A federal appeals court has given patients a route to court even when nothing has been bought with their stolen records yet.
On October 9, the Ninth Circuit revived a putative class action against IEC Group, the administrator of a health plan that mailed a spreadsheet of participants’ claims information to other plan members by mistake. On that sheet sat participants’ names, their providers, claim identifiers, service dates and the sums billed or paid.
Standing without a purchase
The district judge dismissed it, holding that the plaintiffs had not established a substantial likelihood of future harm like identity theft. That is the standard many courts have applied since TransUnion v. Ramirez.
The panel disagreed, and the opinion is pointed. An intangible harm qualifies for Article III standing when it resembles something courts have long recognised, and the court found that analogue in the centuries-old action for breach of confidence. “A trust betrayed is the harm,” the opinion says. It leaned on the administrator’s own privacy promises and on the fact that breach of contract claims have never required financial loss. HIPAA came up too, as proof that Congress regards such data as deserving protection, notwithstanding that the law grants patients no private right of action.
For health systems and plans in the nine western states the circuit covers, the practical effect is narrower than it sounds and more consequential than it looks. Breach defence strategies built on “no proven misuse, no injury” now face a circuit split, and a misdirected spreadsheet can support standing on the disclosure alone.
Healthcare counsel who spoke on the ruling, including a Jones Day team publishing on JD Supra, flagged the tension with other circuits. The case returns to the district court, where the merits now matter more than jurisdiction.
