Ninth Circuit rules unauthorized health data disclosure confers standing to sue
Original title: Ninth Circuit: Breach Of Confidence Confers Standing In Health Data Security Case
On October 9 the appeals court revived Black v. IEC Group, finding plan participants suffer concrete injury from breach of confidence even without financial loss or identity-theft risk.
The Ninth Circuit revived a class action over a plan administrator employee mistakenly emailing a spreadsheet of participants' claims information to other plan members. The court found the unauthorized disclosure of confidential health data is a concrete injury, analogizing to the traditional action for breach of confidence. The ruling departs from the risk-based standing approach many courts have applied since TransUnion and conflicts with other circuits.
Unconfirmed: Whether the decision survives further appeal, given inter-circuit tension, remains open.
- The spreadsheet included names, providers, claim numbers, service dates and amounts.
- The district court had dismissed for lack of likely future harm such as identity theft.
- The court cited HIPAA as evidence Congress views the data as worth protecting.
- The decision is in tension with other circuits and may invite Supreme Court review.
- Organizations
- Ninth CircuitIEC Group
- Countries
- United States
From the original article
3 min read at databreaches.netClaire E. Castles, Amanda Fitzsimmons, Nathaniel P. Garrett, Rebekah Byers Kcehowski, Mary Alexander Myers, and Alexander H.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.