity.

4 Walgreens markets to covered entities a commercial software product registered and

trademarked as “340B Complete®,” which extracts the PII from EDW and compares it to

the PII that a given Walgreens pharmacy received from a covered entity. Assuming there

is a match, the 340B Complete® software transfers the PII on file in EDW into Walgreens’

340B Complete payment process.

This data transferring occurs for purposes of replenishing the pharmaceutical drugs

that a Walgreens pharmacy dispenses to a 340B patient. Under federal law, only a covered

entity may purchase 340B drugs. Walgreens cannot. Using 340B Complete®, Walgreens

performs a financial analysis to determine if it is less expensive to process payment through

the patient’s insurance company. If so, Walgreens will submit the claim to insurance, retain

the full insurance reimbursement amount as it would with any ordinary consumer, and

purchase the resupply itself. If, however, it is cheaper for Walgreens to process the

transaction as a 340B event, then 340B Complete® will designate it as such. This enables

Walgreens to replenish the drug inventory through the covered entity for a 340B patient

and not run afoul of the distinction between 340B and non-340B prescription drug

purchases.

Nonetheless, Plaintiffs claim the transfer of their PII from the pharmacy filling their

prescription to EDW, and the transfer from EDW to 340B Complete®, violates various

rights. Among other claims, they allege that they never gave Walgreens permission to use

or transfer their PII and that Walgreen’s Notice of Privacy Policy (“NPP”) did not inform

them that their PII would be used in 340B Complete®.

5 II.

Plaintiffs filed a twelve-count class action Amended Complaint, seeking

preliminary 1 and permanent injunctive relief, as well as “compensatory, exemplary, and

punitive damages in amounts to be determined.” J.A. 80. The claims are as follows: (1)

invasion of privacy: wrongful appropriation; (2) invasion of privacy: wrongful publicizing

of private affairs; (3) negligence per se based on violations of the PIPA; (4) breach of

contract; (5) negligence (based on violations of the PIPA, the PPA, and regulations issued

by the South Carolina Board of Pharmacy); (6) negligence (based on a duty to disclose to

Plaintiffs “the true facts about [Walgreens’] substandard patient privacy practices,” J.A.

67); (7) respondeat superior 2; (8) negligent training and supervision; (9) unjust enrichment;

(10) violation of the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. §§ 1681–1681x; (11)

negligence per se based on violations of the FCRA, 3 the Health Insurance Portability and

1 The district court denied Plaintiffs’ motion for a preliminary injunction. Plaintiffs’ appeal from that decision is currently being held in abeyance pending resolution of this appeal. See J.R. v. Walgreens Boots Alliance, Inc., No. 19-2404. 2 The district court dismissed this claim because “[r]espondeat superior is not a cause of action; it is a theory of liability.” J.R. Walgreens Boots Alliance, Inc.,

, 561 (D.S.C. 2020) (citing Austin v. Specialty Transp. Servs., Inc.,

(S.C. Ct. App. 2004) (“Under the doctrine of respondeat superior, the employer is liable for the acts of an employee acting within the scope of employment.”)). Plaintiffs have waived any challenge to this aspect of the district court’s holding by failing to address it in their Opening Brief. See Carter v. Lee,

, 252 n.11 (4th Cir. 2002) (“[T]his Court normally views contentions not raised in an opening brief to be waived.”). 3 The district court found that Plaintiffs had “abandoned the FCRA claim” as well as their “negligence per se claim based on an alleged violation of FCRA.” J.R., 470 F. Supp. 3d at 550. Plaintiffs do not challenge this holding in their Opening Brief, and, as such, have waived it. See Carter,

n.11. 6 Accountability Act (“HIPAA”), and the Federal Trade Commission Act (“FTCA”); and

(12) declaratory relief.

Walgreens filed a motion to dismiss for failure to state a claim under Federal Rule

of Civil Procedure 12(b)(6), which the district court granted. 4 We have jurisdiction over

Plaintiffs’ timely-filed appeal, see

, and review the district court’s

dismissal de novo, Garnett v. Remedi SeniorCare of Va., LLC,

(4th Cir.

2018). 5

4 The district court separately granted WBA’s motion to dismiss for lack of personal jurisdiction. By way of background, WBA is a holding company that utilizes three divisions to conduct its operations, one of which is “Retail Pharmacy USA.” Walgreen Co. is a wholly owned WBA subsidiary, which operates the Retail Pharmacy USA division. Stated differently, Walgreen Co. operates all Walgreens pharmacies in the United States. Plaintiffs challenge the district court’s dismissal of WBA on two grounds, arguing that: (1) WBA waived its jurisdictional challenge by asserting a merits-based defense to their preliminary injunction motion; and, alternatively, (2) WBA is subject to the Court’s jurisdiction because it is Walgreen Co.’s alter ego. Even if Plaintiffs are correct as to either theory, we would still affirm the district court’s dismissal of WBA because Plaintiffs alleged the same facts and deficient causes of action against both entities. And we must conduct that analysis regardless of whether the district court’s personal jurisdiction decision as to WBA was correct. Therefore, since the ultimate outcome would be the same even if we agreed with Plaintiffs’ jurisdictional arguments, we need not reach this issue to affirm. See East Coast Repair & Fabrication, LLC v. U.S. ex rel Dep’t of Navy, --- F.4th ---,

, at *2 (4th Cir. 2021) (“[A] court may bypass a difficult jurisdictional question and ‘choose among threshold grounds for denying audience to a case on the merits . . . when considerations of convenience, fairness, and judicial economy so warrant.’” (quoting Sinochem Int’l Co. v. Malaysia Int’l Shipping Corp.,

(2007)); see also Gremillion v. Chivatero,

(5th Cir. 1985) (per curiam) (affirming dismissal for failure to state a claim without addressing personal jurisdiction). 5 We have subject matter jurisdiction under

(d)(2) because the aggregated amount in controversy exceeds $5,000,000, and at least one of the proposed class members is diverse from Walgreens. 7 A. The Invasion of Privacy Claims

“In South Carolina, there are three separate and distinct causes of action for invasion

of privacy: (1) wrongful appropriation of personality; (2) wrongful publicizing of private

affairs; and (3) wrongful intrusion into private affairs.” Sloan v. S.C. Dep’t of Pub. Safety,

(S.C. 2003) (per curiam). Plaintiffs brought claims under the first two

theories, both of which the district court dismissed because there were no allegations that

Walgreens publicized their PII.

The South Carolina Supreme Court has observed that “[e]ncompassed in these . . .

recognized torts is the infringement on the right of publicity.” Gignilliat v. Gignilliat, Savitz

& Bettis, L.L.P.,

(S.C. 2009) (emphasis added). After all, “[t]he right

of privacy is defined as the right of an individual to be let alone and live a life free from

unwarranted publicity.” Glassmeyer v. City of Columbia,

(S.C. Ct.

App. 2015) (emphasis added).

As for wrongful appropriation of personality, the South Carolina Supreme Court has

explained that the “gist” of that claim “is the violation of the plaintiff’s exclusive right at

common law to publicize and profit from his name, likeness, and other aspects of personal

identity.” Sloan,

(emphasis added). Wrongful publicizing of private

affairs similarly “involves a public disclosure of private facts about the plaintiff . . . in

which there is no legitimate public interest.” Snakenberg v. Hartford Cas. Ins. Co.¸

(S.C. Ct. App. 1989). “The gravamen of the tort is publicity as opposed to mere

publication.”

8 According to South Carolina courts, “publicity” “means that the matter is made

public, by communicating it to the public at large, or to so many persons that the matter

must be regarded as substantially certain to become one of public knowledge.” Swinton

Creek Nursery v. Edisto Farm Credit, ACA,

(S.C. 1999) (quoting

Restatement (Second) of Torts § 652D cmt. a (Am. L. Inst. 1977)). Here, though Plaintiffs

allege that their PII is accessible by the 160 non-pharmacist employees in Walgreen’s 340B

Complete division, there is no assertion that Walgreens has publicized that information to

the public at large. The alleged internal corporate disclosures are not “public” broadcasts,

as the PII is only accessed by those employees for private, business purposes. Therefore,

we agree with the district court that Plaintiffs failed to state a claim for invasion of privacy

under South Carolina law.

B. Negligence Per Se Based on Violation of the PIPA

South Carolina’s PIPA provides that “[n]o patient prescription drug information

may be transferred or received by a person without the written consent of the patient or a

person authorized by law to act on behalf of the patient.”

. The

statute provides thirteen exceptions to this broad prohibition.

§ 44-117-30(1)–(13). It

further requires that pharmacies maintain “a mechanism to prevent the disclosure of” PII

and other patient information. Id. § 44-117-350.

The PIPA does not expressly authorize a private right of action, and instead subjects

violators to criminal penalties and a fine. Id. § 44-117-40. The district court, however,

concluded there is an implied private right of action under the statute. Regardless of

whether that decision was correct, we agree with the district court that Plaintiffs failed to

9 allege a substantive PIPA violation because Walgreens’ internal 340B Complete process

did not involve a “transfer” or “receipt” of their PII, nor did Walgreens fail to prevent its

“disclosure.”

The PIPA does not define what it means to “transfer,” “receive,” or “disclos[e]”

protected information, as set out in sections 44-117-30 and -350. Nor does South Carolina

have any case law interpreting the PIPA. Relying on general principles of statutory

interpretation, however, our goal is to “ascertain and effectuate the intent of the

legislature,” by “giv[ing] the words found in the statute their plain and ordinary meaning.”

CFRE, LLC v. Greenville Cnty. Assessor,

(S.C. 2011) (citations

omitted); see also Askew v. HRFC, LLC,

(4th Cir. 2016) (explaining that

federal courts sitting in diversity must, “if necessary, predict how the state’s highest court

would rule on an unsettled issue” (citation omitted)).

With that in mind, we conclude the district court did not err in limiting the PIPA’s

scope to external data transfers. Although the statute does not expressly modify the word

“transfer,” that term’s plain meaning supports this narrow construction. The Webster’s

Third New International Dictionary defines the verb “transfer” as “to carry or take from

one person or place to another”; “to move or send to a different location esp. for business,

vocational, or military purposes”; “to cause to pass from one person or thing to another”;

“to make over or negotiate the possession or control over.” Transfer, Webster’s Third New

Int’l Dictionary (2002) (emphases added). The Oxford English Dictionary similarly defines

it in a way implicating only exchanges between legally distinct entities: “To convey or take

from one place, person, etc. to another; . . . to give or hand over from one to another.”

10 Transfer, Oxford-English Dictionary Online, (Oxford Univ. Press, Sept. 2021) (emphases

added). Naturally read, then, the PIPA’s prohibition on “transfer[s]” is only implicated

when a patient’s PII leaves the custody of the corporate entity originally entitled to possess

it (a “person”) to a different legal entity or natural person.

The exceptions to section 44-117-30’s general prohibition support this

understanding of the text. They encompass—implicitly and explicitly—acceptable

transfers of information from the authorized possessor to a person outside of that legal

entity. In other words, they relate to external transfers of PII. For example, no violation of

the PIPA occurs: when specified professionals providing treatment services to a patient

communicate among themselves, § 44-117-30(2); when information must be transferred

“to effect the recall of a defective drug or device,” § 44-117-30(4); when information must

be transferred to “adjudicate or process payment claims for health care,” § 44-117-30(6),

so long as the recipient does not further disclose the information; when an entity transfers

information as part of a sale of a business to its successor in interest, § 44-117-30(10); or

when the patient has authorized another person to pick up his prescription from the

pharmacy, § 44-117-30(12). 6

6 Other PIPA provisions lend additional support. For example, section 44-117-50 states that PIPA’s prohibition does not invalidate the “authority of a court to issue a subpoena for medical records” or “the authority of a license or disciplinary board of this State” or “of the Department of Health and Environmental Control” to obtain patient records as authorized elsewhere. Yet again, in all of the delineated caveats, the transfer or receipt of PII involves a third party. 11 There is no textual basis for interpreting “transfer” and “receipt” 7 to apply to

movements of data between parts of a single legal entity. As the district court ably

expressed it, to adopt that construction would mean that a pharmacy would violate the

PIPA any time it moved data “outside of the four walls of the pharmacy, [including] basic

functions such as transmitting information for legal, administrative, or IT services that do

not occur within the four walls of the pharmacy.” J.R., 470 F. Supp. 3d at 557. 8 Therefore,

we affirm the district court’s dismissal of this claim.

C. Breach of Contract

Plaintiffs raised two breach of contract claims before the district court. First, they

argued that when they gave Walgreens their PII, it implicitly agreed to take reasonable

measures to secure that data, thereby creating an implied contract. Second, Plaintiffs

claimed that Walgreens’ NPP was a contract, which the 340B Complete process violated.

The district court rejected both theories. We agree.

First, there was no implied contract between Plaintiffs and Walgreens. An implied-

in-fact contract “arises when the assent of the parties is manifested by conduct, not words.”

7 To “receive” means “to take possession or delivery of,” suggesting that the information was not previously possessed by that legal entity. Receive, Webster’s New Int’l Dictionary (2002). 8 And while Plaintiffs now argue that the PIPA prohibits the initial exchange of information from the pharmacy-entered database IntercomPlus to the corporate-controlled database EDW, they did not make that assertion in the district court, instead limiting their argument to the later transfer from EDW to 340B Complete for analysis. As such, that part of the claim is waived. See Holland v. Big River Mins. Corp.,

(4th Cir. 1999) (“Generally, issues that were not raised in the district court will not be addressed on appeal.”).

12 Thomerson v. DeVito,

, 384 n.10 (S.C. 2020) (quoting Stanley Smith & Sons

v. Limestone College,

, 478 n.1 (S.C. Ct. App. 1984)). To be valid, “[t]he

parties must manifest their mutual assent to all essential terms,” so “[i]f one of the parties

has not agreed, then a prerequisite to formation of the contract is lacking.” Stanley Smith,

. Plaintiffs alleged no facts indicating that at the time they agreed to

purchase prescription drugs from a Walgreens pharmacy, both they and Walgreens

implicitly agreed that Walgreens would not use their PII in the 340B Complete process.

See J.A. 44 (alleging that Plaintiffs were “unaware of” Walgreens’ use of Plaintiffs’ PII).

Thus, there is no basis to conclude that they entered into an implied contract with

Walgreens that included a term restricting its use. Indeed, Plaintiffs alleged that Walgreens’

NPP provided customers “the right to request additional restrictions on [Walgreens’] use

or disclosure” of PII, J.A. 35, but they did not allege that they ever asked for such additional

restrictions, further indicating a lack of agreement between the Parties. 9

Second, there was no actionable “breach” of the NPP. If a company’s privacy policy

“does not contain any exchange [of promises],” no enforceable contract exists. In re

Facebook, Inc. Internet Tracking Litig.,

, 610–11 (9th Cir. 2020) (holding a

privacy policy was not a contract because it “merely provides information––not

commitments––regarding Facebook’s use of information and how users can control that

information”); Brush v. Miami Beach Healthcare Grp. Ltd.,

, 1367

9 Plaintiffs cite data breach cases holding that there is an implied contract to keep a person’s sensitive data reasonably secure. Those cases are inapposite because there is no allegation that Walgreens was hacked or otherwise disclosed the PII to any outside party. 13 (S.D. Fla. 2017) (holding the defendant pharmacy’s privacy policy was not a contract

because it merely recounted patients’ rights under federal law, which defendant was

already required to comply with irrespective of the bargain with plaintiff). That same logic

applies here by Plaintiffs’ own allegations, which show that Walgreens’ NPP merely

informs patients of what it is “required by law” to do and “provide[s] notice of

[Walgreens’] ‘legal duties and privacy practices with respect to [PII].’” J.A. 34–35.

Therefore, we affirm the district court’s dismissal of Plaintiffs’ breach of contract claims.

D. Negligence Under the PPA

Next, Plaintiffs argue Walgreens’ purported breach of duties established by

professional standards amounts to negligence. The district court correctly rejected this

claim. The Supreme Court of South Carolina has squarely held that the PPA only

“regulate[s] the licensing and practice of pharmacists; . . . [its] provisions do not set forth,

explicitly or implicitly, a duty of confidentiality.” Evans v. Rite Aid Corp.,

(S.C. 1996). Thus, Plaintiffs’ claim that the PPA imposes a duty of care to “maintain

the confidentiality of [Plaintiffs’] PII,” J.A. 72, is foreclosed.

Plaintiffs also assert that there is a general duty to “maintain a pharmacy patient

record system with adequate security and systems safeguards to prevent unauthorized

access of pharmacy patient records.” J.A. 72. That is one of the PPA’s requirements. See

S.C. Code Ann. § 40–43–86(O)(3). Assuming that this is sufficient evidence of a duty to

do so, Plaintiffs have nevertheless failed to allege a breach of that duty. There are no

allegations that unauthorized persons obtained access to Plaintiffs’ PII, and Plaintiffs have

cited no authority to plausibly establish that a non-pharmacist Walgreens employee’s

14 access to that data to determine if a transaction qualifies for the 340B program is

“unauthorized.”

E. General Negligence

Plaintiffs further allege that Walgreens “fail[ed] to conform to the privacy practices

universally recognized and accepted in the pharmaceutical profession.” J.A. 68. There are

no factual allegations from the American Pharmaceutical Code of Ethics or the South

Carolina Board of Pharmacy’s promulgated rules that show what constitutes those

“universally recognized and accepted” practices or how Walgreens purportedly violated

them. The same logic applies to the alleged duty to “exercise reasonable care to protect

[Plaintiffs] against the risk of foreseeable harm from their actions.” Opening Br. 45.

Without any facts plausibly demonstrating the precise duty Walgreens is alleged to have

breached, the district court properly determined that Plaintiffs failed to plausibly establish

that Walgreen’s 340B Complete process constitutes a breach. See Evans,

(holding there is no common law duty of confidentiality for pharmacists).

F. Negligent Training and Supervision Claims

South Carolina recognizes a cause of action for negligent supervision, Degenhart v.

Knights of Columbus,

(S.C. 1992), but negligent training is merely a

subset of a negligent supervision claim, e.g., Beneficial Financial I, Inc. v. Windham,

, 804–05 (S.C. Ct. App. 2020). Under South Carolina law,

[a]n employer may be liable for negligent supervision when (1) his employee intentionally harms another when he is on the employer’s premises, is on premises he is privileged to enter only as employee, or is using the employer’s chattel; (2) the employer knows or has reason to know he has the

15 ability to control the employee; and (3) the employer knows or has reason to know of the necessity and opportunity to exercise such control.

Doe v. Bishop of Charleston,

(S.C. 2014) (emphasis added) (citing

Degenhart,

).

Here, as the district court observed, there is no allegation of any intentional conduct

on the part of any Walgreens employee. Further, because there has been no cognizable

“harm” to Plaintiffs arising from any Walgreens employee’s conduct, we find that

component of the negligent supervision claim also has not been adequately alleged.

Therefore, we affirm the dismissal of these claims.

G. Unjust Enrichment

To recover for unjust enrichment in South Carolina, a plaintiff must prove: “(1) [a]

benefit conferred by plaintiff upon the defendant; (2) realization of that benefit by the

defendant; and (3) retention of the benefit by the defendant under circumstances that make

it inequitable for him to retain it without paying its value.” Myrtle Beach Hosp., Inc. v. City

of Myrtle Beach,

(S.C. 2000). The district court dismissed Plaintiffs’

unjust enrichment claim because they failed to allege that they “reasonably expected

payment from the unconsented use of their PII.” J.R., 470 F. Supp. 3d at 563. Plaintiffs

argue there is no such requirement in bringing an unjust enrichment claim and that the

district court erroneously added this as an additional element.

We need not resolve this dispute, however, because Plaintiffs’ concession that they

voluntarily “provide[d] their PII to Walgreens’ pharmacy for the intended purposes of

obtaining, and allowing Walgreen’s pharmacy to seek third-party payment for, their

16 individual prescriptions,” J.A. 36 (emphasis added), defeats any allegation that its

acquisition and use of the PII was somehow “inequitable.” Stated differently, Walgreens

could not have acted unjustly by using Plaintiffs’ PII for the very purpose they intended

for it to be used. Therefore, we affirm the district court’s dismissal of Plaintiffs’ unjust

enrichment claim. See Scott v. United States,

(4th Cir. 2003) (“We are,

of course, entitled to affirm on any ground appearing in the record, including theories not

relied upon or rejected by the district court.”).

H. Negligence Per Se Based on HIPAA and FTCA Violations

We turn next to Plaintiffs’ negligence per se claims based on violations of HIPAA

and the FTCA. “Negligence per se is negligence arising from a defendant’s violation of a

statute.” Wogan v. Kunze,

(S.C. Ct. App. 2005). To make out such a

claim, Plaintiffs must demonstrate that the statute allegedly violated allows for a private

cause of action. See Doe v. Marion,

(S.C. 2007). That analysis turns

on whether the legislature intended to permit a private action, either explicitly or implicitly.

But legislative intent can be implied “only if the legislation was enacted for the special

benefit of a private party.”

HIPAA addresses various aspects of confidentiality of health care information,

including requirements about how electronic health care information is stored. The district

court concluded that there was no implied private right of action under HIPAA, meaning

it could not support a negligence per se claim. We agree. Recently, we joined our sister

circuits in holding that HIPAA does not create a private right of action. See Payne v.

Taslimi,

(4th Cir. 2021) (“Every circuit court to consider whether

17 HIPAA created a private right to sue has found that it does not. This is because HIPAA

does not expressly allow for a private cause of action but delegates enforcement authority

to the Secretary of the Department of Health and Human Services, reflecting Congress’s

intent to forgo creating a private remedy. We see no reason to chart a different course from

our sister courts. [The plaintiff] has no private right of action under HIPAA.” (internal

citations omitted)). Therefore, the district court properly dismissed Plaintiffs’ negligence

per se claim based on an alleged HIPAA violation.

Plaintiffs’ FTCA-based negligence per se claim fares no better. The FTCA makes

it unlawful to engage in “[u]nfair methods of competition in or affecting commerce, and

unfair or deceptive acts or practices in or affecting commerce.”

(a)(1). As

with HIPAA, the FTCA does not explicitly provide for a private right of action. And the

Act’s authorization of the Federal Trade Commission to enforce its provisions indicates

Congress’s intent against creating an implied right of action. See

(m); cf.

Payne,

(observing, in the context of another federal statute, that Congress’s

grant of enforcement authority to the executive branch counsels against an implied right of

action). Though we have not yet addressed this issue, other Circuits have uniformly found

the FTCA does not contain an implied private right of action. See, e.g., Morrison v. Back

Yard Burgers, Inc.,

(8th Cir. 1996); Am. Airlines v. Christensen,

, 414 (10th Cir. 1992); R.T. Vanderbilt Co. v. Occupational Safety & Health Rev.

Comm’n,

, 574 n.5 (11th Cir. 1983); Fulton v. Hecht,

, 1248

n.2 (5th Cir. 1978); Holloway v. Bristol-Myers Corp.,

(D.C. Cir. 1973);

18 Carlson v. Coca-Cola Co.,

, 280–81 (9th Cir. 1973). We think this conclusion

is correct and forecloses Plaintiffs’ claim.

But even assuming the FTCA does contain an implied private right of action, the

district court properly determined Plaintiffs failed to assert a violation. Their Amended

Complaint highlights supposed shortfalls in Walgreens’ information-privacy practices,

namely, its purported failure to “maintain the security and privacy of” patient’s PII, which

they contend resulted “in the unauthorized transfer, receipt, and/or use, disclosure, or

dissemination” of that PII. J.A. 61; see also Opening Br. 55 (discussing alleged

“unauthorized access”). But the only factual basis for this alleged violation is Walgreens’

internal transfer of information within various in-house electronic databases to be accessed

by Walgreens employees for purposes of processing a patient’s health care information for

a 340B billing determination. There are no allegations of any attempt—much less a

successful endeavor—by an unauthorized third-party to access Plaintiffs’ PII. Plaintiffs

have thus failed to state a claim under the FTCA, even assuming one exists. Therefore, we

affirm the district court’s dismissal of these claims.

I. Declaratory Relief

Finally, because all of Plaintiffs’ other claims fail as a matter of law, we affirm the

district court’s determination that they are not entitled to declaratory relief. See

(a) (requiring that there be an “actual controversy” before entering a declaratory

judgment).

19 III.

Accordingly, we affirm the district court’s judgment in full.

AFFIRMED

20