Ninth Circuit Rules Unauthorized Health Data Disclosure Constitutes Concrete Injury for Class Action Standing
The Ninth Circuit Court of Appeals has reversed a lower court's decision, ruling that the unauthorized disclosure of sensitive health information constitutes a concrete injury, thereby establishing Article III standing for a class action lawsuit. The case, *Melissa Black and Miles Black v. IEC Group, Inc.*, involved plaintiffs whose health information, including names, tracking numbers, provider names, claim numbers, dates of service, and billed amounts, was inadvertently emailed to unauthorized parties by IEC Group, Inc., their health insurance plan administrator. The District Court had initially dismissed the case, arguing that the plaintiffs did not suffer a sufficient injury in fact. However, the Ninth Circuit determined that the act of disclosing private health information, entrusted to the defendant under a promise of confidentiality, is akin to a breach of confidence and contract. The court emphasized that Congress, through legislation like HIPAA, has recognized the sensitivity of such information, ...
