MEMORANDUM OPINION AND ORDER Press America, Inc. (“Press America”) contracted to print and mail letters for Plaintiffs CVS Pharmacy, Inc. and Caremark Rx, LLC. The letters were related to Plaintiffs’ pharmaceutical benefits program, so the parties were aware that the contract involved some risk that letters containing individuals’ private health care information would be misdirected. Press America indemnified Plaintiffs for any claims or liabilities arising from its negligence. What Press America did not know was that Plaintiffs had entered into a contract with International Business Machines Corporation (“IBM”), requiring that Plaintiffs pay IBM $45,000 for each piece of misdirected mail — a payment obligation that IBM and CVS transparently referred to as a “penalty.” Press America learned that information the hard way. After Press America errantly mailed 41 letters to the wrong people, IBM sought $1.845 million ($45,000*41) from CVS. CVS paid without much fuss, then demanded that Press America reimburse it for that amount pursuant to its indemnity. Press America refused, leading to this lawsuit. Because Press America has established that CVS’s payment was an unenforceable penalty, and therefore was not founded upon any legal liability to CVS, Press America need not reimburse CVS pursuant to its contractual indemnity. For that and the other reasons described below, the parties’ cross motions for summary judgment are GRANTED IN PART and DENIED IN PART.I. BACKGROUND AND FACTS1A. The Parties: Press America and CVSCVS Pharmacy Inc. (“CVS Pharmacy”) and Caremark Rx, L.L.C. (“Caremark”, and collectively with CVS Pharmacy, “CVS”), are in the pharmacy business. Among other things, CVS administers prescription drug plans for clients as part of what are referred to as “pharmacy benefits management programs” (“PBMs”). Joint Statement 1. As part of its administrative obligations to its clients, CVS contacts its clients’ employees, retirees, and dependents about their prescription medications, in particular, when it is time for them to renew their prescriptions. Id. 2-3. CVS mails notices to PBM members about such matters.Aptly named, Press America, Inc. (“Press America”) prints and distributes mass mailings for its customers. Press America had served as a vendor for CVS since approximately 1990. Id. 4. In 2010, CVS began talks with Press America for Press America to provide printing and mailing services to CVS in connection with CVS’s PBM business. Those discussions ultimately yielded fruit in February 2012, when CVS and Press America entered into the series of agreements that are the subject of this litigation. Id. 7.B. CVS’s Relationship with IBMOne of CVS’s PBM clients was International Business Machines Corporation (“IBM”). In early 2011, IBM issued a request for proposals, seeking bids from companies to administer a PBM plan for IBM’s PBM members. Id. 96. One of the requirements of the request for proposals was that any potential bidder agree to provide a “performance guarantee” to protect members’ personally identifiable information (“PII”) and protected health information (“PHI”). Id. 98. In particular, IBM made clear that bidders would have to compensate IBM for each security incident, including inadvertent disclosures of members’ PII or PHI. Id.
98-99. CVS submitted a bid in response to the request for proposals, and won. Id.
